clue-api 1.4.0.dev125__tar.gz → 1.4.0.dev136__tar.gz

{clue_api-1.4.0.dev125 → clue_api-1.4.0.dev136}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: clue-api
-Version: 1.4.0.dev125
+Version: 1.4.0.dev136
 Summary: Clue distributed enrichment service
 License: MIT
 License-File: LICENSE

{clue_api-1.4.0.dev125 → clue_api-1.4.0.dev136}/clue/common/regex.py

@@ -40,3 +40,8 @@ URI_ONLY = f"^{URI_REGEX}$"
 UUID4_REGEX = r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
 
 EMAIL_PATH_REGEX = r"^[A-Z]+_EMAIL://.*"
+MAC_ADDRESS_REGEX = r"^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$"
+COMMUNITY_ID_REGEX = r"^1:[A-Za-z0-9+/]{27}=$"
+JA3_REGEX = r"^[0-9a-fA-F]{32}$"
+JA4_REGEX = r"^[a-zA-Z0-9]+(?:_[a-zA-Z0-9-]+)+$"
+ZEEK_ID_REGEX = r"^[A-Za-z0-9]{15,22}$"

{clue_api-1.4.0.dev125 → clue_api-1.4.0.dev136}/clue/constants/supported_types.py

@@ -1,16 +1,21 @@
 from clue.common.logging import get_logger
 from clue.common.regex import (
+    COMMUNITY_ID_REGEX,
     DOMAIN_ONLY_REGEX,
     EMAIL_PATH_REGEX,
     EMAIL_REGEX,
     IPV4_ONLY_REGEX,
     IPV6_ONLY_REGEX,
+    JA3_REGEX,
+    JA4_REGEX,
+    MAC_ADDRESS_REGEX,
     MD5_REGEX,
     PORT_REGEX,
     SHA1_REGEX,
     SHA256_REGEX,
     URI_ONLY,
     UUID4_REGEX,
+    ZEEK_ID_REGEX,
 )
 
 logger = get_logger(__file__)
@@ -33,10 +38,17 @@ SUPPORTED_TYPES = {
     "sha256": SHA256_REGEX,
     "telemetry": None,
     "hostname": None,
-    "tenant-id": UUID4_REGEX,
+    "tenant_id": UUID4_REGEX,
+    "mac_address": MAC_ADDRESS_REGEX,
+    "command_line": None,
+    "community_id": COMMUNITY_ID_REGEX,
+    "ja3": JA3_REGEX,
+    "ja4": JA4_REGEX,
+    "zeek_id": ZEEK_ID_REGEX,
 }
 
-CASE_INSENSITIVE_TYPES = ["ip", "domain", "port", "tenant-id"]
+
+CASE_INSENSITIVE_TYPES = ["ip", "domain", "port", "tenant_id", "mac_address"]
 
 
 def add_supported_type(

{clue_api-1.4.0.dev125 → clue_api-1.4.0.dev136}/pyproject.toml

@@ -108,10 +108,7 @@ ignore = [
   "TRY003",
   "TRY300",
 ]
-exclude = [
-  "plugins/assemblyline_lookup/app.py",
-  "plugins/**/test*.py",
-]
+exclude = ["plugins/assemblyline_lookup/app.py", "plugins/**/test*.py"]
 
 [tool.ruff.lint.flake8-annotations]
 ignore-fully-untyped = true
@@ -142,7 +139,7 @@ log_cli_level = "WARN"
 [tool.poetry]
 package-mode = true
 name = "clue-api"
-version = "1.4.0.dev125"
+version = "1.4.0.dev136"
 description = "Clue distributed enrichment service"
 authors = ["Canadian Centre for Cyber Security <contact@cyber.gc.ca>"]
 license = "MIT"