django-restit 4.2.165__tar.gz → 4.2.167__tar.gz

{django_restit-4.2.165 → django_restit-4.2.167}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.165
+Version: 4.2.167
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

{django_restit-4.2.165 → django_restit-4.2.167}/incident/__init__.py

@@ -15,6 +15,9 @@ def _request_to_meta(request, metadata):
         metadata["buid"] = request.buid
     if "username" not in metadata and hasattr(request, "member") and request.member is not None:
         metadata["username"] = request.member.username
+    # if "group_name" not in metadata and hasattr(request, "group") and request.group is not None:
+    #     metadata['group_name'] = request.group.name
+    #     metadata['group_id'] = request.group.id
     return metadata
 
 

{django_restit-4.2.165 → django_restit-4.2.167}/incident/rpc.py

@@ -7,6 +7,7 @@ from .parsers import ossec
 from taskqueue.models import Task
 from location.providers.iplookup import abuse
 import incident
+from objict import objict
 
 LOG_REST_PREFIX = settings.get("REST_PREFIX", "api/")
 if not LOG_REST_PREFIX.startswith("/"):
@@ -56,69 +57,93 @@ if settings.REPORT_PERMISSION_DENIED:
     rv.restPermissionDenied = patched_restPermissionDenied
 
 
+@rd.urlPOST(r'^ossec/alert/batch$')
+def batch_ossec_alert_creat_from_request(request):
+    batch = request.DATA.get("batch")
+    if isinstance(batch, str):
+        batch = objict.fromJSON(batch)
+    if not isinstance(batch, list):
+        rh.debug("ossec batch data", batch)
+        rh.debug("ossec data", request.DATA.asDict())
+        data_format = str(type(batch))
+        return rv.restStatus(request, False, error=f"invalid format {data_format}")
+    for alert in batch:
+        on_ossec_alert(request, alert)
+    return rv.restStatus(request, True)  
+
+
 @rd.urlPOST(r'^ossec/alert$')
 def ossec_alert_creat_from_request(request):
     payload = request.DATA.get("payload")
-    if payload:
-        try:
-            # TODO make this a task (background it)
-            # rh.log_error("parsing payload", payload)
-            od = ossec.parseAlert(request, payload)
-            # lets now create a local event
-            if od is not None:
-                level = 10
-                if od.level > 10:
-                    level = 1
-                elif od.level > 7:
-                    level = 2
-                elif od.level == 6:
-                    level = 3
-                elif od.level == 5:
-                    level = 4
-                elif od.level == 4:
-                    level = 6
-                elif od.level <= 3:
-                    level = 8
-                metadata = od.toDict(graph="default")
-                metadata.update(od.metadata)
-                # we reuse the ssh_sig because it is a text field to store urls
-                # ssh_sig = metadata.get("ssh_sig", None)
-                # if ssh_sig is not None and ssh_sig.startswith("http"):    
-                #     metadata["url"] = ssh_sig
-                #     metadata["domain"] = ossec.extractDomain(ssh_sig)
-                #     metadata["path"] = ossec.extractUrlPath(ssh_sig)
-                #     metadata.pop("ssh_sig")
-                if od.geoip:
-                    metadata["country"] = od.geoip.country
-                    metadata["city"] = od.geoip.city
-                    metadata["province"] = od.geoip.state
-                    metadata["isp"] = od.geoip.isp
-
-                am.Event.createFromDict(None, {
-                    "hostname": od.hostname,
-                    "description": od.title,
-                    "details": od.text,
-                    "level": level,
-                    "category": "ossec",
-                    "component": "incident.ServerOssecAlert",
-                    "component_id": od.id,
-                    "reporter_ip": od.src_ip,
-                    "metadata": metadata
-                })
-                return rv.restStatus(request, True)
-        except Exception as err:
-            rh.log_exception()
-            stack = rh.getStackString()
-            # rh.log_exception("during ossec alert", payload)
-            metadata = dict(ip=request.ip, payload=payload)
-            am.Event.createFromDict(None, {
-                "hostname": request.get_host(),
-                "description": f"error parseing alert: {err}",
-                "details": stack,
-                "level": 8,
-                "category": "ossec_error",
+    if not payload:
+        return rv.restStatus(request, False, error="no alert data")
+    on_ossec_alert(request, payload)
+    return rv.restStatus(request, True)
+
+
+def on_ossec_alert(request, alert):
+    try:
+        # TODO make this a task (background it)
+        # rh.log_error("parsing payload", payload)
+        od = ossec.parseAlert(request, alert)
+        # lets now create a local event
+        if od is not None:
+            level = 10
+            if od.level > 10:
+                level = 1
+            elif od.level > 7:
+                level = 2
+            elif od.level == 6:
+                level = 3
+            elif od.level == 5:
+                level = 4
+            elif od.level == 4:
+                level = 6
+            elif od.level <= 3:
+                level = 8
+            metadata = od.toDict(graph="default")
+            metadata.update(od.metadata)
+            # we reuse the ssh_sig because it is a text field to store urls
+            # ssh_sig = metadata.get("ssh_sig", None)
+            # if ssh_sig is not None and ssh_sig.startswith("http"):    
+            #     metadata["url"] = ssh_sig
+            #     metadata["domain"] = ossec.extractDomain(ssh_sig)
+            #     metadata["path"] = ossec.extractUrlPath(ssh_sig)
+            #     metadata.pop("ssh_sig")
+            if od.geoip:
+                metadata["country"] = od.geoip.country
+                metadata["city"] = od.geoip.city
+                metadata["province"] = od.geoip.state
+                metadata["isp"] = od.geoip.isp
+
+            evt = am.Event.createFromDict(None, {
+                "hostname": od.hostname,
+                "description": od.title,
+                "details": od.text,
+                "level": level,
+                "category": "ossec",
+                "component": "incident.ServerOssecAlert",
+                "component_id": od.id,
+                "reporter_ip": od.src_ip,
                 "metadata": metadata
             })
+            # fix the created datetime to be from when it was actually happening
+            evt.created = od.when
+            evt.save()
+            return rv.restStatus(request, True)
+    except Exception as err:
+        rh.log_exception()
+        stack = rh.getStackString()
+        # rh.log_exception("during ossec alert", payload)
+        metadata = dict(ip=request.ip, payload=alert)
+        am.Event.createFromDict(None, {
+            "hostname": request.get_host(),
+            "description": f"error parseing alert: {err}",
+            "details": stack,
+            "level": 8,
+            "category": "ossec_error",
+            "metadata": metadata
+        })
     # rh.log_error("ossec alert", request.DATA.asDict())
     return rv.restStatus(request, False, error="no alert data")
 

{django_restit-4.2.165 → django_restit-4.2.167}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-restit"
-version = "4.2.165"
+version = "4.2.167"
 description = "A Rest Framework for DJANGO"
 authors = ["Ian Starnes <ians@311labs.com>"]
 license = "MIT"

{django_restit-4.2.165 → django_restit-4.2.167}/rest/__init__.py

@@ -1,4 +1,4 @@
 from .uberdict import UberDict  # noqa: F401
 from .settings_helper import settings  # noqa: F401
 
-__version__ = "4.2.165"
+__version__ = "4.2.167"