howler-api 4.0.0.dev724__tar.gz → 4.0.0.dev740__tar.gz

{howler_api-4.0.0.dev724 → howler_api-4.0.0.dev740}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev724
+Version: 4.0.0.dev740
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

howler_api-4.0.0.dev740/howler/actions/add_to_case.py

@@ -0,0 +1,136 @@
+from typing import Optional
+
+import chevron
+
+from howler.common.exceptions import InvalidDataException, NotFoundException
+from howler.common.loader import datastore
+from howler.odm.models.action import VALID_TRIGGERS
+from howler.services import case_service
+
+OPERATION_ID = "add_to_case"
+
+
+def execute(
+    query: str,
+    case_id: Optional[str] = None,
+    path: str = "related",
+    title_template: str = "{{howler.analytic}} ({{howler.id}})",
+    **kwargs,
+):
+    """Add matching alerts to a given case.
+
+    Args:
+        query (str): The query on which to apply this automation.
+        case_id (str): The ID of the case to add the alerts to.
+        path (str): The path within the case at which to place the alerts. Defaults to "related".
+        title_template (str): A Mustache-compatible template string used to generate each item's
+            path suffix (title). The hit's fields are available as template variables.
+            Defaults to "{{howler.analytic}} ({{howler.id}})".
+    """
+    if not case_id:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Missing Case ID",
+                "message": "A case_id must be provided.",
+            }
+        ]
+
+    ds = datastore()
+
+    if ds.case.get(case_id) is None:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Case Not Found",
+                "message": f"No case with ID '{case_id}' exists.",
+            }
+        ]
+
+    hits = ds.hit.search(query, rows=1000)["items"]
+
+    if not hits:
+        return [
+            {
+                "query": query,
+                "outcome": "skipped",
+                "title": "No Matching Hits",
+                "message": "No hits matched the query, so the action was skipped.",
+            }
+        ]
+
+    report = []
+    skipped = []
+    added = []
+
+    normalized_path = path.rstrip("/")
+
+    for hit in hits:
+        hit_data = hit.as_primitives()
+        title = chevron.render(title_template, hit_data)
+        item_path = f"{normalized_path}/{title}" if normalized_path else title
+
+        try:
+            case_service.append_case_item(
+                case_id,
+                item_type="hit",
+                item_value=hit.howler.id,
+                item_path=item_path,
+            )
+            added.append(hit.howler.id)
+        except InvalidDataException as e:
+            skipped.append(f"{hit.howler.id}: {e}")
+        except NotFoundException as e:
+            skipped.append(f"{hit.howler.id}: {e}")
+        except Exception as e:
+            skipped.append(f"{hit.howler.id}: {e}")
+
+    if added:
+        report.append(
+            {
+                "query": f"howler.id:({' OR '.join(added)})",
+                "outcome": "success",
+                "title": "Added to Case",
+                "message": f"{len(added)} alert(s) successfully added to case '{case_id}'.",
+            }
+        )
+
+    if skipped:
+        report.append(
+            {
+                "query": query,
+                "outcome": "skipped",
+                "title": "Skipped Alerts",
+                "message": f"{len(skipped)} alert(s) could not be added: {'; '.join(skipped)}",
+            }
+        )
+
+    return report
+
+
+def specification():
+    """Specify various properties of the action, such as title, descriptions, permissions and input steps."""
+    return {
+        "id": OPERATION_ID,
+        "title": "Add to Case",
+        "priority": 9,
+        "i18nKey": f"operations.{OPERATION_ID}",
+        "description": {
+            "short": "Add matching alerts to a case",
+            "long": execute.__doc__,
+        },
+        "roles": ["automation_basic"],
+        "steps": [
+            {
+                "args": {
+                    "case_id": [],
+                    "path": [],
+                    "title_template": [],
+                },
+                "options": {},
+            }
+        ],
+        "triggers": VALID_TRIGGERS,
+    }

{howler_api-4.0.0.dev724 → howler_api-4.0.0.dev740}/howler/odm/random_data.py

@@ -1063,7 +1063,7 @@ def create_actions(ds: HowlerDatastore, num_actions: int = 30):
 
             for step in available_operations[operation_id].specification()["steps"]:
                 for key in step["args"].keys():
-                    potential_values = step["options"].get(key, None)
+                    potential_values = step.get("options", {}).get(key, None)
                     if potential_values:
                         if isinstance(potential_values, dict):
                             try:

{howler_api-4.0.0.dev724 → howler_api-4.0.0.dev740}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.0.0.dev724"
+version = "4.0.0.dev740"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",