django-restit 4.2.165__py3-none-any.whl → 4.2.167__py3-none-any.whl

{django_restit-4.2.165.dist-info → django_restit-4.2.167.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.165
+Version: 4.2.167
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

{django_restit-4.2.165.dist-info → django_restit-4.2.167.dist-info}/RECORD

@@ -95,7 +95,7 @@ inbox/utils/parsing.py,sha256=y_71dwz8bm3JvF35ol8698XJ36sBF8fQWUrn0sYd2Fs,5597
 inbox/utils/render.py,sha256=CU_F2qUBQE7mjb9Q6Dn9ro5CS_O_zEY-wDMHEClKkIA,4331
 inbox/utils/sending.py,sha256=BKelTZnbkdSLGpjOY6IRTrzj-Hnw2pPZ7RYQGwe-tqk,2179
 incident/README.md,sha256=4vbZTJj7uUmq8rogYngxqNYjFTlBOujfWUGheLoFKMc,1114
-incident/__init__.py,sha256=xgdt3z3z7ygjWv5HxhiWgBtB2W3IUJmmR88NSyUeHuo,3455
+incident/__init__.py,sha256=FXNMmcGP6YAKjwik84ppze33uL0kDTa7YFr3aOEXhhk,3658
 incident/migrations/0001_initial.py,sha256=KmJRau3a2QFRaUwUrFUgY2p7FQZCODv3F-Sl0ZArpu0,9720
 incident/migrations/0002_event_component_event_component_id.py,sha256=Qfu3ndJKh4v7953ULTUZlSa3mVI-lnFIq9VFN1Rbs7Q,595
 incident/migrations/0003_rule_action.py,sha256=LNqV52qOjxxe3L8qEdln-Hd2voFcpyjOZ_cEsasrv7s,425
@@ -122,7 +122,7 @@ incident/models/ticket.py,sha256=S3kqGQpYLE6Y4M9IKu_60sgW-f592xNr8uufqHnvDoU,230
 incident/parsers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 incident/parsers/ossec.py,sha256=fouUsSnrdkEuqDzJ-MxmCP7ny5pCGFS3Tyf6lQSMBc4,11609
 incident/periodic.py,sha256=eX1rQK6v65A9ugofTvJPSmAWei6C-3EYgzCMuGZ03jM,381
-incident/rpc.py,sha256=sFHN1BTTPx-yYd6iCOpcGsKVHZPcD7LWcRcR0XsVquE,8768
+incident/rpc.py,sha256=7sJCrUasXMSVm6RUkna3xG15oSD_9Vbnqp8ezdPiepo,9448
 incident/templates/email/incident_change.html,sha256=tQYphypwLukkVdwH0TB2Szz2VEJ7GnsfRS3_ZJ-MYeE,13895
 incident/templates/email/incident_msg.html,sha256=MZdKhTddUF2MpiH8Z3RTQEmW_ko1n3ajeZ11KLtiLlU,13780
 incident/templates/email/incident_new.html,sha256=W6nwFQROnyDfMlXub8s02ws4hGnJp16pfgp9xTm_aEc,15185
@@ -379,7 +379,7 @@ pushit/utils.py,sha256=IeTCGa-164nmB1jIsK1lu1O1QzUhS3BKfuXHGjCW-ck,2121
 rest/.gitignore,sha256=TbEvWRMnAiajCTOdhiNrd9eeCAaIjRp9PRjE_VkMM5g,118
 rest/README.md,sha256=V3ETc-cJu8PZIbKr9xSe_pA4JEUpC8Dhw4bQeVCDJPw,5460
 rest/RemoteEvents.py,sha256=nL46U7AuxIrlw2JunphR1tsXyqi-ep_gD9CYGpYbNgE,72
-rest/__init__.py,sha256=L-9nmqhBVg-KjQ-1szS_16HPFP4D1t7aJ05kVd52Qy4,122
+rest/__init__.py,sha256=eBXKeTBaSN_87SpMKDrp3hqPYpVdDv_zx8hKsvRrrbI,122
 rest/arc4.py,sha256=y644IbF1ec--e4cUJ3KEYsewTCITK0gmlwa5mJruFC0,1967
 rest/cache.py,sha256=1Qg0rkaCJCaVP0-l5hZg2CIblTdeBSlj_0fP6vlKUpU,83
 rest/crypto/__init__.py,sha256=Tl0U11rgj1eBYqd6OXJ2_XSdNLumW_JkBZnaJqI6Ldw,72
@@ -515,7 +515,7 @@ ws4redis/servers/uwsgi.py,sha256=VyhoCI1DnVFqBiJYHoxqn5Idlf6uJPHvfBKgkjs34mo,172
 ws4redis/settings.py,sha256=KKq00EwoGnz1yLwCZr5Dfoq2izivmAdsNEEM4EhZwN4,1610
 ws4redis/utf8validator.py,sha256=S0OlfjeGRP75aO6CzZsF4oTjRQAgR17OWE9rgZdMBZA,5122
 ws4redis/websocket.py,sha256=R0TUyPsoVRD7Y_oU7w2I6NL4fPwiz5Vl94-fUkZgLHA,14848
-django_restit-4.2.165.dist-info/LICENSE.md,sha256=VHN4hhEeVOoFjtG-5fVv4jesA4SWi0Z-KgOzzN6a1ps,1068
-django_restit-4.2.165.dist-info/METADATA,sha256=rRvGoqgmYwOEx1u5zs7YdPfoWe29f3kBTCybt3bueeQ,7663
-django_restit-4.2.165.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
-django_restit-4.2.165.dist-info/RECORD,,
+django_restit-4.2.167.dist-info/LICENSE.md,sha256=VHN4hhEeVOoFjtG-5fVv4jesA4SWi0Z-KgOzzN6a1ps,1068
+django_restit-4.2.167.dist-info/METADATA,sha256=6AEOSN6ApDMK6jAJsPqm3T4I3EJLbO894J6lhA5p_4E,7663
+django_restit-4.2.167.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
+django_restit-4.2.167.dist-info/RECORD,,

incident/__init__.py

@@ -15,6 +15,9 @@ def _request_to_meta(request, metadata):
         metadata["buid"] = request.buid
     if "username" not in metadata and hasattr(request, "member") and request.member is not None:
         metadata["username"] = request.member.username
+    # if "group_name" not in metadata and hasattr(request, "group") and request.group is not None:
+    #     metadata['group_name'] = request.group.name
+    #     metadata['group_id'] = request.group.id
     return metadata
 
 

incident/rpc.py

@@ -7,6 +7,7 @@ from .parsers import ossec
 from taskqueue.models import Task
 from location.providers.iplookup import abuse
 import incident
+from objict import objict
 
 LOG_REST_PREFIX = settings.get("REST_PREFIX", "api/")
 if not LOG_REST_PREFIX.startswith("/"):
@@ -56,69 +57,93 @@ if settings.REPORT_PERMISSION_DENIED:
     rv.restPermissionDenied = patched_restPermissionDenied
 
 
+@rd.urlPOST(r'^ossec/alert/batch$')
+def batch_ossec_alert_creat_from_request(request):
+    batch = request.DATA.get("batch")
+    if isinstance(batch, str):
+        batch = objict.fromJSON(batch)
+    if not isinstance(batch, list):
+        rh.debug("ossec batch data", batch)
+        rh.debug("ossec data", request.DATA.asDict())
+        data_format = str(type(batch))
+        return rv.restStatus(request, False, error=f"invalid format {data_format}")
+    for alert in batch:
+        on_ossec_alert(request, alert)
+    return rv.restStatus(request, True)  
+
+
 @rd.urlPOST(r'^ossec/alert$')
 def ossec_alert_creat_from_request(request):
     payload = request.DATA.get("payload")
-    if payload:
-        try:
-            # TODO make this a task (background it)
-            # rh.log_error("parsing payload", payload)
-            od = ossec.parseAlert(request, payload)
-            # lets now create a local event
-            if od is not None:
-                level = 10
-                if od.level > 10:
-                    level = 1
-                elif od.level > 7:
-                    level = 2
-                elif od.level == 6:
-                    level = 3
-                elif od.level == 5:
-                    level = 4
-                elif od.level == 4:
-                    level = 6
-                elif od.level <= 3:
-                    level = 8
-                metadata = od.toDict(graph="default")
-                metadata.update(od.metadata)
-                # we reuse the ssh_sig because it is a text field to store urls
-                # ssh_sig = metadata.get("ssh_sig", None)
-                # if ssh_sig is not None and ssh_sig.startswith("http"):    
-                #     metadata["url"] = ssh_sig
-                #     metadata["domain"] = ossec.extractDomain(ssh_sig)
-                #     metadata["path"] = ossec.extractUrlPath(ssh_sig)
-                #     metadata.pop("ssh_sig")
-                if od.geoip:
-                    metadata["country"] = od.geoip.country
-                    metadata["city"] = od.geoip.city
-                    metadata["province"] = od.geoip.state
-                    metadata["isp"] = od.geoip.isp
-
-                am.Event.createFromDict(None, {
-                    "hostname": od.hostname,
-                    "description": od.title,
-                    "details": od.text,
-                    "level": level,
-                    "category": "ossec",
-                    "component": "incident.ServerOssecAlert",
-                    "component_id": od.id,
-                    "reporter_ip": od.src_ip,
-                    "metadata": metadata
-                })
-                return rv.restStatus(request, True)
-        except Exception as err:
-            rh.log_exception()
-            stack = rh.getStackString()
-            # rh.log_exception("during ossec alert", payload)
-            metadata = dict(ip=request.ip, payload=payload)
-            am.Event.createFromDict(None, {
-                "hostname": request.get_host(),
-                "description": f"error parseing alert: {err}",
-                "details": stack,
-                "level": 8,
-                "category": "ossec_error",
+    if not payload:
+        return rv.restStatus(request, False, error="no alert data")
+    on_ossec_alert(request, payload)
+    return rv.restStatus(request, True)
+
+
+def on_ossec_alert(request, alert):
+    try:
+        # TODO make this a task (background it)
+        # rh.log_error("parsing payload", payload)
+        od = ossec.parseAlert(request, alert)
+        # lets now create a local event
+        if od is not None:
+            level = 10
+            if od.level > 10:
+                level = 1
+            elif od.level > 7:
+                level = 2
+            elif od.level == 6:
+                level = 3
+            elif od.level == 5:
+                level = 4
+            elif od.level == 4:
+                level = 6
+            elif od.level <= 3:
+                level = 8
+            metadata = od.toDict(graph="default")
+            metadata.update(od.metadata)
+            # we reuse the ssh_sig because it is a text field to store urls
+            # ssh_sig = metadata.get("ssh_sig", None)
+            # if ssh_sig is not None and ssh_sig.startswith("http"):    
+            #     metadata["url"] = ssh_sig
+            #     metadata["domain"] = ossec.extractDomain(ssh_sig)
+            #     metadata["path"] = ossec.extractUrlPath(ssh_sig)
+            #     metadata.pop("ssh_sig")
+            if od.geoip:
+                metadata["country"] = od.geoip.country
+                metadata["city"] = od.geoip.city
+                metadata["province"] = od.geoip.state
+                metadata["isp"] = od.geoip.isp
+
+            evt = am.Event.createFromDict(None, {
+                "hostname": od.hostname,
+                "description": od.title,
+                "details": od.text,
+                "level": level,
+                "category": "ossec",
+                "component": "incident.ServerOssecAlert",
+                "component_id": od.id,
+                "reporter_ip": od.src_ip,
                 "metadata": metadata
             })
+            # fix the created datetime to be from when it was actually happening
+            evt.created = od.when
+            evt.save()
+            return rv.restStatus(request, True)
+    except Exception as err:
+        rh.log_exception()
+        stack = rh.getStackString()
+        # rh.log_exception("during ossec alert", payload)
+        metadata = dict(ip=request.ip, payload=alert)
+        am.Event.createFromDict(None, {
+            "hostname": request.get_host(),
+            "description": f"error parseing alert: {err}",
+            "details": stack,
+            "level": 8,
+            "category": "ossec_error",
+            "metadata": metadata
+        })
     # rh.log_error("ossec alert", request.DATA.asDict())
     return rv.restStatus(request, False, error="no alert data")
 

rest/__init__.py

@@ -1,4 +1,4 @@
 from .uberdict import UberDict  # noqa: F401
 from .settings_helper import settings  # noqa: F401
 
-__version__ = "4.2.165"
+__version__ = "4.2.167"