[FIX] Delete asset when it is linked to an ioc should not fail

dfir-iris · Oct 18, 2024 · 272b47a · 272b47a
1 parent f4290a6
commit 272b47a
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/source/app/datamgmt/case/case_assets_db.py b/source/app/datamgmt/case/case_assets_db.py
@@ -136,6 +136,7 @@ def delete_asset(asset_id, caseid):
         return
 
     if case_asset.case_id and case_asset.alerts is not None:
+        delete_ioc_asset_link(asset_id)
 
         CaseEventsAssets.query.filter(
             case_asset.asset_id == CaseEventsAssets.asset_id

diff --git a/tests/tests_rest_assets.py b/tests/tests_rest_assets.py
@@ -97,4 +97,15 @@ def test_delete_asset_should_increment_asset_state(self):
         state = response['data']['object_state']
         self._subject.delete(f'/api/v2/assets/{asset_identifier}')
         response = self._subject.get('/case/assets/state', {'cid': case_identifier}).json()
-        self.assertEqual(state + 1, response['data']['object_state'])
+        self.assertEqual(state + 1, response['data']['object_state'])
+
+    def test_delele_asset_should_not_fail_when_it_is_linked_to_an_ioc(self):
+        case_identifier = self._subject.create_dummy_case()
+        body = {'ioc_type_id': 1, 'ioc_tlp_id': 2, 'ioc_value': '8.8.8.8', 'ioc_description': 'rewrw', 'ioc_tags': ''}
+        response = self._subject.create(f'/api/v2/cases/{case_identifier}/iocs', body).json()
+        ioc_identifier = response['ioc_id']
+        body = {'asset_type_id': '1', 'asset_name': 'admin_laptop_test', 'ioc_links': [ioc_identifier]}
+        response = self._subject.create(f'/api/v2/cases/{case_identifier}/assets', body).json()
+        asset_identifier = response['asset_id']
+        response = self._subject.delete(f'/api/v2/assets/{asset_identifier}')
+        self.assertEqual(204, response.status_code)