iris-web icon indicating copy to clipboard operation
iris-web copied to clipboard

Published 20 hours ago • verified publisher icon dfir-iris

Add value validation for iocs

Open Matthijsy opened this issue 3 years ago • 1 comments

Currently the IoC values are allowing everything as value. However, it might be good to check that they match the value of the selected type. This PR implements this by adding a regex field to IocType, which will be checked during validation.

Currently I only added regex for the hashes, and the filename|hash types. But after this method is in place it is easy to add more regex values. If a user decides to add a custom type it also easy to add a regex, since it is expose to the UI as well.

Matthijsy avatar Aug 04 '22 15:08 Matthijsy

Thanks for your feedback! I did not know that. I just tried adding them to the alembic migration script, however then it does not set them anymore in case the database is still empty. Does that mean I have to add them to both the alembic script and the create_safe method? Since that would mean quite some work to define everything twice

Matthijsy avatar Aug 08 '22 11:08 Matthijsy

Thanks for your feedback! I did not know that. I just tried adding them to the alembic migration script, however then it does not set them anymore in case the database is still empty. Does that mean I have to add them to both the alembic script and the create_safe method? Since that would mean quite some work to define everything twice

Yes unfortunately in the way it's working you need to define it twice. Once for the instances upgrading, and once for the new instances. The issue is that alembic wasn't used from the start, so the alembic migrations are not defining the whole database and thus the post_init was/is needed.

We can add them in the migration script if you want. In that case I'll merge now. Otherwise I'll wait for your update.

whikernel avatar Aug 13 '22 15:08 whikernel

Okay, no problem. If you can add them that would be great!

Op za 13 aug. 2022 08:16 schreef whitekernel @.***>:

Thanks for your feedback! I did not know that. I just tried adding them to the alembic migration script, however then it does not set them anymore in case the database is still empty. Does that mean I have to add them to both the alembic script and the create_safe method? Since that would mean quite some work to define everything twice

Yes unfortunately in the way it's working you need to define it twice. Once for the instances upgrading, and once for the new instances. The issue is that alembic wasn't used from the start, so the alembic migrations are not defining the whole database and thus the post_init was/is needed.

We can add them in the migration script if you want. In that case I'll merge now. Otherwise I'll wait for your update.

— Reply to this email directly, view it on GitHub https://github.com/dfir-iris/iris-web/pull/130#issuecomment-1214175211, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABIOQZH7ONY2JWE5X4ZGSGDVY633NANCNFSM55S4Y7OQ . You are receiving this because you authored the thread.Message ID: @.***>

Matthijsy avatar Aug 13 '22 16:08 Matthijsy

Sure thing!

Okay, no problem. If you can add them that would be great! Op za 13 aug. 2022 08:16 schreef whitekernel @.***>:

whikernel avatar Aug 13 '22 17:08 whikernel