catch ioc validation (opensearch-project#1110)

Signed-off-by: Joanne Wang <[email protected]>
jowg-amazon · Jun 28, 2024 · 7b968c4 · 7b968c4
1 parent fe023d8
commit 7b968c4
Showing 1 changed file with 10 additions and 8 deletions.
diff --git a/.../opensearch/securityanalytics/threatIntel/service/SATIFSourceConfigManagementService.java b/.../opensearch/securityanalytics/threatIntel/service/SATIFSourceConfigManagementService.java
@@ -120,12 +120,13 @@ public void createIocAndTIFSourceConfig(
             SATIFSourceConfig saTifSourceConfig = convertToSATIFConfig(saTifSourceConfigDto, null, TIFJobState.CREATING, createdByUser);
 
             // Don't index iocs into source config index
-            List<STIX2IOCDto> iocDtos;
+            List<STIX2IOC> iocs;
             if (saTifSourceConfig.getSource() instanceof IocUploadSource) {
-                iocDtos = ((IocUploadSource) saTifSourceConfigDto.getSource()).getIocs();
+                List<STIX2IOCDto> iocDtos = ((IocUploadSource) saTifSourceConfigDto.getSource()).getIocs();
                 ((IocUploadSource) saTifSourceConfig.getSource()).setIocs(List.of());
+                iocs = convertToIocs(iocDtos, saTifSourceConfig.getName(), saTifSourceConfig.getId());
             } else {
-                iocDtos = null;
+                iocs = null;
             }
 
             // Index threat intel source config as creating and update the last refreshed time
@@ -141,7 +142,7 @@ public void createIocAndTIFSourceConfig(
                                 // Call to download and save IOCS's, update state as AVAILABLE on success
                                 downloadAndSaveIOCs(
                                         indexSaTifSourceConfigResponse,
-                                        convertToIocs(iocDtos, indexSaTifSourceConfigResponse.getName(), indexSaTifSourceConfigResponse.getId()),
+                                        iocs,
                                         ActionListener.wrap(
                                                 r -> {
                                                     markSourceConfigAsAction(
@@ -299,12 +300,13 @@ public void updateIocAndTIFSourceConfig(
                         SATIFSourceConfig updatedSaTifSourceConfig = updateSaTifSourceConfig(saTifSourceConfigDto, retrievedSaTifSourceConfig);
 
                         // Don't index iocs into source config index
-                        List<STIX2IOCDto> iocDtos;
+                        List<STIX2IOC> iocs;
                         if (updatedSaTifSourceConfig.getSource() instanceof IocUploadSource) {
-                            iocDtos = ((IocUploadSource) saTifSourceConfigDto.getSource()).getIocs();
+                            List<STIX2IOCDto> iocDtos = ((IocUploadSource) saTifSourceConfigDto.getSource()).getIocs();
                             ((IocUploadSource) updatedSaTifSourceConfig.getSource()).setIocs(List.of());
+                            iocs = convertToIocs(iocDtos, updatedSaTifSourceConfig.getName(), updatedSaTifSourceConfig.getId());
                         } else {
-                            iocDtos = null;
+                            iocs = null;
                         }
 
                         // Download and save IOCS's based on new threat intel source config
@@ -319,7 +321,7 @@ public void updateIocAndTIFSourceConfig(
                                             break;
                                         case IOC_UPLOAD:
                                             storeAndDeleteIocIndices(
-                                                    convertToIocs(iocDtos, updatedSaTifSourceConfig.getName(), updatedSaTifSourceConfig.getId()),
+                                                    iocs,
                                                     listener,
                                                     updatedSaTifSourceConfig
                                             );