private void ApplyRetoractively(FalconOrchestratorDB db, TaxonomyViewModel model, int taxonomyId) { List <Detection> detections = db.Detections.Include("Account").Include("DetectionDevice").ToList(); switch (model.TypeId) { case 1: detections = detections.Where(x => Regex.IsMatch(x.Account.AccountName, Regex.Replace(model.Value, @"\\", @"\\"))).ToList(); break; case 2: detections = detections.Where(x => Regex.IsMatch(x.DetectionDevice.Device.Hostname, Regex.Replace(model.Value, @"\\", @"\\"))).ToList(); break; case 3: detections = detections.Where(x => x.Account.OrganizationalUnit != null && x.Account.OrganizationalUnit.Equals(Regex.Replace(model.Value, @"\\", @"\\"))).ToList(); break; case 4: var accountGroups = db.AccountGroups.Where(x => x.Group.Name == Regex.Replace(model.Value, @"\\", @"\\")).ToList(); var accountIds = accountGroups.Select(x => x.AccountId).ToList(); detections = db.Detections.Where(x => accountIds.Contains(x.AccountId)).ToList(); break; } foreach (Detection line in detections) { DetectionTaxonomy dt = new DetectionTaxonomy(); dt.DetectionId = line.DetectionId; dt.TaxonomyId = taxonomyId; db.DetectionTaxonomies.Add(dt); if (model.Critical) { line.CustomSeverityId = 5; } } db.SaveChanges(); }
public void SaveToDatabase(string cid, string offset) { Detection detection = new Detection(); detection.AccountId = GetAccountId(); detection.CommandLine = data.CommandLine; detection.CustomerId = GetCustomerId(cid); detection.CustomSeverityId = detection.VendorSeverityId = GetSeverityId(); detection.Description = data.DetectDescription; detection.DetectionDeviceId = GetDetectionDeviceId(); detection.FalconHostLink = data.FalconHostLink; detection.FileName = data.FileName; detection.FilePath = data.FilePath; detection.Name = data.DetectName; detection.ResponderId = data.ResponderId; detection.MD5 = data.MD5String; detection.Offset = offset; detection.ParentProcessId = data.ParentProcessId; detection.ProcessEndTime = data.FormattedProcessEndTime; detection.ProcessStartTime = data.FormattedProcessStartTime; detection.ProcessId = data.ProcessId; detection.SHA1 = data.SHA1String; detection.SHA256 = data.SHA256String; detection.Timestamp = DateTime.UtcNow; if (data.StatusId.HasValue) { detection.StatusId = (int)data.StatusId; } else { detection.StatusId = 1; } using (FalconOrchestratorDB db = new FalconOrchestratorDB()) { db.Detections.Add(detection); db.SaveChanges(); if (data.TaxonomyIds != null) { foreach (int line in data.TaxonomyIds) { DetectionTaxonomy dt = new DetectionTaxonomy(); dt.DetectionId = detection.DetectionId; dt.TaxonomyId = line; db.DetectionTaxonomies.Add(dt); } } if (data.DnsRequest != null) { foreach (DnsRequestsModel line in data.DnsRequest) { DnsRequest dns = new DnsRequest(); dns.CausedDetect = line.CausedDetect; dns.DetectionId = detection.DetectionId; dns.DomainName = line.DomainName; dns.InterfaceIndex = line.InterfaceIndex; dns.RequestType = line.RequestType; dns.Timestamp = line.FormattedTimestamp; db.DnsRequests.Add(dns); } } if (data.DocumentsAccessed != null) { foreach (DocumentsAccessedModel line in data.DocumentsAccessed) { DocumentsAccess doc = new DocumentsAccess(); doc.Timestamp = line.FormattedTimestamp; doc.FileName = line.FileName; doc.FilePath = line.FilePath; doc.DetectionId = detection.DetectionId; db.DocumentsAccesses.Add(doc); } } if (data.ExecutablesWritten != null) { foreach (ExecutableWrittenModel line in data.ExecutablesWritten) { ExecutablesWritten exe = new ExecutablesWritten(); exe.Timestamp = line.FormattedTimestamp; exe.FileName = line.FileName; exe.FilePath = line.FilePath; exe.DetectionId = detection.DetectionId; db.ExecutablesWrittens.Add(exe); } } if (data.NetworkAccesses != null) { foreach (NetworkAccessesModel line in data.NetworkAccesses) { NetworkAccess network = new NetworkAccess(); network.Timestamp = line.FormattedTimestamp; network.AccessType = line.AccessType; network.ConnectionDirection = line.ConnectionDirection; network.IsIPv6 = line.IsIPV6; network.LocalAddress = line.LocalAddress; network.LocalPort = line.LocalPort; network.Protocol = line.Protocol; network.RemoteAddress = line.RemoteAddress; network.RemotePort = line.RemotePort; network.DetectionId = detection.DetectionId; db.NetworkAccesses.Add(network); } } if (data.ScanResults != null) { foreach (ScanResultsModel line in data.ScanResults) { ScanResult scan = new ScanResult(); scan.DetectionId = detection.DetectionId; scan.Engine = line.Engine; scan.ResultName = line.ResultName; scan.Version = line.Version; db.ScanResults.Add(scan); } } db.SaveChanges(); AppConfiguration.FALCON_STREAM_LAST_OFFSET = offset; } }