private void ApplyRetoractively(FalconOrchestratorDB db, TaxonomyViewModel model, int taxonomyId)
{
List <Detection> detections = db.Detections.Include("Account").Include("DetectionDevice").ToList();
switch (model.TypeId)
{
case 1:
detections = detections.Where(x => Regex.IsMatch(x.Account.AccountName, Regex.Replace(model.Value, @"\\", @"\\"))).ToList();
break;
case 2:
detections = detections.Where(x => Regex.IsMatch(x.DetectionDevice.Device.Hostname, Regex.Replace(model.Value, @"\\", @"\\"))).ToList();
break;
case 3:
detections = detections.Where(x => x.Account.OrganizationalUnit != null && x.Account.OrganizationalUnit.Equals(Regex.Replace(model.Value, @"\\", @"\\"))).ToList();
break;
case 4:
var accountGroups = db.AccountGroups.Where(x => x.Group.Name == Regex.Replace(model.Value, @"\\", @"\\")).ToList();
var accountIds = accountGroups.Select(x => x.AccountId).ToList();
detections = db.Detections.Where(x => accountIds.Contains(x.AccountId)).ToList();
break;
}
foreach (Detection line in detections)
{
DetectionTaxonomy dt = new DetectionTaxonomy();
dt.DetectionId = line.DetectionId;
dt.TaxonomyId = taxonomyId;
db.DetectionTaxonomies.Add(dt);
if (model.Critical)
{
line.CustomSeverityId = 5;
}
}
db.SaveChanges();
}
public void SaveToDatabase(string cid, string offset)
{
Detection detection = new Detection();
detection.AccountId = GetAccountId();
detection.CommandLine = data.CommandLine;
detection.CustomerId = GetCustomerId(cid);
detection.CustomSeverityId = detection.VendorSeverityId = GetSeverityId();
detection.Description = data.DetectDescription;
detection.DetectionDeviceId = GetDetectionDeviceId();
detection.FalconHostLink = data.FalconHostLink;
detection.FileName = data.FileName;
detection.FilePath = data.FilePath;
detection.Name = data.DetectName;
detection.ResponderId = data.ResponderId;
detection.MD5 = data.MD5String;
detection.Offset = offset;
detection.ParentProcessId = data.ParentProcessId;
detection.ProcessEndTime = data.FormattedProcessEndTime;
detection.ProcessStartTime = data.FormattedProcessStartTime;
detection.ProcessId = data.ProcessId;
detection.SHA1 = data.SHA1String;
detection.SHA256 = data.SHA256String;
detection.Timestamp = DateTime.UtcNow;
if (data.StatusId.HasValue)
{
detection.StatusId = (int)data.StatusId;
}
else
{
detection.StatusId = 1;
}
using (FalconOrchestratorDB db = new FalconOrchestratorDB())
{
db.Detections.Add(detection);
db.SaveChanges();
if (data.TaxonomyIds != null)
{
foreach (int line in data.TaxonomyIds)
{
DetectionTaxonomy dt = new DetectionTaxonomy();
dt.DetectionId = detection.DetectionId;
dt.TaxonomyId = line;
db.DetectionTaxonomies.Add(dt);
}
}
if (data.DnsRequest != null)
{
foreach (DnsRequestsModel line in data.DnsRequest)
{
DnsRequest dns = new DnsRequest();
dns.CausedDetect = line.CausedDetect;
dns.DetectionId = detection.DetectionId;
dns.DomainName = line.DomainName;
dns.InterfaceIndex = line.InterfaceIndex;
dns.RequestType = line.RequestType;
dns.Timestamp = line.FormattedTimestamp;
db.DnsRequests.Add(dns);
}
}
if (data.DocumentsAccessed != null)
{
foreach (DocumentsAccessedModel line in data.DocumentsAccessed)
{
DocumentsAccess doc = new DocumentsAccess();
doc.Timestamp = line.FormattedTimestamp;
doc.FileName = line.FileName;
doc.FilePath = line.FilePath;
doc.DetectionId = detection.DetectionId;
db.DocumentsAccesses.Add(doc);
}
}
if (data.ExecutablesWritten != null)
{
foreach (ExecutableWrittenModel line in data.ExecutablesWritten)
{
ExecutablesWritten exe = new ExecutablesWritten();
exe.Timestamp = line.FormattedTimestamp;
exe.FileName = line.FileName;
exe.FilePath = line.FilePath;
exe.DetectionId = detection.DetectionId;
db.ExecutablesWrittens.Add(exe);
}
}
if (data.NetworkAccesses != null)
{
foreach (NetworkAccessesModel line in data.NetworkAccesses)
{
NetworkAccess network = new NetworkAccess();
network.Timestamp = line.FormattedTimestamp;
network.AccessType = line.AccessType;
network.ConnectionDirection = line.ConnectionDirection;
network.IsIPv6 = line.IsIPV6;
network.LocalAddress = line.LocalAddress;
network.LocalPort = line.LocalPort;
network.Protocol = line.Protocol;
network.RemoteAddress = line.RemoteAddress;
network.RemotePort = line.RemotePort;
network.DetectionId = detection.DetectionId;
db.NetworkAccesses.Add(network);
}
}
if (data.ScanResults != null)
{
foreach (ScanResultsModel line in data.ScanResults)
{
ScanResult scan = new ScanResult();
scan.DetectionId = detection.DetectionId;
scan.Engine = line.Engine;
scan.ResultName = line.ResultName;
scan.Version = line.Version;
db.ScanResults.Add(scan);
}
}
db.SaveChanges();
AppConfiguration.FALCON_STREAM_LAST_OFFSET = offset;
}
}
