howler-api 2.13.0.dev329__py3-none-any.whl

howler/odm/models/analytic.py

@@ -0,0 +1,90 @@
+# mypy: ignore-errors
+from typing import Optional
+
+from howler import odm
+from howler.odm.models.howler_data import Assessment
+
+
+@odm.model(index=True, store=True, description="Comment definition.")
+class Comment(odm.Model):
+    id = odm.UUID(description="A unique ID for the comment")
+    timestamp = odm.Date(description="Timestamp at which the comment took place.", default="NOW")
+    modified = odm.Date(description="Timestamp at which the comment was last edited.", default="NOW")
+    detection: Optional[str] = odm.Keyword(
+        description="The detection the comment applies to, if it applies to a particular detection",
+        optional=True,
+    )
+    value = odm.Text(description="The comment itself.")
+    user = odm.Keyword(description="User ID who created the comment.")
+    reactions: dict[str, str] = odm.Mapping(
+        odm.Keyword(),
+        default={},
+        description="A list of reactions to the comment",
+    )
+
+
+DEFAULT_TRIAGE = {"skip_rationale": False, "valid_assessments": Assessment.list()}
+
+
+@odm.model(index=True, store=True, description="Settings for triaging this analytic.")
+class TriageOptions(odm.Model):
+    valid_assessments: list[str] = odm.List(
+        odm.Keyword(),
+        default=DEFAULT_TRIAGE["valid_assessments"],
+        description="What list of assessments is valid for this analytic?",
+    )
+    skip_rationale: bool = odm.Boolean(
+        description="Should traiging alerts under this analytic skip the rationale field?",
+        default=DEFAULT_TRIAGE["skip_rationale"],
+    )
+    dossiers: list[str] = odm.List(
+        odm.Keyword(), description="A list of dossiers to present to the user when triaging alerts.", default=[]
+    )
+
+
+@odm.model(index=True, store=True, description="Notebook data")
+class Notebook(odm.Model):
+    id = odm.UUID(description="A unique ID for the notebook")
+    detection: Optional[str] = odm.Keyword(
+        description="The detection the notebook applies to, if it applies to a particular detection",
+        optional=True,
+    )
+    value = odm.Text(description="The link to the notebook")
+    name = odm.Text(description="Name for the analytic")
+    user = odm.Keyword(description="User ID who added the notebook.")
+
+
+@odm.model(index=True, store=True, description="Metadata concerning a howler analytic, including configuration.")
+class Analytic(odm.Model):
+    analytic_id: str = odm.UUID(description="A UUID for this analytic")
+    notebooks: list[Notebook] = odm.List(
+        odm.Compound(Notebook),
+        default=[],
+        description="A list of useful notebooks for the analytic",
+    )
+    name: str = odm.Keyword(description="The name of the analytic.")
+    owner: Optional[str] = odm.Keyword(description="The username of the user who owns this analytic.", optional=True)
+    contributors: list[str] = odm.List(
+        odm.Keyword(),
+        description="A list of users who have contributed to this analytic.",
+        default=[],
+    )
+    description: Optional[str] = odm.Text(description="A markdown description of the analytic", optional=True)
+    detections: list[str] = odm.List(
+        odm.Keyword(),
+        description="The detections which this analytic contains.",
+        default=[],
+    )
+    comment: list[Comment] = odm.List(
+        odm.Compound(Comment),
+        default=[],
+        description="A list of comments with timestamps and attribution.",
+    )
+    rule: Optional[str] = odm.Keyword(description="A rule query", optional=True)
+    rule_type: Optional[str] = odm.Optional(odm.Enum(values=["lucene", "eql", "sigma"], description="Type of rule"))
+    rule_crontab: Optional[str] = odm.Keyword(description="The interval for the rule to run at", optional=True)
+    triage_settings: Optional[TriageOptions] = odm.Compound(
+        TriageOptions,
+        description="Settings for triaging this analytic.",
+        default=DEFAULT_TRIAGE,
+    )

howler/odm/models/assemblyline.py

@@ -0,0 +1,48 @@
+from howler import odm
+
+
+@odm.model(
+    index=True,
+    store=True,
+)
+class ALRecord(odm.Model):
+    type: str = odm.Optional(odm.Keyword())
+    subtype: str = odm.Optional(odm.Keyword())
+    value: str = odm.Optional(odm.Keyword())
+    verdict: str = odm.Optional(odm.Keyword())
+
+
+@odm.model(
+    index=True,
+    store=True,
+)
+class Mitre(odm.Model):
+    tactic: list[ALRecord] = odm.List(odm.Compound(ALRecord), default=[])
+    technique: list[ALRecord] = odm.List(odm.Compound(ALRecord), default=[])
+
+
+DEFAULT_MITRE: dict[str, list[ALRecord]] = {"tactic": [], "technique": []}
+
+
+@odm.model(
+    index=True,
+    store=True,
+    description="The AssemblyLine fields contain any data obtained from AssemblyLine relating to the alert.",
+)
+class AssemblyLine(odm.Model):
+    # al.detailed.av
+    antivirus: list[ALRecord] = odm.List(odm.Compound(ALRecord), default=[])
+    # al.detailed.attrib
+    attribution: list[ALRecord] = odm.List(odm.Compound(ALRecord), default=[])
+    # al.detailed.behavior
+    behaviour: list[ALRecord] = odm.List(odm.Compound(ALRecord), default=[])
+    # al.detailed.domain
+    domain: list[ALRecord] = odm.List(odm.Compound(ALRecord), default=[])
+    # al detailed.heuristic
+    heuristic: list[ALRecord] = odm.List(odm.Compound(ALRecord), default=[])
+    # al.detailed.[attack_category, attack_pattern]
+    mitre: Mitre = odm.Optional(odm.Compound(Mitre), default=DEFAULT_MITRE)
+    # al.detailed.uri
+    uri: list[ALRecord] = odm.List(odm.Compound(ALRecord), default=[])
+    # al.detailed.yara
+    yara: list[ALRecord] = odm.List(odm.Compound(ALRecord), default=[])

howler/odm/models/aws.py

@@ -0,0 +1,23 @@
+from howler import odm
+
+
+@odm.model(index=True, store=True, description="Cloud account information.")
+class Account(odm.Model):
+    id = odm.Optional(odm.Keyword(description="The ID of the AWS Account."))
+    name = odm.Optional(odm.Keyword(description="The name of the AWS Account."))
+
+
+@odm.model(index=True, store=True, description="Organization information.")
+class Organization(odm.Model):
+    id = odm.Optional(odm.Keyword(description="The ID of the AWS Organization."))
+    organizational_unit = odm.Optional(odm.Keyword(description="The Organizational Unit the Account belongs to."))
+
+
+@odm.model(
+    index=True,
+    store=True,
+    description="Fields related to AWS.",
+)
+class AWS(odm.Model):
+    account = odm.Optional(odm.Compound(Account, description="AWS account information."))
+    organization = odm.Optional(odm.Compound(Organization, description="Organization information."))

howler/odm/models/azure.py

@@ -0,0 +1,16 @@
+from howler import odm
+
+
+@odm.model(
+    index=True,
+    store=True,
+    description="Fields related to Azure.",
+)
+class Azure(odm.Model):
+    subscription_id = odm.Optional(odm.Keyword(description="The unique identifier for the Azure subscription."))
+    tenant_id = odm.Optional(odm.Keyword(description="The unique identifier for the Azure tenant."))
+    resource_group = odm.Optional(odm.Keyword(description="The name of the Azure resource group."))
+    upn = odm.Optional(
+        odm.Keyword(description="The user principal name (UPN) in Azure, used for authentication. Alias of user.name.")
+    )
+    resource_id = odm.Optional(odm.Keyword(description="The unique Azure Resource Identifier (AzureRI)."))

howler/odm/models/cbs.py

@@ -0,0 +1,44 @@
+from howler import odm
+
+
+@odm.model(
+    index=True,
+    store=True,
+)
+class SharepointUser(odm.Model):
+    email: str = odm.Optional(odm.Email(description="The email of the sharepoint user associated with this item."))
+    full_name: str = odm.Optional(
+        odm.Keyword(description="The full name of the sharepoint user associated with this item.")
+    )
+    id: str = odm.Optional(odm.Keyword(description="The id of the sharepoint user associated with this item."))
+
+
+@odm.model(
+    index=True,
+    store=True,
+)
+class SharepointData(odm.Model):
+    application: str = odm.Optional(odm.Keyword(description="The associated application."))
+    user: str = odm.Optional(odm.Keyword(description="The associated application."))
+
+
+@odm.model(
+    index=True,
+    store=True,
+)
+class Sharepoint(odm.Model):
+    created: SharepointData = odm.Optional(
+        odm.Compound(SharepointData, description="Information about how the item was created.")
+    )
+    modified: SharepointData = odm.Optional(
+        odm.Compound(SharepointData, description="Information about how the item was modified.")
+    )
+
+
+@odm.model(
+    index=True,
+    store=True,
+    description="The cbs fields contain any data obtained from CBS relating to the alert.",
+)
+class CBS(odm.Model):
+    sharepoint: Sharepoint = odm.Optional(odm.Compound(Sharepoint, description="Sharepoint metadata"))