django-restit 4.1.60__tar.gz → 4.1.62__tar.gz

{django_restit-4.1.60 → django_restit-4.1.62}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.1.60
+Version: 4.1.62
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

{django_restit-4.1.60 → django_restit-4.1.62}/account/rpc/group.py

@@ -3,6 +3,7 @@ from rest import views as rv
 from account.models import Group, Membership, Member, GroupFeed, MemberFeed
 from taskqueue import models as tq
 
+
 @rd.url(r'^group$')
 @rd.url(r'^group/$')  # required for legacy support
 @rd.url(r'^group/(?P<pk>\d+)$')

django_restit-4.1.62/incident/migrations/0010_incident_category_incident_component_id.py

@@ -0,0 +1,23 @@
+# Generated by Django 4.1.4 on 2023-11-20 03:38
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('incident', '0009_incident_reporter_ip'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='incident',
+            name='category',
+            field=models.CharField(db_index=True, default=None, max_length=124, null=True),
+        ),
+        migrations.AddField(
+            model_name='incident',
+            name='component_id',
+            field=models.IntegerField(blank=True, db_index=True, default=None, null=True),
+        ),
+    ]

django_restit-4.1.62/incident/migrations/0011_ticket.py

@@ -0,0 +1,38 @@
+# Generated by Django 4.1.4 on 2023-11-20 03:51
+
+from django.db import migrations, models
+import django.db.models.deletion
+import rest.models.base
+import rest.models.metadata
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('account', '0016_authsession_buid'),
+        ('incident', '0010_incident_category_incident_component_id'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Ticket',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('created', models.DateTimeField(auto_now_add=True)),
+                ('modified', models.DateTimeField(auto_now=True)),
+                ('category', models.CharField(db_index=True, max_length=200)),
+                ('priority', models.IntegerField(db_index=True, default=10)),
+                ('title', models.CharField(max_length=200)),
+                ('description', models.TextField()),
+                ('status', models.CharField(db_index=True, default=None, max_length=32, null=True)),
+                ('state', models.IntegerField(default=0)),
+                ('component', models.CharField(db_index=True, default=None, max_length=200, null=True)),
+                ('component_id', models.IntegerField(blank=True, db_index=True, default=None, null=True)),
+                ('assigned_to', models.ForeignKey(default=None, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='tickets', to='account.member')),
+                ('created_by', models.ForeignKey(default=None, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='+', to='account.member')),
+                ('group', models.ForeignKey(default=None, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='tickets', to='account.group')),
+                ('incident', models.ForeignKey(default=None, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='tickets', to='incident.incident')),
+            ],
+            bases=(models.Model, rest.models.base.RestModel, rest.models.metadata.MetaDataModel),
+        ),
+    ]

{django_restit-4.1.60 → django_restit-4.1.62}/incident/models/__init__.py

@@ -2,3 +2,4 @@ from .rules import *  # noqa: F401, F403
 from .incident import *  # noqa: F401, F403
 from .event import *  # noqa: F401, F403
 from .ossec import *  # noqa: F401, F403
+from .ticket import *  # noqa: F401, F403

{django_restit-4.1.60 → django_restit-4.1.62}/incident/models/event.py

@@ -15,7 +15,13 @@ from .rules import Rule
 INCIDENT_METRICS = settings.get("INCIDENT_METRICS", False)
 INCIDENT_EVENT_METRICS = settings.get("INCIDENT_EVENT_METRICS", False)
 EVENT_TO_INCIDENT_LEVEL = settings.get("EVENT_TO_INCIDENT_LEVEL", 4)
-
+EVENT_DETAIL_TEMPLATES = settings.get("EVENT_DETAIL_TEMPLATES", None)
+EVENT_META_KEYWORDS = settings.get("EVENT_META_KEYWORDS", [
+        "path", "ip", "reporter_ip", "code", 
+        "reason", "buid", "merchant", "tid", 
+        "group", "http_user_agent", "user_agent",
+        "app_url", "isp", "city", "state", "country"
+    ])
 
 logger = log.getLogger("incident", filename="incident.log")
 
@@ -80,6 +86,23 @@ class Event(JSONMetaData, rm.RestModel):
                 return rule
         return None
 
+    @property
+    def details_by_category(self):
+        # returns detailed text based on the category settings
+        # if EVENT_DETAIL_TEMPLATES is None or self.category not in EVENT_DETAIL_TEMPLATES:
+        #     return self.details
+        output = []
+        if self.component:
+            output.append(f"{self.component}({self.component_id})")
+        for key in EVENT_META_KEYWORDS:
+            if self.metadata.get(key, None) is not None:
+                output.append(f"{key}: {self.metadata[key]}")
+        if self.details:
+            output.append(self.details)
+            output.append("")
+            output.append("")
+        return "\n".join(output)
+
     def lookupIP(self, ip):
         GeoIP = rm.RestModel.getModel("location", "GeoIP")
         gip = GeoIP.lookup(ip)
@@ -138,7 +161,10 @@ class Event(JSONMetaData, rm.RestModel):
             incident = Incident(
                 rule=hit_rule, priority=priority,
                 reporter_ip=self.reporter_ip,
-                component=self.category, hostname=self.hostname)
+                category=self.category,
+                component=self.component, 
+                component_id=self.component_id,
+                hostname=self.hostname)
             if hit_rule is not None:
                 incident.group = hit_rule.group
             # TODO possibly make this smarter?

{django_restit-4.1.60 → django_restit-4.1.62}/incident/models/incident.py

@@ -52,7 +52,12 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
     modified = models.DateTimeField(auto_now=True)
 
     description = models.CharField(max_length=200)
+
+    category = models.CharField(max_length=124, null=True, default=None, db_index=True)
+
     component = models.CharField(max_length=200, null=True, default=None, db_index=True)
+    component_id = models.IntegerField(null=True, blank=True, default=None, db_index=True)
+
     hostname = models.CharField(max_length=200, null=True, default=None, db_index=True)
     reporter_ip = models.CharField(max_length=16, blank=True, null=True, default=None, db_index=True)
 
@@ -68,7 +73,15 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
     @property
     def first_event(self):
         return self.events.first()
-    
+
+    def shouldTriggerAction(self):
+        count = self.events.all().count()
+        aa = self.rule.action_after
+        if aa>= 0:
+            return aa == count-1
+        aa = abs(self.rule.action_after)
+        return (count % aa) == 0
+
     def triggerAction(self, force=False):
         if self.rule is None:
             if self.action_sent is None:
@@ -82,7 +95,7 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
         #     return
         # only do query if not 0
         logger.info("triggerAction", self.rule.action)
-        if force or self.rule.action_after == 0 or self.rule.action_after < self.events.all().count():
+        if force or self.shouldTriggerAction():
             logger.info(f"triggering incident action: {self.rule.action}")
             self.triggerAsyncNotify()
             if self.rule.action is None or self.rule.action == "notify":
@@ -96,9 +109,12 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
 
     def triggerAsyncNotify(self):
         msg = dict(
+            pk=self.pk,
             created=time.mktime(self.created.timetuple()),
             description=self.description,
+            category=self.category,
             component=self.component,
+            component_id=self.component_id,
             hostname=self.hostname)
         if self.rule is not None:
             msg["rule"] = self.rule.name
@@ -148,7 +164,7 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
         # logger.info("notifyWith", perm)
         Member.notifyWith(
             perm,
-            subject=F"Incident #{self.pk} {self.component}@{self.hostname}",
+            subject=F"New Incident #{self.pk} {self.component}@{self.hostname}",
             template=settings.get("INCIDENT_TEMPLATE", "email/incident_plain.html"),
             context=dict(incident=self, portal_url=settings.INCIDENT_PORTAL_URL),
             email_only=True, from_email=INCIDENT_EMAIL_FROM)
@@ -176,7 +192,8 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
             if request != None and "DATA" in request and "note" in request.DATA:
                 self.logHistory(kind="note", note=request.DATA.get("note"), request=request)
 
-    def logHistory(self, kind="history", note=None, media=None, request=None, member=None):
+    def logHistory(self, kind="history", note=None, media=None, 
+                   request=None, member=None, notify=True):
         if request is None:
             request = self.getActiveRequest()
         if member is None and request is not None and hasattr(request, "member"):
@@ -186,7 +203,7 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
             for k, v in self._changed__.items():
                 nv = self.getFieldValue(k)
                 notes.append(f"{k} changed from {v} to {nv}")
-            note = "\n".join(notes)
+            note = "\n<br>".join(notes)
 
         h = IncidentHistory(
             parent=self,
@@ -203,57 +220,71 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
         if media is not None:
             h.saveMediaFile(media, "media", media.name)
         h.save()
-        if h.state != INCIDENT_STATE_IGNORE:
+        if notify and h.state != INCIDENT_STATE_IGNORE:
             self.notifyWatchers(
                 subject=F"Updated Incident #{self.id}",
                 history=h)
 
     def notifyWatchers(self, subject, history=None):
+        action = None
+        perm = "notify.incident_alerts"
+        if self.rule is not None and (self.rule.action.startswith("email:") or self.rule.action.startswith("notify:")):
+            action, perm = self.rule.action.split(":")
+        context = dict(
+                    incident=self,
+                    portal_url=settings.INCIDENT_PORTAL_URL,
+                    history=history)
+        template = "email/incident_plain.html"
+
         # this should notify all users in our incident group of the change
         if self.group is not None:
             # all member of the group are notified because it is an incident group
             self.group.notifyMembers(
                 subject=subject,
-                template="email/incident_change.html",
-                context=dict(incident=self, portal_url=settings.INCIDENT_PORTAL_URL),
-                perms=["notify.incident_alerts"],
-                email_only=True, from_email=INCIDENT_EMAIL_FROM)
-        elif history is not None:
-            action = None
-            perm = "notify.incident_alerts"
-            if self.rule is not None and (self.rule.action.startswith("email:") or self.rule.action.startswith("notify:")):
-                action, perm = self.rule.action.split(":")
+                template=template,
+                context=context,
+                perms=[perm],
+                email_only=True,
+                from_email=INCIDENT_EMAIL_FROM)
+        elif history.by is None:
+            # notify everyone with the perm
+            Member.notifyWith(
+                perm,
+                subject,
+                template=template,
+                context=context,
+                email_only=True,
+                from_email=INCIDENT_EMAIL_FROM)
+        else:
+            # notitfy everyone but the sender          
             if history.by is None:
-                Member.notifyWith(
-                    perm, subject,
-                    message=history.note,
-                    from_email=INCIDENT_EMAIL_FROM)
-            else:
                 members = Member.GetWithPermission(perm).exclude(pk=history.by.pk)
-                if members.count() > 0:
-                    NotificationRecord = Incident.getModel("account", "NotificationRecord")
-                    message = f"{history.note}\n\n- {history.by.username}\n\n\n"
-                    NotificationRecord.notify(
-                        members, subject, message,
-                        email_only=True, from_email=INCIDENT_EMAIL_FROM)
+                if members.count() == 0:
+                    return
+                NotificationRecord = Incident.getModel("account", "NotificationRecord")
+                NotificationRecord.notify(
+                    members,
+                    subject,
+                    template=template,
+                    context=context,
+                    email_only=True,
+                    from_email=INCIDENT_EMAIL_FROM)
 
     @classmethod
     def getBundled(cls, rule, event):
         # calculate our bundle start time
         when = datetime.now() - timedelta(minutes=rule.bundle)
         q = objict(rule=rule, created__gte=when)
-        if rule.bundle_by == 1:
-            q.hostname = event.hostname
-        elif rule.bundle_by == 2:
-            q.component = event.category
-        elif rule.bundle_by == 3:
+        if rule.bundle_by in [2, 3, 5]:
+            if event.component_id:
+                q.component = event.component
+                q.component_id = event.component_id
+        if rule.bundle_by in [1, 3, 7]:
             q.hostname = event.hostname
-            q.component = event.category
-        elif rule.bundle_by == 4:
-            q.reporter_ip = event.reporter_ip
-        elif rule.bundle_by == 5:
+        elif rule.bundle_by in [4, 5, 8]:
             q.reporter_ip = event.reporter_ip
-            q.component = event.category
+        elif rule.bundle_by in [6, 7, 8]:
+            q.category = event.category
         return Incident.objects.filter(**q).last()
 
     @classmethod

django_restit-4.1.62/incident/models/ticket.py

@@ -0,0 +1,65 @@
+from django.db import models
+from django.conf import settings
+
+from rest import models as rm
+from rest import helpers as rh
+
+
+class Ticket(models.Model, rm.RestModel, rm.MetaDataModel):
+    class RestMeta:
+        SEARCH_FIELDS = ["title", "description"]
+        CAN_DELETE = True
+        VIEW_PERMS = ["view_tickets"]
+        GRAPHS = {
+            "default": {
+                "extra": ["metadata"],
+                "graphs": {
+                    "group": "basic",
+                    "created_by": "basic",
+                    "assigned_to": "basic",
+                    "incident": "basic"
+                },
+            },
+            "detailed": {
+                "graphs": {
+                    "group": "basic",
+                    "created_by": "basic",
+                    "assigned_to": "basic",
+                    "incident": "basic",
+                    "generic__component": "basic"
+                },
+            },
+        }
+
+    created = models.DateTimeField(auto_now_add=True)
+    modified = models.DateTimeField(auto_now=True)
+
+    group = models.ForeignKey(
+        "account.Group", on_delete=models.SET_NULL, 
+        related_name="tickets",
+        null=True, default=None)
+    assigned_to = models.ForeignKey(
+        "account.Member", on_delete=models.SET_NULL, 
+        related_name="tickets",
+        null=True, default=None)
+    created_by = models.ForeignKey(
+        "account.Member", on_delete=models.CASCADE,
+        related_name="+",
+        null=True, default=None)
+
+    # if category is null then this will run on all events?
+    category = models.CharField(max_length=200, db_index=True)
+    priority = models.IntegerField(default=10, db_index=True)  # 1-10, 1 being the highest
+
+    title = models.CharField(max_length=200)
+    description = models.TextField()
+
+    status = models.CharField(max_length=32, default=None, null=True, db_index=True)
+    state = models.IntegerField(default=0)  # how many incidents before firing action
+
+    incident = models.ForeignKey(
+        "incident.Incident", null=True, default=None, 
+        related_name="tickets", on_delete=models.SET_NULL)
+
+    component = models.CharField(max_length=200, null=True, default=None, db_index=True)
+    component_id = models.IntegerField(null=True, blank=True, default=None, db_index=True)

{django_restit-4.1.60 → django_restit-4.1.62}/incident/rpc.py

@@ -158,3 +158,9 @@ def rest_firewall_block(request):
         return rv.restPermissionDenied(request)
     Task.Publish("incident", f"firewall_{action}", dict(ip=ip), channel="tq_broadcast")
     return rv.restStatus(request, True)
+
+
+@rd.url('ticket')
+@rd.url('ticket/<int:pk>')
+def rest_on_ticket(request, pk=None):
+    return am.Ticket.on_rest_request(request, pk)

django_restit-4.1.60/incident/templates/email/incident_plain.html → django_restit-4.1.62/incident/templates/email/incident_change.html

@@ -180,7 +180,7 @@
                     <td align="left" style="font-size:0px;padding:0;word-break:break-word;">
                       <div style="font-family:Roboto, Helvetica, Arial, sans-serif;font-size:30px;font-weight:300;line-height:30px;text-align:left;color:#FFFFFF;">
                         
-                      New Incident on {{incident.hostname}}</div>
+                      Incident #{{incident.pk}} on {{incident.hostname}}</div>
 
                     </td>
                   </tr>
@@ -195,10 +195,28 @@
                   </tr>
                   <tr>
                     <td>
-                      <pre style="font-size: 16px; overflow-x: scroll; word-wrap: normal; max-width: 980px; padding: 8px;">{{incident.first_event.details}}
+                      <pre style="font-size: 16px; overflow-x: scroll; word-wrap: normal; max-width: 980px; padding: 8px;">{{incident.first_event.details_by_category}}
                       </pre>
                     </td>
                   </tr>
+                  {% if history %}
+                  <tr>
+                    <td>
+                      <pre style="font-size: 16px; overflow-x: scroll; word-wrap: normal; max-width: 980px; padding: 8px;">
+updated by: {% if history %}{{history.by.username}}{% else %}system{% endif %}
+
+{{history.note}}
+                      </pre>
+                    </td>
+                  </tr>
+                  {% endif %}
+                  <tr>
+                    <td>
+                       <div style="font-family:Roboto, Helvetica, Arial, sans-serif;font-size:16;font-weight:300;font-style:italic;line-height:30px;text-align:left;">
+                         You can respond to this email with notes or actions.  Make sure to leave to blank lines at the end of your email.  For actions just include one of these words on its own line: "open", "close", "pause", "ignore".
+                       </div>
+                    </td>
+                  </tr>
                 
                   <tr>
                     <td align="center" vertical-align="middle" style="font-size:0px;padding:10px 25px;word-break:break-word;">