cyberhaven-incidents 0.4.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 117a00860ffb6bcb9995a8cd5873f19fc79e59a4ce145c1dccf388f37d4148ab
-  data.tar.gz: 0ba9dcedfa1bd2b20eeb23c46ff1c6951ebd06b0c9796ee54ccc531bfe405ded
+  metadata.gz: 7985905cb033dfe71fcb962f4be2ea680ca583df1e315fbc636a9beb2b38ec9d
+  data.tar.gz: 7d5d1d6b9fe260476a73a6e8ccf3e9cbee1cd5bd5002be83ea8178b5e2b17165
 SHA512:
-  metadata.gz: 14708bcbd39f466f0d5de88bb13a29163abec446df9b69de2b585a9d60d07b62e8596db33966ac8919c0eb3b9354aa54d09fb65d7b45ec5ee9558984c016cad0
-  data.tar.gz: 684d1cef9121a450e57fdfc9e9f3bdb09101145d0a79cb768be38e4ac30ec6fd5f3ad4d77f8db6b3112550de90517617e88b494b0500c5eaffbd72d944d004ad
+  metadata.gz: ccc5c00bd83dea570da1ba935074e87942b0b253e16ca716d447de05936d7d20b9559bb61bb9abde4fee7389df7d6f1f2e79240f72024fcc90e634382327d581
+  data.tar.gz: 672d631b289b7ac1df005c2c988bebcd429bdb77aec2cdfe6d918c56241cf5b0e9f47f3a11347a660c7efb1867ef51c3b14f07b428c348684f63f287920c2d6b

data/CHANGELOG.md

@@ -1,6 +1,9 @@
 
+## 0.5.0
+Add: Add incidents by policy name
+
 ## 0.4.1
-Add: add user civ
+Add: add user csv export
 Fixed: pagination on user events
 
 ## 0.4.0

data/README.md

@@ -38,24 +38,22 @@ Cyberhaven::Incidents::totalIgnoredIncidents
 Cyberhaven::Incidents::totalInProgressIncidents
 Cyberhaven::Incidents::totalResolvedIncidents
 
-## Detailed Incident details by ID
+## Detailed Incident by ID
 Cyberhaven::Incidents::Id::DetailedJson("incidentID")
 Cyberhaven::Incidents::Id::DetailedYaml("incidentID")
 Cyberhaven::Incidents::Id::DetailedReport("incidentID")
 
-## Summaried Incidents details by ID
+## Summarized Incident details by ID
 Cyberhaven::Incidents::Id::SummaryJson("incidentID")
 Cyberhaven::Incidents::Id::SummaryYaml("incidentID")
 Cyberhaven::Incidents::Id::SummaryReport("incidentID")
 
 ## Incident details by user
-puts Cyberhaven::Incidents::User::DetailedRaw("username", "status", numberOfEvents)
-puts Cyberhaven::Incidents::User::DetailedJson("username", "status", numberOfEvents)
-
-#example
-puts Cyberhaven::Incidents::User::DetailedJson("joedaily", "unresolved", 100)
-
-• status options are: "ignored", "in_progress", "resolved", or "unresolved"
+puts Cyberhaven::Incidents::User::TotalIncidents("username")
+puts Cyberhaven::Incidents::User::AllIncidents("username")
+Cyberhaven::Incidents::User::AllIncidentsCSV("username")
+puts Cyberhaven::Incidents::User::AllIncidentsJson("username")
+puts Cyberhaven::Incidents::User::AllIncidentsYaml("username")
 ```
 
 ---

data/cyberhaven-incidents.gemspec

@@ -3,6 +3,7 @@
 require_relative "lib/cyberhaven/incidents/version"
 require_relative "lib/cyberhaven/incidents/id"
 require_relative "lib/cyberhaven/incidents/user"
+require_relative "lib/cyberhaven/incidents/policy"
 
 Gem::Specification.new do |spec|
   spec.name = "cyberhaven-incidents"

data/lib/cyberhaven/incidents/policy.rb

@@ -0,0 +1,254 @@
+# frozen_string_literal: true
+
+
+require 'etc'
+require 'csv'
+
+
+module Cyberhaven
+  module Incidents
+    module Policy
+        def self.TotalPolicyIncidents(policyName)
+            
+            $pageToken = "1"
+            loop do
+                unless $pageToken.empty?
+        
+                    if $pageToken == "1"
+                        $pageToken = ""
+                    end
+
+                    $query ={
+                        "filters":{
+                            "category_names": [
+                                "#{policyName}"
+                            ],
+                        },
+                        "sort_by": "event_time",
+                        "page_id": "#{$pageToken}",
+                        "sort_desc": true
+                    }.to_json
+            
+                    url = URI("https://#{$deployment}/api/rest/v1/incidents/list")
+                    https = Net::HTTP.new(url.host, url.port)
+                    https.use_ssl = true
+                    request = Net::HTTP::Get.new(url)
+                    request["Content-Type"] = "application/json"
+                    request["Authorization"] = "Bearer #{$bearerToken}"
+                    request.body = $query
+                    response = https.request(request)
+                    status = response.code
+                    results = JSON.parse(response.read_body)
+
+                    puts results["total"]
+                else
+                    break
+                end
+            end
+        end
+        
+        def self.AllIncidentsResults(policyName)
+
+            $incidentArray = []
+            
+            $pageToken = "1"
+            loop do
+                unless $pageToken.empty?
+        
+                    if $pageToken == "1"
+                        $pageToken = ""
+                    end
+
+                    $query ={
+                        "filters":{
+                            "resolution_statuses":[
+                                "unresolved", "ignored", "in_progress", "resolved"
+                            ],
+                            "category_names": [
+                                "#{policyName}"
+                            ],
+                        },
+                        "sort_by": "event_time",
+                        "page_id": "#{$pageToken}",
+                        "page_size": 1000,
+                        "sort_desc": true
+                    }.to_json
+            
+                    url = URI("https://#{$deployment}/api/rest/v1/incidents/list")
+                    https = Net::HTTP.new(url.host, url.port)
+                    https.use_ssl = true
+                    request = Net::HTTP::Get.new(url)
+                    request["Content-Type"] = "application/json"
+                    request["Authorization"] = "Bearer #{$bearerToken}"
+                    request.body = $query
+                    response = https.request(request)
+                    status = response.code
+                    results = JSON.parse(response.read_body)
+
+                    $pageToken = results["next_page_id"]
+                    results["incidents"].each do |item|
+                        $incidentArray.push(item)
+                    end
+                else
+                    break
+                end
+            end
+        end
+
+        def self.AllIncidents(policyName)
+            AllIncidentsResults("#{policyName}")
+            return $incidentArray
+        end
+
+        def self.AllIncidentsCSV(policyName)
+            now_date = DateTime.now
+            datetime = now_date.strftime('%Y%m%d')
+            $currentUser = ENV['USER']
+            $reportPath="/Users/#{$currentUser}/Desktop/#{datetime}_#{policyName}_report.csv"
+    
+            $pageToken = "1"
+            $incidentArray = []
+          
+            loop do
+                unless $pageToken.empty?
+        
+                    if $pageToken == "1"
+                        $pageToken = ""
+                    end
+        
+                    $query ={
+                        "filters":{
+                            "resolution_statuses":[
+                                "unresolved", "ignored", "in_progress", "resolved"
+                            ],
+                            "category_names": [
+                                "#{policyName}"
+                            ],
+                        },
+                        "page_id": "#{$pageToken}",
+                        "sort_by": "event_time",
+                        "page_size": 1000,
+                        "sort_desc": true
+                    }.to_json
+        
+                    url = URI("https://dailypay.cyberhaven.io/api/rest/v1/incidents/list")
+                    https = Net::HTTP.new(url.host, url.port)
+                    https.use_ssl = true
+                    request = Net::HTTP::Get.new(url)
+                    request["Content-Type"] = "application/json"
+                    request["Authorization"] = "Bearer #{$bearerToken}"
+                    request.body = $query
+                    response = https.request(request)
+                    status = response.code
+                    results = JSON.parse(response.read_body)
+                    
+                    $pageToken = results["next_page_id"]
+                    # puts results["total"]
+                    # puts results["next_page_id"]
+        
+                    array = []
+                    results["incidents"].each do |item|
+                    $incident_hash = {
+                        "Event Time" => "#{item["event_time"]}",
+                        "Trigger Time" => "#{item["trigger_time"]}",
+                        "ID" => "#{item["id"]}",
+                        "Incident Risk Score" => "#{item["risk_score"]}",
+                        "Policy Name" => "#{item["category"]["name"]}",
+                        "Policy Severity" => "#{item["category"]["severity"]}",
+                        "User" => "#{item["user"]}",
+                        "Assignee" => "#{item["assignee"]}",
+                        "Status" => "#{item["resolution_status"]}",
+                        "Severity" => "#{item["severity"]}",
+                        "Dataset Name" => "#{item["dataset"]["name"]}",
+                        "Category Severity" => "#{item["category"]["severity"]}",
+                        "File" => "#{item["file"]}",
+                        "Data Path" => "#{item["data"]["path"]}",
+                        "Source Path" => "#{item["source_data"]["path"]}",
+                        "Content Tags" => "#{item["content_tags"]}",
+                        "Source Path " => "#{item["edge"]["source"]["path"]}",
+                        "Source Extension" => "#{item["edge"]["source"]["extension"]}",
+                        "Source Url" => "#{item["edge"]["source"]["url"]}",
+                        "Source Browser Url" => "#{item["edge"]["source"]["browser_page_url"]}",
+                        "Source Domain" => "#{item["edge"]["source"]["browser_page_domain"]}",
+                        "Source Browser Title" => "#{item["edge"]["source"]["browser_page_title"]}",
+                        "Source Hostname" => "#{item["edge"]["source"]["hostname"]}",
+                        "Source URI" => "#{item["edge"]["source"]["content_uri"]}",
+                        "Source Location" => "#{item["edge"]["source"]["location"]}",
+                        "Source Location Outline" => "#{item["edge"]["source"]["location_outline"]}",
+                        "Source Category" => "#{item["edge"]["source"]["category"]}",
+                        "Source Links" => "#{item["edge"]["source"]["links"]}",
+                        "Source ID" => "#{item["edge"]["source"]["links"]}",
+                        "Tags Applied" => "#{item["edge"]["source"]["tags_applied"]}",
+                        "Source Upload URI" => "#{item["edge"]["source"]["content_upload_uri"]}",
+                        "Source Report URI" => "#{item["edge"]["source"]["content_report_uri"]}",
+                        "Source Event Type" => "#{item["edge"]["source"]["event_type"]}",
+                        "Source Sensor Name" => "#{item["edge"]["source"]["sensor_name"]}",
+                        "Source Local User" => "#{item["edge"]["source"]["local_user_name"]}",
+                        "Source Local User ID" => "#{item["edge"]["source"]["local_user_sid"]}",
+                        "Source Local Time" => "#{item["edge"]["source"]["local_time"]}",
+                        "Source Local Machine" => "#{item["edge"]["source"]["local_machine_name"]}",
+                        "Source Endpoint ID" => "#{item["edge"]["source"]["endpoint_id"]}",
+                        "Source Local ID" => "#{item["edge"]["source"]["local_id"]}",
+                        "Destination Path" => "#{item["edge"]["destination"]["path"]}",
+                        "Destination Extension" => "#{item["edge"]["destination"]["extension"]}",
+                        "Destination Upload File ID" => "#{item["edge"]["destination"]["upload_file_id"]}",
+                        "Destination Browser Page Title" => "#{item["edge"]["destination"]["browser_page_title"]}",
+                        "Destination Hostname" => "#{item["edge"]["destination"]["hostname"]}",
+                        "Destination MD5" => "#{item["edge"]["destination"]["md5_hash"]}",
+                        "Destination File Size" => "#{item["edge"]["destination"]["file_size"]}",
+                        "Destination Path Components" => "#{item["edge"]["destination"]["path_components"]}",
+                        "Destination Path Basename" => "#{item["edge"]["destination"]["path_basename"]}",
+                        "Destination Domain" => "#{item["edge"]["destination"]["domain"]}",
+                        "Destination URI" => "#{item["edge"]["destination"]["content_uri"]}",
+                        "Destination Location" => "#{item["edge"]["destination"]["location"]}",
+                        "Destination Location Outline" => "#{item["edge"]["destination"]["location_outline"]}",
+                        "Destination Category" => "#{item["edge"]["destination"]["category"]}",
+                        "Destination Links" => "#{item["edge"]["destination"]["links"]}",
+                        "Destination Event Type" => "#{item["edge"]["destination"]["event_type"]}",
+                        "Destination Sensor Name" => "#{item["edge"]["destination"]["sensor_name"]}",
+                        "Destination Local User" => "#{item["edge"]["destination"]["local_user_name"]}",
+                        "Destination Local User ID" => "#{item["edge"]["destination"]["local_user_sid"]}",
+                        "Destination Local Time" => "#{item["edge"]["destination"]["local_time"]}",
+                        "Destination Local Machine" => "#{item["edge"]["destination"]["local_machine_name"]}",
+                        "Destination Endpoint ID" => "#{item["edge"]["destination"]["endpoint_id"]}",
+                        "Destination Local ID" => "#{item["edge"]["destination"]["local_id"]}",
+                        "Destination Blocked" => "#{item["edge"]["destination"]["blocked"]}",
+                        "Destination Data Size" => "#{item["edge"]["destination"]["data_size"]}",
+                        "Destination Google Drive ID" => "#{item["edge"]["destination"]["gdrive_file_id"]}",
+                        "Destination Cloud Provider" => "#{item["edge"]["destination"]["cloud_provider"]}",
+                        "Destination Cloud App" => "#{item["edge"]["destination"]["cloud_app"]}",
+                        "Destination Cloud Account" => "#{item["edge"]["destination"]["cloud_app_account"]}",
+                        "Destination Scan ID" => "#{item["edge"]["destination"]["dlp_scan_linking_id"]}"
+                    }
+                    $incidentArray.push($incident_hash)
+                    end
+                else
+                    break
+                end
+            end
+        
+            CSV.open("#{$reportPath}", 'w') do |csv|
+                # Write the header based on the keys of the first hash
+                csv << $incidentArray.first.keys
+              
+                # Write each hash as a row in the CSV file
+                $incidentArray.each do |hash|
+                  csv << hash.values
+                end
+            end
+            puts "Finished writting report: #{$reportPath}"
+        end
+    
+        def self.AllIncidentsJson(policyName)
+            AllIncidentsResults("#{policyName}")
+            return $incidentArray.to_json
+        end
+
+         def self.AllIncidentsYaml(policyName)
+            AllIncidentsResults("#{policyName}")
+            return $incidentArray.to_yaml
+        end
+
+    end
+  end
+end

data/lib/cyberhaven/incidents/user.rb

@@ -3,7 +3,7 @@
 
 require 'etc'
 require 'csv'
-require "set"
+# require "set"
 
 
 module Cyberhaven
@@ -156,6 +156,7 @@ module Cyberhaven
                         "Event Time" => "#{item["event_time"]}",
                         "Trigger Time" => "#{item["trigger_time"]}",
                         "ID" => "#{item["id"]}",
+                        "Incident Risk Score" => "#{item["risk_score"]}",
                         "Policy Name" => "#{item["category"]["name"]}",
                         "Policy Severity" => "#{item["category"]["severity"]}",
                         "User" => "#{item["user"]}",

data/lib/cyberhaven/incidents/version.rb

@@ -2,6 +2,6 @@
 
 module Cyberhaven
   module Incidents
-    VERSION = "0.4.1"
+    VERSION = "0.5.0"
   end
 end

data/lib/cyberhaven/incidents.rb

@@ -9,6 +9,7 @@ require 'base64'
 require_relative "incidents/version"
 require_relative "incidents/id"
 require_relative "incidents/user"
+require_relative "incidents/policy"
 
 module Cyberhaven
   module Incidents

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cyberhaven-incidents
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.5.0
 platform: ruby
 authors:
 - nic scott
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-01-07 00:00:00.000000000 Z
+date: 2024-01-20 00:00:00.000000000 Z
 dependencies: []
 description: 
 email:
@@ -24,6 +24,7 @@ files:
 - cyberhaven-incidents.gemspec
 - lib/cyberhaven/incidents.rb
 - lib/cyberhaven/incidents/id.rb
+- lib/cyberhaven/incidents/policy.rb
 - lib/cyberhaven/incidents/user.rb
 - lib/cyberhaven/incidents/version.rb
 - sig/cyberhaven/incidents.rbs