howler-api 4.0.0.dev1279__tar.gz → 4.0.0.dev1283__tar.gz

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev1279
+Version: 4.0.0.dev1283
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/actions/demote.py

@@ -76,7 +76,7 @@ def execute(
                     *hit_helper.demote_hit(escalation=escalation),
                     odm_helper.update("howler.assessment", None),
                     odm_helper.update("howler.rationale", None),
-                    odm_helper.update("howler.assignment", None),
+                    odm_helper.update("howler.triaged", None),
                 ],
             )
         else:
@@ -94,7 +94,7 @@ def execute(
             ds.hit.update_by_query(
                 query,
                 [
-                    *hit_helper.assess_hit(assessment, rationale, user=(user if user else "automation")),
+                    *hit_helper.assess_hit(assessment, rationale),
                     odm_helper.update(
                         "howler.assignment",
                         user.get("uname", "automation") if user else "automation",

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/actions/promote.py

@@ -10,7 +10,6 @@ from howler.odm.models.howler_data import (
     AssessmentEscalationMap,
     Escalation,
 )
-from howler.odm.models.user import User
 from howler.utils.str_utils import sanitize_lucene_query
 
 OPERATION_ID = "promote"
@@ -27,7 +26,6 @@ def execute(
     escalation: Escalation = Escalation.ALERT,
     assessment: Optional[str] = None,
     rationale: Optional[str] = None,
-    user: Optional[User] = None,
     **kwargs,
 ):
     """Promote a hit.
@@ -75,7 +73,7 @@ def execute(
                     *hit_helper.promote_hit(escalation=escalation),
                     odm_helper.update("howler.assessment", None),
                     odm_helper.update("howler.rationale", None),
-                    odm_helper.update("howler.assignment", None),
+                    odm_helper.update("howler.triaged", None),
                 ],
             )
         else:
@@ -90,9 +88,7 @@ def execute(
                 )
                 return report
 
-            ds.hit.update_by_query(
-                query, hit_helper.assess_hit(assessment, rationale, user=(user if user else "automation"))
-            )
+            ds.hit.update_by_query(query, hit_helper.assess_hit(assessment, rationale))
 
         report.append(
             {

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/api/v2/ingest.py

@@ -11,7 +11,7 @@ from howler.common.exceptions import HowlerException, HowlerValueError
 from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.common.swagger import generate_swagger_docs
-from howler.config import config
+from howler.config import CORRELATION_QUEUE_NAME, config
 from howler.datastore.collection import ESCollection
 from howler.datastore.exceptions import DataStoreException
 from howler.datastore.howler_store import INDEXES
@@ -46,7 +46,7 @@ def _get_ingestion_queue() -> NamedQueue[str]:
 
     if _ingestion_queue is None:
         _ingestion_queue = NamedQueue(
-            "howler.ingestion_queue",
+            CORRELATION_QUEUE_NAME,
             host=config.core.redis.persistent.host,
             port=config.core.redis.persistent.port,
             private=False,

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/config.py

@@ -24,6 +24,7 @@ HWL_USE_WEBSOCKET_API = os.environ.get("HWL_USE_WEBSOCKET_API", "false").lower()
 HWL_USE_JOB_SYSTEM = os.environ.get("HWL_USE_JOB_SYSTEM", "false").lower() == "true"
 HWL_ENABLE_COVERAGE = os.environ.get("HWL_ENABLE_COVERAGE", "false").lower() == "true"
 HWL_PLUGIN_DIRECTORY = os.environ.get("HWL_PLUGIN_DIRECTORY", "/etc/howler/plugins")
+CORRELATION_QUEUE_NAME = os.environ.get("HWL_CORRELATION_QUEUE_NAME", "howler.ingestion_queue")
 
 
 def get_version() -> str:

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/helper/hit.py

@@ -24,14 +24,11 @@ def assess_hit(
     assessment: Optional[str] = None,
     rationale: Optional[str] = None,
     hit: Optional[Union[dict[str, Any], Hit]] = None,
-    *,
-    user: User | str,
     **kwargs,
 ) -> list[OdmUpdateOperation]:
     """Update the assessment and esclation of a hit
 
     Args:
-        user (User | str): The user making the assessment
         assessment (Optional[str], optional): The assessment to set the hit to. Defaults to None.
         hit (Optional[Union[dict[str, Any], Hit]], optional): The hit to update. Defaults to None.
 
@@ -55,6 +52,14 @@ def assess_hit(
     if assessment is None and rationale:
         rationale = None
 
+    if assessment is None:
+        # reset the timestamp and set state to in progress if removing assessment (re-assessing)
+        triaged_timestamp = None
+        status = Status.IN_PROGRESS
+    else:
+        triaged_timestamp = "NOW"
+        status = Status.RESOLVED
+
     logger.debug(
         "Updating assessment of %s to %s",
         hit["howler"]["id"] if hit else "unknown",
@@ -66,16 +71,12 @@ def assess_hit(
         escalation,
     )
 
-    if assessment is None:
-        assessor_id = None
-    else:
-        assessor_id = user.get("uname", user.get("username", None)) if isinstance(user, User) else user
-
     return [
         odm_helper.update("howler.assessment", assessment),
         odm_helper.update("howler.escalation", escalation),
         odm_helper.update("howler.rationale", rationale, silent=True),
-        odm_helper.update("howler.assessor", assessor_id, silent=True),
+        odm_helper.update("howler.triaged", triaged_timestamp),
+        odm_helper.update("howler.status", status),
     ]
 
 

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/helper/workflow.py

@@ -86,7 +86,13 @@ class Workflow:
 
                 updates_dict[update.key] = update
 
-        if self.status_prop not in updates_dict and _transition.get("dest", False):
+        if _transition.get("dest", False):
+            if self.status_prop in updates_dict and updates_dict[self.status_prop].value != _transition["dest"]:
+                raise WorkflowException(
+                    f"Transition {transition} attempted to update the status {self.status_prop} with \
+                        a different value than the transition destination."
+                )
+
             updates_dict[self.status_prop] = OdmUpdateOperation(
                 ESCollection.UPDATE_SET,
                 self.status_prop,

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/odm/helper.py

@@ -178,10 +178,10 @@ def generate_useful_hit(  # noqa: C901
 
     hit.howler.assessment = None
     hit.howler.rationale = None
+    hit.howler.triaged = None
     hit.howler.status = "open"
     hit.howler.assignment = "unassigned"
     hit.howler.escalation = choice([Escalation.HIT, Escalation.ALERT])
-    hit.howler.assessor = None
 
     if randint(1, 10) > 9:
         hit.howler.expiry = datetime.now() + timedelta(days=randint(1, 60))

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/odm/models/howler_data.py

@@ -1,4 +1,5 @@
 # mypy: ignore-errors
+from datetime import datetime
 from typing import Optional
 
 from howler import odm
@@ -180,12 +181,6 @@ class HowlerData(odm.Model):
         description="Unique identifier of the assigned user.",
         default=DEFAULT_ASSIGNMENT,
     )
-    assessor: Optional[str] = odm.Optional(
-        odm.Keyword(
-            description="The most recent person to assess a hit",
-            default=None,
-        )
-    )
     data: list[str] = odm.List(
         odm.Keyword(description="Raw telemetry records associated with this hit."),
         default=[],
@@ -248,6 +243,7 @@ class HowlerData(odm.Model):
             )
         )
     )
+    triaged: Optional[datetime] = odm.Optional(odm.Date(description="Timestamp at which the hit was triaged."))
     comment: list[Comment] = odm.List(
         odm.Compound(Comment),
         default=[],

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/odm/random_data.py

@@ -595,7 +595,6 @@ def create_hits(ds: HowlerDatastore, hit_count: int = 200):
                 hit.howler.id,
                 [
                     *assess_hit(
-                        user=user,
                         assessment=choice(Assessment.list()),
                         rationale=get_random_string(),
                         hit=hit,

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/services/correlation_service.py

@@ -16,6 +16,7 @@ from opentelemetry import trace
 from howler.common.exceptions import InvalidDataException, NotFoundException
 from howler.common.loader import datastore
 from howler.common.logging import get_logger
+from howler.config import CORRELATION_QUEUE_NAME
 from howler.odm.models.case import CaseRule, RuleIndexTypes
 from howler.odm.models.config import config
 from howler.remote.datatypes.queues.named import NamedQueue
@@ -181,7 +182,7 @@ def process_batch(record_ids: list[str]) -> int:  # noqa: C901
 def _build_queue() -> NamedQueue[str]:
     """Create the NamedQueue backed by persistent Redis."""
     return NamedQueue(
-        "howler.ingestion_queue",
+        CORRELATION_QUEUE_NAME,
         host=config.core.redis.persistent.host,
         port=config.core.redis.persistent.port,
         private=False,
@@ -210,7 +211,7 @@ def run_worker() -> None:  # pragma: no cover – long-running loop, tested via
                 logger.debug("Processing correlation batch of %d hit(s)", len(batch))
                 try:
                     added = process_batch(batch)
-                    logger.info("Correlation batch complete: %d/%d hit(s) added", added, len(batch))
+                    logger.info("Correlation batch complete: %d case item(s) added for %d record(s)", added, len(batch))
                 except Exception:
                     logger.exception("Error processing correlation batch")
                 finally:

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/howler/services/hit_service.py

@@ -111,7 +111,7 @@ def get_hit_workflow() -> Workflow:
                     "source": [Status.OPEN, Status.IN_PROGRESS],
                     "transition": HitStatusTransition.ASSESS,
                     "dest": Status.RESOLVED,
-                    "actions": [assess_hit],
+                    "actions": [assess_hit, assign_hit],
                 }
             ),
             Transition(

{howler_api-4.0.0.dev1279 → howler_api-4.0.0.dev1283}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.0.0.dev1279"
+version = "4.0.0.dev1283"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",