howler-sentinel-plugin 0.1.0.dev50__py3-none-any.whl → 0.2.0.dev20__py3-none-any.whl

{howler_sentinel_plugin-0.1.0.dev50.dist-info → howler_sentinel_plugin-0.2.0.dev20.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: howler-sentinel-plugin
-Version: 0.1.0.dev50
+Version: 0.2.0.dev20
 Summary: A howler plugin for integration with Microsoft's Sentinel API
 License: MIT
 Author: CCCS
@@ -14,7 +14,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Description-Content-Type: text/markdown
 
-# Howler Internal Plugins
+# Howler Sentinel Plugin
 
-This plugin contains modules for internal authentication and OBO in the aurora platform.
+This plugin contains modules for Microsoft Sentinel integration in Howler.
 

howler_sentinel_plugin-0.2.0.dev20.dist-info/RECORD

@@ -0,0 +1,10 @@
+sentinel/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sentinel/odm/hit.py,sha256=hAuO2ONMK3Ml8Xu6E7tHrmZ7M6HG5tT38RD9ZxwY254,666
+sentinel/odm/models/sentinel.py,sha256=XT3XdT92uoCV5vmY9dT1jmcxRyuu9vp1gE8AwZdKBIc,337
+sentinel/routes/__init__.py,sha256=JYmKRwIfEsiPos1XuMQ2mlGDbxk6TN_cVEM0K_RNze4,130
+sentinel/routes/ingest.py,sha256=zcKQmLStIh1uU_kWO6KBgqr-ZBkAGcFwvXWBiwjOuC8,1067
+howler_sentinel_plugin-0.2.0.dev20.dist-info/LICENSE,sha256=Wg2luVnxEkP2NSn11nh1US6W_nFFbICBAVTG9iG3t5M,1091
+howler_sentinel_plugin-0.2.0.dev20.dist-info/METADATA,sha256=cPq8kTNzcCzVNnzxejM7Xr4RuPMjpqlGNMT_7i-dxR0,694
+howler_sentinel_plugin-0.2.0.dev20.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+howler_sentinel_plugin-0.2.0.dev20.dist-info/entry_points.txt,sha256=4IJyMY0V49s3Wp659ngN_7U8g66-czeKxI-_dNAFP5g,60
+howler_sentinel_plugin-0.2.0.dev20.dist-info/RECORD,,

sentinel/routes/__init__.py

@@ -0,0 +1,5 @@
+from flask.blueprints import Blueprint
+
+from sentinel.routes.ingest import sentinel_api
+
+ROUTES: list[Blueprint] = [sentinel_api]

sentinel/routes/ingest.py

@@ -0,0 +1,42 @@
+import os
+import re
+
+from flask import request
+from howler.api import make_subapi_blueprint, ok, unauthorized
+from howler.common.logging import get_logger
+from howler.common.swagger import generate_swagger_docs
+
+SUB_API = "sentinel"
+sentinel_api = make_subapi_blueprint(SUB_API, api_version=1)
+sentinel_api._doc = "Interact with spellbook"
+
+logger = get_logger(__file__)
+
+SECRET = os.environ["SENTINEL_LINK_KEY"]
+
+
+@generate_swagger_docs()
+@sentinel_api.route("/ingest", methods=["POST"])
+def ingest_alert(**kwargs):
+    """Ingest a sentinel alert into howler
+
+    Variables:
+    None
+
+    Optional Arguments:
+    None
+
+    Result Example:
+    """
+    apikey = request.headers.get("Authorization", "Basic ", type=str).split(" ")[1]
+
+    if not apikey or apikey != SECRET:
+        return unauthorized(err="API Key does not match expected value.")
+
+    logger.info("Recieved authorization header with value %s", re.sub(r"^(.{3}).+(.{3})$", r"\1...\2", apikey))
+
+    sentinel_alert = request.json
+
+    logger.info("Sentinel Alert:\n%s", sentinel_alert)
+
+    return ok()

howler_sentinel_plugin-0.1.0.dev50.dist-info/RECORD

@@ -1,8 +0,0 @@
-sentinel/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-sentinel/odm/hit.py,sha256=hAuO2ONMK3Ml8Xu6E7tHrmZ7M6HG5tT38RD9ZxwY254,666
-sentinel/odm/models/sentinel.py,sha256=XT3XdT92uoCV5vmY9dT1jmcxRyuu9vp1gE8AwZdKBIc,337
-howler_sentinel_plugin-0.1.0.dev50.dist-info/LICENSE,sha256=Wg2luVnxEkP2NSn11nh1US6W_nFFbICBAVTG9iG3t5M,1091
-howler_sentinel_plugin-0.1.0.dev50.dist-info/METADATA,sha256=3OehY5iBgB0iLcN6wM4iED83r94nvWDkw3obIAE_PL0,709
-howler_sentinel_plugin-0.1.0.dev50.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-howler_sentinel_plugin-0.1.0.dev50.dist-info/entry_points.txt,sha256=4IJyMY0V49s3Wp659ngN_7U8g66-czeKxI-_dNAFP5g,60
-howler_sentinel_plugin-0.1.0.dev50.dist-info/RECORD,,