howler-sentinel-plugin 0.2.0.dev96__py3-none-any.whl → 0.2.0.dev97__py3-none-any.whl

{howler_sentinel_plugin-0.2.0.dev96.dist-info → howler_sentinel_plugin-0.2.0.dev97.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: howler-sentinel-plugin
-Version: 0.2.0.dev96
+Version: 0.2.0.dev97
 Summary: A howler plugin for integration with Microsoft's Sentinel API
 License: MIT
 Author: CCCS

{howler_sentinel_plugin-0.2.0.dev96.dist-info → howler_sentinel_plugin-0.2.0.dev97.dist-info}/RECORD

@@ -1,8 +1,8 @@
 sentinel/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 sentinel/actions/ingestion.py,sha256=_t7wrmozhoT_MmktDmNxYiXrA1Q0LCiDt0rTwHBkwbc,1669
-sentinel/actions/send_to_sentinel.py,sha256=REclVHxuG0Q5PIXZ-13crQhoz8BmJJJyTc6suzpq0m0,3227
+sentinel/actions/send_to_sentinel.py,sha256=sg3LyP7IGApMftBU1TTZSUmCGtUI9PwvmI7UBj1Jrf0,3714
 sentinel/actions/synchronization.py,sha256=g5c34410zINWb4fSEzj94drnk5alRj_ju9xMrB39z0s,1818
-sentinel/actions/update_defender_xdr_alert.py,sha256=hlCG2d2X19Zhtm1KGAqNHLG9a4yO53GZebRp--07D7c,6408
+sentinel/actions/update_defender_xdr_alert.py,sha256=_Dtsi2pR5xN8ltzYGpCn9JbYnK731l6LSrGtERVfym4,6398
 sentinel/mapping/sentinel_incident.py,sha256=3QBnP6qFpJgE3pHvx5VvFnB3m2TVOoWxs8OysDlJVV8,9547
 sentinel/mapping/xdr_alert.py,sha256=UPoqdZsjUXmJz0dCf_qMlh9Jr0D2HcSNOFvbg8lE4wY,18250
 sentinel/mapping/xdr_alert_evidence.py,sha256=q622G4eZwFR3TCj418ZCpE83DGVicrWIQZo8Gkj_3FM,31323
@@ -11,8 +11,8 @@ sentinel/odm/models/sentinel.py,sha256=XT3XdT92uoCV5vmY9dT1jmcxRyuu9vp1gE8AwZdKB
 sentinel/routes/__init__.py,sha256=JYmKRwIfEsiPos1XuMQ2mlGDbxk6TN_cVEM0K_RNze4,130
 sentinel/routes/ingest.py,sha256=_9OdOw_9nBJseKIBnmHDLjnqZ_bDdM4wfLpLrek4-ak,7018
 sentinel/utils/tenant_utils.py,sha256=W7kBtxYNhs3vcgMf78eIRqiTpDtqjzEI2H2d0papQ_Q,1224
-howler_sentinel_plugin-0.2.0.dev96.dist-info/LICENSE,sha256=Wg2luVnxEkP2NSn11nh1US6W_nFFbICBAVTG9iG3t5M,1091
-howler_sentinel_plugin-0.2.0.dev96.dist-info/METADATA,sha256=rLIqpGiyGrs750JTWKDjpoDIesH3zh9i495TjeOwoZs,748
-howler_sentinel_plugin-0.2.0.dev96.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-howler_sentinel_plugin-0.2.0.dev96.dist-info/entry_points.txt,sha256=4IJyMY0V49s3Wp659ngN_7U8g66-czeKxI-_dNAFP5g,60
-howler_sentinel_plugin-0.2.0.dev96.dist-info/RECORD,,
+howler_sentinel_plugin-0.2.0.dev97.dist-info/LICENSE,sha256=Wg2luVnxEkP2NSn11nh1US6W_nFFbICBAVTG9iG3t5M,1091
+howler_sentinel_plugin-0.2.0.dev97.dist-info/METADATA,sha256=x3hPU9xXhV3PXUjvFkolFYrXimd1VvhWk96rky6mcpA,748
+howler_sentinel_plugin-0.2.0.dev97.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+howler_sentinel_plugin-0.2.0.dev97.dist-info/entry_points.txt,sha256=4IJyMY0V49s3Wp659ngN_7U8g66-czeKxI-_dNAFP5g,60
+howler_sentinel_plugin-0.2.0.dev97.dist-info/RECORD,,

sentinel/actions/send_to_sentinel.py

@@ -34,8 +34,22 @@ def execute(query: str, **kwargs):
         return report
 
     for hit in hits:
+        tenant_id = hit.azure.tenant_id
+        if not tenant_id and hit.organization.id:
+            tenant_id = hit.organization.id
+        elif not tenant_id:
+            report.append(
+                {
+                    "query": f"howler.id:{hit.howler.id}",
+                    "outcome": "skipped",
+                    "title": "Azure Tenant ID is missing",
+                    "message": "This alert does not have a set tenant ID.",
+                }
+            )
+            continue
+
         try:
-            token, credentials = get_token(hit.azure.tenant_id)
+            token, credentials = get_token(tenant_id)
         except HowlerRuntimeError as err:
             logger.exception("Error on token fetching")
             report.append(

sentinel/actions/update_defender_xdr_alert.py

@@ -88,7 +88,7 @@ def execute(query: str, **kwargs):
             continue
 
         try:
-            token = get_token(hit.azure.tenant_id)[0]
+            token = get_token(tenant_id)[0]
         except HowlerRuntimeError as err:
             logger.exception("Error on token fetching")
             report.append(