Reporting rework #24
Draft
Reporting rework #24
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
josh-feather
force-pushed
the
reporting-rework
branch
2 times, most recently
from
212895f to
58b4be1
Compare
josh-feather
reviewed
Feb 5, 2025
josh-feather
force-pushed
the
reporting-rework
branch
from
0c56a94 to
9771427
Compare
- Added a new file: mongodb_constants.py - We'll use this new file whenever we're touching mongodb - The new constants are collection names and some field names
- A bit of refactoring to ensure testability.
- Using mongomock, write tests for web/analysis/views
- Add a test for report doc insert calls - Add tests for perform_search
This starts to migrate the reporting capabilities out of the processing phase where it currently lives exclusively, to a core part of CAPE with a few different backend stubs to start.
This was a (disabled) example of how easy it is to extend the Web GUI with external tools. It conflicts with the goal of having well-defined reporting API and schemas, so remove it for now. It can come back as needed in the future with more up front thought.
Shrike is no longer used. Let's remove it to tighten up what's needed in reporting functionality. Note this requires a database migration. It should be the antithesis of f111620bb8 which was added in add_shrike_and_parent_id_columns.py, but there's a bug in the downgrade logic in that revision - "parent_sid" not "parent_id".
The reporting changes will be substantial. This will keep diffs limited ot the changes we care about, avoiding random line wraps because the Python tooling ecosystem is obsessed with recreating the same thing over and over again.
This will be used to get at process, process tree, and detection2pids data.
- since shrike parameters were removed from parse_request_arguments
josh-feather
force-pushed
the
reporting-rework
branch
from
e5ac3ae to
c8ba382
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Use pydantic to specify backend schema