howler-api 4.0.0.dev1266__tar.gz → 4.0.0.dev1281__tar.gz

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev1266
+Version: 4.0.0.dev1281
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/actions/demote.py

@@ -76,7 +76,7 @@ def execute(
                     *hit_helper.demote_hit(escalation=escalation),
                     odm_helper.update("howler.assessment", None),
                     odm_helper.update("howler.rationale", None),
-                    odm_helper.update("howler.assignment", None),
+                    odm_helper.update("howler.triaged", None),
                 ],
             )
         else:
@@ -94,7 +94,7 @@ def execute(
             ds.hit.update_by_query(
                 query,
                 [
-                    *hit_helper.assess_hit(assessment, rationale, user=(user if user else "automation")),
+                    *hit_helper.assess_hit(assessment, rationale),
                     odm_helper.update(
                         "howler.assignment",
                         user.get("uname", "automation") if user else "automation",

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/actions/promote.py

@@ -10,7 +10,6 @@ from howler.odm.models.howler_data import (
     AssessmentEscalationMap,
     Escalation,
 )
-from howler.odm.models.user import User
 from howler.utils.str_utils import sanitize_lucene_query
 
 OPERATION_ID = "promote"
@@ -27,7 +26,6 @@ def execute(
     escalation: Escalation = Escalation.ALERT,
     assessment: Optional[str] = None,
     rationale: Optional[str] = None,
-    user: Optional[User] = None,
     **kwargs,
 ):
     """Promote a hit.
@@ -75,7 +73,7 @@ def execute(
                     *hit_helper.promote_hit(escalation=escalation),
                     odm_helper.update("howler.assessment", None),
                     odm_helper.update("howler.rationale", None),
-                    odm_helper.update("howler.assignment", None),
+                    odm_helper.update("howler.triaged", None),
                 ],
             )
         else:
@@ -90,9 +88,7 @@ def execute(
                 )
                 return report
 
-            ds.hit.update_by_query(
-                query, hit_helper.assess_hit(assessment, rationale, user=(user if user else "automation"))
-            )
+            ds.hit.update_by_query(query, hit_helper.assess_hit(assessment, rationale))
 
         report.append(
             {

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/datastore/howler_store.py

@@ -8,6 +8,7 @@ from howler.odm.models.action import Action
 from howler.odm.models.analytic import Analytic
 from howler.odm.models.case import Case
 from howler.odm.models.clue import Clue
+from howler.odm.models.config import ILMIndexConfig
 from howler.odm.models.dossier import Dossier
 from howler.odm.models.event import Event
 from howler.odm.models.hit import Hit
@@ -34,6 +35,8 @@ INDEXES = {
     "user_avatar": None,
 }
 
+ILM_ENABLED_INDEXES = {"hit", "event", "case"}
+
 
 class HowlerDatastore(object):
     def __init__(self, datastore_object: "ESStore"):
@@ -55,7 +58,12 @@ class HowlerDatastore(object):
             )
 
         for _index, _odm in INDEXES.items():
-            ilm_index_config = config.datastore.ilm.indices.get(_index) if config.datastore.ilm.enabled else None
+            ilm_index_config = config.datastore.ilm.indices.get(_index)
+            if ilm_index_config is None:
+                ilm_index_config = ILMIndexConfig(enabled=_index in ILM_ENABLED_INDEXES)
+            if not (config.datastore.ilm.enabled and ilm_index_config.enabled):
+                ilm_index_config = None
+
             self.ds.register(_index, _odm, ilm_config=ilm_index_config)
 
     def __enter__(self):

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/helper/hit.py

@@ -24,14 +24,11 @@ def assess_hit(
     assessment: Optional[str] = None,
     rationale: Optional[str] = None,
     hit: Optional[Union[dict[str, Any], Hit]] = None,
-    *,
-    user: User | str,
     **kwargs,
 ) -> list[OdmUpdateOperation]:
     """Update the assessment and esclation of a hit
 
     Args:
-        user (User | str): The user making the assessment
         assessment (Optional[str], optional): The assessment to set the hit to. Defaults to None.
         hit (Optional[Union[dict[str, Any], Hit]], optional): The hit to update. Defaults to None.
 
@@ -55,6 +52,14 @@ def assess_hit(
     if assessment is None and rationale:
         rationale = None
 
+    if assessment is None:
+        # reset the timestamp and set state to in progress if removing assessment (re-assessing)
+        triaged_timestamp = None
+        status = Status.IN_PROGRESS
+    else:
+        triaged_timestamp = "NOW"
+        status = Status.RESOLVED
+
     logger.debug(
         "Updating assessment of %s to %s",
         hit["howler"]["id"] if hit else "unknown",
@@ -66,16 +71,12 @@ def assess_hit(
         escalation,
     )
 
-    if assessment is None:
-        assessor_id = None
-    else:
-        assessor_id = user.get("uname", user.get("username", None)) if isinstance(user, User) else user
-
     return [
         odm_helper.update("howler.assessment", assessment),
         odm_helper.update("howler.escalation", escalation),
         odm_helper.update("howler.rationale", rationale, silent=True),
-        odm_helper.update("howler.assessor", assessor_id, silent=True),
+        odm_helper.update("howler.triaged", triaged_timestamp),
+        odm_helper.update("howler.status", status),
     ]
 
 

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/helper/workflow.py

@@ -86,7 +86,13 @@ class Workflow:
 
                 updates_dict[update.key] = update
 
-        if self.status_prop not in updates_dict and _transition.get("dest", False):
+        if _transition.get("dest", False):
+            if self.status_prop in updates_dict and updates_dict[self.status_prop].value != _transition["dest"]:
+                raise WorkflowException(
+                    f"Transition {transition} attempted to update the status {self.status_prop} with \
+                        a different value than the transition destination."
+                )
+
             updates_dict[self.status_prop] = OdmUpdateOperation(
                 ESCollection.UPDATE_SET,
                 self.status_prop,

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/odm/helper.py

@@ -178,10 +178,10 @@ def generate_useful_hit(  # noqa: C901
 
     hit.howler.assessment = None
     hit.howler.rationale = None
+    hit.howler.triaged = None
     hit.howler.status = "open"
     hit.howler.assignment = "unassigned"
     hit.howler.escalation = choice([Escalation.HIT, Escalation.ALERT])
-    hit.howler.assessor = None
 
     if randint(1, 10) > 9:
         hit.howler.expiry = datetime.now() + timedelta(days=randint(1, 60))

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/odm/models/config.py

@@ -97,10 +97,11 @@ class Host(BaseModel):
 class ILMIndexConfig(BaseModel):
     """Per-index ILM phase configuration.
 
-    Controls when an index transitions to warm and cold phases.
+    Controls whether an index uses ILM and when it transitions to warm and cold phases.
     Values are Elasticsearch age strings (e.g. "30d", "90d").
     """
 
+    enabled: bool = Field(default=True, description="Enable ILM for this index")
     warm: Optional[str] = Field(
         default=None,
         description="Min age before the index enters the warm phase (e.g. '30d'). None to skip.",
@@ -135,7 +136,7 @@ class ILMConfig(BaseModel):
         description="Maximum primary shard size before rollover (e.g. '50gb')",
     )
     indices: dict[str, ILMIndexConfig] = Field(
-        default={},
+        default_factory=dict,
         description="Per-index ILM configuration, keyed by collection name (e.g. 'hit')",
     )
 

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/odm/models/ecs/related.py

@@ -33,7 +33,13 @@ class Related(odm.Model):
     )
 
     # Extra fields not defined in ECS but added for outline purposes
-    id = odm.Optional(odm.Keyword(description="The id related to the event."))
+    id = odm.Optional(
+        odm.Keyword(
+            description="The id related to the event.",
+            deprecated=True,
+            deprecated_description="related.ids should be used instead of related.id.",
+        )
+    )
 
     uri = odm.Optional(odm.List(odm.URI(), description="All of the URIs related to the event."))
 
@@ -43,3 +49,23 @@ class Related(odm.Model):
             description="All the signatures/rules that were triggered by the event.",
         )
     )
+
+    def __init__(self, data: dict = None, *args, **kwargs):
+        if data is not None and data.get("id") is not None:
+            # Avoid mutating the caller-provided dict
+            data = dict(data)
+
+            existing_ids = data.get("ids")
+            if isinstance(existing_ids, (list, tuple)):
+                merged_ids = list(existing_ids)
+            elif existing_ids is None:
+                merged_ids = []
+            else:
+                merged_ids = [existing_ids]
+
+            if data["id"] not in merged_ids:
+                merged_ids.append(data["id"])
+
+            data["ids"] = merged_ids
+
+        super().__init__(data, *args, **kwargs)

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/odm/models/howler_data.py

@@ -1,4 +1,5 @@
 # mypy: ignore-errors
+from datetime import datetime
 from typing import Optional
 
 from howler import odm
@@ -180,12 +181,6 @@ class HowlerData(odm.Model):
         description="Unique identifier of the assigned user.",
         default=DEFAULT_ASSIGNMENT,
     )
-    assessor: Optional[str] = odm.Optional(
-        odm.Keyword(
-            description="The most recent person to assess a hit",
-            default=None,
-        )
-    )
     data: list[str] = odm.List(
         odm.Keyword(description="Raw telemetry records associated with this hit."),
         default=[],
@@ -248,6 +243,7 @@ class HowlerData(odm.Model):
             )
         )
     )
+    triaged: Optional[datetime] = odm.Optional(odm.Date(description="Timestamp at which the hit was triaged."))
     comment: list[Comment] = odm.List(
         odm.Compound(Comment),
         default=[],

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/odm/random_data.py

@@ -595,7 +595,6 @@ def create_hits(ds: HowlerDatastore, hit_count: int = 200):
                 hit.howler.id,
                 [
                     *assess_hit(
-                        user=user,
                         assessment=choice(Assessment.list()),
                         rationale=get_random_string(),
                         hit=hit,

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/howler/services/hit_service.py

@@ -111,7 +111,7 @@ def get_hit_workflow() -> Workflow:
                     "source": [Status.OPEN, Status.IN_PROGRESS],
                     "transition": HitStatusTransition.ASSESS,
                     "dest": Status.RESOLVED,
-                    "actions": [assess_hit],
+                    "actions": [assess_hit, assign_hit],
                 }
             ),
             Transition(

{howler_api-4.0.0.dev1266 → howler_api-4.0.0.dev1281}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.0.0.dev1266"
+version = "4.0.0.dev1281"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",