howler-api 3.2.0.dev430__tar.gz → 3.2.0.dev437__tar.gz

{howler_api-3.2.0.dev430 → howler_api-3.2.0.dev437}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.2.0.dev430
+Version: 3.2.0.dev437
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-3.2.0.dev430 → howler_api-3.2.0.dev437}/howler/datastore/howler_store.py

@@ -1,9 +1,12 @@
 from typing import TYPE_CHECKING
 
 from howler.common.exceptions import HowlerAttributeError
+from howler.config import config
 from howler.datastore.collection import ESCollection, logger
+from howler.odm.base import Compound
 from howler.odm.models.action import Action
 from howler.odm.models.analytic import Analytic
+from howler.odm.models.clue import Clue
 from howler.odm.models.dossier import Dossier
 from howler.odm.models.hit import Hit
 from howler.odm.models.overview import Overview
@@ -41,6 +44,12 @@ class HowlerDatastore(object):
                     logger.info("Modifying %s odm with function from plugin %s", _index, plugin.name)
                     modify_odm(_odm)
 
+        if config.core.clue.enabled:
+            Hit.add_namespace(
+                "clue",
+                Compound(Clue, description="Clue-specific overrides for this alert", default=None, optional=True),
+            )
+
         for _index, _odm in INDEXES:
             self.ds.register(_index, _odm)
 

howler_api-3.2.0.dev437/howler/odm/models/clue.py

@@ -0,0 +1,16 @@
+from howler import odm
+
+
+@odm.model(index=True, store=True, description="A mapping from a specific field in Howler to a clue type")
+class TypeMap(odm.Model):
+    field: str = odm.Keyword(description="The field whose clue type to override")
+    type: str = odm.Keyword(description="The clue type to override the field as")
+
+
+@odm.model(index=True, store=True, description="Clue-specific overrides for this alert")
+class Clue(odm.Model):
+    types: list[TypeMap] = odm.List(
+        odm.Compound(TypeMap),
+        default=[],
+        description="A mapping of howler fields to clue types to augment/override system configuration.",
+    )

{howler_api-3.2.0.dev430 → howler_api-3.2.0.dev437}/howler/odm/random_data.py

@@ -4,6 +4,7 @@ from pathlib import Path
 
 from dotenv import load_dotenv
 
+from howler.odm.models.clue import Clue
 from howler.plugins import get_plugins
 
 load_dotenv()
@@ -529,6 +530,18 @@ def create_hits(ds: HowlerDatastore, hit_count: int = 200):
             hit.howler.analytic = "SecretAnalytic"
             hit.howler.detection = None
 
+        if config.core.clue.enabled:
+            hit.clue = Clue(
+                {
+                    "types": [
+                        {"field": "destination.user.group.id", "type": "domain"},
+                        {"field": "dns.response_code", "type": "url"},
+                        {"field": "file.name", "type": "url"},
+                        {"field": "faas.name", "type": "domain"},
+                    ]
+                }
+            )
+
         ds.hit.save(hit.howler.id, hit)
         analytic_service.save_from_hit(hit, random.choice(users))
         ds.analytic.commit()

{howler_api-3.2.0.dev430 → howler_api-3.2.0.dev437}/pyproject.toml

@@ -148,7 +148,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "3.2.0.dev430"
+version = "3.2.0.dev437"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",