create disposition for unknown file on first interaction.

3 files changed, 8 insertions, 17 deletions

diff --git a/app/jobs/fingerprint_lookup_job.rb b/app/jobs/fingerprint_lookup_job.rb
index 3085564..25a17f6 100644
--- a/app/jobs/fingerprint_lookup_job.rb
+++ b/app/jobs/fingerprint_lookup_job.rb
@@ -9,11 +9,8 @@ class FingerprintLookupJob < ActiveJob::Base
       apiKey: ENV.fetch("VIRUS_TOTAL_API_KEY"),
     })
     report = JSON.parse(response.response_body)
-    puts "+++"
-    puts response.response_body.inspect
-    puts "---"
     puts report.inspect
-    puts "+++"
-    Disposition.create_for(fingerprint, report)
+    disposition = Disposition.find_by(fingerprint: fingerprint)
+    disposition.file_reports.create!(data: report)
   end
 end
diff --git a/app/models/disposition.rb b/app/models/disposition.rb
index 87ce27e..979eefd 100644
--- a/app/models/disposition.rb
+++ b/app/models/disposition.rb
@@ -9,11 +9,4 @@ class Disposition < ActiveRecord::Base
   def to_param
     fingerprint
   end
-
-  def self.create_for(fingerprint, report)
-    disposition = Disposition.find_by(fingerprint: fingerprint)
-    disposition = Disposition.new(fingerprint: fingerprint) if disposition.nil?
-    disposition.state = :unknown
-    disposition.file_reports.create!(data: report)
-  end
 end
diff --git a/app/workers/cloud_queries.rb b/app/workers/cloud_queries.rb
index 4e87649..e944142 100644
--- a/app/workers/cloud_queries.rb
+++ b/app/workers/cloud_queries.rb
@@ -8,7 +8,7 @@ class CloudQueries
     logger.info "Query for: #{json.inspect}"
     attributes = JSON.parse(json)
 
-    fingerprint = attributes["fingerprint"]
+    fingerprint = attributes["data"]["fingerprint"]
     disposition = Disposition.find_by(fingerprint: fingerprint)
 
     publish(JSON.generate({
@@ -19,11 +19,12 @@ class CloudQueries
 
     if disposition.nil?
       #publish(JSON.generate({
-        #command: :request_analysis,
-        #agent_id: attributes["agent_id"],
-        #fingerprint: fingerprint,
+      #command: :request_analysis,
+      #agent_id: attributes["agent_id"],
+      #fingerprint: fingerprint,
       #}), routing_key: "malwer.commands")
-      FingerprintLookup.perform_later(fingerprint)
+      Disposition.create!(fingerprint: fingerprint, state: :unknown)
+      FingerprintLookupJob.perform_later(fingerprint)
     end
 
     ack!