detect-droid 0.3.3__tar.gz → 0.3.4__tar.gz

{detect_droid-0.3.3/src/detect_droid.egg-info → detect_droid-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: detect-droid
-Version: 0.3.3
+Version: 0.3.4
 Summary: Detection Rules Optimisation Integration Deployment
 Home-page: https://github.com/certeu/droid
 Author: cert-eu/mlc

{detect_droid-0.3.3 → detect_droid-0.3.4}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = detect-droid
-version = 0.3.3
+version = 0.3.4
 author = cert-eu/mlc
 author_email = services@cert.europa.eu
 description = Detection Rules Optimisation Integration Deployment

{detect_droid-0.3.3 → detect_droid-0.3.4/src/detect_droid.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: detect-droid
-Version: 0.3.3
+Version: 0.3.4
 Summary: Detection Rules Optimisation Integration Deployment
 Home-page: https://github.com/certeu/droid
 Author: cert-eu/mlc

{detect_droid-0.3.3 → detect_droid-0.3.4}/src/detect_droid.egg-info/SOURCES.txt

@@ -44,8 +44,11 @@ src/droid/sources/__init__.py
 src/droid/sources/sigmahq.py
 tests/test_convert.py
 tests/test_export.py
+tests/test_export_error_propagation.py
+tests/test_integrity.py
 tests/test_json_logging.py
 tests/test_platforms_common.py
+tests/test_search_logging.py
 tests/test_token_hook.py
 tests/test_validate.py
 tests/test_version.py

{detect_droid-0.3.3 → detect_droid-0.3.4}/src/droid/convert.py

@@ -489,8 +489,9 @@ def convert_sigma(
     if parameters.export and parameters.search and rule_converted:
         try:
             error, search_warning = search_rule(parameters, rule_content, rule_converted, platform, rule_file, error, search_warning, logger_param)
-        except:
+        except Exception as e:
             logger.error(f"Could not export the rule {rule_file} since the search ran into error.", extra={"rule_file": rule_file, "error": e, "rule_content": rule_content})
+            error = True
 
         if not error:
             error = False

{detect_droid-0.3.3 → detect_droid-0.3.4}/src/droid/integrity.py

@@ -29,7 +29,7 @@ def load_rule(rule_file):
         print("Error reading {0}".format(rule_file))
         return True
 
-def check_rule_removed(rule_content, rule_file, saved_search, logger, error):
+def check_rule_removed(rule_content, rule_file, saved_search, logger, error, tolerate_deletion_delay=False):
     is_removed = rule_content.get("custom", {}).get("removed")
 
     if not saved_search:
@@ -40,6 +40,13 @@ def check_rule_removed(rule_content, rule_file, saved_search, logger, error):
             logger.error(f"Rule not found {rule_file}")
             error = True
         return error
+
+    if is_removed and tolerate_deletion_delay:
+        # The platform can take a while to actually drop the rule from its
+        # backend, comparing the content of a rule meant to be gone is pointless
+        logger.warning(f"The rule {rule_file} is marked as removed but is still present on the platform - skipping the integrity check")
+        return False
+
     return None
 
 def integrity_rule_splunk(rule_converted, rule_content, platform: SplunkPlatform, rule_file, parameters, logger, error):
@@ -264,9 +271,10 @@ def integrity_rule_ms_xdr_mssp(rule_converted, rule_content, platform: Microsoft
             logger.error(f"Couldn't check the integrity for the rule {rule_file} on tenant {tenant_id} from {group} - error {e}")
             return error
 
-        error = check_rule_removed(rule_content, rule_file, saved_search, logger, error)
-        if error is not None:
-            error_occured = True
+        removed_check = check_rule_removed(rule_content, rule_file, saved_search, logger, error, tolerate_deletion_delay=True)
+        if removed_check is not None:
+            if removed_check:
+                error_occured = True
             continue
 
         error = integrity_rule_ms_xdr(customer_rule_converted, rule_content, platform, rule_file, parameters, logger, error, saved_search=saved_search)
@@ -274,8 +282,7 @@ def integrity_rule_ms_xdr_mssp(rule_converted, rule_content, platform: Microsoft
         if error:
             error_occured = True
 
-    if error_occured:
-        return error
+    return error_occured
 
 def integrity_rule_ms_xdr(rule_converted, rule_content, platform: MicrosoftXDRPlatform, rule_file, parameters, logger, error, saved_search=None):
     try:
@@ -285,7 +292,7 @@ def integrity_rule_ms_xdr(rule_converted, rule_content, platform: MicrosoftXDRPl
         logger.error(f"Couldn't check the integrity for the rule {rule_file} - error {e}")
         return error
 
-    error = check_rule_removed(rule_content, rule_file, saved_search, logger, error)
+    error = check_rule_removed(rule_content, rule_file, saved_search, logger, error, tolerate_deletion_delay=True)
     if error is not None:
         return error
 

{detect_droid-0.3.3 → detect_droid-0.3.4}/src/droid/platforms/common.py

@@ -33,6 +33,28 @@ def get_token_hook_headers():
 
     return {}
 
+def get_error_message(response):
+    """Extract the error message out of a platform API response
+
+    The response is the already decoded body. It may be None when the request
+    could not be performed at all, or may not carry the expected error
+    structure, hence the fallbacks.
+
+    Return: a str with the error message
+    """
+
+    if isinstance(response, dict):
+        error = response.get('error')
+        if isinstance(error, dict):
+            return error.get('message', str(error))
+        if error:
+            return str(error)
+
+    if response is None:
+        return "No response from the platform"
+
+    return str(response)
+
 def get_pipeline_group_match(rule_content: dict, fields: dict):
     """Retrieve the config group name based on a dict
 

{detect_droid-0.3.3 → detect_droid-0.3.4}/src/droid/platforms/ms_xdr.py

@@ -10,10 +10,9 @@ import time
 
 from os import environ
 from datetime import datetime, timedelta
-from pprint import pprint
 from droid.abstracts import AbstractPlatform
 from droid.color import ColorLogger
-from droid.platforms.common import get_pipeline_group_match, get_token_hook_headers
+from droid.platforms.common import get_error_message, get_pipeline_group_match, get_token_hook_headers
 from msal import ConfidentialClientApplication
 from azure.identity import DefaultAzureCredential
 from cryptography import x509
@@ -162,7 +161,7 @@ class MicrosoftXDRPlatform(AbstractPlatform):
                                 self.logger.info(f"Rule {rule_file} was successfully deleted from tenant {tenant_id}")
                             else:
                                 self.logger.error(
-                                    f"Could not delete {rule_file} from tenant {tenant_id} - error: {response.json()['error']['message']}",
+                                    f"Could not delete {rule_file} from tenant {tenant_id} - error: {get_error_message(response)}",
                                     extra={
                                         "rule_file": rule_file,
                                         "rule_converted": rule_converted,
@@ -184,10 +183,10 @@ class MicrosoftXDRPlatform(AbstractPlatform):
                         )
                         error = True
                 if error:
-                    raise
+                    raise Exception(f"Could not remove the rule {rule_file} from one or more tenants")
             else:
                 self.logger.error("Export list not found. Please provide the list of designated customers")
-                raise
+                raise Exception("Export list not found. Please provide the list of designated customers")
         else:
             existing_rule = self.get_rule(rule_content["id"])
             tenant_id = self._tenant_id
@@ -207,14 +206,14 @@ class MicrosoftXDRPlatform(AbstractPlatform):
                     )
                 else:
                     self.logger.error(
-                        f"Could not delete {rule_file} - error: {response.json()['error']['message']}",
+                        f"Could not delete {rule_file} - error: {get_error_message(response)}",
                         extra={
                             "rule_file": rule_file,
                             "rule_converted": rule_converted,
                             "rule_content": rule_content,
                         },
                     )
-                    raise
+                    raise Exception(f"Could not delete {rule_file} - error: {get_error_message(response)}")
             else:
                 self.logger.info(
                     f"Rule {rule_file} was already removed",
@@ -473,12 +472,12 @@ class MicrosoftXDRPlatform(AbstractPlatform):
                         )
                         error = True
                 if error:
-                    raise
+                    raise Exception(f"Could not export the rule {rule_file} to one or more tenants")
             else:
                 self.logger.error(
                     "Export list not found. Please provide the list of designated customers"
                 )
-                raise
+                raise Exception("Export list not found. Please provide the list of designated customers")
         else:
             try:
                 self.push_detection_rule(
@@ -574,28 +573,8 @@ class MicrosoftXDRPlatform(AbstractPlatform):
                 url=api_url, payload=alert_rule, tenant_id=tenant_id
             )
 
-        if status_code == 400:
-            self.logger.error(
-                f"Could not export the rule {rule_file} due to a bad request. {response['error']['message']}",
-                extra={
-                    "rule_file": rule_file,
-                    "rule_converted": rule_converted,
-                    "rule_content": rule_content,
-                    "error": response,
-                },
-            )
-        elif status_code == 403:
-            self.logger.error(
-                f"Could not export the rule {rule_file} due to insufficient permissions. {response}",
-                extra={
-                    "rule_file": rule_file,
-                    "rule_converted": rule_converted,
-                    "rule_content": rule_content,
-                    "error": response,
-                },
-            )
-        elif status_code == 201 or 200:
-            if "error" in response:
+        if status_code in (200, 201, 204):
+            if isinstance(response, dict) and "error" in response:
                 self.logger.error(
                     f"Could not export the rule {rule_file}",
                     extra={
@@ -606,19 +585,34 @@ class MicrosoftXDRPlatform(AbstractPlatform):
                     },
                 )
                 raise Exception(response)
-            else:
-                self.logger.info(
-                    f"Successfully exported the rule {rule_file}",
-                    extra={
-                        "rule_file": rule_file,
-                        "rule_converted": rule_converted,
-                        "rule_content": rule_content,
-                    },
-                )
-                time.sleep(6)
+            self.logger.info(
+                f"Successfully exported the rule {rule_file}",
+                extra={
+                    "rule_file": rule_file,
+                    "rule_converted": rule_converted,
+                    "rule_content": rule_content,
+                },
+            )
+            time.sleep(6)
+            return True
+
+        if status_code == 400:
+            reason = f"due to a bad request. {get_error_message(response)}"
+        elif status_code == 403:
+            reason = f"due to insufficient permissions. {get_error_message(response)}"
         else:
-            print(status_code)
-            pprint(response)
+            reason = f"due to an unexpected status code {status_code}. {get_error_message(response)}"
+
+        self.logger.error(
+            f"Could not export the rule {rule_file} {reason}",
+            extra={
+                "rule_file": rule_file,
+                "rule_converted": rule_converted,
+                "rule_content": rule_content,
+                "error": response,
+            },
+        )
+        raise Exception(f"Could not export the rule {rule_file} {reason}")
 
     def parse_actions(self, actions, rule_file=None):
         # TODO: It might be better to have a schema validation for the actions

{detect_droid-0.3.3 → detect_droid-0.3.4}/src/droid/platforms/sentinel.py

@@ -409,9 +409,9 @@ class SentinelPlatform(AbstractPlatform):
                 if results.status == LogsQueryStatus.SUCCESS:
                     result = sum(len(table.rows) for table in results.tables)
                     if result > 0:
-                        self.logger.warning(f"(Sentinel MSSP) Results for {customer_name or workspace_name}: {result}, {rule_file}")
+                        self.logger.warning(f"(Sentinel MSSP) {result} hit(s) found for {rule_file} on customer '{customer_name or workspace_name}'")
                     else:
-                        self.logger.info(f"(Sentinel MSSP) No results for {customer_name or workspace_name}, {rule_file}")
+                        self.logger.info(f"(Sentinel MSSP) No hits for {rule_file} on customer '{customer_name or workspace_name}'")
                     total_result += result
                 elif results.status == LogsQueryStatus.PARTIAL:
                     self.logger.error(f"Rule {rule_file} partial error for {customer_name or workspace_name}: {results.partial_error}")
@@ -456,9 +456,9 @@ class SentinelPlatform(AbstractPlatform):
 
                 for customer, result in results.items():
                     if result > 0:
-                        self.logger.warning(f"(Sentinel MSSP) Results for {customer}: {result}, {rule_file}")
+                        self.logger.warning(f"(Sentinel MSSP) {result} hit(s) found for {rule_file} on customer '{customer}'")
                     else:
-                        self.logger.info(f"(Sentinel MSSP) No results for {customer}, {rule_file}")
+                        self.logger.info(f"(Sentinel MSSP) No hits for {rule_file} on customer '{customer}'")
                     total_result += result
 
                 return total_result
@@ -594,10 +594,10 @@ class SentinelPlatform(AbstractPlatform):
                         self.logger.error(f"Failed to delete the rule {rule_file} from {workspace_name} - error: {e}")
                         error = True
                 if error:
-                    raise
+                    raise Exception(f"Could not delete the rule {rule_file} from one or more workspaces")
             else:
                 self.logger.error("Export list not found. Please provide the list of designated customers")
-                raise
+                raise Exception("Export list not found. Please provide the list of designated customers")
         else:
             credential = self.get_credentials()
             client = SecurityInsights(credential, self._subscription_id)
@@ -798,10 +798,10 @@ class SentinelPlatform(AbstractPlatform):
                         self.logger.error(f"Failed to export the rule {rule_file} to {workspace_name} - error: {e}")
                         error = True
                 if error:
-                    raise
+                    raise Exception(f"Could not export the rule {rule_file} to one or more workspaces")
             else:
                 self.logger.error("Export list not found. Please provide the list of designated customers")
-                raise
+                raise Exception("Export list not found. Please provide the list of designated customers")
         else:
             credential = self.get_credentials()
             client = SecurityInsights(credential, self._subscription_id)

{detect_droid-0.3.3 → detect_droid-0.3.4}/src/droid/search.py

@@ -35,7 +35,7 @@ def search_rule_splunk(rule_converted, platform: SplunkPlatform, rule_file, para
 
         if result["resultCount"] > 0: # If the rule has match
             job_url = result["jobUrl"]
-            logger.warning(f"(Splunk) Match found for {rule_file} - {job_url}")
+            logger.warning(f"(Splunk) {result['resultCount']} hit(s) found for {rule_file} - {job_url}")
             search_warning = True
             return error, search_warning
         else:
@@ -56,7 +56,7 @@ def search_rule_sentinel_mssp(rule_converted, rule_content, platform: SentinelPl
         logger.info(f"Successfully searched the rule {rule_file}")
 
         if result > 0:  # If the rule has match
-            logger.warning(f"(Sentinel MSSP) Match found for {rule_file} - {result} hit(s)")
+            logger.warning(f"(Sentinel MSSP) {result} hit(s) found in total for {rule_file}")
             search_warning = True
             return error, search_warning
         else:
@@ -76,7 +76,7 @@ def search_rule_sentinel(rule_converted, platform: SentinelPlatform, rule_file,
         logger.info(f"Successfully searched the rule {rule_file}")
 
         if result > 0: # If the rule has match
-            logger.warning(f"(Sentinel) Match found for {rule_file} - {result} hit(s)")
+            logger.warning(f"(Sentinel) {result} hit(s) found for {rule_file}")
             search_warning = True
             return error, search_warning
         else:
@@ -98,11 +98,14 @@ def search_rule_ms_xdr_mssp(rule_converted, rule_content, platform: MicrosoftXDR
 
     logger.info("Searching for designated customers")
 
+    total_result = 0
+
     for group, info in export_list.items():
 
         tenant_id = info['tenant_id']
         customer_name = info.get('customer_name')
         customer_filter_dir = info.get('customer_filters_directory')
+        customer = customer_name or tenant_id
 
         logger.debug(f"Processing rule on {tenant_id} from group id {group}")
 
@@ -124,15 +127,20 @@ def search_rule_ms_xdr_mssp(rule_converted, rule_content, platform: MicrosoftXDR
             logger.info(f"Successfully searched the rule {rule_file}")
 
             if result > 0:  # If the rule has a match
-                logger.warning(f"{result} Matches found for {rule_file}")
+                logger.warning(f"(XDR MSSP) {result} hit(s) found for {rule_file} on customer '{customer}'")
                 search_warning = True
             else:
-                logger.info(f"No hits for {rule_file}")
+                logger.info(f"(XDR MSSP) No hits for {rule_file} on customer '{customer}'")
+
+            total_result += result
 
         except Exception as e:
             logger.error(f"Couldn't search for the rule {rule_file} for tenant {tenant_id} - error {e}")
             error = True
 
+    if total_result > 0:
+        logger.warning(f"(XDR MSSP) {total_result} hit(s) found in total for {rule_file}")
+
     return error, search_warning
 
 def search_rule_ms_xdr(rule_converted, platform: MicrosoftXDRPlatform, rule_file, parameters, logger, error, search_warning):
@@ -143,11 +151,11 @@ def search_rule_ms_xdr(rule_converted, platform: MicrosoftXDRPlatform, rule_file
         logger.info(f"Successfully searched the rule {rule_file}")
 
         if result > 0: # If the rule has match
-            logger.warning(f"{result} Matches found for {rule_file}")
+            logger.warning(f"(XDR) {result} hit(s) found for {rule_file}")
             search_warning = True
             return error, search_warning
         else:
-            logger.info(f"No hits for {rule_file}")
+            logger.info(f"(XDR) No hits for {rule_file}")
             return error, search_warning
 
     except Exception as e:
@@ -163,7 +171,7 @@ def search_rule_elastic(rule_converted, platform: ElasticPlatform, rule_file, pa
         logger.info(f"Successfully searched the rule {rule_file}")
 
         if result > 0: # If the rule has match
-            logger.warning(f"(Elastic) {result} hits found for {rule_file}")
+            logger.warning(f"(Elastic) {result} hit(s) found for {rule_file}")
             search_warning = True
             return error, search_warning
         else:

detect_droid-0.3.4/tests/test_export_error_propagation.py

@@ -0,0 +1,142 @@
+"""
+Tests that export failures are propagated to the caller
+
+A failure returned by the platform API (HTTP 400/403) must raise so that
+export_rule() flags the error and droid exits with a non-zero code.
+"""
+
+import time
+
+import pytest
+
+from droid.export import export_rule
+from droid.platforms.ms_xdr import MicrosoftXDRPlatform
+
+LOGGER_PARAM = {
+    "debug_mode": False,
+    "json_enabled": False,
+    "json_stdout": False,
+    "log_file": None,
+}
+
+RULE_FILE = "rules/sigma/delivery/anchovy_smuggling_on_neptune.yml"
+
+RULE_CONTENT = {
+    "id": "0c1b1b1a-0000-0000-0000-0000deadbeef",
+    "title": "Anchovy smuggling",
+    "description": "Detects anchovies being delivered to Neptune",
+    "level": "medium",
+    "tags": ["attack.execution"],
+}
+
+RULE_CONVERTED = "DeviceNetworkEvents | where RemoteUrl has 'panucci'"
+
+BAD_REQUEST = (
+    {"error": {"code": "BadRequest", "message": "Invalid query"}},
+    400,
+)
+
+
+def build_platform(export_mssp: bool):
+    parameters = {
+        "query_period": "24H",
+        "search_auth": "app",
+        "export_auth": "app",
+        "tenant_id": "tenant-new-new-york",
+        "client_id": "bender-bending-rodriguez",
+        "client_secret": "shiny-metal-secret",
+        "export_list_mssp": {
+            "group1": {"tenant_id": "tenant-planet-express", "customer_name": "Planet Express"},
+            "group2": {"tenant_id": "tenant-panucci", "customer_name": "Panucci's Pizza"},
+        },
+    }
+    return MicrosoftXDRPlatform(parameters, LOGGER_PARAM, export_mssp=export_mssp)
+
+
+@pytest.fixture
+def xdr_bad_request(monkeypatch):
+    """Platform factory whose Graph calls always answer 400 Bad Request."""
+
+    def _factory(export_mssp):
+        platform = build_platform(export_mssp)
+        # No existing rule -> create path, which answers 400
+        monkeypatch.setattr(platform, "_get", lambda *a, **kw: ({"value": []}, 200))
+        monkeypatch.setattr(platform, "_post", lambda *a, **kw: BAD_REQUEST)
+        monkeypatch.setattr(platform, "_patch", lambda *a, **kw: BAD_REQUEST)
+        return platform
+
+    return _factory
+
+
+@pytest.mark.parametrize("export_mssp", [False, True])
+def test_xdr_create_rule_raises_on_bad_request(xdr_bad_request, export_mssp):
+    """A 400 from Graph must raise instead of silently returning"""
+    platform = xdr_bad_request(export_mssp)
+
+    with pytest.raises(Exception):
+        platform.create_rule(RULE_CONTENT, RULE_CONVERTED, RULE_FILE)
+
+
+@pytest.mark.parametrize("export_mssp", [False, True])
+def test_xdr_create_rule_succeeds_on_created(monkeypatch, export_mssp):
+    """A 201 from Graph must not raise"""
+    platform = build_platform(export_mssp)
+    monkeypatch.setattr(platform, "_get", lambda *a, **kw: ({"value": []}, 200))
+    monkeypatch.setattr(platform, "_post", lambda *a, **kw: ({"id": "rule-anchovy"}, 201))
+    monkeypatch.setattr(time, "sleep", lambda *a: None)
+
+    error = export_rule(
+        parameters={},
+        rule_content=RULE_CONTENT,
+        rule_converted=RULE_CONVERTED,
+        platform=platform,
+        rule_file=RULE_FILE,
+        error=False,
+        logger_param=LOGGER_PARAM,
+    )
+
+    assert error is False
+
+
+def test_xdr_mssp_partial_failure_flags_error(monkeypatch):
+    """One failing tenant out of two must still flag the export as failed"""
+    platform = build_platform(export_mssp=True)
+    monkeypatch.setattr(platform, "_get", lambda *a, **kw: ({"value": []}, 200))
+    monkeypatch.setattr(time, "sleep", lambda *a: None)
+
+    def _post(*args, tenant_id=None, **kwargs):
+        if tenant_id == "tenant-panucci":
+            return BAD_REQUEST
+        return {"id": "rule-anchovy"}, 201
+
+    monkeypatch.setattr(platform, "_post", _post)
+
+    error = export_rule(
+        parameters={},
+        rule_content=RULE_CONTENT,
+        rule_converted=RULE_CONVERTED,
+        platform=platform,
+        rule_file=RULE_FILE,
+        error=False,
+        logger_param=LOGGER_PARAM,
+    )
+
+    assert error is True
+
+
+@pytest.mark.parametrize("export_mssp", [False, True])
+def test_export_rule_flags_error_on_bad_request(xdr_bad_request, export_mssp):
+    """export_rule() must report error=True so the CLI exits non-zero"""
+    platform = xdr_bad_request(export_mssp)
+
+    error = export_rule(
+        parameters={},
+        rule_content=RULE_CONTENT,
+        rule_converted=RULE_CONVERTED,
+        platform=platform,
+        rule_file=RULE_FILE,
+        error=False,
+        logger_param=LOGGER_PARAM,
+    )
+
+    assert error is True