howler-sentinel-plugin 0.2.0.dev98__tar.gz → 0.2.0.dev100__tar.gz

{howler_sentinel_plugin-0.2.0.dev98 → howler_sentinel_plugin-0.2.0.dev100}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: howler-sentinel-plugin
-Version: 0.2.0.dev98
+Version: 0.2.0.dev100
 Summary: A howler plugin for integration with Microsoft's Sentinel API
 License: MIT
 Author: CCCS

{howler_sentinel_plugin-0.2.0.dev98 → howler_sentinel_plugin-0.2.0.dev100}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "howler-sentinel-plugin"
-version = "0.2.0.dev98"
+version = "0.2.0.dev100"
 description = "A howler plugin for integration with Microsoft's Sentinel API"
 authors = [{ name = "CCCS", email = "analysis-development@cyber.gc.ca" }]
 license = { text = "MIT" }

{howler_sentinel_plugin-0.2.0.dev98 → howler_sentinel_plugin-0.2.0.dev100}/sentinel/actions/azure_emit_hash.py

@@ -1,4 +1,5 @@
 import os
+from typing import Optional
 
 import requests
 from howler.common.loader import datastore
@@ -9,11 +10,26 @@ from pydash import get
 OPERATION_ID = "azure_emit_hash"
 
 
-def execute(query: str, field: str = "file.hash.sha256", **kwargs):
+def execute(
+    query: str,
+    url: Optional[str] = os.environ.get("SHA256_LOGIC_APP_URL", None),
+    field: str = "file.hash.sha256",
+    **kwargs,
+):
     "Emit hashes to sentinel"
     result = datastore().hit.search(query, rows=1)
     hits = result["items"]
 
+    if not url:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Action is not properly configured",
+                "message": "url argument cannot be empty.",
+            }
+        ]
+
     if len(hits) < 1:
         return [
             {
@@ -41,7 +57,7 @@ def execute(query: str, field: str = "file.hash.sha256", **kwargs):
         hash_value = get(hit, field)
         if hash_value:
             requests.post(
-                os.environ["SHA256_LOGIC_APP_URL"],  # noqa: F821
+                url,  # noqa: F821
                 json={
                     "indicator": hash_value,
                     "type": "FileSha256",
@@ -76,7 +92,7 @@ def specification():
         "roles": ["automation_basic"],
         "steps": [
             {
-                "args": {"field": []},
+                "args": {"url": [], "field": []},
                 "options": {"field": [field for field in Hit.flat_fields().keys() if field.endswith("sha256")]},
             }
         ],

{howler_sentinel_plugin-0.2.0.dev98 → howler_sentinel_plugin-0.2.0.dev100}/sentinel/actions/send_to_sentinel.py

@@ -34,10 +34,11 @@ def execute(query: str, **kwargs):
         return report
 
     for hit in hits:
-        tenant_id = hit.azure.tenant_id
-        if not tenant_id and hit.organization.id:
+        if hit.azure and hit.azure.tenant_id:
+            tenant_id = hit.azure.tenant_id
+        elif hit.organization.id:
             tenant_id = hit.organization.id
-        elif not tenant_id:
+        else:
             report.append(
                 {
                     "query": f"howler.id:{hit.howler.id}",

{howler_sentinel_plugin-0.2.0.dev98 → howler_sentinel_plugin-0.2.0.dev100}/sentinel/actions/update_defender_xdr_alert.py

@@ -73,10 +73,11 @@ def execute(query: str, **kwargs):
         return report
 
     for hit in hits:
-        tenant_id = hit.azure.tenant_id
-        if not tenant_id and hit.organization.id:
+        if hit.azure and hit.azure.tenant_id:
+            tenant_id = hit.azure.tenant_id
+        elif hit.organization.id:
             tenant_id = hit.organization.id
-        elif not tenant_id:
+        else:
             report.append(
                 {
                     "query": f"howler.id:{hit.howler.id}",

{howler_sentinel_plugin-0.2.0.dev98 → howler_sentinel_plugin-0.2.0.dev100}/sentinel/mapping/sentinel_incident.py

@@ -76,7 +76,7 @@ class SentinelIncident:
                     "score": self.map_severity_to_score(severity),
                     "outline.summary": description,
                     "rationale": resolving_comment,
-                    "analytic": "MSGraph",
+                    "analytic": "Sentinel",
                     "is_bundle": True,
                     "bundle_size": 0,
                     "hits": [],