crits/crits — pull request #333 by puhley (2014-12-03 09:10:11+00:00)
Title: API delete support for domains and IPs

This is a rough draft of code that will enable delete support for the IP and domain APIs. Since an IP or domain can be associated with multiple sources and campaigns, this approach allows you to delete an individual reference or to delete the entire record. If you provide a campaign and source along with the record ID, then this will just delete the references to that campaign and source. If you only provide the record ID, then it will delete the entire record.

The code for delete support in the domain API is a little complicated. The django-tastypie-mongoengine won't accept a DELETE request with parameters passed in the body of the request. Therefore, the DELETE request must pass the parameters in the URL. However, in order to pass the request to the generate_domain_jtable, the request must be converted into a POST format. Since I didn't know the jtable code well enough to reformat it, I got around the issue by creating a fake POST object and passing that instead. This isn't the most elegant solution but it allowed me to contain the changes to the API code.

Being able to delete an IP or API reference would be useful for people who want to use CRITs to track only the current list of threats. For instance, IPs are sometimes removed from IOC lists because the compromised host has been fixed. These changes would allow you to remove the IP from the current list of threats via the API. This code still requires the user to have admin privileges in order to perform the deletion.

Please take a look at the code and let me know your thoughts.