howler-api 4.0.0.dev1291__tar.gz → 4.0.0.dev1297__tar.gz

{howler_api-4.0.0.dev1291 → howler_api-4.0.0.dev1297}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev1291
+Version: 4.0.0.dev1297
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.0.0.dev1291 → howler_api-4.0.0.dev1297}/howler/odm/models/howler_data.py

@@ -131,17 +131,17 @@ class Log(odm.Model):
 
 @odm.model(index=True, store=True, description="Hit outline header.")
 class Header(odm.Model):
-    threat: Optional[str] = odm.Optional(odm.Keyword(description="The IP of the threat."))
-    target: Optional[str] = odm.Optional(odm.Keyword(description="The target of the hit."))
+    threat: str | None = odm.Optional(odm.Keyword(description="The IP of the threat."))
+    target: str | None = odm.Optional(odm.Keyword(description="The target of the hit."))
     indicators: list[str] = odm.List(odm.Keyword(description="Indicators of the hit."), default=[])
-    summary: Optional[str] = odm.Optional(odm.Keyword(description="Summary of the hit."))
+    summary: str | None = odm.Optional(odm.Keyword(description="Summary of the hit."))
 
 
 @odm.model(index=True, store=True, description="Fields describing the location where this alert has been retained.")
 class Incident(odm.Model):
     platform: str = odm.Keyword(description="The name of the platform for this incident.")
-    incident_id: Optional[str] = odm.Keyword(description="The ID of the incident.", optional=True)
-    url: Optional[str] = odm.Keyword(description="The url where the incident can be found.", optional=True)
+    incident_id: str | None = odm.Keyword(description="The ID of the incident.", optional=True)
+    url: str | None = odm.Keyword(description="The url where the incident can be found.", optional=True)
 
 
 @odm.model(index=True, store=True, description="Labels for the hit")
@@ -177,7 +177,7 @@ DEFAULT_ASSIGNMENT = "unassigned"
 class HowlerData(odm.Model):
     id: str = odm.UUID(description="A UUID for this hit.")
     analytic: str = odm.CaseInsensitiveKeyword(description="Title of the analytic.")
-    assignment: Optional[str] = odm.Keyword(
+    assignment: str = odm.Keyword(
         description="Unique identifier of the assigned user.",
         default=DEFAULT_ASSIGNMENT,
     )
@@ -191,7 +191,7 @@ class HowlerData(odm.Model):
         default=[],
         description="A list of links associated with this hit.",
     )
-    detection: Optional[str] = odm.Optional(
+    detection: str | None = odm.Optional(
         odm.CaseInsensitiveKeyword(description="The detection that produced this hit.")
     )
     hash: str = odm.HowlerHash(
@@ -219,13 +219,13 @@ class HowlerData(odm.Model):
     score: Optional[float] = odm.Optional(
         odm.Float(description="A score assigned by an enrichment to help prioritize triage.", default=0)
     )
-    status = odm.Enum(values=Status, default=Status.OPEN, description="Status of the hit.")
-    scrutiny = odm.Enum(
+    status: str = odm.Enum(values=Status, default=Status.OPEN, description="Status of the hit.")
+    scrutiny: str = odm.Enum(
         values=Scrutiny,
         default=Scrutiny.UNSEEN,
         description="Level of scrutiny done to this hit.",
     )
-    escalation = odm.Enum(
+    escalation: str = odm.Enum(
         values=Escalation,
         default=Escalation.HIT,
         description="Level of escalation of this hit.",
@@ -235,8 +235,8 @@ class HowlerData(odm.Model):
             description="User selected time for hit expiry",
         )
     )
-    assessment: Optional[str] = odm.Optional(odm.Enum(values=Assessment, description="Assessment of the hit."))
-    rationale: Optional[str] = odm.Optional(
+    assessment: str | None = odm.Optional(odm.Enum(values=Assessment, description="Assessment of the hit."))
+    rationale: str | None = odm.Optional(
         odm.Keyword(
             description=(
                 "The rationale behind the hit assessment. Allows it to be understood and verified by other analysts."
@@ -254,9 +254,9 @@ class HowlerData(odm.Model):
         default=[],
         description="A list of changes to the hit with timestamps and attribution.",
     )
-    monitored: Optional[str] = odm.Optional(odm.Keyword(description="Link to the incident monitoring dashboard."))
-    reported: Optional[str] = odm.Optional(odm.Keyword(description="Link to the incident report."))
-    mitigated: Optional[str] = odm.Optional(odm.Keyword(description="Link to the mitigation record (tool dependent)."))
+    monitored: str | None = odm.Optional(odm.Keyword(description="Link to the incident monitoring dashboard."))
+    reported: str | None = odm.Optional(odm.Keyword(description="Link to the incident report."))
+    mitigated: str | None = odm.Optional(odm.Keyword(description="Link to the mitigation record (tool dependent)."))
     outline: Optional[Header] = odm.Optional(odm.Compound(Header), description="The user specified header of the hit")
     incidents: list[Incident] = odm.List(
         odm.Compound(Incident), default=[], description="Fields describing an incident associated with this alert."

{howler_api-4.0.0.dev1291 → howler_api-4.0.0.dev1297}/howler/services/hit_service.py

@@ -317,6 +317,18 @@ def convert_hit(  # noqa: C901
             "See howler's documentation for more information."
         )
 
+    if odm.howler.assessment:
+        target_escalation = AssessmentEscalationMap[odm.howler.assessment]
+        if odm.howler.escalation != target_escalation:
+            warnings.append(
+                f"Hits with assessment {odm.howler.assessment} must also have escalation set to {target_escalation}."
+            )
+            odm.howler.escalation = str(target_escalation)
+
+    if odm.howler.escalation in [Escalation.MISS, Escalation.EVIDENCE] and odm.howler.status != Status.RESOLVED:
+        warnings.append("Hits with escalation miss or evidence must also have their status set to resolved.")
+        odm.howler.status = Status.RESOLVED.value
+
     if odm.event:
         odm.event.id = odm.howler.id
         if not odm.event.created:

{howler_api-4.0.0.dev1291 → howler_api-4.0.0.dev1297}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.0.0.dev1291"
+version = "4.0.0.dev1297"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",