howler-api 4.0.0.dev724__tar.gz → 4.0.0.dev799__tar.gz

{howler_api-4.0.0.dev724 → howler_api-4.0.0.dev799}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev724
+Version: 4.0.0.dev799
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs
@@ -8,7 +8,7 @@ Author: Canadian Centre for Cyber Security
 Author-email: howler@cyber.gc.ca
 Maintainer: Matthew Rafuse
 Maintainer-email: matthew.rafuse@cyber.gc.ca
-Requires-Python: >=3.9.17,<4.0.0
+Requires-Python: >=3.10,<4.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -21,10 +21,10 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries
 Requires-Dist: apscheduler (==3.11.2)
 Requires-Dist: authlib (>=1.6.0,<2.0.0)
+Requires-Dist: azure-monitor-opentelemetry (>=1.8.7,<2.0.0)
 Requires-Dist: bcrypt (==4.3.0)
 Requires-Dist: chardet (==5.2.0)
 Requires-Dist: chevron (==0.14.0)
-Requires-Dist: elastic-apm[flask] (>=6.22.0,<7.0.0)
 Requires-Dist: elasticsearch (==8.19.3)
 Requires-Dist: flasgger (>=0.9.7.1,<0.10.0.0)
 Requires-Dist: flask (==3.1.3)
@@ -33,6 +33,9 @@ Requires-Dist: gevent (>=25.9.1,<26.0.0)
 Requires-Dist: gunicorn (==23.0.0)
 Requires-Dist: luqum (>=1.0.0,<2.0.0)
 Requires-Dist: mergedeep (>=1.3.4,<2.0.0)
+Requires-Dist: opentelemetry-exporter-otlp-proto-http (==1.40.0)
+Requires-Dist: opentelemetry-instrumentation-flask (==0.61b0)
+Requires-Dist: opentelemetry-sdk (==1.40.0)
 Requires-Dist: packaging (<25.0)
 Requires-Dist: passlib (==1.7.4)
 Requires-Dist: prometheus-client (==0.24.1)

howler_api-4.0.0.dev799/howler/actions/add_to_bundle.py

@@ -0,0 +1,136 @@
+"""Deprecated add_to_bundle action — delegates to add_to_case via bundle_compat_service."""
+
+from typing import Optional
+
+from howler.common.exceptions import NotFoundException
+from howler.common.loader import datastore
+from howler.odm.models.action import VALID_TRIGGERS
+from howler.services import bundle_compat_service, case_service
+from howler.utils.str_utils import sanitize_lucene_query
+
+OPERATION_ID = "add_to_bundle"
+
+
+def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
+    """Add a set of hits matching the query to the specified bundle (deprecated — uses cases).
+
+    Args:
+        query (str): The query containing the matching hits
+        bundle_id (str): The ``howler.id`` of the bundle to add the hits to.
+    """
+    report = []
+
+    if not bundle_id:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Invalid Bundle ID",
+                "message": "Bundle ID cannot be empty.",
+            }
+        ]
+
+    try:
+        case_id = bundle_compat_service.find_case_for_bundle(bundle_id)
+        if case_id is None:
+            report.append(
+                {
+                    "query": query,
+                    "outcome": "error",
+                    "title": "Invalid Bundle",
+                    "message": f"Either a hit with ID {bundle_id} does not exist, or it has no associated case.",
+                }
+            )
+            return report
+
+        ds = datastore()
+        matching_hits = ds.hit.search(query, rows=1000)["items"]
+
+        if not matching_hits:
+            report.append(
+                {
+                    "query": query,
+                    "outcome": "skipped",
+                    "title": "No Matching Hits",
+                    "message": "There were no hits matching this query.",
+                }
+            )
+            return report
+
+        added = []
+        skipped = []
+        for hit in matching_hits:
+            child_label = f"hits/{hit.howler.analytic} ({hit.howler.id})"
+            try:
+                case_service.append_case_item(
+                    case_id,
+                    item_type="hit",
+                    item_value=hit.howler.id,
+                    item_path=child_label,
+                )
+                added.append(hit.howler.id)
+            except Exception:
+                skipped.append(hit.howler.id)
+
+        if skipped:
+            report.append(
+                {
+                    "query": f"howler.id:({' OR '.join(sanitize_lucene_query(h) for h in skipped)})",
+                    "outcome": "skipped",
+                    "title": "Skipped Hits",
+                    "message": "These hits could not be added (already present or invalid).",
+                }
+            )
+
+        if added:
+            report.append(
+                {
+                    "query": f"howler.id:({' OR '.join(sanitize_lucene_query(h) for h in added)})",
+                    "outcome": "success",
+                    "title": "Executed Successfully",
+                    "message": "The specified bundle has had all matching hits added.",
+                }
+            )
+
+    except NotFoundException as e:
+        report.append(
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Failed to Execute",
+                "message": str(e),
+            }
+        )
+    except Exception as e:
+        report.append(
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Failed to Execute",
+                "message": f"Unknown exception occurred: {str(e)}",
+            }
+        )
+
+    return report
+
+
+def specification():
+    """Specify various properties of the action, such as title, descriptions, permissions and input steps."""
+    return {
+        "id": OPERATION_ID,
+        "title": "Add to Bundle (Deprecated)",
+        "priority": 6,
+        "i18nKey": f"operations.{OPERATION_ID}",
+        "description": {
+            "short": "Add a set of hits to a bundle (deprecated — uses cases)",
+            "long": execute.__doc__,
+        },
+        "roles": ["automation_basic"],
+        "steps": [
+            {
+                "args": {"bundle_id": []},
+                "options": {},
+            }
+        ],
+        "triggers": VALID_TRIGGERS,
+    }

howler_api-4.0.0.dev799/howler/actions/add_to_case.py

@@ -0,0 +1,136 @@
+from typing import Optional
+
+import chevron
+
+from howler.common.exceptions import InvalidDataException, NotFoundException
+from howler.common.loader import datastore
+from howler.odm.models.action import VALID_TRIGGERS
+from howler.services import case_service
+
+OPERATION_ID = "add_to_case"
+
+
+def execute(
+    query: str,
+    case_id: Optional[str] = None,
+    path: str = "related",
+    title_template: str = "{{howler.analytic}} ({{howler.id}})",
+    **kwargs,
+):
+    """Add matching alerts to a given case.
+
+    Args:
+        query (str): The query on which to apply this automation.
+        case_id (str): The ID of the case to add the alerts to.
+        path (str): The path within the case at which to place the alerts. Defaults to "related".
+        title_template (str): A Mustache-compatible template string used to generate each item's
+            path suffix (title). The hit's fields are available as template variables.
+            Defaults to "{{howler.analytic}} ({{howler.id}})".
+    """
+    if not case_id:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Missing Case ID",
+                "message": "A case_id must be provided.",
+            }
+        ]
+
+    ds = datastore()
+
+    if ds.case.get(case_id) is None:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Case Not Found",
+                "message": f"No case with ID '{case_id}' exists.",
+            }
+        ]
+
+    hits = ds.hit.search(query, rows=1000)["items"]
+
+    if not hits:
+        return [
+            {
+                "query": query,
+                "outcome": "skipped",
+                "title": "No Matching Hits",
+                "message": "No hits matched the query, so the action was skipped.",
+            }
+        ]
+
+    report = []
+    skipped = []
+    added = []
+
+    normalized_path = path.rstrip("/")
+
+    for hit in hits:
+        hit_data = hit.as_primitives()
+        title = chevron.render(title_template, hit_data)
+        item_path = f"{normalized_path}/{title}" if normalized_path else title
+
+        try:
+            case_service.append_case_item(
+                case_id,
+                item_type="hit",
+                item_value=hit.howler.id,
+                item_path=item_path,
+            )
+            added.append(hit.howler.id)
+        except InvalidDataException as e:
+            skipped.append(f"{hit.howler.id}: {e}")
+        except NotFoundException as e:
+            skipped.append(f"{hit.howler.id}: {e}")
+        except Exception as e:
+            skipped.append(f"{hit.howler.id}: {e}")
+
+    if added:
+        report.append(
+            {
+                "query": f"howler.id:({' OR '.join(added)})",
+                "outcome": "success",
+                "title": "Added to Case",
+                "message": f"{len(added)} alert(s) successfully added to case '{case_id}'.",
+            }
+        )
+
+    if skipped:
+        report.append(
+            {
+                "query": query,
+                "outcome": "skipped",
+                "title": "Skipped Alerts",
+                "message": f"{len(skipped)} alert(s) could not be added: {'; '.join(skipped)}",
+            }
+        )
+
+    return report
+
+
+def specification():
+    """Specify various properties of the action, such as title, descriptions, permissions and input steps."""
+    return {
+        "id": OPERATION_ID,
+        "title": "Add to Case",
+        "priority": 9,
+        "i18nKey": f"operations.{OPERATION_ID}",
+        "description": {
+            "short": "Add matching alerts to a case",
+            "long": execute.__doc__,
+        },
+        "roles": ["automation_basic"],
+        "steps": [
+            {
+                "args": {
+                    "case_id": [],
+                    "path": [],
+                    "title_template": [],
+                },
+                "options": {},
+            }
+        ],
+        "triggers": VALID_TRIGGERS,
+    }

howler_api-4.0.0.dev799/howler/actions/remove_from_bundle.py

@@ -0,0 +1,150 @@
+"""Deprecated remove_from_bundle action — delegates to case_service for item removal."""
+
+from typing import Optional
+
+from howler.common.exceptions import NotFoundException
+from howler.common.loader import datastore
+from howler.odm.models.action import VALID_TRIGGERS
+from howler.services import bundle_compat_service, case_service
+from howler.utils.str_utils import sanitize_lucene_query
+
+OPERATION_ID = "remove_from_bundle"
+
+
+def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
+    """Remove a set of hits matching the query from the specified bundle (deprecated — uses cases).
+
+    Args:
+        query (str): The query containing the matching hits
+        bundle_id (str): The ``howler.id`` of the bundle to remove the hits from.
+    """
+    report = []
+
+    if not bundle_id:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Invalid Bundle ID",
+                "message": "Bundle ID cannot be empty.",
+            }
+        ]
+
+    try:
+        case_id = bundle_compat_service.find_case_for_bundle(bundle_id)
+        if case_id is None:
+            report.append(
+                {
+                    "query": query,
+                    "outcome": "error",
+                    "title": "Invalid Bundle",
+                    "message": f"Either a hit with ID {bundle_id} does not exist, or it has no associated case.",
+                }
+            )
+            return report
+
+        ds = datastore()
+        matching_hits = ds.hit.search(query, rows=1000)["items"]
+
+        if not matching_hits:
+            report.append(
+                {
+                    "query": query,
+                    "outcome": "skipped",
+                    "title": "No Matching Hits",
+                    "message": "There were no hits matching this query.",
+                }
+            )
+            return report
+
+        # Get the case to check which hits are actually in it
+        case = ds.case.get(case_id)
+        if case is None:
+            report.append(
+                {
+                    "query": query,
+                    "outcome": "error",
+                    "title": "Case Not Found",
+                    "message": f"Associated case {case_id} no longer exists.",
+                }
+            )
+            return report
+
+        case_item_values = {item.value for item in case.items}
+        values_to_remove = [h.howler.id for h in matching_hits if h.howler.id in case_item_values]
+        skipped_ids = [h.howler.id for h in matching_hits if h.howler.id not in case_item_values]
+
+        if skipped_ids:
+            report.append(
+                {
+                    "query": f"howler.id:({' OR '.join(sanitize_lucene_query(h) for h in skipped_ids)})",
+                    "outcome": "skipped",
+                    "title": "Skipped Hits Not in Bundle",
+                    "message": "These hits are not in the bundle.",
+                }
+            )
+
+        if not values_to_remove:
+            report.append(
+                {
+                    "query": query,
+                    "outcome": "skipped",
+                    "title": "No Matching Hits",
+                    "message": "None of the matching hits were found in the bundle.",
+                }
+            )
+            return report
+
+        case_service.remove_case_items(case_id, values_to_remove)
+
+        report.append(
+            {
+                "query": query,
+                "outcome": "success",
+                "title": "Executed Successfully",
+                "message": f"Matching hits removed from bundle with id {bundle_id}",
+            }
+        )
+
+    except NotFoundException as e:
+        report.append(
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Failed to Execute",
+                "message": str(e),
+            }
+        )
+    except Exception as e:
+        report.append(
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Failed to Execute",
+                "message": f"Unknown exception occurred: {str(e)}",
+            }
+        )
+
+    return report
+
+
+def specification():
+    """Specify various properties of the action, such as title, descriptions, permissions and input steps."""
+    return {
+        "id": OPERATION_ID,
+        "title": "Remove from Bundle (Deprecated)",
+        "priority": 5,
+        "i18nKey": f"operations.{OPERATION_ID}",
+        "description": {
+            "short": "Remove a set of hits from a bundle (deprecated — uses cases)",
+            "long": execute.__doc__,
+        },
+        "roles": ["automation_basic"],
+        "steps": [
+            {
+                "args": {"bundle_id": []},
+                "options": {},
+            }
+        ],
+        "triggers": VALID_TRIGGERS,
+    }

{howler_api-4.0.0.dev724 → howler_api-4.0.0.dev799}/howler/api/__init__.py

@@ -10,6 +10,7 @@ from howler import odm
 from howler.common.loader import APP_NAME
 from howler.common.logging import get_logger, log_with_traceback
 from howler.config import QUOTA_TRACKER, get_version
+from howler.utils.constants import TESTING
 from howler.utils.str_utils import safe_str
 
 API_PREFIX = "/api"
@@ -73,7 +74,8 @@ def _make_api_response(
             resp.set_cookie(k, v, secure=True, httponly=True, samesite="Lax")
 
     RAW_API_COUNTER.labels(request.method, str(request.url_rule), status_code).inc()
-    logger.info("%s %s - %s", request.method, request.path, status_code)
+    if not TESTING:
+        logger.info("%s %s - %s", request.method, request.path, status_code)
 
     return resp
 

{howler_api-4.0.0.dev724 → howler_api-4.0.0.dev799}/howler/api/socket.py

@@ -4,6 +4,7 @@ import os
 from typing import Any
 
 from flask import Blueprint, request
+from opentelemetry import trace
 
 import howler.services.event_service as event_service
 from howler.api import ok, unauthorized
@@ -21,10 +22,12 @@ socket_api = Blueprint("socket", "socket", url_prefix="/socket/v1")
 socket_api._doc = "Endpoints concerning websocket connectivity between the client and server"  # type: ignore
 
 logger = get_logger(__file__)
+tracer = trace.get_tracer(__name__)
 
 hit_helper = OdmHelper(Hit)
 
 
+@tracer.start_as_current_span(f"{__name__}.emit")
 @socket_api.route("/emit/<event>", methods=["POST"])
 def emit(event: str):
     """Emit an event to all listening websockets"""
@@ -46,6 +49,7 @@ def emit(event: str):
     return ok()
 
 
+@tracer.start_as_current_span(f"{__name__}.connect")
 @socket_api.route("/connect", websocket=True)  # type: ignore
 @websocket_auth(required_priv=["R"])
 def connect(ws: Server, *args: Any, ws_id: str, **kwargs):

{howler_api-4.0.0.dev724 → howler_api-4.0.0.dev799}/howler/api/v1/clue.py

@@ -1,9 +1,7 @@
-import sys
 import time
 from typing import Callable, Optional
 
 import requests
-from elasticapm.traces import capture_span
 from flask import request
 
 from howler.api import bad_gateway, make_subapi_blueprint, ok
@@ -13,6 +11,7 @@ from howler.common.swagger import generate_swagger_docs
 from howler.config import cache, config
 from howler.plugins import get_plugins
 from howler.security import api_login
+from howler.utils.constants import TESTING
 
 SUB_API = "clue"
 clue_api = make_subapi_blueprint(SUB_API, api_version=1)
@@ -23,7 +22,7 @@ logger = get_logger(__file__)
 
 def skip_cache(*args):
     "Function to skip cache in testing mode"
-    return "pytest" in sys.modules
+    return TESTING
 
 
 @cache.memoize(15 * 60, unless=skip_cache)
@@ -74,22 +73,21 @@ def proxy_to_clue(path, **kwargs):
     clue_token = get_token(auth_token)
 
     start = time.perf_counter()
-    with capture_span("clue", span_type="http"):
-        if request.method.lower() == "get":
-            response = requests.get(
-                f"{config.core.clue.url}/{path}",
-                headers={"Authorization": f"Bearer {clue_token}", "Accept": "application/json"},
-                params=request.args.to_dict(),
-                timeout=5 * 60,
-            )
-        else:
-            response = requests.post(
-                f"{config.core.clue.url}/{path}",
-                json=request.json,
-                headers={"Authorization": f"Bearer {clue_token}", "Accept": "application/json"},
-                params=request.args.to_dict(),
-                timeout=5 * 60,
-            )
+    if request.method.lower() == "get":
+        response = requests.get(
+            f"{config.core.clue.url}/{path}",
+            headers={"Authorization": f"Bearer {clue_token}", "Accept": "application/json"},
+            params=request.args.to_dict(),
+            timeout=5 * 60,
+        )
+    else:
+        response = requests.post(
+            f"{config.core.clue.url}/{path}",
+            json=request.json,
+            headers={"Authorization": f"Bearer {clue_token}", "Accept": "application/json"},
+            params=request.args.to_dict(),
+            timeout=5 * 60,
+        )
 
     logger.debug("Request to clue completed in %s ms", round(time.perf_counter() - start))