howler-api 3.4.0.dev950__tar.gz → 3.4.0.dev962__tar.gz

{howler_api-3.4.0.dev950 → howler_api-3.4.0.dev962}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.4.0.dev950
+Version: 3.4.0.dev962
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-3.4.0.dev950 → howler_api-3.4.0.dev962}/howler/datastore/collection.py

@@ -1364,6 +1364,43 @@ class ESCollection(Generic[ModelType]):
 
         return res["updated"]
 
+    def _expand_fl(self, fl: str) -> str:
+        """Expand wildcard patterns in a field list string using the model's flat_fields.
+
+        For each comma-separated entry in `fl`, if the entry contains a `*`, it is treated
+        as a glob-style wildcard pattern and matched against all fields returned by
+        ``flat_fields()``.  Entries without wildcards are kept as-is.
+
+        Args:
+            fl: Comma-separated list of field names, optionally containing ``*`` wildcards
+                (e.g. ``"howler.*,event.start"``).
+
+        Returns:
+            A comma-separated string of expanded field names.  If no model class is
+            associated with this collection the original ``fl`` string is returned
+            unchanged.
+        """
+        if not self.model_class or "*" not in fl:
+            return fl
+
+        all_fields = list(self.model_class.flat_fields().keys())
+        expanded: list[str] = []
+        for pattern in fl.split(","):
+            pattern = pattern.strip()
+            if not pattern:
+                # Skip empty entries (e.g. from trailing commas).
+                continue
+            if "*" not in pattern or pattern == "*":
+                # Exact names and the bare '*' (meaning "all fields") are kept as-is.
+                expanded.append(pattern)
+            else:
+                # Convert the glob-style wildcard to a full regex pattern.
+                # Replace '*' with '.*' and escape all other regex special characters.
+                regex = re.compile("^" + re.escape(pattern).replace(r"\*", ".*") + "$")
+                matched = [f for f in all_fields if regex.match(f)]
+                expanded.extend(matched if matched else [pattern])
+        return ",".join(expanded)
+
     def _format_output(self, result, fields=None, as_obj=True):
         # Getting search document data
         extra_fields = result.get("fields", {})
@@ -1735,6 +1772,7 @@ class ESCollection(Generic[ModelType]):
         ]
 
         if fl:
+            fl = self._expand_fl(fl)
             field_list = fl.split(",")
             args.append(("field_list", field_list))
         else:
@@ -1847,6 +1885,7 @@ class ESCollection(Generic[ModelType]):
             filters.append(access_control)
 
         if fl:
+            fl = self._expand_fl(fl)
             fl = fl.split(",")
 
         query_expression = {
@@ -1896,6 +1935,8 @@ class ESCollection(Generic[ModelType]):
 
         if not fl:
             fl = "howler.id"
+        else:
+            fl = self._expand_fl(fl)
 
         if rows is None:
             rows = 5
@@ -2226,6 +2267,7 @@ class ESCollection(Generic[ModelType]):
         filters.append("%s:*" % group_field)
 
         if fl:
+            fl = self._expand_fl(fl)
             field_list = fl.split(",")
             args.append(("field_list", field_list))
         else:

{howler_api-3.4.0.dev950 → howler_api-3.4.0.dev962}/howler/odm/models/ecs/host.py

@@ -13,5 +13,11 @@ class Host(odm.Model):
     ip: list[str] = odm.List(odm.IP(), default=[], description="Host ip addresses.")
     mac: list[str] = odm.List(odm.Keyword(), default=[], description="Host MAC addresses.")
     name: Optional[str] = odm.Optional(odm.Keyword(description="Name of the host."))
+    hostname: Optional[str] = odm.Optional(
+        odm.Keyword(
+            description="Hostname of the host. It normally contains what the hostname "
+            "command returns on the host machine"
+        )
+    )
     domain: Optional[str] = odm.Optional(odm.Keyword(description="Domain the host is a member of."))
     type: Optional[str] = odm.Optional(odm.Keyword(description="As described by CSP."))

{howler_api-3.4.0.dev950 → howler_api-3.4.0.dev962}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "3.4.0.dev950"
+version = "3.4.0.dev962"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",