Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
S
Sleuthkit
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Iterations
Requirements
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Locked files
Build
Pipelines
Jobs
Pipeline schedules
Test cases
Artifacts
Deploy
Releases
Package registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Code review analytics
Issue analytics
Insights
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
IRT
Sleuthkit
Commits
8aad9566
Commit
8aad9566
authored
3 years ago
by
Richard Cordovano
Browse files
Options
Downloads
Patches
Plain Diff
7673 Add ingest job IDs to artifact posts
parent
a981eb28
No related branches found
No related tags found
No related merge requests found
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
bindings/java/src/org/sleuthkit/datamodel/Blackboard.java
+69
-77
69 additions, 77 deletions
bindings/java/src/org/sleuthkit/datamodel/Blackboard.java
with
69 additions
and
77 deletions
bindings/java/src/org/sleuthkit/datamodel/Blackboard.java
+
69
−
77
View file @
8aad9566
...
@@ -62,8 +62,8 @@ public final class Blackboard {
...
@@ -62,8 +62,8 @@ public final class Blackboard {
private
final
Map
<
String
,
BlackboardArtifact
.
Type
>
typeNameToArtifactTypeMap
=
new
ConcurrentHashMap
<>();
private
final
Map
<
String
,
BlackboardArtifact
.
Type
>
typeNameToArtifactTypeMap
=
new
ConcurrentHashMap
<>();
private
final
Map
<
String
,
BlackboardAttribute
.
Type
>
typeNameToAttributeTypeMap
=
new
ConcurrentHashMap
<>();
private
final
Map
<
String
,
BlackboardAttribute
.
Type
>
typeNameToAttributeTypeMap
=
new
ConcurrentHashMap
<>();
static
final
int
MIN_USER_DEFINED_TYPE_ID
=
10000
;
static
final
int
MIN_USER_DEFINED_TYPE_ID
=
10000
;
private
final
SleuthkitCase
caseDb
;
private
final
SleuthkitCase
caseDb
;
/**
/**
...
@@ -77,49 +77,47 @@ public final class Blackboard {
...
@@ -77,49 +77,47 @@ public final class Blackboard {
}
}
/**
/**
* Posts an artifact
(data artifact or analysis result) to the blackboard.
* Posts an artifact
to the blackboard. The artifact should be complete (all
*
The artifact should be complete (all attributes have been added) before
*
attributes have been added) before it is posted. Posting the artifact
*
it is posted. Posting the artifact
triggers the creation of appropriate
* triggers the creation of appropriate
timeline events, if any, and
*
timeline events, if any, and
broadcast of a notification that the
* broadcast of a notification that the
artifact is ready for further
*
artifact is ready for further
analysis.
* analysis.
*
*
* @param artifact The artifact
(data artifact or analysis result)
.
* @param artifact The artifact.
* @param moduleName The display name of the module posting the artifact.
* @param moduleName The display name of the module posting the artifact.
*
*
* @throws BlackboardException The exception is thrown if there is an issue
* @throws BlackboardException The exception is thrown if there is an issue
* posting the artifact.
* posting the artifact. RJCTODO: Deprecate
* RJCTODO: Deprecate
*/
*/
public
void
postArtifact
(
BlackboardArtifact
artifact
,
String
moduleName
)
throws
BlackboardException
{
public
void
postArtifact
(
BlackboardArtifact
artifact
,
String
moduleName
)
throws
BlackboardException
{
postArtifacts
(
Collections
.
singleton
(
artifact
),
moduleName
,
null
);
postArtifacts
(
Collections
.
singleton
(
artifact
),
moduleName
,
null
);
}
}
/**
/**
* Posts a collection of artifacts
(data artifacts and/or analysis results)
* Posts a collection of artifacts
to the blackboard. The artifacts should
*
to the blackboard. The artifacts should be complete (all attributes have
*
be complete (all attributes have been added) before they are posted.
*
been added) before they are posted.
Posting the artifacts triggers the
* Posting the artifacts triggers the
creation of appropriate timeline
*
creation of appropriate timeline
events, if any, and broadcast of a
* events, if any, and broadcast of a
notification that the artifacts are
*
notification that the artifacts are
ready for further analysis.
* ready for further analysis.
*
*
* @param artifacts The artifacts
(data artifacts and/or analysis results)
.
* @param artifacts The artifacts.
* @param moduleName The display name of the module posting the artifacts.
* @param moduleName The display name of the module posting the artifacts.
*
*
* @throws BlackboardException The exception is thrown if there is an issue
* @throws BlackboardException The exception is thrown if there is an issue
* posting the artifact.
* posting the artifact. RJCTODO: Deprecate
* RJCTODO: Deprecate
*/
*/
public
void
postArtifacts
(
Collection
<
BlackboardArtifact
>
artifacts
,
String
moduleName
)
throws
BlackboardException
{
public
void
postArtifacts
(
Collection
<
BlackboardArtifact
>
artifacts
,
String
moduleName
)
throws
BlackboardException
{
postArtifacts
(
artifacts
,
moduleName
,
null
);
postArtifacts
(
artifacts
,
moduleName
,
null
);
}
}
/**
/**
* Posts an artifact
(data artifact or analysis result) to the blackboard.
* Posts an artifact
to the blackboard. The artifact should be complete (all
*
The artifact should be complete (all attributes have been added) before
*
attributes have been added) before it is posted. Posting the artifact
*
it is posted. Posting the artifact
triggers the creation of appropriate
* triggers the creation of appropriate
timeline events, if any, and
*
timeline events, if any, and
broadcast of a notification that the
* broadcast of a notification that the
artifact is ready for further
*
artifact is ready for further
analysis.
* analysis.
*
*
* @param artifact The artifact
(data artifact or analysis result)
.
* @param artifact The artifact.
* @param moduleName The display name of the module posting the artifact.
* @param moduleName The display name of the module posting the artifact.
* @param ingestJobId The numeric identifier of the ingest job within which
* @param ingestJobId The numeric identifier of the ingest job within which
* the artifact was posted.
* the artifact was posted.
...
@@ -129,17 +127,16 @@ public void postArtifacts(Collection<BlackboardArtifact> artifacts, String modul
...
@@ -129,17 +127,16 @@ public void postArtifacts(Collection<BlackboardArtifact> artifacts, String modul
*/
*/
public
void
postArtifact
(
BlackboardArtifact
artifact
,
String
moduleName
,
Long
ingestJobId
)
throws
BlackboardException
{
public
void
postArtifact
(
BlackboardArtifact
artifact
,
String
moduleName
,
Long
ingestJobId
)
throws
BlackboardException
{
postArtifacts
(
Collections
.
singleton
(
artifact
),
moduleName
,
ingestJobId
);
postArtifacts
(
Collections
.
singleton
(
artifact
),
moduleName
,
ingestJobId
);
}
}
/**
/**
* Posts a collection of artifacts (data artifacts and/or analysis results)
* Posts a collection of artifacts to the blackboard. The artifacts should
* to the blackboard. The artifacts should be complete (all attributes have
* be complete (all attributes have been added) before they are posted.
* been added) before they are posted. Posting the artifacts triggers the
* Posting the artifacts triggers the creation of appropriate timeline
* creation of appropriate timeline events, if any, and broadcast of a
* events, if any, and broadcast of a notification that the artifacts are
* notification that the artifacts are ready for further analysis.
* ready for further analysis.
*
*
* @param artifacts The artifacts (data artifacts and/or analysis
* @param artifacts The artifacts.
* results).
* @param moduleName The display name of the module posting the artifacts.
* @param moduleName The display name of the module posting the artifacts.
* @param ingestJobId The numeric identifier of the ingest job within which
* @param ingestJobId The numeric identifier of the ingest job within which
* the artifacts were posted.
* the artifacts were posted.
...
@@ -156,8 +153,8 @@ public void postArtifacts(Collection<BlackboardArtifact> artifacts, String modul
...
@@ -156,8 +153,8 @@ public void postArtifacts(Collection<BlackboardArtifact> artifacts, String modul
}
}
}
}
caseDb
.
fireTSKEvent
(
new
ArtifactsPostedEvent
(
artifacts
,
moduleName
,
ingestJobId
));
caseDb
.
fireTSKEvent
(
new
ArtifactsPostedEvent
(
artifacts
,
moduleName
,
ingestJobId
));
}
}
/**
/**
* Gets an artifact type, creating it if it does not already exist. Use this
* Gets an artifact type, creating it if it does not already exist. Use this
* method to define custom artifact types.
* method to define custom artifact types.
...
@@ -197,7 +194,7 @@ public BlackboardArtifact.Type getOrAddArtifactType(String typeName, String disp
...
@@ -197,7 +194,7 @@ public BlackboardArtifact.Type getOrAddArtifactType(String typeName, String disp
if
(
typeNameToArtifactTypeMap
.
containsKey
(
typeName
))
{
if
(
typeNameToArtifactTypeMap
.
containsKey
(
typeName
))
{
return
typeNameToArtifactTypeMap
.
get
(
typeName
);
return
typeNameToArtifactTypeMap
.
get
(
typeName
);
}
}
Statement
s
=
null
;
Statement
s
=
null
;
ResultSet
rs
=
null
;
ResultSet
rs
=
null
;
CaseDbTransaction
trans
=
null
;
CaseDbTransaction
trans
=
null
;
...
@@ -257,7 +254,7 @@ public BlackboardArtifact.Type getOrAddArtifactType(String typeName, String disp
...
@@ -257,7 +254,7 @@ public BlackboardArtifact.Type getOrAddArtifactType(String typeName, String disp
}
}
}
}
}
}
/**
/**
* Get the attribute type associated with an attribute type name.
* Get the attribute type associated with an attribute type name.
*
*
...
@@ -296,8 +293,8 @@ public BlackboardAttribute.Type getAttributeType(String attrTypeName) throws Tsk
...
@@ -296,8 +293,8 @@ public BlackboardAttribute.Type getAttributeType(String attrTypeName) throws Tsk
closeConnection
(
connection
);
closeConnection
(
connection
);
caseDb
.
releaseSingleUserCaseReadLock
();
caseDb
.
releaseSingleUserCaseReadLock
();
}
}
}
}
/**
/**
* Get the attribute type associated with an attribute type ID.
* Get the attribute type associated with an attribute type ID.
*
*
...
@@ -336,8 +333,8 @@ BlackboardAttribute.Type getAttributeType(int typeID) throws TskCoreException {
...
@@ -336,8 +333,8 @@ BlackboardAttribute.Type getAttributeType(int typeID) throws TskCoreException {
closeConnection
(
connection
);
closeConnection
(
connection
);
caseDb
.
releaseSingleUserCaseReadLock
();
caseDb
.
releaseSingleUserCaseReadLock
();
}
}
}
}
/**
/**
* Get the artifact type associated with an artifact type name.
* Get the artifact type associated with an artifact type name.
*
*
...
@@ -377,8 +374,8 @@ public BlackboardArtifact.Type getArtifactType(String artTypeName) throws TskCor
...
@@ -377,8 +374,8 @@ public BlackboardArtifact.Type getArtifactType(String artTypeName) throws TskCor
closeConnection
(
connection
);
closeConnection
(
connection
);
caseDb
.
releaseSingleUserCaseReadLock
();
caseDb
.
releaseSingleUserCaseReadLock
();
}
}
}
}
/**
/**
* Get the artifact type associated with an artifact type id.
* Get the artifact type associated with an artifact type id.
*
*
...
@@ -421,16 +418,16 @@ public BlackboardArtifact.Type getArtifactType(int artTypeId) throws TskCoreExce
...
@@ -421,16 +418,16 @@ public BlackboardArtifact.Type getArtifactType(int artTypeId) throws TskCoreExce
closeConnection
(
connection
);
closeConnection
(
connection
);
caseDb
.
releaseSingleUserCaseReadLock
();
caseDb
.
releaseSingleUserCaseReadLock
();
}
}
}
}
/**
/**
* Get the list of attributes for the given artifact.
* Get the list of attributes for the given artifact.
*
*
* @param artifact The artifact to load attributes for.
* @param artifact The artifact to load attributes for.
*
*
* @return The list of attributes.
* @return The list of attributes.
*
*
* @throws TskCoreException
* @throws TskCoreException
*/
*/
public
ArrayList
<
BlackboardAttribute
>
getBlackboardAttributes
(
final
BlackboardArtifact
artifact
)
throws
TskCoreException
{
public
ArrayList
<
BlackboardAttribute
>
getBlackboardAttributes
(
final
BlackboardArtifact
artifact
)
throws
TskCoreException
{
CaseDbConnection
connection
=
null
;
CaseDbConnection
connection
=
null
;
...
@@ -486,7 +483,7 @@ public ArrayList<BlackboardAttribute> getBlackboardAttributes(final BlackboardAr
...
@@ -486,7 +483,7 @@ public ArrayList<BlackboardAttribute> getBlackboardAttributes(final BlackboardAr
closeConnection
(
connection
);
closeConnection
(
connection
);
caseDb
.
releaseSingleUserCaseReadLock
();
caseDb
.
releaseSingleUserCaseReadLock
();
}
}
}
}
/**
/**
* Get the attributes associated with the given file.
* Get the attributes associated with the given file.
...
@@ -553,7 +550,7 @@ ArrayList<Attribute> getFileAttributes(final AbstractFile file) throws TskCoreEx
...
@@ -553,7 +550,7 @@ ArrayList<Attribute> getFileAttributes(final AbstractFile file) throws TskCoreEx
caseDb
.
releaseSingleUserCaseReadLock
();
caseDb
.
releaseSingleUserCaseReadLock
();
}
}
}
}
/**
/**
* Adds the standard artifact types to the blackboard_artifact_types table
* Adds the standard artifact types to the blackboard_artifact_types table
* and the artifact type caches.
* and the artifact type caches.
...
@@ -611,8 +608,8 @@ void initBlackboardArtifactTypes(CaseDbConnection connection) throws SQLExceptio
...
@@ -611,8 +608,8 @@ void initBlackboardArtifactTypes(CaseDbConnection connection) throws SQLExceptio
}
finally
{
}
finally
{
caseDb
.
releaseSingleUserCaseWriteLock
();
caseDb
.
releaseSingleUserCaseWriteLock
();
}
}
}
}
/**
/**
* Adds the standard attribute types to the blackboard_attribute_types table
* Adds the standard attribute types to the blackboard_attribute_types table
* and the attribute type caches.
* and the attribute type caches.
...
@@ -670,8 +667,8 @@ void initBlackboardAttributeTypes(CaseDbConnection connection) throws SQLExcepti
...
@@ -670,8 +667,8 @@ void initBlackboardAttributeTypes(CaseDbConnection connection) throws SQLExcepti
}
finally
{
}
finally
{
caseDb
.
releaseSingleUserCaseWriteLock
();
caseDb
.
releaseSingleUserCaseWriteLock
();
}
}
}
}
/**
/**
* Adds new analysis result artifact.
* Adds new analysis result artifact.
*
*
...
@@ -1364,7 +1361,7 @@ public BlackboardAttribute.Type getOrAddAttributeType(String typeName, Blackboar
...
@@ -1364,7 +1361,7 @@ public BlackboardAttribute.Type getOrAddAttributeType(String typeName, Blackboar
if
(
typeNameToAttributeTypeMap
.
containsKey
(
typeName
))
{
if
(
typeNameToAttributeTypeMap
.
containsKey
(
typeName
))
{
return
typeNameToAttributeTypeMap
.
get
(
typeName
);
return
typeNameToAttributeTypeMap
.
get
(
typeName
);
}
}
CaseDbTransaction
trans
=
null
;
CaseDbTransaction
trans
=
null
;
Statement
s
=
null
;
Statement
s
=
null
;
ResultSet
rs
=
null
;
ResultSet
rs
=
null
;
...
@@ -1422,7 +1419,7 @@ public BlackboardAttribute.Type getOrAddAttributeType(String typeName, Blackboar
...
@@ -1422,7 +1419,7 @@ public BlackboardAttribute.Type getOrAddAttributeType(String typeName, Blackboar
throw
new
BlackboardException
(
"Error rolling back transaction"
,
ex
);
throw
new
BlackboardException
(
"Error rolling back transaction"
,
ex
);
}
}
}
}
}
}
}
}
/**
/**
...
@@ -1918,9 +1915,9 @@ private List<BlackboardArtifact> getArtifactsWhere(BlackboardArtifact.Type artif
...
@@ -1918,9 +1915,9 @@ private List<BlackboardArtifact> getArtifactsWhere(BlackboardArtifact.Type artif
}
}
/**
/**
* An event published by SleuthkitCase when one or more artifacts
(data
* An event published by SleuthkitCase when one or more artifacts
are
*
artifacts and/or analysis results) are posted. Posted artifacts should be
*
posted. Posted artifacts should be complete (all attributes have been
*
complete (all attributes have been
added) and ready for further analysis.
* added) and ready for further analysis.
*/
*/
final
public
class
ArtifactsPostedEvent
{
final
public
class
ArtifactsPostedEvent
{
...
@@ -1931,12 +1928,10 @@ final public class ArtifactsPostedEvent {
...
@@ -1931,12 +1928,10 @@ final public class ArtifactsPostedEvent {
/**
/**
* Constructs an Event published by SleuthkitCase when one or more
* Constructs an Event published by SleuthkitCase when one or more
* artifacts (data artifacts and/or analysis results) are posted. Posted
* artifacts are posted. Posted artifacts should be complete (all
* artifacts should be complete (all attributes have been added) and
* attributes have been added) and ready for further analysis.
* ready for further analysis.
*
*
* @param artifacts The artifacts (data artifacts and/or analysis
* @param artifacts The artifacts.
* results).
* @param moduleName The display name of the module posting the
* @param moduleName The display name of the module posting the
* artifacts.
* artifacts.
* @param ingestJobId The numeric identifier of the ingest job within
* @param ingestJobId The numeric identifier of the ingest job within
...
@@ -1961,7 +1956,7 @@ private ArtifactsPostedEvent(Collection<BlackboardArtifact> artifacts, String mo
...
@@ -1961,7 +1956,7 @@ private ArtifactsPostedEvent(Collection<BlackboardArtifact> artifacts, String mo
}
}
/**
/**
* Gets the posted artifacts
(data artifacts and/or analysis results)
.
* Gets the posted artifacts.
*
*
* @return The artifacts (data artifacts and/or analysis results).
* @return The artifacts (data artifacts and/or analysis results).
*/
*/
...
@@ -1970,12 +1965,11 @@ public Collection<BlackboardArtifact> getArtifacts() {
...
@@ -1970,12 +1965,11 @@ public Collection<BlackboardArtifact> getArtifacts() {
}
}
/**
/**
* Gets the posted artifacts (data artifacts or analysis results) of a
* Gets the posted artifacts of a given type.
* given type.
*
*
* @param artifactType The artifact type.
* @param artifactType The artifact type.
*
*
* @return The artifacts
(data artifacts or analysis results)
, if any.
* @return The artifacts, if any.
*/
*/
public
Collection
<
BlackboardArtifact
>
getArtifacts
(
BlackboardArtifact
.
Type
artifactType
)
{
public
Collection
<
BlackboardArtifact
>
getArtifacts
(
BlackboardArtifact
.
Type
artifactType
)
{
Set
<
BlackboardArtifact
>
tempSet
=
artifacts
.
stream
()
Set
<
BlackboardArtifact
>
tempSet
=
artifacts
.
stream
()
...
@@ -1985,8 +1979,7 @@ public Collection<BlackboardArtifact> getArtifacts(BlackboardArtifact.Type artif
...
@@ -1985,8 +1979,7 @@ public Collection<BlackboardArtifact> getArtifacts(BlackboardArtifact.Type artif
}
}
/**
/**
* Gets the display name of the module that posted the artifacts (data
* Gets the display name of the module that posted the artifacts.
* artifacts and/or analysis results).
*
*
* @return The display name.
* @return The display name.
*/
*/
...
@@ -1995,8 +1988,7 @@ public String getModuleName() {
...
@@ -1995,8 +1988,7 @@ public String getModuleName() {
}
}
/**
/**
* Gets the types of artifacts (data artifacts and/or analysis results)
* Gets the types of artifacts that were posted.
* that were posted.
*
*
* @return The types.
* @return The types.
*/
*/
...
@@ -2006,7 +1998,7 @@ public Collection<BlackboardArtifact.Type> getArtifactTypes() {
...
@@ -2006,7 +1998,7 @@ public Collection<BlackboardArtifact.Type> getArtifactTypes() {
/**
/**
* Gets the numeric identifier of the ingest job within which the
* Gets the numeric identifier of the ingest job within which the
* artifacts
(data artifacts and/or analysis results)
were posted.
* artifacts were posted.
*
*
* @return The ingest job ID, may be null.
* @return The ingest job ID, may be null.
*/
*/
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment