django-restit 4.2.79__tar.gz → 4.2.81__tar.gz

{django_restit-4.2.79 → django_restit-4.2.81}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.79
+Version: 4.2.81
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

django_restit-4.2.81/auditlog/migrations/0002_alter_persistentlog_session.py

@@ -0,0 +1,20 @@
+# Generated by Django 4.2.11 on 2024-05-13 02:34
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('sessionlog', '0001_initial'),
+        ('auditlog', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='persistentlog',
+            name='session',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, to='sessionlog.sessionlog'),
+        ),
+    ]

django_restit-4.2.81/inbox/migrations/0005_alter_mailbox_state.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.11 on 2024-05-13 02:34
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('inbox', '0004_mailtemplate'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='mailbox',
+            name='state',
+            field=models.IntegerField(db_index=True, default=1),
+        ),
+    ]

django_restit-4.2.81/incident/migrations/0015_rule_title_template_alter_incident_state.py

@@ -0,0 +1,23 @@
+# Generated by Django 4.2.11 on 2024-05-13 02:34
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('incident', '0014_event_group_alter_rulecheck_index'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='rule',
+            name='title_template',
+            field=models.CharField(default=None, max_length=200, null=True),
+        ),
+        migrations.AlterField(
+            model_name='incident',
+            name='state',
+            field=models.IntegerField(choices=[(0, 'new'), (1, 'opened'), (2, 'paused'), (3, 'ignored'), (4, 'resolved'), (5, 'pending')], default=0),
+        ),
+    ]

{django_restit-4.2.79 → django_restit-4.2.81}/incident/models/event.py

@@ -155,7 +155,7 @@ class Event(JSONMetaData, rm.RestModel):
         incident = None
         action_count = 0
         if hit_rule is not None:
-            logger.error(f"RULE HIT: {hit_rule.name}")
+            # logger.error(f"RULE HIT: {hit_rule.name}")
             priority = hit_rule.priority
             if hit_rule.action == "ignore":
                 self.save()
@@ -184,7 +184,13 @@ class Event(JSONMetaData, rm.RestModel):
             if hit_rule is not None and hit_rule.action_after != 0:
                 incident.state = INCIDENT_STATE_PENDING
             # TODO possibly make this smarter?
-            if self.category == "ossec":
+            if hit_rule and hit_rule.title_template and "{" in hit_rule.title_template:
+                try:
+                    incident.description = hit_rule.title_template.format(event=self)
+                except Exception:
+                    logger.exception(hit_rule.title_template)
+                    incident.description = self.description
+            elif self.category == "ossec":
                 incident.description = f"{self.hostname}: {self.description}"
             else:
                 incident.description = self.description

{django_restit-4.2.79 → django_restit-4.2.81}/incident/models/rules.py

@@ -63,6 +63,7 @@ class Rule(models.Model, rm.RestModel):
     modified = models.DateTimeField(auto_now=True)
 
     name = models.CharField(max_length=200)
+    title_template = models.CharField(max_length=200, default=None, null=True)
     # the group the rule gets assigned to when triggered
     group = models.ForeignKey("account.Group", on_delete=models.CASCADE, null=True, default=None)
     # category allows us to limit running rules to only those with a category

{django_restit-4.2.79 → django_restit-4.2.81}/incident/parsers/ossec.py

@@ -131,8 +131,12 @@ def parse_alert_metadata(alert):
         if match:
             return dict(filename=match.group(1), action="added")
     elif alert.rule_id == "5402":
-        match = re.search(r'(?P<username>\w+) : PWD=(?P<pwd>\S+) ; USER=(?P<user>\w+) ; COMMAND=(?P<command>.+)', alert.text)
-        return match.groupdict()
+        match = re.search(r'(?P<username>[\w-]+) : PWD=(?P<pwd>\S+) ; USER=(?P<user>\w+) ; COMMAND=(?P<command>.+)', alert.text)
+        if match:
+            return match.groupdict()
+        match = re.search(r'(?P<username>[\w-]+) : TTY=(?P<tty>\S+) ; PWD=(?P<pwd>\S+) ; USER=(?P<user>\w+) ; COMMAND=(?P<command>.+)', alert.text)
+        if match:
+            return match.groupdict()
     elif alert.rule_id in ["5501", "5502"]:
         match = re.search(r"session (?P<action>\S+) for user (?P<username>\S+)*", alert.text)
         if match:
@@ -239,7 +243,8 @@ def update_by_rule(data, geoip=None):
     elif data.rule_id == "533":
         data.title = f"Network Open Port Change Detected on {data.hostname}"
     elif data.rule_id == "5402":
-        data.title = f"Sudo(user: {data.user}) executed on {data.hostname}"
+        cmd = truncate_str(data.command, 50)
+        data.title = f"Sudo(user: {data.user}) executed '{cmd}' on {data.hostname}"
     elif data.rule_id in ["551", "554"] and data.filename:
         name = truncate_str(data.filename, 50)
         data.title = f"File {data.action.capitalize()} on {data.hostname}: {name}"

{django_restit-4.2.79 → django_restit-4.2.81}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-restit"
-version = "4.2.79"
+version = "4.2.81"
 description = "A Rest Framework for DJANGO"
 authors = ["Ian Starnes <ians@311labs.com>"]
 license = "MIT"

django_restit-4.2.81/wiki/migrations/0002_alter_pagemedia_entry.py

@@ -0,0 +1,19 @@
+# Generated by Django 4.2.11 on 2024-05-13 02:34
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('wiki', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='pagemedia',
+            name='entry',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='media_library', to='wiki.page'),
+        ),
+    ]