Handle the cases when there are no stream rules during creation

airbus-cyber · Nov 6, 2024 · bfa398e · bfa398e
1 parent 1baed73
commit bfa398e
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 8 deletions.
diff --git a/.../com/airbus_cyber_security/graylog/wizard/alert/business/TriggeringConditionsService.java b/.../com/airbus_cyber_security/graylog/wizard/alert/business/TriggeringConditionsService.java
@@ -117,31 +117,45 @@ private TriggeringConditions createTriggeringConditionsFromStream(AlertRuleStrea
         List<FieldRule> fieldRulesWithList = this.streamPipelineService.extractPipelineFieldRules(streamConfiguration.getFieldRules());
 
         TriggeringConditions.Builder builder = TriggeringConditions.builder().filteringStreamIdentifier(filteringStreamIdentifier);
+        Stream.MatchingType matchingType = streamConfiguration.getMatchingType();
+        builder.matchingType(matchingType);
         if (fieldRulesWithList.isEmpty()) {
-            return builder.outputStreamIdentifier(filteringStreamIdentifier).build();
+            String outputStreamIdentifier;
+            if (filteringStreamIdentifier == null) {
+                outputStreamIdentifier = Stream.DEFAULT_STREAM_ID;
+            } else {
+                outputStreamIdentifier = filteringStreamIdentifier;
+            }
+            return builder.outputStreamIdentifier(outputStreamIdentifier).build();
         }
 
         for (FieldRule fieldRule: fieldRulesWithList) {
             this.alertListUtilsService.incrementUsage(fieldRule.getValue());
         }
 
-        Stream.MatchingType matchingType = streamConfiguration.getMatchingType();
-        builder.matchingType(matchingType);
-        if (matchingType.equals(Stream.MatchingType.AND) && this.fieldRulesUtilities.hasStreamRules(streamConfiguration.getFieldRules())) {
-            PipelineDao graylogPipeline = this.streamPipelineService.createPipeline(title, matchingType, filteringStreamIdentifier);
+        if (!this.fieldRulesUtilities.hasStreamRules(streamConfiguration.getFieldRules())) {
+            PipelineDao graylogPipeline = this.streamPipelineService.createPipeline(title, matchingType, Stream.DEFAULT_STREAM_ID);
             Stream outputStream = this.streamPipelineService.createStream(matchingType, title + " output", userName);
             RuleDao pipelineRule = this.streamPipelineService.createPipelineRule(title, fieldRulesWithList, matchingType, outputStream.getId());
             Pipeline pipeline = Pipeline.builder()
                     .identifier(graylogPipeline.id()).ruleIdentifier(pipelineRule.id()).fieldRules(fieldRulesWithList)
                     .build();
             return builder.outputStreamIdentifier(outputStream.getId()).pipeline(pipeline).build();
-        } else {
+        } else if (matchingType.equals(Stream.MatchingType.OR)) {
             PipelineDao graylogPipeline = this.streamPipelineService.createPipeline(title, matchingType, Stream.DEFAULT_STREAM_ID);
             RuleDao pipelineRule = this.streamPipelineService.createPipelineRule(title, fieldRulesWithList, matchingType, filteringStreamIdentifier);
             Pipeline pipeline = Pipeline.builder()
                     .identifier(graylogPipeline.id()).ruleIdentifier(pipelineRule.id()).fieldRules(fieldRulesWithList)
                     .build();
             return builder.outputStreamIdentifier(filteringStreamIdentifier).pipeline(pipeline).build();
+        } else {
+            PipelineDao graylogPipeline = this.streamPipelineService.createPipeline(title, matchingType, filteringStreamIdentifier);
+            Stream outputStream = this.streamPipelineService.createStream(matchingType, title + " output", userName);
+            RuleDao pipelineRule = this.streamPipelineService.createPipelineRule(title, fieldRulesWithList, matchingType, outputStream.getId());
+            Pipeline pipeline = Pipeline.builder()
+                    .identifier(graylogPipeline.id()).ruleIdentifier(pipelineRule.id()).fieldRules(fieldRulesWithList)
+                    .build();
+            return builder.outputStreamIdentifier(outputStream.getId()).pipeline(pipeline).build();
         }
     }
 

diff --git a/src/main/java/com/airbus_cyber_security/graylog/wizard/alert/model/TriggeringConditions.java b/src/main/java/com/airbus_cyber_security/graylog/wizard/alert/model/TriggeringConditions.java
@@ -33,11 +33,11 @@
  * The output stream is the stream on which the event feeds.
  *
  * There are 4 possible constructions:
- * - no stream, no list conditions: filteringStream == null, outputStream == DEFAULT_STREAM
+ * - no stream conditions, no list conditions: filteringStream == null, outputStream == DEFAULT_STREAM
  * - stream conditions only: pipeline == null, filteringStream == outputStream
  * - list conditions only: pipeline -> outputStream, filteringStream == null
  * - both stream and list conditions:
- *     If the conditions matching type is OR (at least one): pipeline -> outputString == filteringStream
+ *     If the conditions matching type is OR (at least one): pipeline -> outputStream == filteringStream
  *     If the conditions matching type is AND (all): filteringStream -> pipeline -> outputStream
  */
 @AutoValue