diff --git a/README.md b/README.md
index c40e6a88385204d6bb275235a5fa2f21fe4c08a5..de928cf4b22142d45bee556d3df178c0ca402846 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,12 @@ Visceral is a forensic tool aiming visualize data extracted from [EVTXtract](htt
The development of the application is currently focused on Windows OS.
+## Disclaimer
+
+This project is currently in beta, which means it won't be effective in a real forensic case for now.
+It is currently closer to a PoC (proof of concept), rather than a finished project.
+All constructed criticism is appreciated.
+
## Requirements
In order to run the application, you will need to install :
@@ -49,6 +55,10 @@ The import time will depend of the size of the data. Over 1Go of imported data,
Graph visualization enables the investigator to navigate through pre-analyzed graph generated by the previously imported data.
+
+
+
+
Start with a node as your entry point, then expend the range of your investigation by displaying adjacent nodes.
* A **date range filter** is available to narrow down the graph you will investigate.
@@ -61,4 +71,4 @@ Big thanks to the members of the team who spent 1 month on this end-of-studies p
## License
-This software is available under the [GPLv3 Licence](./LICENSE).
\ No newline at end of file
+This software is available under the [GPLv3 Licence](./LICENSE).
diff --git a/Visceral.sln.DotSettings.user b/Visceral.sln.DotSettings.user
new file mode 100644
index 0000000000000000000000000000000000000000..7dce6a01e06c0fec76a8eae3e6581fdacab0a14d
--- /dev/null
+++ b/Visceral.sln.DotSettings.user
@@ -0,0 +1,3 @@
+
+ True
+ True
\ No newline at end of file
diff --git a/Visceral/Controllers/ApiController.cs b/Visceral/Controllers/ApiController.cs
index 267598310d68344b5296cdfa3e0f13a393917be3..1001993dceb45f89b172f95a7c8cc2e19830c909 100644
--- a/Visceral/Controllers/ApiController.cs
+++ b/Visceral/Controllers/ApiController.cs
@@ -10,7 +10,7 @@ namespace Visceral.Controllers
private readonly object _apiInformations = new
{
title = "Visceral API",
- author = "mailto:visceral_taskforce@protonmail.com"
+ author = "mailto:visceral_team@protonmail.com"
};
private readonly object _apiUrls = new
diff --git a/Visceral/Controllers/ImportController.cs b/Visceral/Controllers/ImportController.cs
index f4432c6132d289aa9f85d1370296ce52b6e49fce..024847e935b10d48e9aa9058ed88dd202edade25 100644
--- a/Visceral/Controllers/ImportController.cs
+++ b/Visceral/Controllers/ImportController.cs
@@ -1,5 +1,4 @@
using System;
-using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Threading.Tasks;
@@ -7,9 +6,7 @@ using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Visceral.Models.ConfigFiles;
using Visceral.Models.View;
-using Visceral.Repository;
using Visceral.Repository.Import;
-using Visceral.Services;
using Visceral.Services.Import;
namespace Visceral.Controllers
@@ -20,12 +17,13 @@ namespace Visceral.Controllers
private readonly PlasoMftEventRepository _plasoMftEventRepository;
private readonly GraphRepository _graphRepository;
private readonly IndexRepository _indexRepository;
+ private readonly CustomFunctionRepository _customFunctionRepository;
private readonly UploadConfig _uploadConfig;
private readonly JsonSplittingService _jsonSplittingService;
public ImportController(WindowsEventRepository windowsEventRepository, UploadConfig uploadConfig,
PlasoMftEventRepository plasoMftEventRepository, JsonSplittingService jsonSplittingService,
- GraphRepository graphRepository, IndexRepository indexRepository )
+ GraphRepository graphRepository, IndexRepository indexRepository, CustomFunctionRepository customFunctionRepository )
{
_windowsEventRepository = windowsEventRepository;
_plasoMftEventRepository = plasoMftEventRepository;
@@ -33,6 +31,7 @@ namespace Visceral.Controllers
_uploadConfig = uploadConfig;
_jsonSplittingService = jsonSplittingService;
_indexRepository = indexRepository;
+ _customFunctionRepository = customFunctionRepository;
}
public IActionResult Import()
@@ -56,6 +55,7 @@ namespace Visceral.Controllers
try
{
await _indexRepository.CreateIndexesIfNotAlreadyExisting();
+ await _customFunctionRepository.CreateAllCustomsFunctionIfNotAlreadyExisting();
switch (uploadTypeAction)
{
diff --git a/Visceral/Controllers/LabelsController.cs b/Visceral/Controllers/LabelsController.cs
index d34e464df1cf6544dc2259e8a83a54acf96c8e4e..5bee75111783a3988e2169d6a90a13e67e4dfebc 100644
--- a/Visceral/Controllers/LabelsController.cs
+++ b/Visceral/Controllers/LabelsController.cs
@@ -56,7 +56,7 @@ namespace Visceral.Controllers
}
else
{
- queryResult = await _repository.GetNeighboursLabel(label);
+ queryResult = await _repository.GetOuterNeighboursLabel(label);
}
return _service.ResultToApiFormat(queryResult);
}
diff --git a/Visceral/Controllers/NodesController.cs b/Visceral/Controllers/NodesController.cs
index e954ef681ffa0767dc401d70e99a31815f90c19a..6d0e7fbe57dc34c5a704113ca5cac4046db7e224 100644
--- a/Visceral/Controllers/NodesController.cs
+++ b/Visceral/Controllers/NodesController.cs
@@ -6,9 +6,7 @@ using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Neo4j.Driver;
using Visceral.Models.ErrorsApi;
-using Visceral.Repository;
using Visceral.Repository.API;
-using Visceral.Services;
using Visceral.Services.API;
namespace Visceral.Controllers
@@ -44,8 +42,6 @@ namespace Visceral.Controllers
/// Filters the node by label. Only take one label.
/// Maximum number of nodes returned.
/// Number of nodes to skip before returning the rest.
- /// Filter. Keep every element after this date
- /// Filter. Keep every element before this date
/// A list of all nodes queried in Vis Node Format.
/// Returns a list of all nodes queried in Vis Node Format.
/// If one or more parameters doesn't complete validation. Returns errors.
@@ -53,11 +49,11 @@ namespace Visceral.Controllers
[ProducesResponseType(StatusCodes.Status200OK)]
[ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
public async Task> GetNodes([FromQuery] string? label=null,[FromQuery] int limit=0,
- [FromQuery] int skip=0, [FromQuery] string? startDate=null, [FromQuery] string? endDate=null)
+ [FromQuery] int skip=0)
{
try
{
- List neo4JNodeList = await _nodeRepository.GetNodes(label,skip,limit,startDate,endDate);
+ List neo4JNodeList = await _nodeRepository.GetNodes(label,skip,limit);
List> visNodeList = neo4JNodeList.AsParallel()
.Select(node => _nodeService.NodeToVisNode(node))
.ToList();
@@ -76,8 +72,6 @@ namespace Visceral.Controllers
/// Gets a node by id.
///
/// Id of the queried node.
- /// Filter. Keep every element after this date
- /// Filter. Keep every element before this date
/// The node with the given id in Vis Node Format.
/// Returns the node found with the given id in Vis Node Format.
/// If there is no node with this id.
@@ -86,12 +80,11 @@ namespace Visceral.Controllers
[ProducesResponseType(StatusCodes.Status200OK)]
[ProducesResponseType(StatusCodes.Status404NotFound)]
[ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
- public async Task> GetNodeById(int id,[FromQuery] string? startDate=null,
- [FromQuery] string? endDate=null)
+ public async Task> GetNodeById(int id)
{
try
{
- INode neo4JNode = await _nodeRepository.GetNodeById(id,startDate,endDate);
+ INode neo4JNode = await _nodeRepository.GetNodeById(id);
IDictionary visNode = _nodeService.NodeToVisNode(neo4JNode);
return _apiService.ResultToApiFormat(visNode);
}
@@ -122,7 +115,7 @@ namespace Visceral.Controllers
[ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
public async Task> GetNeighborsNodesByLabel(int id,[FromQuery] string? label=null,
[FromQuery] string? type=null, [FromQuery] int limit=0,[FromQuery] int skip=0,
- [FromQuery] string? startDate=null, [FromQuery] string? endDate=null )
+ [FromQuery] long? startDate=null, [FromQuery] long? endDate=null )
{
try
{
@@ -150,5 +143,19 @@ namespace Visceral.Controllers
return _apiService.ErrorToApiFormat(error.ToDictionary());
}
}
+
+ //GET /api/node/{id}/neighbour/labels
+ ///
+ /// From the node id, gets neighbours labels without caring of the orientation of the relationship.
+ ///
+ /// id of the starting node.
+ /// A list of labels from the neighbour nodes
+ [Route("{id}/neighbour/labels"), HttpGet]
+ [ProducesResponseType(StatusCodes.Status200OK)]
+ public async Task