howler-sentinel-plugin 0.2.0.dev98__py3-none-any.whl → 0.2.0.dev100__py3-none-any.whl

{howler_sentinel_plugin-0.2.0.dev98.dist-info → howler_sentinel_plugin-0.2.0.dev100.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: howler-sentinel-plugin
-Version: 0.2.0.dev98
+Version: 0.2.0.dev100
 Summary: A howler plugin for integration with Microsoft's Sentinel API
 License: MIT
 Author: CCCS

howler_sentinel_plugin-0.2.0.dev100.dist-info/RECORD

@@ -0,0 +1,17 @@
+sentinel/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sentinel/actions/azure_emit_hash.py,sha256=yEO8ZjFTUjNm03fJfHRVER3xf0v5o0qdU8GnqwZtMTM,2938
+sentinel/actions/send_to_sentinel.py,sha256=rfIJk02iAACvb8bfKv9MEkSDILDnvXlxt49hQVyvvQ4,3734
+sentinel/actions/update_defender_xdr_alert.py,sha256=OjNXM8DixURYdl7fHLCS81I0izQVtQgFkw9Iteeklwg,6418
+sentinel/mapping/sentinel_incident.py,sha256=U7fIh8N4Jdr1A4z1E0jPRP28Ll0Cq7u9Q6292AnyRDI,9548
+sentinel/mapping/xdr_alert.py,sha256=UPoqdZsjUXmJz0dCf_qMlh9Jr0D2HcSNOFvbg8lE4wY,18250
+sentinel/mapping/xdr_alert_evidence.py,sha256=q622G4eZwFR3TCj418ZCpE83DGVicrWIQZo8Gkj_3FM,31323
+sentinel/odm/hit.py,sha256=hAuO2ONMK3Ml8Xu6E7tHrmZ7M6HG5tT38RD9ZxwY254,666
+sentinel/odm/models/sentinel.py,sha256=XT3XdT92uoCV5vmY9dT1jmcxRyuu9vp1gE8AwZdKBIc,337
+sentinel/routes/__init__.py,sha256=JYmKRwIfEsiPos1XuMQ2mlGDbxk6TN_cVEM0K_RNze4,130
+sentinel/routes/ingest.py,sha256=_9OdOw_9nBJseKIBnmHDLjnqZ_bDdM4wfLpLrek4-ak,7018
+sentinel/utils/tenant_utils.py,sha256=W7kBtxYNhs3vcgMf78eIRqiTpDtqjzEI2H2d0papQ_Q,1224
+howler_sentinel_plugin-0.2.0.dev100.dist-info/LICENSE,sha256=Wg2luVnxEkP2NSn11nh1US6W_nFFbICBAVTG9iG3t5M,1091
+howler_sentinel_plugin-0.2.0.dev100.dist-info/METADATA,sha256=i2_2R4LULJ85TCCgOzJBY3SCs3lRVoTOoCkFLPdeNEU,749
+howler_sentinel_plugin-0.2.0.dev100.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+howler_sentinel_plugin-0.2.0.dev100.dist-info/entry_points.txt,sha256=4IJyMY0V49s3Wp659ngN_7U8g66-czeKxI-_dNAFP5g,60
+howler_sentinel_plugin-0.2.0.dev100.dist-info/RECORD,,

sentinel/actions/azure_emit_hash.py

@@ -1,4 +1,5 @@
 import os
+from typing import Optional
 
 import requests
 from howler.common.loader import datastore
@@ -9,11 +10,26 @@ from pydash import get
 OPERATION_ID = "azure_emit_hash"
 
 
-def execute(query: str, field: str = "file.hash.sha256", **kwargs):
+def execute(
+    query: str,
+    url: Optional[str] = os.environ.get("SHA256_LOGIC_APP_URL", None),
+    field: str = "file.hash.sha256",
+    **kwargs,
+):
     "Emit hashes to sentinel"
     result = datastore().hit.search(query, rows=1)
     hits = result["items"]
 
+    if not url:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Action is not properly configured",
+                "message": "url argument cannot be empty.",
+            }
+        ]
+
     if len(hits) < 1:
         return [
             {
@@ -41,7 +57,7 @@ def execute(query: str, field: str = "file.hash.sha256", **kwargs):
         hash_value = get(hit, field)
         if hash_value:
             requests.post(
-                os.environ["SHA256_LOGIC_APP_URL"],  # noqa: F821
+                url,  # noqa: F821
                 json={
                     "indicator": hash_value,
                     "type": "FileSha256",
@@ -76,7 +92,7 @@ def specification():
         "roles": ["automation_basic"],
         "steps": [
             {
-                "args": {"field": []},
+                "args": {"url": [], "field": []},
                 "options": {"field": [field for field in Hit.flat_fields().keys() if field.endswith("sha256")]},
             }
         ],

sentinel/actions/send_to_sentinel.py

@@ -34,10 +34,11 @@ def execute(query: str, **kwargs):
         return report
 
     for hit in hits:
-        tenant_id = hit.azure.tenant_id
-        if not tenant_id and hit.organization.id:
+        if hit.azure and hit.azure.tenant_id:
+            tenant_id = hit.azure.tenant_id
+        elif hit.organization.id:
             tenant_id = hit.organization.id
-        elif not tenant_id:
+        else:
             report.append(
                 {
                     "query": f"howler.id:{hit.howler.id}",

sentinel/actions/update_defender_xdr_alert.py

@@ -73,10 +73,11 @@ def execute(query: str, **kwargs):
         return report
 
     for hit in hits:
-        tenant_id = hit.azure.tenant_id
-        if not tenant_id and hit.organization.id:
+        if hit.azure and hit.azure.tenant_id:
+            tenant_id = hit.azure.tenant_id
+        elif hit.organization.id:
             tenant_id = hit.organization.id
-        elif not tenant_id:
+        else:
             report.append(
                 {
                     "query": f"howler.id:{hit.howler.id}",

sentinel/mapping/sentinel_incident.py

@@ -76,7 +76,7 @@ class SentinelIncident:
                     "score": self.map_severity_to_score(severity),
                     "outline.summary": description,
                     "rationale": resolving_comment,
-                    "analytic": "MSGraph",
+                    "analytic": "Sentinel",
                     "is_bundle": True,
                     "bundle_size": 0,
                     "hits": [],

howler_sentinel_plugin-0.2.0.dev98.dist-info/RECORD

@@ -1,17 +0,0 @@
-sentinel/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-sentinel/actions/azure_emit_hash.py,sha256=52ZJNbaCT4OshM1EqK3y47KD_HCxqPqnEnc3XsgUqso,2582
-sentinel/actions/send_to_sentinel.py,sha256=sg3LyP7IGApMftBU1TTZSUmCGtUI9PwvmI7UBj1Jrf0,3714
-sentinel/actions/update_defender_xdr_alert.py,sha256=_Dtsi2pR5xN8ltzYGpCn9JbYnK731l6LSrGtERVfym4,6398
-sentinel/mapping/sentinel_incident.py,sha256=3QBnP6qFpJgE3pHvx5VvFnB3m2TVOoWxs8OysDlJVV8,9547
-sentinel/mapping/xdr_alert.py,sha256=UPoqdZsjUXmJz0dCf_qMlh9Jr0D2HcSNOFvbg8lE4wY,18250
-sentinel/mapping/xdr_alert_evidence.py,sha256=q622G4eZwFR3TCj418ZCpE83DGVicrWIQZo8Gkj_3FM,31323
-sentinel/odm/hit.py,sha256=hAuO2ONMK3Ml8Xu6E7tHrmZ7M6HG5tT38RD9ZxwY254,666
-sentinel/odm/models/sentinel.py,sha256=XT3XdT92uoCV5vmY9dT1jmcxRyuu9vp1gE8AwZdKBIc,337
-sentinel/routes/__init__.py,sha256=JYmKRwIfEsiPos1XuMQ2mlGDbxk6TN_cVEM0K_RNze4,130
-sentinel/routes/ingest.py,sha256=_9OdOw_9nBJseKIBnmHDLjnqZ_bDdM4wfLpLrek4-ak,7018
-sentinel/utils/tenant_utils.py,sha256=W7kBtxYNhs3vcgMf78eIRqiTpDtqjzEI2H2d0papQ_Q,1224
-howler_sentinel_plugin-0.2.0.dev98.dist-info/LICENSE,sha256=Wg2luVnxEkP2NSn11nh1US6W_nFFbICBAVTG9iG3t5M,1091
-howler_sentinel_plugin-0.2.0.dev98.dist-info/METADATA,sha256=MLmv_F7Wd0W3um49eqIZXDUGvDfR1XV1mjBM_3WcW7o,748
-howler_sentinel_plugin-0.2.0.dev98.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-howler_sentinel_plugin-0.2.0.dev98.dist-info/entry_points.txt,sha256=4IJyMY0V49s3Wp659ngN_7U8g66-czeKxI-_dNAFP5g,60
-howler_sentinel_plugin-0.2.0.dev98.dist-info/RECORD,,