Snorby/snorby — Issue #152: Searching for Unclassified Events Doesn't Return Results
Author: infosec
Created: 2011-10-25 00:22:31+00:00
State: open

When searching for an "Unclassified" event the search doesn't return any results. In /app/models/event.rb lines 494-496 have the following code.

unless params[:classification_id].blank?
@search.merge!({:classification_id => params[:classification_id].to_i})
end

If you provide the search string without a value it wont search by classification. I don't know ruby so my workaround probably isn't the cleanest fix. I set the Unclassified value in the search page to 100000 and changed the code above to what I have below.

unless params[:classification_id].blank?
if params[:classification_id].to_i == 100000
@search.merge!({:classification_id => nil})
else
@search.merge!({:classification_id => params[:classification_id].to_i})
end
end