howler-sentinel-plugin 0.2.0.dev95__tar.gz → 0.2.0.dev97__tar.gz

{howler_sentinel_plugin-0.2.0.dev95 → howler_sentinel_plugin-0.2.0.dev97}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: howler-sentinel-plugin
-Version: 0.2.0.dev95
+Version: 0.2.0.dev97
 Summary: A howler plugin for integration with Microsoft's Sentinel API
 License: MIT
 Author: CCCS

{howler_sentinel_plugin-0.2.0.dev95 → howler_sentinel_plugin-0.2.0.dev97}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "howler-sentinel-plugin"
-version = "0.2.0.dev95"
+version = "0.2.0.dev97"
 description = "A howler plugin for integration with Microsoft's Sentinel API"
 authors = [{ name = "CCCS", email = "analysis-development@cyber.gc.ca" }]
 license = { text = "MIT" }

{howler_sentinel_plugin-0.2.0.dev95 → howler_sentinel_plugin-0.2.0.dev97}/sentinel/actions/send_to_sentinel.py

@@ -34,8 +34,22 @@ def execute(query: str, **kwargs):
         return report
 
     for hit in hits:
+        tenant_id = hit.azure.tenant_id
+        if not tenant_id and hit.organization.id:
+            tenant_id = hit.organization.id
+        elif not tenant_id:
+            report.append(
+                {
+                    "query": f"howler.id:{hit.howler.id}",
+                    "outcome": "skipped",
+                    "title": "Azure Tenant ID is missing",
+                    "message": "This alert does not have a set tenant ID.",
+                }
+            )
+            continue
+
         try:
-            token, credentials = get_token(hit.azure.tenant_id)
+            token, credentials = get_token(tenant_id)
         except HowlerRuntimeError as err:
             logger.exception("Error on token fetching")
             report.append(

{howler_sentinel_plugin-0.2.0.dev95 → howler_sentinel_plugin-0.2.0.dev97}/sentinel/actions/update_defender_xdr_alert.py

@@ -73,43 +73,34 @@ def execute(query: str, **kwargs):
         return report
 
     for hit in hits:
-        try:
-            token, credentials = get_token(hit.azure.tenant_id)
-        except HowlerRuntimeError as err:
-            logger.exception("Error on token fetching")
+        tenant_id = hit.azure.tenant_id
+        if not tenant_id and hit.organization.id:
+            tenant_id = hit.organization.id
+        elif not tenant_id:
             report.append(
                 {
                     "query": f"howler.id:{hit.howler.id}",
-                    "outcome": "error",
-                    "title": "Invalid Credentials",
-                    "message": err.message,
+                    "outcome": "skipped",
+                    "title": "Azure Tenant ID is missing",
+                    "message": "This alert does not have a set tenant ID.",
                 }
             )
             continue
 
-        token_request_url = f"https://login.microsoftonline.com/{hit.azure.tenant_id}/oauth2/v2.0/token"
-        data = {
-            "grant_type": "client_credentials",
-            "client_id": credentials["client_id"],
-            "client_secret": credentials["client_secret"],
-            "scope": "https://graph.microsoft.com/.default",
-        }
-        response = requests.post(token_request_url, data=data, timeout=5.0)
-
-        if not response.ok:
-            logger.warning("Failed to authenticate to Microsoft Graph.")
+        try:
+            token = get_token(tenant_id)[0]
+        except HowlerRuntimeError as err:
+            logger.exception("Error on token fetching")
             report.append(
                 {
-                    "query": query,
+                    "query": f"howler.id:{hit.howler.id}",
                     "outcome": "error",
-                    "title": "Authentication failed",
-                    "message": f"Authentication to Microsoft Graph API failed with status code {response.status_code}.",
+                    "title": "Invalid Credentials",
+                    "message": err.message,
                 }
             )
             continue
 
-        token = response.json()["access_token"]
-
         # Fetch alert details
         alert_url = f"https://graph.microsoft.com/v1.0/security/alerts_v2/{hit.rule.id}"
         response = requests.get(alert_url, headers={"Authorization": f"Bearer {token}"}, timeout=5.0)
@@ -124,6 +115,7 @@ def execute(query: str, **kwargs):
                 }
             )
             continue
+
         alert_data = response.json()
 
         # Update alert