contentctl 4.4.7__py3-none-any.whl → 5.0.0__py3-none-any.whl

contentctl/output/api_json_output.py

@@ -1,246 +1,259 @@
+from __future__ import annotations
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from contentctl.objects.detection import Detection
+    from contentctl.objects.lookup import Lookup
+    from contentctl.objects.macro import Macro
+    from contentctl.objects.story import Story
+    from contentctl.objects.baseline import Baseline
+    from contentctl.objects.investigation import Investigation
+    from contentctl.objects.deployment import Deployment
+
 import os
-import json
 import pathlib
 
 from contentctl.output.json_writer import JsonWriter
-from contentctl.objects.enums import SecurityContentType
-from contentctl.objects.abstract_security_content_objects.security_content_object_abstract import (
-    SecurityContentObject_Abstract,
-)
-
 
 
 class ApiJsonOutput:
+    output_path: pathlib.Path
+    app_label: str
+
+    def __init__(self, output_path: pathlib.Path, app_label: str):
+        self.output_path = output_path
+        self.app_label = app_label
 
-    def writeObjects(
+    def writeDetections(
         self,
-        objects: list[SecurityContentObject_Abstract],
-        output_path: pathlib.Path,
-        app_label:str = "ESCU",
-        contentType: SecurityContentType = None
+        objects: list[Detection],
     ) -> None:
-        """#Serialize all objects
-        try:
-            for obj in objects:
-
-                serialized_objects.append(obj.model_dump())
-        except Exception as e:
-            raise Exception(f"Error serializing object with name '{obj.name}' and type '{type(obj).__name__}': '{str(e)}'")
-        """
-
-        if contentType == SecurityContentType.detections:
-            detections = [
-                detection.model_dump(
-                    include=set(
-                        [
-                            "name",
-                            "author",
-                            "date",
-                            "version",
-                            "id",
-                            "description",
-                            "tags",
-                            "search",
-                            "how_to_implement",
-                            "known_false_positives",
-                            "references",
-                            "datamodel",
-                            "macros",
-                            "lookups",
-                            "source",
-                            "nes_fields",
-                        ]
-                    )
+        detections = [
+            detection.model_dump(
+                include=set(
+                    [
+                        "name",
+                        "author",
+                        "date",
+                        "version",
+                        "id",
+                        "description",
+                        "tags",
+                        "search",
+                        "how_to_implement",
+                        "known_false_positives",
+                        "references",
+                        "datamodel",
+                        "macros",
+                        "lookups",
+                        "source",
+                        "nes_fields",
+                    ]
                 )
-                for detection in objects
-            ]
-            #Only a subset of macro fields are required:
-            # for detection in detections:
-            #     new_macros = []
-            #     for macro in detection.get("macros",[]):
-            #         new_macro_fields = {}
-            #         new_macro_fields["name"] = macro.get("name")
-            #         new_macro_fields["definition"] = macro.get("definition")
-            #         new_macro_fields["description"] = macro.get("description")
-            #         if len(macro.get("arguments", [])) > 0:
-            #             new_macro_fields["arguments"] = macro.get("arguments") 
-            #         new_macros.append(new_macro_fields)
-            #     detection["macros"] = new_macros
-            #     del()
-                    
-            
-            JsonWriter.writeJsonObject(
-                os.path.join(output_path, "detections.json"), "detections", detections
             )
+            for detection in objects
+        ]
+        # Only a subset of macro fields are required:
+        # for detection in detections:
+        #     new_macros = []
+        #     for macro in detection.get("macros",[]):
+        #         new_macro_fields = {}
+        #         new_macro_fields["name"] = macro.get("name")
+        #         new_macro_fields["definition"] = macro.get("definition")
+        #         new_macro_fields["description"] = macro.get("description")
+        #         if len(macro.get("arguments", [])) > 0:
+        #             new_macro_fields["arguments"] = macro.get("arguments")
+        #         new_macros.append(new_macro_fields)
+        #     detection["macros"] = new_macros
+        #     del()
 
-        elif contentType == SecurityContentType.macros:
-            macros = [
-                macro.model_dump(include=set(["definition", "description", "name"]))
-                for macro in objects
-            ]
-            for macro in macros:
-                for k in ["author", "date","version","id","references"]:
-                    if k in macro:
-                        del(macro[k])
-            JsonWriter.writeJsonObject(
-                os.path.join(output_path, "macros.json"), "macros", macros
-            )
+        JsonWriter.writeJsonObject(
+            os.path.join(self.output_path, "detections.json"), "detections", detections
+        )
 
-        elif contentType == SecurityContentType.stories:
-            stories = [
-                story.model_dump(
-                    include=set(
-                        [
-                            "name",
-                            "author",
-                            "date",
-                            "version",
-                            "id",
-                            "description",
-                            "narrative",
-                            "references",
-                            "tags",
-                            "detections_names",
-                            "investigation_names",
-                            "baseline_names",
-                            "detections",
-                        ]
-                    )
+    def writeMacros(
+        self,
+        objects: list[Macro],
+    ) -> None:
+        macros = [
+            macro.model_dump(include=set(["definition", "description", "name"]))
+            for macro in objects
+        ]
+        for macro in macros:
+            for k in ["author", "date", "version", "id", "references"]:
+                if k in macro:
+                    del macro[k]
+        JsonWriter.writeJsonObject(
+            os.path.join(self.output_path, "macros.json"), "macros", macros
+        )
+
+    def writeStories(
+        self,
+        objects: list[Story],
+    ) -> None:
+        stories = [
+            story.model_dump(
+                include=set(
+                    [
+                        "name",
+                        "author",
+                        "date",
+                        "version",
+                        "id",
+                        "description",
+                        "narrative",
+                        "references",
+                        "tags",
+                        "detections_names",
+                        "investigation_names",
+                        "baseline_names",
+                        "detections",
+                    ]
                 )
-                for story in objects
-            ]
-            # Only get certain fields from detections
-            for story in stories:
-                # Only use a small subset of fields from the detection
-                story["detections"] = [
-                    {
-                        "name": detection["name"],
-                        "source": detection["source"],
-                        "type": detection["type"],
-                        "tags": detection["tags"].get("mitre_attack_enrichments", []),
-                    }
-                    for detection in story["detections"]
-                ]
-                story["detection_names"] = [f"{app_label} - {name} - Rule" for name in story["detection_names"]]
-                
-
-            JsonWriter.writeJsonObject(
-                os.path.join(output_path, "stories.json"), "stories", stories
             )
+            for story in objects
+        ]
+        # Only get certain fields from detections
+        for story in stories:
+            # Only use a small subset of fields from the detection
+            story["detections"] = [
+                {
+                    "name": detection["name"],
+                    "source": detection["source"],
+                    "type": detection["type"],
+                    "tags": detection["tags"].get("mitre_attack_enrichments", []),
+                }
+                for detection in story["detections"]
+            ]
+            story["detection_names"] = [
+                f"{self.app_label} - {name} - Rule" for name in story["detection_names"]
+            ]
 
-        elif contentType == SecurityContentType.baselines:
-            try:
-                baselines = [
-                    baseline.model_dump(
-                        include=set(
-                            [
-                                "name",
-                                "author",
-                                "date",
-                                "version",
-                                "id",
-                                "description",
-                                "type",
-                                "datamodel",
-                                "search",
-                                "how_to_implement",
-                                "known_false_positives",
-                                "references",
-                                "tags",
-                            ]
-                        )
-                    )
-                    for baseline in objects
-                ]
-            except Exception as e:
-                print(e)
-                print('wait')
-
-            JsonWriter.writeJsonObject(
-                    os.path.join(output_path, "baselines.json"), "baselines", baselines
+        JsonWriter.writeJsonObject(
+            os.path.join(self.output_path, "stories.json"), "stories", stories
+        )
+
+    def writeBaselines(
+        self,
+        objects: list[Baseline],
+    ) -> None:
+        baselines = [
+            baseline.model_dump(
+                include=set(
+                    [
+                        "name",
+                        "author",
+                        "date",
+                        "version",
+                        "id",
+                        "description",
+                        "type",
+                        "datamodel",
+                        "search",
+                        "how_to_implement",
+                        "known_false_positives",
+                        "references",
+                        "tags",
+                    ]
                 )
+            )
+            for baseline in objects
+        ]
 
-        elif contentType == SecurityContentType.investigations:
-            investigations = [
-                investigation.model_dump(
-                    include=set(
-                        [
-                            "name",
-                            "author",
-                            "date",
-                            "version",
-                            "id",
-                            "description",
-                            "type",
-                            "datamodel",
-                            "search",
-                            "how_to_implemnet",
-                            "known_false_positives",
-                            "references",
-                            "inputs",
-                            "tags",
-                            "lowercase_name",
-                        ]
-                    )
+        JsonWriter.writeJsonObject(
+            os.path.join(self.output_path, "baselines.json"), "baselines", baselines
+        )
+
+    def writeInvestigations(
+        self,
+        objects: list[Investigation],
+    ) -> None:
+        investigations = [
+            investigation.model_dump(
+                include=set(
+                    [
+                        "name",
+                        "author",
+                        "date",
+                        "version",
+                        "id",
+                        "description",
+                        "type",
+                        "datamodel",
+                        "search",
+                        "how_to_implemnet",
+                        "known_false_positives",
+                        "references",
+                        "inputs",
+                        "tags",
+                        "lowercase_name",
+                    ]
                 )
-                for investigation in objects
-            ]
-            JsonWriter.writeJsonObject(
-                os.path.join(output_path, "response_tasks.json"),
-                "response_tasks",
-                investigations,
             )
+            for investigation in objects
+        ]
+        JsonWriter.writeJsonObject(
+            os.path.join(self.output_path, "response_tasks.json"),
+            "response_tasks",
+            investigations,
+        )
 
-        elif contentType == SecurityContentType.lookups:
-            lookups = [
-                lookup.model_dump(
-                    include=set(
-                        [
-                            "name",
-                            "description",
-                            "collection",
-                            "fields_list",
-                            "filename",
-                            "default_match",
-                            "match_type",
-                            "min_matches",
-                            "case_sensitive_match",
-                        ]
-                    )
+    def writeLookups(
+        self,
+        objects: list[Lookup],
+    ) -> None:
+        lookups = [
+            lookup.model_dump(
+                include=set(
+                    [
+                        "name",
+                        "description",
+                        "collection",
+                        "fields_list",
+                        "filename",
+                        "default_match",
+                        "match_type",
+                        "min_matches",
+                        "case_sensitive_match",
+                    ]
                 )
-                for lookup in objects
-            ]
-            for lookup in lookups:
-                for k in ["author","date","version","id","references"]:
-                    if k in lookup:
-                        del(lookup[k]) 
-            JsonWriter.writeJsonObject(
-                os.path.join(output_path, "lookups.json"), "lookups", lookups
             )
+            for lookup in objects
+        ]
+        for lookup in lookups:
+            for k in ["author", "date", "version", "id", "references"]:
+                if k in lookup:
+                    del lookup[k]
+        JsonWriter.writeJsonObject(
+            os.path.join(self.output_path, "lookups.json"), "lookups", lookups
+        )
 
-        elif contentType == SecurityContentType.deployments:
-            deployments = [
-                deployment.model_dump(
-                    include=set(
-                        [
-                            "name",
-                            "author",
-                            "date",
-                            "version",
-                            "id",
-                            "description",
-                            "scheduling",
-                            "rba",
-                            "tags"
-                        ] 
-                    )
+    def writeDeployments(
+        self,
+        objects: list[Deployment],
+    ) -> None:
+        deployments = [
+            deployment.model_dump(
+                include=set(
+                    [
+                        "name",
+                        "author",
+                        "date",
+                        "version",
+                        "id",
+                        "description",
+                        "scheduling",
+                        "rba",
+                        "tags",
+                    ]
                 )
-                for deployment in objects
-            ]
-            #references are not to be included, but have been deleted in the
-            #model_serialization logic
-            JsonWriter.writeJsonObject(
-                os.path.join(output_path, "deployments.json"),
-                "deployments",
-                deployments,
-            )
+            )
+            for deployment in objects
+        ]
+        # references are not to be included, but have been deleted in the
+        # model_serialization logic
+        JsonWriter.writeJsonObject(
+            os.path.join(self.output_path, "deployments.json"),
+            "deployments",
+            deployments,
+        )

contentctl/output/attack_nav_output.py

@@ -1,25 +1,25 @@
-import os
-from typing import List,Union
+from typing import List, Union
 import pathlib
 
 from contentctl.objects.detection import Detection
 from contentctl.output.attack_nav_writer import AttackNavWriter
 
 
-class AttackNavOutput():
-
-    def writeObjects(self, detections: List[Detection], output_path: pathlib.Path) -> None:
-        techniques:dict[str,dict[str,Union[List[str],int]]] = {}
+class AttackNavOutput:
+    def writeObjects(
+        self, detections: List[Detection], output_path: pathlib.Path
+    ) -> None:
+        techniques: dict[str, dict[str, Union[List[str], int]]] = {}
         for detection in detections:
             for tactic in detection.tags.mitre_attack_id:
                 if tactic not in techniques:
-                    techniques[tactic] = {'score':0,'file_paths':[]}
-                
+                    techniques[tactic] = {"score": 0, "file_paths": []}
+
                 detection_url = f"https://github.com/splunk/security_content/blob/develop/detections/{detection.source}/{detection.file_path.name}"
-                techniques[tactic]['score'] += 1
-                techniques[tactic]['file_paths'].append(detection_url)
-                
-        '''
+                techniques[tactic]["score"] += 1
+                techniques[tactic]["file_paths"].append(detection_url)
+
+        """
         for detection in objects:
             if detection.tags.mitre_attack_enrichments:
                 for mitre_attack_enrichment in detection.tags.mitre_attack_enrichments:
@@ -31,16 +31,16 @@ class AttackNavOutput():
                     else:
                         techniques[mitre_attack_enrichment.mitre_attack_id]['score'] = techniques[mitre_attack_enrichment.mitre_attack_id]['score'] + 1
                         techniques[mitre_attack_enrichment.mitre_attack_id]['file_paths'].append('https://github.com/splunk/security_content/blob/develop/detections/' + detection.getSource() + '/' + self.convertNameToFileName(detection.name))
-        '''
-        AttackNavWriter.writeAttackNavFile(techniques, output_path / 'coverage.json')
-        
+        """
+        AttackNavWriter.writeAttackNavFile(techniques, output_path / "coverage.json")
 
     def convertNameToFileName(self, name: str):
-        file_name = name \
-            .replace(' ', '_') \
-            .replace('-','_') \
-            .replace('.','_') \
-            .replace('/','_') \
+        file_name = (
+            name.replace(" ", "_")
+            .replace("-", "_")
+            .replace(".", "_")
+            .replace("/", "_")
             .lower()
-        file_name = file_name + '.yml'
+        )
+        file_name = file_name + ".yml"
         return file_name

contentctl/output/attack_nav_writer.py

@@ -1,75 +1,67 @@
-
 import json
 from typing import Union, List
 import pathlib
+
 VERSION = "4.3"
 NAME = "Detection Coverage"
 DESCRIPTION = "security_content detection coverage"
 DOMAIN = "mitre-enterprise"
 
 
-class AttackNavWriter():
-
+class AttackNavWriter:
     @staticmethod
-    def writeAttackNavFile(mitre_techniques : dict[str,dict[str,Union[List[str],int]]], output_path : pathlib.Path) -> None:
+    def writeAttackNavFile(
+        mitre_techniques: dict[str, dict[str, Union[List[str], int]]],
+        output_path: pathlib.Path,
+    ) -> None:
         max_count = 0
         for technique_id in mitre_techniques.keys():
-            if mitre_techniques[technique_id]['score'] > max_count:
-                max_count = mitre_techniques[technique_id]['score']
-        
+            if mitre_techniques[technique_id]["score"] > max_count:
+                max_count = mitre_techniques[technique_id]["score"]
+
         layer_json = {
             "version": VERSION,
             "name": NAME,
             "description": DESCRIPTION,
             "domain": DOMAIN,
-            "techniques": []
+            "techniques": [],
         }
 
         layer_json["gradient"] = {
-            "colors": [
-                "#ffffff",
-                "#66b1ff",
-                "#096ed7"
-            ],
+            "colors": ["#ffffff", "#66b1ff", "#096ed7"],
             "minValue": 0,
-            "maxValue": max_count
+            "maxValue": max_count,
         }
 
         layer_json["filters"] = {
-                "platforms":
-                    ["Windows",
-                    "Linux",
-                    "macOS",
-                    "AWS",
-                    "GCP",
-                    "Azure",
-                    "Office 365",
-                    "SaaS"
-                ]
+            "platforms": [
+                "Windows",
+                "Linux",
+                "macOS",
+                "AWS",
+                "GCP",
+                "Azure",
+                "Office 365",
+                "SaaS",
+            ]
         }
 
         layer_json["legendItems"] = [
-            {
-                "label": "NO available detections",
-                "color": "#ffffff"
-            },
-            {
-                "label": "Some detections available",
-                "color": "#66b1ff"
-            }
+            {"label": "NO available detections", "color": "#ffffff"},
+            {"label": "Some detections available", "color": "#66b1ff"},
         ]
 
-        layer_json['showTacticRowBackground'] = True
-        layer_json['tacticRowBackground'] = "#dddddd"
+        layer_json["showTacticRowBackground"] = True
+        layer_json["tacticRowBackground"] = "#dddddd"
         layer_json["sorting"] = 3
 
         for technique_id in mitre_techniques.keys():
             layer_technique = {
                 "techniqueID": technique_id,
-                "score": mitre_techniques[technique_id]['score'],
-                "comment": "\n\n".join(mitre_techniques[technique_id]['file_paths'])
+                "score": mitre_techniques[technique_id]["score"],
+                "comment": "\n\n".join(mitre_techniques[technique_id]["file_paths"]),
             }
             layer_json["techniques"].append(layer_technique)
 
-        with open(output_path, 'w') as outfile:
+        with open(output_path, "w") as outfile:
             json.dump(layer_json, outfile, ensure_ascii=False, indent=4)