django-restit 4.2.76__tar.gz → 4.2.78__tar.gz

{django_restit-4.2.76 → django_restit-4.2.78}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.76
+Version: 4.2.78
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

{django_restit-4.2.76 → django_restit-4.2.78}/account/models/member.py

@@ -884,8 +884,8 @@ class Member(User, RestModel, MetaDataModel):
             if token is None:
                 token = AuthToken(member=self, role="default")
             token.generateToken()
-        elif action == "refresh_keys":
-            self.refreshSecurityToken()
+        elif action == "refresh_keys" or action == "force_logout":
+            self.forceLogout()
 
     def set_full_name(self, value):
         self.set_name(value)

{django_restit-4.2.76 → django_restit-4.2.78}/incident/parsers/ossec.py

@@ -45,7 +45,7 @@ def extractUrlPath(text):
 
 def extractMetaData(alert):
     irule = int(alert.rule_id)
-    if irule == 31301:
+    if irule in [31301, 31302, 31303]:
         patterns = {
             "src_ip": re.compile(r"Src IP: (\S+)"),
             "path": re.compile(r"request: (\S+ \S+)"),
@@ -171,13 +171,24 @@ def parseAlert(request, data):
             remote_file = m.group(1)
             alert.title = f"New file detected: '{remote_file}'"
     elif irule == 31101:
-        m = re.search(r"GET\s+(http://[^\s]+)\s+HTTP/\d\.\d\s+(\d+)", data.text)
+        m = re.search(r"(GET|POST|DELETE|PUT)\s+(http://[^\s]+)\s+HTTP/\d\.\d\s+(\d+)", data.text)
         if m and m.groups():
-            code = m.group(2)
-            request_path = m.group(1)
-            alert.title = f"HTTP {code}: {request_path}"
-    elif irule == 31301:
-        m = re.search(r"(\[error\]|\[crit\])[^\*]*\*\d*\s+(.*?),", text)
+            code = m.group(3)
+            method = m.group(1)
+            request_path = m.group(2)
+            alert.title = f"HTTP {code}: {METHOD} {request_path}"
+    elif irule == 31104 or irule == 31516:
+        m = re.search(r"(GET|POST|DELETE|PUT)\s+(http://[^\s]+)\s+HTTP/\d\.\d\s+(\d+)", data.text)
+        if m and m.groups():
+            code = m.group(3)
+            method = m.group(1)
+            request_path = m.group(2)
+            kind = "Common"
+            if irule == 31516:
+                kind = "Suspect"
+            alert.title = f"{kind} Attack {code}: {METHOD} {request_path}"
+    elif irule in [31301, 31302, 31303]:
+        m = re.search(r"(\[error\]|\[crit\])[^\*]*\*\d*\s+(.*?),", data.text)
         if m and len(m.groups()) >=2:
             alert.title = error
     elif irule == 100020:

{django_restit-4.2.76 → django_restit-4.2.78}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-restit"
-version = "4.2.76"
+version = "4.2.78"
 description = "A Rest Framework for DJANGO"
 authors = ["Ian Starnes <ians@311labs.com>"]
 license = "MIT"