howler-sentinel-plugin 0.2.0.dev373__tar.gz → 0.2.0.dev418__tar.gz

{howler_sentinel_plugin-0.2.0.dev373 → howler_sentinel_plugin-0.2.0.dev418}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-sentinel-plugin
-Version: 0.2.0.dev373
+Version: 0.2.0.dev418
 Summary: A howler plugin for integration with Microsoft's Sentinel API
 License: MIT
 License-File: LICENSE

{howler_sentinel_plugin-0.2.0.dev373 → howler_sentinel_plugin-0.2.0.dev418}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "howler-sentinel-plugin"
-version = "0.2.0.dev373"
+version = "0.2.0.dev418"
 description = "A howler plugin for integration with Microsoft's Sentinel API"
 authors = [{ name = "CCCS", email = "analysis-development@cyber.gc.ca" }]
 license = { text = "MIT" }
@@ -131,14 +131,14 @@ packages = [{ include = "sentinel" }]
 
 
 [tool.poetry.group.dev.dependencies]
-ruff = "^0.15.19"
+ruff = "^0.15.20"
 mypy = "^1.20.2"
 pre-commit = "^4.6.0"
 howler-api = { path = "../../api" }
 pytest = "^9.1.1"
 mock = "^5.2.0"
 pytest-cov = "^6.3.0"
-coverage = { extras = ["toml"], version = "^7.14.3" }
+coverage = { extras = ["toml"], version = "^7.15.0" }
 diff-cover = "^10.3.0"
 python-dotenv = "^1.2.2"
 

{howler_sentinel_plugin-0.2.0.dev373 → howler_sentinel_plugin-0.2.0.dev418}/sentinel/actions/update_defender_xdr_alert.py

@@ -4,7 +4,7 @@ from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.odm.models.action import VALID_TRIGGERS
 from howler.odm.models.hit import Hit
-from howler.odm.models.howler_data import Assessment, HitStatus
+from howler.odm.models.howler_data import Assessment, Status
 
 from sentinel.utils.tenant_utils import get_token
 
@@ -15,10 +15,10 @@ OPERATION_ID = "update_defender_xdr_alert"
 properties_map = {
     "graph": {
         "status": {
-            HitStatus.OPEN: "new",
-            HitStatus.IN_PROGRESS: "inProgress",
-            HitStatus.ON_HOLD: "inProgress",
-            HitStatus.RESOLVED: "resolved",
+            Status.OPEN: "new",
+            Status.IN_PROGRESS: "inProgress",
+            Status.ON_HOLD: "inProgress",
+            Status.RESOLVED: "resolved",
         },
         "classification": {
             Assessment.AMBIGUOUS: "unknown",

{howler_sentinel_plugin-0.2.0.dev373 → howler_sentinel_plugin-0.2.0.dev418}/sentinel/actions/update_defender_xdr_incident.py

@@ -4,7 +4,7 @@ from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.odm.models.action import VALID_TRIGGERS
 from howler.odm.models.hit import Hit
-from howler.odm.models.howler_data import Assessment, HitStatus
+from howler.odm.models.howler_data import Assessment, Status
 
 from sentinel.utils.tenant_utils import get_token
 
@@ -15,10 +15,10 @@ OPERATION_ID = "update_defender_xdr_incident"
 properties_map = {
     "graph": {
         "status": {
-            HitStatus.OPEN: "active",
-            HitStatus.IN_PROGRESS: "inProgress",
-            HitStatus.ON_HOLD: "inProgress",
-            HitStatus.RESOLVED: "resolved",
+            Status.OPEN: "active",
+            Status.IN_PROGRESS: "inProgress",
+            Status.ON_HOLD: "inProgress",
+            Status.RESOLVED: "resolved",
         },
         "classification": {
             Assessment.AMBIGUOUS: "unknown",

{howler_sentinel_plugin-0.2.0.dev373 → howler_sentinel_plugin-0.2.0.dev418}/sentinel/routes/ingest.py

@@ -7,7 +7,9 @@ from howler.common.exceptions import HowlerException
 from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.common.swagger import generate_swagger_docs
-from howler.services import action_service, analytic_service, hit_service
+from howler.config import CLASSIFICATION
+from howler.odm.models.user import User
+from howler.services import action_service, analytic_service, case_service, hit_service
 
 from sentinel.mapping.sentinel_incident import SentinelIncident
 from sentinel.mapping.xdr_alert import XDRAlert
@@ -18,6 +20,16 @@ sentinel_api._doc = "Ingest Microsoft Sentinel XDR incidents into Howler"  # typ
 
 logger = get_logger(__file__)
 
+SYSTEM_USER = User(
+    {
+        "uname": "system",
+        "name": "system",
+        "type": ["admin", "user"],
+        "classification": CLASSIFICATION.RESTRICTED,
+        "password": "__NO_PASSWORD__",
+    }
+)
+
 
 @generate_swagger_docs()
 @sentinel_api.route("/ingest", methods=["POST"])
@@ -115,33 +127,50 @@ def _update_existing_incident(
 ) -> tuple[dict[str, Any], int]:
     """Update an existing incident and its underlying alerts in Howler.
 
+    Finds the associated case via ``howler.related`` on the root hit, then
+    updates the status on the root hit and all child hits referenced by the case.
+
     Args:
-        existing_bundle: The existing Howler bundle object.
+        existing_bundle: The existing Howler root hit object.
         xdr_incident: The incoming XDR incident data.
         incident_mapper: The incident mapper instance.
 
     Returns:
         Tuple containing response dictionary and HTTP status code.
     """
+    ds = datastore()
     new_status = xdr_incident.get("status")
+
+    # Find child hit IDs via the case items
+    child_hit_ids: list[str] = []
+    for related_id in getattr(existing_bundle.howler, "related", []):
+        case = ds.case.get(related_id)
+        if case is not None:
+            child_hit_ids = [
+                item.value for item in case.items if item.type == "hit" and item.value != existing_bundle.howler.id
+            ]
+            break
+
     if new_status:
         existing_bundle.howler.status = incident_mapper.map_sentinel_status_to_howler(new_status)
-        datastore().hit.save(existing_bundle.howler.id, existing_bundle)
-    for child_id in getattr(existing_bundle.howler, "hits", []):
-        child_hit = datastore().hit.get(child_id, as_obj=True)
-        if child_hit:
-            child_hit.howler.status = incident_mapper.map_sentinel_status_to_howler(new_status)
-            datastore().hit.save(child_id, child_hit)
-    datastore().hit.commit()
-    logger.info("Updated status for existing bundle %s and its child hits", existing_bundle.howler.id)
+        ds.hit.save(existing_bundle.howler.id, existing_bundle)
+
+        for child_id in child_hit_ids:
+            child_hit = ds.hit.get(child_id, as_obj=True)
+            if child_hit:
+                child_hit.howler.status = incident_mapper.map_sentinel_status_to_howler(new_status)
+                ds.hit.save(child_id, child_hit)
+
+    ds.hit.commit()
+    logger.info("Updated status for existing incident %s and its child hits", existing_bundle.howler.id)
     return ok(
         {
             "success": True,
             "bundle_hit_id": existing_bundle.howler.id,
             "bundle_id": existing_bundle.sentinel.id if hasattr(existing_bundle, "sentinel") else None,
-            "individual_hit_ids": getattr(existing_bundle.howler, "hits", []),
-            "total_hits_updated": 1 + len(getattr(existing_bundle.howler, "hits", [])),
-            "bundle_size": len(getattr(existing_bundle.howler, "hits", [])),
+            "individual_hit_ids": child_hit_ids,
+            "total_hits_updated": 1 + len(child_hit_ids),
+            "bundle_size": len(child_hit_ids),
             "organization": getattr(existing_bundle, "organization", {}).get("name", ""),
             "updated": True,
         }
@@ -169,7 +198,7 @@ def _create_alert_hits(alerts: list[dict[str, Any]], tenant_id: str, alert_mappe
                     alert_hit_odm.event.id = alert_hit_odm.howler.id
                 logger.info("Creating individual alert hit %s with ID %s", i, alert_hit_odm.howler.id)
                 hit_service.create_hit(alert_hit_odm.howler.id, alert_hit_odm, user="system")
-                analytic_service.save_from_hits(alert_hit_odm, {"uname": "system"})
+                analytic_service.save_from_hits(alert_hit_odm, SYSTEM_USER)
                 child_hit_ids.append(alert_hit_odm.howler.id)
                 logger.debug("Successfully created alert hit %s: %s", i, alert_hit_odm.howler.id)
             else:
@@ -180,33 +209,13 @@ def _create_alert_hits(alerts: list[dict[str, Any]], tenant_id: str, alert_mappe
     return child_hit_ids
 
 
-def _link_child_hits_to_bundle(bundle_odm: Any, child_hit_ids: list[str]) -> None:
-    """Link child hits to the bundle and update their bundle references.
-
-    Args:
-        bundle_odm: The bundle ODM object.
-        child_hit_ids: List of child hit IDs to link.
-    """
-    for hit_id in bundle_odm.howler.hits:
-        child_hit = hit_service.get_hit(hit_id, as_odm=True)
-
-        if child_hit.howler.is_bundle:
-            logger.warning("Child hit %s is a bundle - skipping bundle assignment", child_hit.howler.id)
-            continue
-
-        new_bundle_list = child_hit.howler.get("bundles", [])
-        new_bundle_list.append(bundle_odm.howler.id)
-        child_hit.howler.bundles = new_bundle_list
-        datastore().hit.save(child_hit.howler.id, child_hit)
-
-
 def _create_new_incident(
     bundle_hit: dict[str, Any], xdr_incident: dict[str, Any], tenant_mapping: dict[str, str]
 ) -> tuple[dict[str, Any], int]:
-    """Create a new incident bundle and its underlying alerts in Howler.
+    """Create a new incident as a root hit plus a case with child alert items.
 
     Args:
-        bundle_hit: The mapped Howler bundle data.
+        bundle_hit: The mapped Howler hit data for the root incident hit.
         xdr_incident: The incoming XDR incident data.
         tenant_mapping: The tenant mapping dictionary.
 
@@ -218,32 +227,66 @@ def _create_new_incident(
     alert_mapper = XDRAlert(tid_mapping=tenant_mapping)
     child_hit_ids = _create_alert_hits(alerts, tenant_id, alert_mapper)
     try:
-        bundle_odm, _ = hit_service.convert_hit(bundle_hit, unique=True)
-        # If there are no alerts, do not treat as bundle
-        if child_hit_ids:
-            bundle_odm.howler.is_bundle = True
-            if not hasattr(bundle_odm.howler, "hits") or not isinstance(bundle_odm.howler.hits, list):
-                bundle_odm.howler.hits = []
-            for hit_id in child_hit_ids:
-                if hit_id not in bundle_odm.howler.hits:
-                    bundle_odm.howler.hits.append(hit_id)
-            bundle_odm.howler.bundle_size = len(bundle_odm.howler.hits)
-        else:
-            bundle_odm.howler.is_bundle = False
-            bundle_odm.howler.hits = []
-            bundle_odm.howler.bundle_size = 0
+        # Strip legacy bundle fields so convert_hit doesn't choke
+        if isinstance(bundle_hit.get("howler"), dict):
+            bundle_hit["howler"].pop("is_bundle", None)
+            bundle_hit["howler"].pop("hits", None)
+            bundle_hit["howler"].pop("bundle_size", None)
+            bundle_hit["howler"].pop("bundles", None)
+
+        bundle_odm, _ = hit_service.convert_hit(bundle_hit, unique=True, ignore_extra_values=True)
 
         if bundle_odm.event is not None:
             bundle_odm.event.id = bundle_odm.howler.id
 
         logger.info("Creating incident hit with ID %s", bundle_odm.howler.id)
         hit_service.create_hit(bundle_odm.howler.id, bundle_odm, user="system")
-        analytic_service.save_from_hits(bundle_odm, {"uname": "system"})
+        analytic_service.save_from_hits(bundle_odm, SYSTEM_USER)
+
+        # Create a case linking root hit and children
         if child_hit_ids:
-            _link_child_hits_to_bundle(bundle_odm, child_hit_ids)
+            analytic = bundle_odm.howler.analytic or "Sentinel"
+            detection = bundle_odm.howler.detection or "XDR Incident"
+            case = case_service.create_case(
+                {"title": f"{analytic} - {detection}", "summary": f"Sentinel incident {bundle_odm.howler.id}"},
+                user=SYSTEM_USER,
+            )
+
+            case_service.append_case_item(
+                case.case_id,
+                item_type="hit",
+                item_value=bundle_odm.howler.id,
+                item_name=analytic,
+            )
+
+            # Re-fetch the case to get the latest saved state, then create the
+            # "hits" folder so children can be nested inside it.
+            case = datastore().case.get(case.case_id) or case
+            hits_folder = case_service.get_parent_from_path(case, "hits", create_if_missing=True)
+            datastore().case.save(case.case_id, case)
+
+            for child_id in child_hit_ids:
+                child_hit = hit_service.get_hit(child_id, as_odm=True)
+                if child_hit:
+                    child_name = f"{child_hit.howler.analytic} ({child_id})"
+                    try:
+                        case_service.append_case_item(
+                            case.case_id,
+                            item_type="hit",
+                            item_value=child_id,
+                            item_parent=hits_folder.id if hits_folder else None,
+                            item_name=child_name,
+                        )
+                    except Exception:
+                        logger.exception("Failed to add child hit %s to case", child_id)
+
+            datastore().case.commit()
+
         datastore().hit.commit()
+
         if child_hit_ids:
-            action_service.bulk_execute_on_query(f"howler.id:{bundle_odm.howler.id}", user={"uname": "system"})
+            action_service.bulk_execute_on_query(f"howler.id:{bundle_odm.howler.id}", user=SYSTEM_USER)
+
         logger.info("Successfully completed XDR incident ingestion")
         response_body = {
             "success": True,
@@ -256,5 +299,5 @@ def _create_new_incident(
         }
         return created(response_body)
     except HowlerException as e:
-        logger.exception("Failed to create bundle")
-        return internal_error(err=f"Failed to create bundle: {str(e)}")
+        logger.exception("Failed to create incident")
+        return internal_error(err=f"Failed to create incident: {str(e)}")