howler-api 2.11.0.dev240__tar.gz → 2.11.0.dev244__tar.gz

{howler_api-2.11.0.dev240 → howler_api-2.11.0.dev244}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: howler-api
-Version: 2.11.0.dev240
+Version: 2.11.0.dev244
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs
@@ -33,7 +33,6 @@ Requires-Dist: gevent (==23.9.1)
 Requires-Dist: gunicorn (==23.0.0)
 Requires-Dist: luqum (>=1.0.0,<2.0.0)
 Requires-Dist: mergedeep (>=1.3.4,<2.0.0)
-Requires-Dist: netifaces (==0.11.0)
 Requires-Dist: packaging (<25.0)
 Requires-Dist: passlib (==1.7.4)
 Requires-Dist: prometheus-client (==0.17.1)

{howler_api-2.11.0.dev240 → howler_api-2.11.0.dev244}/howler/services/analytic_service.py

@@ -1,3 +1,5 @@
+from typing import Any, Union
+
 from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.datastore.operations import OdmUpdateOperation
@@ -36,6 +38,27 @@ def update_analytic(
     return result
 
 
+def get_matching_analytics(hits: Union[list[Hit], list[dict[str, Any]]]) -> list[Analytic]:
+    """Get a list of matching analytics for the given list of hits.
+
+    Args:
+        hits (Union[list[Hit], list[dict[str, Any]]]): A list of Hit objects or dictionaries representing hits.
+    Returns:
+        list[Analytic]: A list of Analytic objects that match the analytics referenced in the hits.
+    """
+    storage = datastore()
+
+    analytic_names: set[str] = set()
+    for hit in hits:
+        analytic_names.add(f'"{sanitize_lucene_query(hit["howler"]["analytic"])}"')
+
+    existing_analytics: list[Analytic] = storage.analytic.search(f'name:({" OR ".join(analytic_names)})', as_obj=True)[
+        "items"
+    ]
+
+    return existing_analytics
+
+
 def save_from_hit(hit: Hit, user: User):
     """Save updates to an analytic based on a new hit that has been created
 

{howler_api-2.11.0.dev240 → howler_api-2.11.0.dev244}/howler/services/hit_service.py

@@ -30,7 +30,7 @@ from howler.odm.models.ecs.event import Event
 from howler.odm.models.hit import Hit
 from howler.odm.models.howler_data import HitOperationType, HitStatus, HitStatusTransition, Log
 from howler.odm.models.user import User
-from howler.services import action_service, dossier_service
+from howler.services import action_service, analytic_service, dossier_service
 from howler.utils.dict_utils import extra_keys, flatten
 from howler.utils.uid import get_random_id
 
@@ -821,7 +821,7 @@ def __match_metadata(candidates: list[dict[str, Any]], hit: dict[str, Any]) -> O
     return sorted(matching_candidates, key=functools.cmp_to_key(__compare_metadata))[0]
 
 
-def augment_metadata(data: list[dict[str, Any]] | dict[str, Any], metadata: list[str], user: dict[str, Any]):
+def augment_metadata(data: list[dict[str, Any]] | dict[str, Any], metadata: list[str], user: dict[str, Any]):  # noqa: C901
     """Augment hit search results with additional metadata.
 
     This function enriches hit data by adding related information such as templates,
@@ -862,6 +862,21 @@ def augment_metadata(data: list[dict[str, Any]] | dict[str, Any], metadata: list
             for hit in hits:
                 hit["__overview"] = __match_metadata(overview_candidates, hit)
 
+    if "analytic" in metadata:
+        matched_analytics = analytic_service.get_matching_analytics(hits)
+
+        for hit in hits:
+            matched_analytic = next(
+                (
+                    analytic
+                    for analytic in matched_analytics
+                    if analytic.name.lower() == hit["howler"]["analytic"].lower()
+                ),
+                None,
+            )
+
+            hit["__analytic"] = matched_analytic.as_primitives() if matched_analytic else None
+
     if "dossiers" in metadata:
         dossiers: list[dict[str, Any]] = datastore().dossier.search(
             "dossier_id:*",

{howler_api-2.11.0.dev240 → howler_api-2.11.0.dev244}/pyproject.toml

@@ -148,7 +148,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "2.11.0.dev240"
+version = "2.11.0.dev244"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",
@@ -203,7 +203,6 @@ flask = "2.2.5"
 flask-caching = "2.0.2"
 gevent = "23.9.1"
 gunicorn = "23.0.0"
-netifaces = "0.11.0"
 packaging = "<25.0"
 passlib = "1.7.4"
 prometheus-client = "0.17.1"