diff --git a/iris_webhooks_module/IrisWebHooksInterface.py b/iris_webhooks_module/IrisWebHooksInterface.py index 2496f95..96cdfbe 100644 --- a/iris_webhooks_module/IrisWebHooksInterface.py +++ b/iris_webhooks_module/IrisWebHooksInterface.py @@ -31,12 +31,12 @@ from app.datamgmt.iris_engine.modules_db import module_list_available_hooks from app.schema.marshables import (AlertSchema, CaseDetailsSchema, CaseAssetsSchema, CaseNoteSchema, IocSchema, EventSchema, CaseEvidenceSchema, CaseTaskSchema, CommentSchema) +from app.models.models import IocLink import iris_webhooks_module.IrisWebHooksConfig as interface_conf class IrisWebHooksInterface(IrisModuleInterface): - """ - Provide the interface between Iris and WebHooks + """ Provide the interface between Iris and WebHooks """ name = "IrisWebHooksInterface" _module_name = interface_conf.module_name @@ -310,8 +310,17 @@ def _do_web_hook(self, hook_name, data, hook, server_url) -> InterfaceStatus.IIS elif hook_object == 'ioc': object_name = data[0].ioc_value + try: + ioc_link = IocLink.query.filter_by(ioc_id=data[0].ioc_id).order_by(IocLink.ioc_link_id.desc()).first() + if ioc_link: + case_id = ioc_link.case_id + case_name = ioc_link.case.name + object_url = f"{server_url}/case/ioc?cid={case_id}&shared={data[0].ioc_id}" + except Exception as e: + self.log.error(f"Could not resolve case_id for IOC {data[0].ioc_id}: {e}") raw_data = { 'iocs': IocSchema(many=True).dump(data), + 'case_id': case_id, 'object_url': object_url }