howler-api 3.4.0.dev962__tar.gz → 3.4.0.dev971__tar.gz

{howler_api-3.4.0.dev962 → howler_api-3.4.0.dev971}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.4.0.dev962
+Version: 3.4.0.dev971
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

howler_api-3.4.0.dev971/howler/odm/models/ecs/file.py

@@ -0,0 +1,83 @@
+from howler import odm
+from howler.odm.models.ecs.code_signature import CodeSignature
+from howler.odm.models.ecs.elf import ELF
+from howler.odm.models.ecs.hash import Hashes
+from howler.odm.models.ecs.pe import PE
+
+# from howler.odm.models.ecs.x509 import X509
+
+FILE_TYPE = ["file", "dir", "symlink"]
+
+
+@odm.model(
+    index=True,
+    store=True,
+    description="A file is defined as a set of information that has been created on, or has existed on a filesystem.",
+)
+class File(odm.Model):
+    accessed: str | None = odm.Optional(odm.Date(description="Last time the file was accessed."))
+    attributes: list[str] | None = odm.Optional(odm.List(odm.Keyword(), description="Array of file attributes."))
+    created: str | None = odm.Optional(odm.Date(description="File creation time."))
+    ctime: str | None = odm.Optional(odm.Date(description="Last time the file attributes or metadata changed."))
+    device: str | None = odm.Optional(odm.Keyword(description="Device that is the source of the file."))
+    directory: str | None = odm.Optional(
+        odm.Keyword(
+            description="Directory where the file is located. It should include the drive letter, when appropriate."
+        )
+    )
+    drive_letter: str | None = odm.Optional(
+        odm.Keyword(description="Drive letter where the file is located. This field is only relevant on Windows.")
+    )
+    extension: str | None = odm.Optional(odm.Keyword(description="File extension, excluding the leading dot."))
+    fork_name: str | None = odm.Optional(
+        odm.Keyword(description="A fork is additional data associated with a filesystem object.")
+    )
+    gid: str | None = odm.Optional(odm.Keyword(description="Primary group ID (GID) of the file."))
+    group: str | None = odm.Optional(odm.Keyword(description="Primary group name of the file."))
+    inode: str | None = odm.Optional(odm.Keyword(description="Inode representing the file in the filesystem."))
+    mime_type: str | None = odm.Optional(
+        odm.Keyword(
+            description="MIME type should identify the format of the file or stream of "
+            "bytes using IANA official types, where possible."
+        )
+    )
+    mode: str | None = odm.Optional(odm.Keyword(description="Mode of the file in octal representation."))
+    mtime: str | None = odm.Optional(odm.Date(description="Last time the file content was modified."))
+    name: str | None = odm.Optional(
+        odm.Keyword(description="Name of the file including the extension, without the directory.")
+    )
+    owner: str | None = odm.Optional(odm.Keyword(description="File owner’s username."))
+    path: str | None = odm.Optional(
+        odm.Keyword(
+            description="Full path to the file, including the file name. "
+            "It should include the drive letter, when appropriate."
+        )
+    )
+    size: int | None = odm.Long(description="File size in bytes.", optional=True)
+    target_path: str | None = odm.Optional(odm.Keyword(description="Target path for symlinks."))
+    type: str | None = odm.Optional(odm.Enum(values=FILE_TYPE, description="File type (file, dir, or symlink)."))
+    uid: str | None = odm.Optional(
+        odm.Keyword(description="The user ID (UID) or security identifier (SID) of the file owner.")
+    )
+
+    code_signature: CodeSignature | None = odm.Optional(
+        odm.Compound(
+            CodeSignature,
+            description="These fields contain information about binary code signatures.",
+        )
+    )
+    elf: ELF | None = odm.Optional(
+        odm.Compound(
+            ELF,
+            description="These fields contain Linux Executable Linkable Format (ELF) metadata.",
+        )
+    )
+    hash: Hashes | None = odm.Optional(
+        odm.Compound(
+            Hashes,
+            description="Hashes, usually file hashes.",
+        )
+    )
+    pe: PE | None = odm.Optional(
+        odm.Compound(PE, description="These fields contain Windows Portable Executable (PE) metadata.")
+    )

{howler_api-3.4.0.dev962 → howler_api-3.4.0.dev971}/howler/odm/models/ecs/process.py

@@ -79,7 +79,7 @@ class ParentParentProcess(odm.Model):
         odm.Compound(PE),
         description="Windows Portable Executable (PE) metadata.",
     )
-    pid = odm.Optional(odm.Integer(description="Process id."))
+    pid = odm.Optional(odm.Long(description="Process id."))
     same_as_process = odm.Optional(
         odm.Boolean(
             description="This boolean is used to identify if a leader process is the same as the top level process."
@@ -141,7 +141,7 @@ class ParentProcess(odm.Model):
         odm.Compound(PE),
         description="Windows Portable Executable (PE) metadata.",
     )
-    pid = odm.Optional(odm.Integer(description="Process id."))
+    pid = odm.Optional(odm.Long(description="Process id."))
     same_as_process = odm.Optional(
         odm.Boolean(
             description="This boolean is used to identify if a leader process is the same as the top level process."
@@ -203,7 +203,7 @@ class Process(odm.Model):
         odm.Compound(PE),
         description="Windows Portable Executable (PE) metadata.",
     )
-    pid = odm.Optional(odm.Integer(description="Process id."))
+    pid = odm.Optional(odm.Long(description="Process id."))
     same_as_process = odm.Optional(
         odm.Boolean(
             description="This boolean is used to identify if a leader process is the same as the top level process."

{howler_api-3.4.0.dev962 → howler_api-3.4.0.dev971}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "3.4.0.dev962"
+version = "3.4.0.dev971"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",

howler_api-3.4.0.dev962/howler/odm/models/ecs/file.py

@@ -1,83 +0,0 @@
-from typing import Optional
-
-from howler import odm
-from howler.odm.models.ecs.code_signature import CodeSignature
-from howler.odm.models.ecs.elf import ELF
-from howler.odm.models.ecs.hash import Hashes
-from howler.odm.models.ecs.pe import PE
-
-# from howler.odm.models.ecs.x509 import X509
-
-FILE_TYPE = ["file", "dir", "symlink"]
-
-
-@odm.model(
-    index=True,
-    store=True,
-    description="A file is defined as a set of information that has been created on, or has existed on a filesystem.",
-)
-class File(odm.Model):
-    accessed: Optional[str] = odm.Optional(odm.Date(description="Last time the file was accessed."))
-    attributes: Optional[list[str]] = odm.Optional(odm.List(odm.Keyword(), description="Array of file attributes."))
-    created: Optional[str] = odm.Optional(odm.Date(description="File creation time."))
-    ctime: Optional[str] = odm.Optional(odm.Date(description="Last time the file attributes or metadata changed."))
-    device: Optional[str] = odm.Optional(odm.Keyword(description="Device that is the source of the file."))
-    directory: Optional[str] = odm.Optional(
-        odm.Keyword(
-            description="Directory where the file is located. It should include the drive letter, when appropriate."
-        )
-    )
-    drive_letter: Optional[str] = odm.Optional(
-        odm.Keyword(description="Drive letter where the file is located. This field is only relevant on Windows.")
-    )
-    extension: Optional[str] = odm.Optional(odm.Keyword(description="File extension, excluding the leading dot."))
-    fork_name: Optional[str] = odm.Optional(
-        odm.Keyword(description="A fork is additional data associated with a filesystem object.")
-    )
-    gid: Optional[str] = odm.Optional(odm.Keyword(description="Primary group ID (GID) of the file."))
-    group: Optional[str] = odm.Optional(odm.Keyword(description="Primary group name of the file."))
-    inode: Optional[str] = odm.Optional(odm.Keyword(description="Inode representing the file in the filesystem."))
-    mime_type: Optional[str] = odm.Optional(
-        odm.Keyword(
-            description="MIME type should identify the format of the file or stream of "
-            "bytes using IANA official types, where possible."
-        )
-    )
-    mode: Optional[str] = odm.Optional(odm.Keyword(description="Mode of the file in octal representation."))
-    mtime: Optional[str] = odm.Optional(odm.Date(description="Last time the file content was modified."))
-    name: Optional[str] = odm.Optional(
-        odm.Keyword(description="Name of the file including the extension, without the directory.")
-    )
-    owner: Optional[str] = odm.Optional(odm.Keyword(description="File owner’s username."))
-    path: Optional[str] = odm.Optional(
-        odm.Keyword(
-            description="Full path to the file, including the file name. "
-            "It should include the drive letter, when appropriate."
-        )
-    )
-    size: Optional[int] = odm.Integer(description="File size in bytes.", optional=True)
-    target_path: Optional[str] = odm.Optional(odm.Keyword(description="Target path for symlinks."))
-    type: Optional[str] = odm.Optional(odm.Enum(values=FILE_TYPE, description="File type (file, dir, or symlink)."))
-    uid: Optional[str] = odm.Optional(
-        odm.Keyword(description="The user ID (UID) or security identifier (SID) of the file owner.")
-    )
-
-    code_signature: Optional[CodeSignature] = odm.Optional(
-        odm.Compound(
-            CodeSignature,
-            description="These fields contain information about binary code signatures.",
-        )
-    )
-    elf: Optional[ELF] = odm.Optional(
-        odm.Compound(
-            ELF,
-            description="These fields contain Linux Executable Linkable Format (ELF) metadata.",
-        )
-    )
-    hash: Optional[Hashes] = odm.Optional(
-        odm.Compound(
-            Hashes,
-            description="These fields contain Windows Portable Executable (PE) metadata.",
-        )
-    )
-    pe: Optional[PE] = odm.Optional(odm.Compound(PE, description="Hashes, usually file hashes."))