Fix abuseipdb tags (#2932)

* fixed abuseipdb tags

* fix to similar investigation search

Author: drosetti

api_app/analyzers_manager/observable_analyzers/abuseipdb.py

@@ -101,11 +101,27 @@ def _monkeypatch(cls):
 
     def _update_data_model(self, data_model) -> None:
         super()._update_data_model(data_model)
+        data_model.tags = []
         report_data = self.report.report.get("data", {})
+        categories_found = self.report.report.get("categories_found", {})
+        data_model.additional_info = {"distinct_users": report_data["numDistinctUsers"]}
         if report_data.get("totalReports", 0):
             self.report: AnalyzerReport
             if report_data["isWhitelisted"]:
                 evaluation = self.report.data_model_class.EVALUATIONS.TRUSTED.value
+                data_model.additional_info["description"] = (
+                    "AbuseIPDB is a service where users can report malicious IP addresses attacking "
+                    + "their infrastructure."
+                    + "This IP address has been whitelisted"
+                )
             else:
                 evaluation = self.report.data_model_class.EVALUATIONS.MALICIOUS.value
+                data_model.additional_info["description"] = (
+                    "AbuseIPDB is a service where users can report malicious IP addresses attacking "
+                    + "their infrastructure."
+                    + "This IP address has been categorized with some malicious "
+                    + "categories"
+                )
             data_model.evaluation = evaluation
+            data_model.reliability = report_data["abuseConfidenceScore"] // 10
+        data_model.tags.extend(list(categories_found.keys()))

api_app/investigations_manager/models.py

@@ -106,10 +106,10 @@ def investigation_for_analyzable(
         cls, queryset: models.QuerySet, analyzed_object_name: str
     ) -> models.QuerySet:
         related_job_id_list = [
-            job_data[0]
+            job_data.get_root().id
             for job_data in Job.objects.filter(
                 analyzable__name__icontains=analyzed_object_name
-            ).values_list("id")
+            )
         ]
         return queryset.filter(jobs__id__in=related_job_id_list).distinct()
 

tests/api_app/test_views.py

@@ -166,25 +166,23 @@ def setUp(self):
                     "tlp": Job.TLP.GREEN.value,
                 }
             )
-            self.job5, _ = Job.objects.get_or_create(
-                **{
-                    "user": self.superuser,
-                    "analyzable": self.analyzable,
-                    "playbook_to_execute": PlaybookConfig.objects.get(name="Dns"),
-                    "tlp": Job.TLP.AMBER.value,
-                }
-            )
             self.investigation1, _ = Investigation.objects.get_or_create(
                 name="test_investigation1", owner=self.superuser
             )
             self.investigation1.jobs.add(self.job)
             self.investigation2, _ = Investigation.objects.get_or_create(
                 name="test_investigation2", owner=self.superuser
             )
-            self.investigation2.jobs.add(self.job5)
+            self.investigation2.jobs.add(self.job2)
+            # in this way we can check we filter investagion looking for child job and not only the one in the root
+            self.job2.add_child(
+                user=self.superuser,
+                analyzable=self.analyzable,
+                playbook_to_execute=PlaybookConfig.objects.get(name="Dns"),
+                tlp=Job.TLP.AMBER.value,
+            )
 
     def tearDown(self):
-        self.job5.delete()
         self.job4.delete()
         self.job3.delete()
         self.job2.delete()