howler-api 4.0.0.dev1110__tar.gz → 4.0.0.dev1121__tar.gz

{howler_api-4.0.0.dev1110 → howler_api-4.0.0.dev1121}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev1110
+Version: 4.0.0.dev1121
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.0.0.dev1110 → howler_api-4.0.0.dev1121}/howler/api/v2/case.py

@@ -354,7 +354,8 @@ def add_rule(id: str, user: User, **kwargs):
     {
         "query": "howler.analytic:Suspicious*",
         "destination": "alerts/{{howler.analytic}}",
-        "timeframe": "2026-05-06T00:00:00Z"   // optional, null means no expiry
+        "timeframe": 14,                        // optional, days until expiry (null = no expiry)
+        "expire_after_resolved": true           // optional, start countdown after case resolution
     }
 
     Result Example:
@@ -405,7 +406,8 @@ def delete_rule(id: str, rule_id: str, user: User, **kwargs):
 def update_rule(id: str, rule_id: str, user: User, **kwargs):
     """Update a correlation rule on a case
 
-    Allows updating individual fields on a rule: enabled, query, destination, timeframe.
+    Allows updating individual fields on a rule: enabled, query, destination,
+    timeframe, expire_after_resolved.
 
     Variables:
     id        => The id of the case
@@ -416,7 +418,9 @@ def update_rule(id: str, rule_id: str, user: User, **kwargs):
 
     Data Block:
     {
-        "enabled": false
+        "enabled": false,
+        "timeframe": 7,                 // days until expiry
+        "expire_after_resolved": true   // start countdown after resolution
     }
 
     Result Example:

{howler_api-4.0.0.dev1110 → howler_api-4.0.0.dev1121}/howler/odm/base.py

@@ -637,6 +637,11 @@ class IndexText(_Field):
 class Integer(_Field):
     """A field storing an integer value."""
 
+    def __init__(self, *args, min=None, max=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.min = min
+        self.max = max
+
     def check(self, value, context=[], **kwargs):
         if self.optional and value is None:
             return None
@@ -646,10 +651,17 @@ class Integer(_Field):
                 return self.default
 
         try:
-            return int(value)
+            result = int(value)
         except ValueError as e:
             raise HowlerValueError(f"[{'.'.join(context)}]: {str(e)}")
 
+        if self.min is not None and result < self.min:
+            raise HowlerValueError(f"[{'.'.join(context)}]: {result} is less than minimum value {self.min}")
+        if self.max is not None and result > self.max:
+            raise HowlerValueError(f"[{'.'.join(context)}]: {result} is greater than maximum value {self.max}")
+
+        return result
+
 
 class Long(_Field):
     """
@@ -658,6 +670,11 @@ class Long(_Field):
     In Elasticsearch, Integer supports values from -2^31 to 2^31-1, while Long supports values from -2^63 to 2^63-1.
     """
 
+    def __init__(self, *args, min=None, max=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.min = min
+        self.max = max
+
     def check(self, value, context=[], **kwargs):
         if self.optional and value is None:
             return None
@@ -667,10 +684,17 @@ class Long(_Field):
                 return self.default
 
         try:
-            return int(value)
+            result = int(value)
         except ValueError as e:
             raise HowlerValueError(f"[{'.'.join(context)}]: {str(e)}")
 
+        if self.min is not None and result < self.min:
+            raise HowlerValueError(f"[{'.'.join(context)}]: {result} is less than minimum value {self.min}")
+        if self.max is not None and result > self.max:
+            raise HowlerValueError(f"[{'.'.join(context)}]: {result} is greater than maximum value {self.max}")
+
+        return result
+
 
 class Float(_Field):
     """A field storing a floating point value."""

{howler_api-4.0.0.dev1110 → howler_api-4.0.0.dev1121}/howler/odm/helper.py

@@ -7,7 +7,7 @@ from random import choice, randint, sample
 from typing import Any, cast
 
 from howler.common.logging import get_logger
-from howler.config import config
+from howler.config import CLASSIFICATION, config
 from howler.datastore.howler_store import HowlerDatastore
 from howler.helper.discover import get_apps_list
 from howler.odm.base import Model
@@ -49,6 +49,9 @@ def generate_useful_hit(  # noqa: C901
     "Create a random, useful/cogent hit for synthetic data"
     hit: Hit = random_model_obj(cast(Model, Hit))
 
+    if CLASSIFICATION.enforce:
+        hit.classification = CLASSIFICATION.UNRESTRICTED
+
     rand_seed = random.random()
 
     timestamp = datetime.now() - timedelta(

{howler_api-4.0.0.dev1110 → howler_api-4.0.0.dev1121}/howler/odm/models/case.py

@@ -88,16 +88,34 @@ class CaseRule(odm.Model):
     query: str = odm.Keyword(description="Lucene query used by this rule.")
     author: str = odm.Keyword(description="Username who created the rule.")
     enabled: bool = odm.Boolean(default=True, description="Whether the rule is currently active.")
-    timeframe: Optional[str] = odm.Optional(
-        odm.Date(description="ISO datetime when rule expires. Null means no expiry."),
+    created_at: str = odm.Date(
+        default="NOW",
+        description="Timestamp when the rule was created.",
+    )
+    timeframe: Optional[int] = odm.Optional(
+        odm.Integer(min=1, description="Number of days the rule stays active. Null means no expiry."),
         default=None,
     )
+    expire_after_resolved: bool = odm.Boolean(
+        default=False,
+        description="When true, the timeframe countdown starts from the case's last "
+        "resolution time instead of from rule creation.",
+    )
     indexes: list[str] = odm.List(
         odm.Enum(values=RuleIndexTypes),
         default=[RuleIndexTypes.HIT],
         description="Indexes to run this rule against (hit, event, or both).",
     )
 
+    def __init__(self, data: dict = None, *args, **kwargs):
+        timeframe = data.get("timeframe") if data else None
+        if timeframe is not None and (isinstance(timeframe, bool) or not isinstance(timeframe, int) or timeframe <= 0):
+            raise HowlerValueError("Rule timeframe must be a positive integer or None")
+        elif timeframe is None and data.get("expire_after_resolved", False):
+            raise HowlerValueError("Rule cannot expire after resolved when no timeframe is set")
+
+        super().__init__(data, *args, **kwargs)
+
 
 @odm.model(index=True, store=True, description="Task associated with a case item path.")
 class CaseTask(odm.Model):

{howler_api-4.0.0.dev1110 → howler_api-4.0.0.dev1121}/howler/odm/random_data.py

@@ -19,7 +19,7 @@ import importlib
 import json
 import random
 import textwrap
-from datetime import datetime, timedelta
+from datetime import datetime
 from random import choice, randint, sample
 from typing import Any, Callable, cast
 from uuid import uuid4
@@ -908,13 +908,8 @@ def create_cases(ds: HowlerDatastore, num_cases: int = 5):
                         ),
                         "author": choice(selected_participants or ["admin"]),
                         "enabled": choice([True, True, True, False]),
-                        "timeframe": choice(
-                            [
-                                (datetime.now() + timedelta(days=randint(7, 28))).isoformat(),
-                                (datetime.now() + timedelta(days=randint(7, 28))).isoformat(),
-                                None,
-                            ]
-                        ),
+                        "timeframe": choice([7, 14, 28, None]),
+                        "expire_after_resolved": choice([True, False]),
                     }
                     for _ in range(randint(1, 3))
                 ],

{howler_api-4.0.0.dev1110 → howler_api-4.0.0.dev1121}/howler/odm/randomizer.py

@@ -490,10 +490,14 @@ def random_data_for_field(field: _Field, name: str, minimal: bool = False) -> _A
     elif isinstance(field, Date):
         return get_random_iso_date()
     elif isinstance(field, Integer):
-        return random.randint(-2_147_483_648, 2_147_483_647)
+        lo = field.min if field.min is not None else -2_147_483_648
+        hi = field.max if field.max is not None else 2_147_483_647
+        return random.randint(lo, hi)
     elif isinstance(field, Long):
         # Generate a random 64-bit signed integer
-        return random.randint(-9_223_372_036_854_775_808, 9_223_372_036_854_775_807)
+        lo = field.min if field.min is not None else -9_223_372_036_854_775_808
+        hi = field.max if field.max is not None else 9_223_372_036_854_775_807
+        return random.randint(lo, hi)
     elif isinstance(field, Float):
         # Generate a random float in a reasonable range
         return random.uniform(-1e6, 1e6)

{howler_api-4.0.0.dev1110 → howler_api-4.0.0.dev1121}/howler/services/case_service.py

@@ -4,6 +4,7 @@ This module provides functionality for creating, updating, retrieving, and manag
 cases - collections of security alerts and investigation data organized by analysts.
 """
 
+from datetime import datetime, timezone
 from typing import Any, overload
 
 from prometheus_client import Counter
@@ -149,6 +150,34 @@ def delete_cases(case_ids: set[str]) -> bool:
     return ds.case.delete_by_query(f"case_id:({' OR '.join(case_ids)})")
 
 
+def get_last_resolved_time(case: Case) -> datetime | None:
+    """Return the timestamp of the most recent resolution of a case.
+
+    Scans the case log newest-to-oldest for an entry where ``key='status'``
+    and ``new_value='resolved'``. In the case of multiple resolve/unresolve
+    cycles, returns the **final** resolved timestamp.
+
+    Args:
+        case: The Case object whose log to scan.
+
+    Returns:
+        A timezone-aware datetime if the case was ever resolved, else None.
+    """
+    for entry in reversed(case.log):
+        if entry.key == "status" and entry.new_value == "resolved":
+            ts = entry.timestamp
+            if isinstance(ts, datetime):
+                if ts.tzinfo is None:
+                    return ts.replace(tzinfo=timezone.utc)
+                return ts
+            try:
+                dt = datetime.fromisoformat(str(ts).replace("Z", "+00:00"))
+                return dt
+            except (ValueError, TypeError):
+                continue
+    return None
+
+
 def _describe_field_change(
     key: str, previous: Any, new: Any, compound_fields: set[str]
 ) -> tuple[str, str | None, str | None]:
@@ -823,10 +852,16 @@ def add_case_rule(case_id: str, rule_data: dict, user: User) -> Case:
         raise InvalidDataException("Rule 'destination' is required")
 
     rule_data.pop("rule_id", None)
+    rule_data.pop("created_at", None)
     rule_data["author"] = user.uname
     rule_data.setdefault("enabled", True)
+    rule_data.setdefault("expire_after_resolved", False)
+
+    try:
+        rule = CaseRule(rule_data)
+    except HowlerValueError as ex:
+        raise InvalidDataException(str(ex)) from ex
 
-    rule = CaseRule(rule_data)
     _case.rules.append(rule)
 
     _case.log.append(
@@ -890,7 +925,8 @@ def remove_case_rule(case_id: str, rule_id: str, user: User) -> Case:
 def update_case_rule(case_id: str, rule_id: str, update_data: dict, user: User) -> Case:
     """Update fields on an existing correlation rule.
 
-    Allowed fields: ``enabled``, ``query``, ``destination``, ``timeframe``.
+    Allowed fields: ``enabled``, ``query``, ``destination``, ``timeframe``,
+    ``expire_after_resolved``.
 
     Args:
         case_id: Unique identifier of the case.
@@ -911,7 +947,7 @@ def update_case_rule(case_id: str, rule_id: str, update_data: dict, user: User)
     if _case is None:
         raise NotFoundException(f"Case {case_id} does not exist")
 
-    allowed_fields = {"enabled", "query", "destination", "timeframe"}
+    allowed_fields = {"enabled", "query", "destination", "timeframe", "expire_after_resolved"}
     patch = {k: v for k, v in update_data.items() if k in allowed_fields}
     if not patch:
         raise InvalidDataException(
@@ -928,6 +964,11 @@ def update_case_rule(case_id: str, rule_id: str, update_data: dict, user: User)
         setattr(rule, key, value)
         changes.append(f"{key}: '{old_value}' → '{value}'")
 
+    if rule.timeframe is not None and (not isinstance(rule.timeframe, int) or rule.timeframe <= 0):
+        raise HowlerValueError("Rule timeframe must be a positive integer or None")
+    elif rule.timeframe is None and rule.expire_after_resolved:
+        raise InvalidDataException("Rule cannot expire after resolved when no timeframe is set")
+
     _case.log.append(
         CaseLog(
             {

{howler_api-4.0.0.dev1110 → howler_api-4.0.0.dev1121}/howler/services/correlation_service.py

@@ -8,7 +8,7 @@ The public API consists of three functions:
   calls ``process_batch`` in debounced batches.
 """
 
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 
 import chevron
 from opentelemetry import trace
@@ -29,9 +29,24 @@ BATCH_SIZE: int = config.system.correlation.batch_size
 BATCH_TIMEOUT: int = config.system.correlation.batch_timeout
 
 
-def get_active_rules() -> list[tuple[str, CaseRule]]:
+def _normalize_utc(ts: datetime) -> datetime:
+    """Normalize a datetime to UTC, assuming naive timestamps are UTC."""
+    if ts.tzinfo is None:
+        return ts.replace(tzinfo=timezone.utc)
+    return ts
+
+
+def get_active_rules() -> list[tuple[str, CaseRule]]:  # noqa: C901
     """Return all active (enabled, non-expired) rules across every case.
 
+    A rule's ``timeframe`` is an optional integer representing how many days
+    the rule stays active. When ``expire_after_resolved`` is False (default),
+    the countdown starts from ``rule.created_at``. When True, it starts from
+    the case's most recent resolution time (if the case has never been resolved
+    the timer has not started and the rule remains active).
+
+    If ``timeframe`` is None the rule never expires.
+
     Returns:
         A list of ``(case_id, rule)`` tuples for rules that should be evaluated.
     """
@@ -41,20 +56,43 @@ def get_active_rules() -> list[tuple[str, CaseRule]]:
 
     # Only fetch cases that actually have rules.
     for _case in ds.case.stream_search("_exists_:rules.rule_id"):
+        # Lazily compute last resolved time only if needed by at least one rule.
+        _last_resolved: datetime | None = None
+        _last_resolved_computed = False
+
         for rule in _case.rules:
             if not rule.enabled:
                 continue
 
-            if rule.timeframe is not None:
-                try:
-                    expiry = datetime.fromisoformat(str(rule.timeframe))
-                    if expiry <= now:
-                        continue
-                except (ValueError, TypeError):
-                    logger.warning("Invalid timeframe on rule %s in case %s", rule.rule_id, _case.case_id)
+            if rule.timeframe is None:
+                # No expiry configured — rule is always active.
+                active.append((_case.case_id, rule))
+                continue
+
+            # Skip rules whose timeframe is not a valid positive integer.
+            if isinstance(rule.timeframe, bool) or not isinstance(rule.timeframe, int) or rule.timeframe <= 0:
+                logger.warning("Skipping rule %s with invalid timeframe: %r", rule.rule_id, rule.timeframe)
+                continue
+
+            start: datetime
+            if not rule.expire_after_resolved:
+                start = datetime.fromisoformat(str(rule.created_at).replace("Z", "+00:00"))
+            else:
+                # Timer starts from last resolution.
+                if not _last_resolved_computed:
+                    _last_resolved = case_service.get_last_resolved_time(_case)
+                    _last_resolved_computed = True
+
+                if _last_resolved is None:
+                    # Case not yet resolved — timer hasn't started.
+                    active.append((_case.case_id, rule))
                     continue
 
-            active.append((_case.case_id, rule))
+                start = _normalize_utc(_last_resolved)
+
+            expiry = start + timedelta(days=rule.timeframe)
+            if expiry > now:
+                active.append((_case.case_id, rule))
 
     return active
 

{howler_api-4.0.0.dev1110 → howler_api-4.0.0.dev1121}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.0.0.dev1110"
+version = "4.0.0.dev1121"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",