Skip to content

Commit e35dfc0

Browse files
mjabascal10mjabascal10
authored
Bugfix/10.2/402 incident response trigger select cause modal scroll (#413)
* Fixed Incident-response-trigger-select-cause-modal-scroll (#402) * Fixed Incident-response-trigger-select-cause-modal-scroll (#402) * Fixed Incident-response-trigger-select-cause-modal-scroll (#402) * Fixed Incident-response-trigger-select-cause-modal-scroll (#402) * Fixed Auditor crash try to parse (#405) * Fixed Auditor crash try to parse (#405)
1 parent 1ad4d0c commit e35dfc0

File tree

4 files changed

+35
-27
lines changed

4 files changed

+35
-27
lines changed

‎frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.html‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@
9595
[label]="'Incident response automation is active'">
9696
</app-utm-toggle>
9797
</div>
98-
<div *ngIf="step===2" class="configure-step mt-3 mb-3 has-fixed-height overflow-auto">
98+
<div *ngIf="step===2" class="configure-step mt-3 mb-3">
9999

100100
<div class="w-100">
101101
<div formArrayName="conditions">
@@ -179,17 +179,17 @@
179179
</div>-->
180180
</div>
181181
<div class="d-flex mt-3 flex-column">
182-
<app-utm-toggle (toggleChange)="formRule.get('agentType').setValue($event)"
182+
<div class="alert alert-info alert-styled-right mb-2 info-dismissible">
183+
<span class="font-weight-semibold">Info! </span>
184+
<span>Select the agent handling strategy for the automation. By default (not active), commands will run on specified platform agents if the trigger conditions and dataSource field value of the alert match. Alternatively, choose a default agent to run the automation if no other agent matches the criteria. If this option is active, commands will run only on specified platform agents if the trigger conditions and dataSource field value of the alert match, if not, the automation won't be executed.</span>
185+
</div>
186+
<app-utm-toggle (toggleChange)="onChangeToggle($event)"
183187
[active]="formRule.get('agentType').value"
184188
[emitAtStart]="false"
185189
[customClass]="'pl-3'"
186-
[label]="'Agent handling strategy for the automation'"></app-utm-toggle>
187-
<div class="alert alert-info alert-styled-right mt-1 info-dismissible">
188-
<span class="font-weight-semibold">Info! </span>
189-
<span>Select the agent handling strategy for the automation. By default, commands won't run on specified agents, even if the trigger conditions match. Alternatively, choose a default agent to run the automation if no other agent matches the criteria.</span>
190-
</div>
190+
[label]="'Run on specific agent'"></app-utm-toggle>
191191
</div>
192-
<div *ngIf="formRule.get('agentType').value" class="d-flex mt-3 flex-column">
192+
<div *ngIf="!formRule.get('agentType').value" class="d-flex mt-2 flex-column">
193193
<div class="col-12 p-0">
194194
<label class="pb-1" for="exclude">Exclude agents</label>
195195
<ng-select [clearable]="false"
@@ -212,9 +212,9 @@
212212
</div>
213213
</div>
214214
</div>
215-
<div *ngIf="!formRule.get('agentType').value" class="d-flex mt-3 flex-column">
216-
<div class="col-12 p-0">
217-
<label class="pb-1" for="exclude">Default agents</label>
215+
<div *ngIf="formRule.get('agentType').value" class="d-flex mt-2 flex-column">
216+
<div class="col-6 p-0">
217+
<label class="pb-1" for="exclude">Default agent</label>
218218
<ng-select [clearable]="false"
219219
[items]="agents"
220220
[placeholder]="'Select agent'"

‎frontend/src/app/incident-response/shared/component/ir-create-rule/ir-create-rule.component.ts‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ export class IrCreateRuleComponent implements OnInit {
5454
conditions: this.fb.array([]),
5555
command: ['', Validators.required],
5656
active: [true],
57-
agentType: [true],
57+
agentType: [false],
5858
excludedAgents: [[]],
5959
defaultAgent: [''],
6060
agentPlatform: ['', Validators.required]
@@ -81,7 +81,7 @@ export class IrCreateRuleComponent implements OnInit {
8181
this.ruleConditions.push(ruleCondition);
8282
this.getAgents(this.formRule.get('agentPlatform').value);
8383
this.formRule.get('excludedAgents').setValue(this.rule.excludedAgents);
84-
this.formRule.get('agentType').setValue(this.rule.excludedAgents.length > 0);
84+
this.formRule.get('agentType').setValue(this.rule.excludedAgents.length === 0);
8585
this.formRule.get('defaultAgent').setValue(this.rule.defaultAgent);
8686
}
8787
} else if (this.alert) {
@@ -148,6 +148,9 @@ export class IrCreateRuleComponent implements OnInit {
148148
}
149149

150150
nextStep() {
151+
if (this.step === 3) {
152+
this.formRule.get('command').setValue(this.command);
153+
}
151154
this.stepCompleted.push(this.step);
152155
this.step += 1;
153156
}
@@ -194,7 +197,6 @@ export class IrCreateRuleComponent implements OnInit {
194197
}
195198

196199
editRule() {
197-
console.log('edit');
198200
const action = 'edited';
199201
const actionError = 'editing';
200202
this.clearAgentTypeSelection();
@@ -216,7 +218,7 @@ export class IrCreateRuleComponent implements OnInit {
216218
}
217219

218220
clearAgentTypeSelection() {
219-
if (!this.formRule.get('agentType').value) {
221+
if (this.formRule.get('agentType').value) {
220222
this.formRule.get('excludedAgents').setValue([]);
221223
} else {
222224
this.formRule.get('defaultAgent').setValue('');
@@ -247,13 +249,13 @@ export class IrCreateRuleComponent implements OnInit {
247249
}
248250

249251
isDisable(step: number) {
250-
console.log((!this.formRule.get('agentType').value && this.formRule.get('defaultAgent').value === ''));
251252
switch (step) {
252253
case 1:
253254
return !this.formRule.get('name').valid || !this.formRule.get('description').valid || this.exist;
254255
case 2:
255256
return !this.formRule.get('agentPlatform').valid || this.ruleConditions.length === 0
256-
|| (!this.formRule.get('agentType').value && !this.formRule.get('defaultAgent').value);
257+
|| !this.ruleConditions.valid
258+
|| (this.formRule.get('agentType').value && !this.formRule.get('defaultAgent').value);
257259
case 3:
258260
return !this.command || this.command === '';
259261
}
@@ -283,8 +285,13 @@ export class IrCreateRuleComponent implements OnInit {
283285
});
284286
}
285287

286-
onChangeToggle() {
287-
288+
onChangeToggle($event) {
289+
if ($event ) {
290+
this.formRule.get('excludedAgents').setValue([]);
291+
} else {
292+
this.formRule.get('defaultAgent').setValue('');
293+
}
294+
this.formRule.get('agentType').setValue($event);
288295
}
289296

290297
}

‎frontend/src/app/incident-response/shared/component/ir-summary/ir-summary.component.html‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
</span>
2020

2121

22-
<ng-container *ngIf="agentType">
22+
<ng-container *ngIf="!agentType">
2323
<span>
2424
Importantly, the automation excludes designated agents, such as
2525
</span>
@@ -28,7 +28,7 @@
2828
</span>
2929
</ng-container>
3030

31-
<ng-container *ngIf="!agentType">
31+
<ng-container *ngIf="agentType">
3232
<span>
3333
In case none of the agents satisfy the specified conditions, the automation will smoothly revert and execute on the default agent,
3434
<span class="badge p-1 border-1 badge-flat font-weight-light border-info-800 text-info-800 mr-2 mb-2">
@@ -44,7 +44,7 @@
4444
<span>
4545
Crucially, when these conditions are met, the automation will proceed to execute the following action:
4646
</span>
47-
<app-utm-code-view [code]="command" [allowCopy]="true"></app-utm-code-view>
47+
<app-utm-code-view class="w-100 mt-1" [code]="command" [allowCopy]="false"></app-utm-code-view>
4848
</div>
4949
</div>
5050

‎user-auditor/src/main/java/com/utmstack/userauditor/model/winevent/WinEventLog.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,16 +19,17 @@ public class WinEventLog{
1919
public ArrayList<String> keywords;
2020
public String level;
2121
public String log_name;
22-
public String message;
22+
23+
public String mesage;
2324
public String opcode;
24-
public int process_id;
25+
public String process_id;
2526
public String provider_guid;
26-
public int record_number;
27+
public String record_number;
2728
public String source_name;
2829
public ArrayList<String> tags;
2930
public String task;
30-
public int thread_id;
31-
public int version;
31+
public String thread_id;
32+
public String version;
3233
}
3334

3435

0 commit comments

Comments
 (0)