MISP/SkillAegis
MISP/SkillAegis
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

new: [backend:user_activity] Improved user activity filtering

Browse source
This commit is contained in:
Sami Mokaddem 2024-07-09 14:05:40 +02:00
parent 7ed839d391
commit d637f2a0ee
2 changed files with 19 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
notification.py
View file

@ -197,4 +197,21 @@ def is_accepted_notification(notification) -> bool:
return True
elif action in config.live_logs_accepted_scope[scope]:
return True
return False
def is_accepted_user_activity(notification) -> bool:
global VERBOSE_MODE
if notification['user_agent'] == 'misp-exercise-dashboard': # Ignore message generated from this app
return False
if '@' not in notification['user']: # Ignore message from system
return False
scope, action = get_scope_action_from_url(notification['url'])
if scope in config.uesr_activity_accepted_scope:
if config.uesr_activity_accepted_scope == '*':
return True
elif action in config.uesr_activity_accepted_scope[scope]:
return True
return False

3
server.py
View file

@ -150,10 +150,11 @@ async def handleMessage(topic, s, message):
if notification_model.is_accepted_notification(notification):
notification_model.record_notification(notification)
ZMQ_MESSAGE_COUNT_LAST_TIMESPAN += 1
await sio.emit('notification', notification)
if notification_model.is_accepted_user_activity(notification):
user_id = notification_model.get_user_id(data)
if user_id is not None:
USER_ACTIVITY[user_id] += 1
await sio.emit('notification', notification)
user_id = notification_model.get_user_id(data)
if user_id is not None: