howler-sentinel-plugin 0.2.0.dev104__tar.gz → 0.2.0.dev105__tar.gz

{howler_sentinel_plugin-0.2.0.dev104 → howler_sentinel_plugin-0.2.0.dev105}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: howler-sentinel-plugin
-Version: 0.2.0.dev104
+Version: 0.2.0.dev105
 Summary: A howler plugin for integration with Microsoft's Sentinel API
 License: MIT
 Author: CCCS

{howler_sentinel_plugin-0.2.0.dev104 → howler_sentinel_plugin-0.2.0.dev105}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "howler-sentinel-plugin"
-version = "0.2.0.dev104"
+version = "0.2.0.dev105"
 description = "A howler plugin for integration with Microsoft's Sentinel API"
 authors = [{ name = "CCCS", email = "analysis-development@cyber.gc.ca" }]
 license = { text = "MIT" }

{howler_sentinel_plugin-0.2.0.dev104 → howler_sentinel_plugin-0.2.0.dev105}/sentinel/actions/azure_emit_hash.py

@@ -71,6 +71,14 @@ def execute(
                     },
                     timeout=5.0,
                 )
+                report.append(
+                    {
+                        "query": f"howler.id:{hit.howler.id}",
+                        "outcome": "success",
+                        "title": "Webhook Triggered",
+                        "message": f"Field {field} from alert {hit.howler.id} was successfully sent to url {url}.",
+                    }
+                )
             except Exception:
                 logger.exception("Exception on network call for alert %s", hit.howler.id)
                 report.append(
@@ -109,6 +117,7 @@ def specification():
             {
                 "args": {"url": [], "field": []},
                 "options": {"field": [field for field in Hit.flat_fields().keys() if field.endswith("sha256")]},
+                "validation": {"warn": {"query": "-_exists_:$field"}},
             }
         ],
         "triggers": VALID_TRIGGERS,