howler-sentinel-plugin 0.2.0.dev327__tar.gz → 0.2.0.dev334__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/PKG-INFO +1 -1
  2. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/pyproject.toml +1 -1
  3. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/routes/ingest.py +2 -2
  4. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/LICENSE +0 -0
  5. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/README.md +0 -0
  6. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/__init__.py +0 -0
  7. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/actions/azure_emit_hash.py +0 -0
  8. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/actions/send_to_sentinel.py +0 -0
  9. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/actions/update_defender_xdr_alert.py +0 -0
  10. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/actions/update_defender_xdr_incident.py +0 -0
  11. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/config.py +0 -0
  12. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/manifest.yml +0 -0
  13. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/mapping/sentinel_incident.py +0 -0
  14. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/mapping/xdr_alert.py +0 -0
  15. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/mapping/xdr_alert_evidence.py +0 -0
  16. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/odm/__init__.py +0 -0
  17. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/odm/hit.py +0 -0
  18. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/odm/models/sentinel.py +0 -0
  19. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/routes/__init__.py +0 -0
  20. {howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/utils/tenant_utils.py +0 -0
{howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/PKG-INFO RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: howler-sentinel-plugin
3
- Version: 0.2.0.dev327
3
+ Version: 0.2.0.dev334
4
4
  Summary: A howler plugin for integration with Microsoft's Sentinel API
5
5
  License: MIT
6
6
  License-File: LICENSE
{howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/pyproject.toml RENAMED
@@ -1,6 +1,6 @@
1
1
  [project]
2
2
  name = "howler-sentinel-plugin"
3
- version = "0.2.0.dev327"
3
+ version = "0.2.0.dev334"
4
4
  description = "A howler plugin for integration with Microsoft's Sentinel API"
5
5
  authors = [{ name = "CCCS", email = "analysis-development@cyber.gc.ca" }]
6
6
  license = { text = "MIT" }
{howler_sentinel_plugin-0.2.0.dev327 → howler_sentinel_plugin-0.2.0.dev334}/sentinel/routes/ingest.py RENAMED
@@ -169,7 +169,7 @@ def _create_alert_hits(alerts: list[dict[str, Any]], tenant_id: str, alert_mappe
169
169
  alert_hit_odm.event.id = alert_hit_odm.howler.id
170
170
  logger.info("Creating individual alert hit %s with ID %s", i, alert_hit_odm.howler.id)
171
171
  hit_service.create_hit(alert_hit_odm.howler.id, alert_hit_odm, user="system")
172
- analytic_service.save_from_hit(alert_hit_odm, {"uname": "system"})
172
+ analytic_service.save_from_hits(alert_hit_odm, {"uname": "system"})
173
173
  child_hit_ids.append(alert_hit_odm.howler.id)
174
174
  logger.debug("Successfully created alert hit %s: %s", i, alert_hit_odm.howler.id)
175
175
  else:
@@ -238,7 +238,7 @@ def _create_new_incident(
238
238
 
239
239
  logger.info("Creating incident hit with ID %s", bundle_odm.howler.id)
240
240
  hit_service.create_hit(bundle_odm.howler.id, bundle_odm, user="system")
241
- analytic_service.save_from_hit(bundle_odm, {"uname": "system"})
241
+ analytic_service.save_from_hits(bundle_odm, {"uname": "system"})
242
242
  if child_hit_ids:
243
243
  _link_child_hits_to_bundle(bundle_odm, child_hit_ids)
244
244
  datastore().hit.commit()