[frontend] Implement Detection Remediation Rules by AI - Button UseAriane (Issue/3668 chunk 3) #4051

RomuDeuxfois · 2025-09-22T06:54:06Z

Proposed changes

Add button UseAriane into remediation of Payload and Inject (AtomicTesting & Simulation)
Animation AI while rules generated
Chips Informations : Rules generated by AI or edited by HUMAN or AI Outdated (rules generated by AI but the payload as been updated after generation of rules; Field concerned : type, hostname, Command executor, Attack command, description, platform, attack patterns, architecture, arguments)

Testing Instructions

Follow Instruction chunk 1
Workflow concern:
2.1 Payload Creation
2.2 Payload Update
2.3 Rules generation by Inject : Atomic Testing
2.4 Rules generation by Inject : Simulation
Payload Type:

File Drop : Not implemented
Executable: Not implemented
Command: implemented
Dns resolution: implemented

Collector Type:

Crowdstrike
The table collector is populated by an external system: https://github.com/OpenAEV-Platform/collectors , depending on the collectors (EDR and SIEM) installed on your system. Note that the name of your CrowdStrike collector MUST BE "openbas_crowdstrike". An update of the collectors project is in progress to prevent modification of this name. On 30/09/2025, the names starting with "openbas_" will be updated to "openaev_".

RBAC:

Edition Payload

Workflow Payload 2.1 (Creation) and 2.2 (Update):

Create or Update a Payload (1 by available type) see join file yaml for payload exemple.
Form incomplet should disable the Button UseAriane (Tab Remediation)
Button UseAriane should be disable for other collector's type than Crowdstrike (30/09/2025)
Content into Editor Crowdstrike should disable the button UseArian (30/09/2025)
EE licence not activated should disable the button Use Ariane
Click on Button UseAriane :
- case 1: EE licence not activated : display dialog 'Activation EE required'
- case 2: EE licence activated & Setting>Parameters>Remove Filigran logos disable : call process and loading Filigran display
- case 3: EE licence activated & Setting>Parameters>Remove Filigran logos enable : call process and loading circle display
- After case 2 or 3 (AI process duration : max 3min):
  - case 1: ERROR: Type Payload not implemented (END)
  - case 2:
    - Animation typing start
    - Chips Rules edited by AI display.
    - Edit rules : should change the chips by "Rules written by Human" (green)
    - Edit form (see fields concern) : should change the chips by "Payload changed since rule was edited" (orange)
    - Remove change form and rules : should change the chips by "Rules generated by AI" (purple)
    - Click on Update: Save the Payload and Detection Remediation (END)

Workflow 2.3 (Inject Atomic Testing):

Create a Payload Command or DnsResolution
Create an Atomic Testing inject preview payload
Tab "Remediations"
Button UseAriane available if:
- Content empty
- Collector available (at 30/09/2025 : only Crowdstrike)
Click on "UseAriane" :
case 1: EE licence not activated : display dialog 'Activation EE required'
case 2: EE licence activated & Setting > Parameters > Remove Filigran logos disable : call process and loading Filigran display
case 3: EE licence activated & Setting > Parameters > Remove Filigran logos enable : call process and loading circle display
After case 2 or 3:
Animation typing start
Chips display "Rules generated by AI" (purple) (END)

Workflow 2.4 (Simulation):

Create a Payload Command or DnsResolution
Create a Simulation
Tab Inject > Add an inject with your previous payload
Launch the simulation
Tab Overview > Part: "Injects results" > click on your inject
Tab > Remediation
Button UseAriane available if:
- Content empty
- Collector available (at 30/09/2025 : only Crowdstrike)
- Click on "UseAriane" :
- case 1: EE licence not activated : display dialog 'Activation EE required'
- case 2: EE licence activated & Setting > Parameters > Remove Filigran logos disable : call process and loading Filigran display
- case 3: EE licence activated & Setting > Parameters > Remove Filigran logos enable : call process and loading circle display
- After case 2 or 3:
- Animation typing start
- Chips display "Rules generated by AI" (purple) (END)

Error Workflow 2.3 (Inject Atomic Testing) and 2.4 (Simulation):

Use payload not Command or DnsResolution
Button UseAriane available if:
- Content empty
- Collector available (at 30/09/2025 : only Crowdstrike)
Click on UseAriane
return an error "AI Webservice for FileDrop or Executable File not implemented"

Environment or config notes

Local : install Docker webservice: webservice.remediation.detection : https://github.com/FiligranHQ/remediation_detection_webservice

Related issues

Closes #ISSUE-NUMBER Detection Remediation by AI #3668

Checklist

I consider the submitted work as finished
I tested the code for its functionality
I wrote test cases for the relevant uses case
I added/update the relevant documentation (either on github or on notion)
Where necessary I refactored code to improve the overall quality
For bug fix -> I implemented a test that covers the bug

Further comments

If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc...
download-macro-phishing.txt
activate-guest-account.txt
enable-guest-rdp-admin.txt

…service

- Add comment properties file; - Add DTO Swagger description - Add API Swagger description - Use new project structure (Service: webservice (Response/Request) / API : restController (dto.Input/Output) - New method into EE to get encoded certificate EE - Add new generic class OkHttpClientUtils

- Add findAllByIdIn() to get Attack pattern list by ids - Update Model: DetectionRemediation; Add field authorRule and Enum AUTHOR_RULE(Human, AI) + TYPE enum in DB and Update DB with new column and default value 'HUMAN'; - Rename DetectionRemediationService to DetectionRemediationAIService and create another one DetectionRemediationService: separate roles DetectionRemediationAIService (call webservice) DetectionRemediationService (CRUD OpenAEV Model) - Add new API /rules/crowdstrike

- ADD @LogExecutionTime

…service

- update migration V4_24 to V4_26 due to update from release

… var; use @value;

…r, remove Gson;

…ay script V4_26

…ules; add payload_collector_type_selected into input and generify api;

… AI_OUTOFDATE)

…668_chunk_2

# Conflicts: # openbas-api/src/main/java/io/openbas/api/detection_remediation/DetectionRemediationApi.java # openbas-api/src/main/java/io/openbas/collectors/utils/CollectorsUtils.java # openbas-api/src/main/java/io/openbas/service/detection_remediation/DetectionRemediationRequest.java # openbas-api/src/main/java/io/openbas/service/detection_remediation/DetectionRemediationService.java # openbas-front/src/utils/api-types.d.ts

… API : api/detection-remediations/ai/rules/inject/{injectId}/collector/{collectorType}; add static Collector name into CollectorsUtils; add method collectorByType into CollectorService to create DetectionRemediation linked to the colletor (collectors are created from external call OpenAEV/collector python); Generify creation of DetectionRemediationRequest using 2 differents constructor and a unique setPayload(...) ; # Conflicts: # openbas-api/src/main/java/io/openbas/api/detection_remediation/DetectionRemediationApi.java # openbas-api/src/main/java/io/openbas/collectors/utils/CollectorsUtils.java # openbas-api/src/main/java/io/openbas/service/detection_remediation/DetectionRemediationRequest.java # openbas-api/src/main/java/io/openbas/service/detection_remediation/DetectionRemediationService.java

…r updated remediation; update PayloadMapper method toDetectionRemediationOutput();

- Fix loading and AI rules status updates based on changes - Fix ESLint warnings and errors - Add payload type validation for Ariane usage - Implement snapshot context to persist remediation state

# Conflicts: # openbas-api/src/main/java/io/openbas/rest/collector/service/CollectorService.java # openbas-front/package.json # openbas-front/src/admin/components/payloads/PayloadForm.tsx # openbas-front/src/admin/components/payloads/form/RemediationFormTab.tsx # openbas-front/yarn.lock

…668_chunk_3

codecov · 2025-10-01T15:57:04Z

Codecov Report

❌ Patch coverage is 2.59259% with 263 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.15%. Comparing base (17a984e) to head (d1ca67f).
⚠️ Report is 2 commits behind head on release/current.

Files with missing lines	Patch %	Lines
...ation/DetectionRemediationCrowdstrikeResponse.java	0.00%	78 Missing ⚠️
...ction_remediation/DetectionRemediationRequest.java	0.00%	76 Missing ⚠️
...ction_remediation/DetectionRemediationService.java	3.03%	32 Missing ⚠️
...detection_remediation/DetectionRemediationApi.java	0.00%	30 Missing ⚠️
...ion_remediation/DetectionRemediationAIService.java	3.44%	28 Missing ⚠️
...in/java/io/openbas/utils/mapper/PayloadMapper.java	11.11%	8 Missing ⚠️
openbas-api/src/main/java/io/openbas/ee/Ee.java	0.00%	4 Missing ⚠️
...enbas/rest/collector/service/CollectorService.java	0.00%	3 Missing ⚠️
...as/api/detection_remediation/dto/PayloadInput.java	0.00%	1 Missing ⚠️
...a/io/openbas/collectors/utils/CollectorsUtils.java	0.00%	1 Missing ⚠️
... and 2 more

Additional details and impacted files

@@                  Coverage Diff                  @@
##             release/current    #4051      +/-   ##
=====================================================
- Coverage              47.62%   47.15%   -0.47%     
- Complexity              3266     3272       +6     
=====================================================
  Files                    842      851       +9     
  Lines                  25034    25302     +268     
  Branches                1814     1846      +32     
=====================================================
+ Hits                   11923    11932       +9     
- Misses                 12409    12667     +258     
- Partials                 702      703       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

EvaE-Filigran added 25 commits September 5, 2025 18:45

[backend] integration webservice remediation-detection-webservice

5cac619

Merge branch 'refs/heads/release/current' into issue/3668_chunk_1_web…

2fac0d1

…service

[backend] fix spotless

28817a6

[backend] rename field

ec54754

[backend]

9b095f8

- ADD @LogExecutionTime

Merge branch 'refs/heads/release/current' into issue/3668_chunk_1_web…

5f3e181

…service

Merge branch 'issue/3668_chunk_1_webservice' into issue/3668_chunk_2

10425ff

[backend]

3e70e48

- update migration V4_24 to V4_26 due to update from release

[backend ] chage rbac

56f0caf

[backend ] add doc getEncodedCertificate

189d74c

[backend ] remove doc swagger for external call

69448b2

[backend]

7cf59bf

[backend ] improve exception description

bcd3ee5

[backend ] put resources in plural

3dbcab4

[backend ] remove okHttpClient and use HttpClient instead; change env…

3090b0f

… var; use @value;

[backend ] change Response webservice in camelCase; use Jackson Mappe…

e575918

…r, remove Gson;

[backend ] change field authorRule to aiRuleCreationDate; update flyw…

3fa5ec6

…ay script V4_26

[backend ] change api api/detection-remediations/ai; do not persist r…

48bfb2b

…ules; add payload_collector_type_selected into input and generify api;

[backend] add authorRules into DetectionRemediation Enum ( HUMAN, AI,…

f7c885a

… AI_OUTOFDATE)

[backend] add authorRules into DetectionRemediation Enum ( HUMAN, AI,…

523bb93

… AI_OUTOFDATE)

Merge remote-tracking branch 'origin/issue/3668_chunk_2' into issue/3…

3e49f2d

…668_chunk_2

[backend] fix spotless, clean

391d163

[backend] fix 'must not be null' value enum authorRule; drone

dcd771f

RomuDeuxfois force-pushed the issue/3668_chunk_3 branch from 2520419 to a9a72a2 Compare September 22, 2025 12:39

[backend/frontend] Front-end

84dc059

RomuDeuxfois force-pushed the issue/3668_chunk_3 branch from a9a72a2 to 84dc059 Compare September 22, 2025 12:44

[backend/frontend] Improvement

051889d

EvaE-Filigran changed the title ~~Issue/3668 chunk 3~~ [frontend] Implement Detection Remediation Rules by AI - Button UseAriane (Issue/3668 chunk 3) Sep 22, 2025

EvaE-Filigran added 4 commits September 23, 2025 09:24

[backend] change API return for remediation by Inject ID return new o…

c7d6363

…r updated remediation; update PayloadMapper method toDetectionRemediationOutput();

fix: improve AI rules status and loading state management

ba0b916

- Fix loading and AI rules status updates based on changes - Fix ESLint warnings and errors - Add payload type validation for Ariane usage - Implement snapshot context to persist remediation state

EvaE-Filigran self-assigned this Sep 30, 2025

EvaE-Filigran added 2 commits October 1, 2025 09:33

[frontend/backend] fix merge current into PR

643bf74

EvaE-Filigran changed the base branch from issue/3668_chunk_2 to release/current October 1, 2025 07:51

EvaE-Filigran self-requested a review October 1, 2025 07:51

EvaE-Filigran approved these changes Oct 1, 2025

View reviewed changes

EvaE-Filigran added 11 commits October 1, 2025 09:52

Merge branch 'release/current' into issue/3668_chunk_3

7974ec7

Merge branch 'release/current' into issue/3668_chunk_3

28ec711

[frontend/backend] fix spotless and check ts

3151c69

[frontend/backend] fix update call

d6514fe

[frontend/backend] fix drone , trad + spotless

e2a7bc2

Merge branch 'release/current' into issue/3668_chunk_3

2c9837b

[frontend/backend] fix drone

487cee2

Merge remote-tracking branch 'origin/issue/3668_chunk_3' into issue/3…

61a4112

…668_chunk_3

[frontend/backend] fix drone 2

00e5026

[frontend] fix AI_outdated

d346b52

[backend] fix drone

d1ca67f

EvaE-Filigran merged commit 491cdfb into release/current Oct 1, 2025
10 checks passed

EvaE-Filigran deleted the issue/3668_chunk_3 branch October 1, 2025 16:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[frontend] Implement Detection Remediation Rules by AI - Button UseAriane (Issue/3668 chunk 3) #4051

[frontend] Implement Detection Remediation Rules by AI - Button UseAriane (Issue/3668 chunk 3) #4051

Uh oh!

RomuDeuxfois commented Sep 22, 2025 •

edited by EvaE-Filigran

Loading

Uh oh!

codecov bot commented Oct 1, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

[frontend] Implement Detection Remediation Rules by AI - Button UseAriane (Issue/3668 chunk 3) #4051

[frontend] Implement Detection Remediation Rules by AI - Button UseAriane (Issue/3668 chunk 3) #4051

Uh oh!

Conversation

RomuDeuxfois commented Sep 22, 2025 • edited by EvaE-Filigran Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Testing Instructions

Related issues

Checklist

Further comments

Uh oh!

codecov bot commented Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

RomuDeuxfois commented Sep 22, 2025 •

edited by EvaE-Filigran

Loading

codecov bot commented Oct 1, 2025 •

edited

Loading