howler-sentinel-plugin 0.2.0.dev21__py3-none-any.whl → 0.2.0.dev31__py3-none-any.whl

{howler_sentinel_plugin-0.2.0.dev21.dist-info → howler_sentinel_plugin-0.2.0.dev31.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: howler-sentinel-plugin
-Version: 0.2.0.dev21
+Version: 0.2.0.dev31
 Summary: A howler plugin for integration with Microsoft's Sentinel API
 License: MIT
 Author: CCCS

{howler_sentinel_plugin-0.2.0.dev21.dist-info → howler_sentinel_plugin-0.2.0.dev31.dist-info}/RECORD

@@ -1,10 +1,12 @@
 sentinel/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sentinel/actions/ingestion.py,sha256=_t7wrmozhoT_MmktDmNxYiXrA1Q0LCiDt0rTwHBkwbc,1669
+sentinel/actions/synchronization.py,sha256=g5c34410zINWb4fSEzj94drnk5alRj_ju9xMrB39z0s,1818
 sentinel/odm/hit.py,sha256=hAuO2ONMK3Ml8Xu6E7tHrmZ7M6HG5tT38RD9ZxwY254,666
 sentinel/odm/models/sentinel.py,sha256=XT3XdT92uoCV5vmY9dT1jmcxRyuu9vp1gE8AwZdKBIc,337
 sentinel/routes/__init__.py,sha256=JYmKRwIfEsiPos1XuMQ2mlGDbxk6TN_cVEM0K_RNze4,130
 sentinel/routes/ingest.py,sha256=zcKQmLStIh1uU_kWO6KBgqr-ZBkAGcFwvXWBiwjOuC8,1067
-howler_sentinel_plugin-0.2.0.dev21.dist-info/LICENSE,sha256=Wg2luVnxEkP2NSn11nh1US6W_nFFbICBAVTG9iG3t5M,1091
-howler_sentinel_plugin-0.2.0.dev21.dist-info/METADATA,sha256=nUT5UDmcdEejR3yZ5iN7jRA-oQlxZZ9bgXWseF-bKMM,694
-howler_sentinel_plugin-0.2.0.dev21.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-howler_sentinel_plugin-0.2.0.dev21.dist-info/entry_points.txt,sha256=4IJyMY0V49s3Wp659ngN_7U8g66-czeKxI-_dNAFP5g,60
-howler_sentinel_plugin-0.2.0.dev21.dist-info/RECORD,,
+howler_sentinel_plugin-0.2.0.dev31.dist-info/LICENSE,sha256=Wg2luVnxEkP2NSn11nh1US6W_nFFbICBAVTG9iG3t5M,1091
+howler_sentinel_plugin-0.2.0.dev31.dist-info/METADATA,sha256=ZYY3PQKPTdpwQc5x55fldX7rRx5EfTcSuEChFiDwfdo,694
+howler_sentinel_plugin-0.2.0.dev31.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+howler_sentinel_plugin-0.2.0.dev31.dist-info/entry_points.txt,sha256=4IJyMY0V49s3Wp659ngN_7U8g66-czeKxI-_dNAFP5g,60
+howler_sentinel_plugin-0.2.0.dev31.dist-info/RECORD,,

sentinel/actions/ingestion.py

@@ -0,0 +1,59 @@
+from howler.common.loader import datastore
+from howler.datastore.operations import OdmHelper
+from howler.odm.models.hit import Hit
+
+hit_helper = OdmHelper(Hit)
+
+OPERATION_ID = "sentinel_ingestion"
+
+
+def execute(query: str, **kwargs):
+    """Handle ingestion of howler alerts into sentinel.
+
+    Args:
+        query (str): The query specifying alerts to ingest into sentinel.
+    """
+    report = [
+        {
+            "query": query,
+            "outcome": "skipped",
+            "title": "Not Yet Implemented",
+            "message": "This functionality hasn't been implemented yet.",
+        }
+    ]
+
+    ds = datastore()
+
+    skipped_hits = ds.hit.search(
+        f"({query}) AND _exists_:sentinel.id",
+        fl="howler.id",
+    )["items"]
+
+    if len(skipped_hits) > 0:
+        report.append(
+            {
+                "query": f"howler.id:({' OR '.join(h.howler.id for h in skipped_hits)})",
+                "outcome": "skipped",
+                "title": "Skipped Hit with matching sentinel alert",
+                "message": "These hits already have a matching incident in sentinel.",
+            }
+        )
+
+    print("Ingest alerts into sentinel that match this query:", query)  # noqa: T201
+
+    return report
+
+
+def specification():
+    """Specify various properties of the action, such as title, descriptions, permissions and input steps."""
+    return {
+        "id": OPERATION_ID,
+        "title": "Ingest into Sentinel",
+        "priority": 15,
+        "description": {
+            "short": "Ingest alerts into sentinel",
+            "long": execute.__doc__,
+        },
+        "roles": ["automation_basic"],
+        "triggers": ["create"],
+    }

sentinel/actions/synchronization.py

@@ -0,0 +1,60 @@
+from howler.common.loader import datastore
+from howler.datastore.operations import OdmHelper
+from howler.odm.models.action import VALID_TRIGGERS
+from howler.odm.models.hit import Hit
+
+hit_helper = OdmHelper(Hit)
+
+OPERATION_ID = "sentinel_synchronization"
+
+
+def execute(query: str, **kwargs):
+    """Handle synchronization of howler alerts into sentinel.
+
+    Args:
+        query (str): The query specifying alerts to syncrhonize with sentinel.
+    """
+    report = [
+        {
+            "query": query,
+            "outcome": "skipped",
+            "title": "Not Yet Implemented",
+            "message": "This functionality hasn't been implemented yet.",
+        }
+    ]
+
+    ds = datastore()
+
+    skipped_hits = ds.hit.search(
+        f"({query}) AND -_exists_:sentinel.id",
+        fl="howler.id",
+    )["items"]
+
+    if len(skipped_hits) > 0:
+        report.append(
+            {
+                "query": f"howler.id:({' OR '.join(h.howler.id for h in skipped_hits)})",
+                "outcome": "skipped",
+                "title": "No matching sentinel alert",
+                "message": "These hits do not have a matching incident in sentinel.",
+            }
+        )
+
+    print("Update alerts into sentinel that match this query:", f"({query}) AND _exists_:sentinel.id")  # noqa: T201
+
+    return report
+
+
+def specification():
+    """Specify various properties of the action, such as title, descriptions, permissions and input steps."""
+    return {
+        "id": OPERATION_ID,
+        "title": "Synchronize with Sentinel",
+        "priority": 16,
+        "description": {
+            "short": "Synchronize alerts with sentinel",
+            "long": execute.__doc__,
+        },
+        "roles": ["automation_basic"],
+        "triggers": [trigger for trigger in VALID_TRIGGERS if trigger != "create"],
+    }