rosetta-ce 1.3.2__py3.11.egg → 1.3.4__py3.11.egg

EGG-INFO/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: rosetta-ce
-Version: 1.3.2
+Version: 1.3.4
 Summary: Rosetta is a Python package that can be used to fake security logs and alerts for testing different detection and response use cases.
 Home-page: https://github.com/ayman-m/rosetta
 Author: Ayman Mahmoud

rosetta/rfaker.py

@@ -31,21 +31,32 @@ class ObservableKnown(Enum):
 
 class Observables:
     def __init__(self, src_ip: list = None, dst_ip: Optional[list] = None, src_host: Optional[list] = None,
-                 dst_host: Optional[list] = None, url: Optional[list] = None, port: Optional[list] = None,
-                 protocol: Optional[list] = None, app: Optional[list] = None, os: Optional[list] = None,
-                 user: Optional[list] = None, cve: Optional[list] = None, file_name: Optional[list] = None,
-                 file_hash: Optional[list] = None, cmd: Optional[list] = None, process: Optional[list] = None,
-                 technique: Optional[list] = None, entry_type: Optional[list] = None, severity: Optional[list] = None,
-                 sensor: Optional[list] = None, action: Optional[list] = None, event_id: Optional[list] = None,
-                 error_code: Optional[list] = None, terms: Optional[list] = None, incident_types: Optional[list] = None,
-                 analysts: Optional[list] = None):
+                 dst_host: Optional[list] = None, src_domain: Optional[list] = None, dst_domain: Optional[list] = None,
+                 sender_email: Optional[list] = None, recipient_email: Optional[list] = None,
+                 email_subject: Optional[list] = None, email_body: Optional[list] = None,
+                 url: Optional[list] = None, port: Optional[list] = None, protocol: Optional[list] = None,
+                 inbound_bytes: Optional[list] = None, outbound_bytes: Optional[list] = None,
+                 app: Optional[list] = None, os: Optional[list] = None, user: Optional[list] = None,
+                 cve: Optional[list] = None, file_name: Optional[list] = None, file_hash: Optional[list] = None,
+                 cmd: Optional[list] = None, process: Optional[list] = None, technique: Optional[list] = None,
+                 entry_type: Optional[list] = None, severity: Optional[list] = None, sensor: Optional[list] = None,
+                 action: Optional[list] = None, event_id: Optional[list] = None, error_code: Optional[list] = None,
+                 terms: Optional[list] = None, incident_types: Optional[list] = None, analysts: Optional[list] = None):
         self.src_ip = src_ip
         self.dst_ip = dst_ip
         self.src_host = src_host
         self.dst_host = dst_host
+        self.src_domain = src_domain
+        self.dst_domain = dst_domain
+        self.sender_email = sender_email
+        self.recipient_email = recipient_email
+        self.email_subject = email_subject
+        self.email_body = email_body
         self.url = url
         self.port = port
         self.protocol = protocol
+        self.inbound_bytes = inbound_bytes
+        self.outbound_bytes = outbound_bytes
         self.app = app
         self.os = os
         self.user = user
@@ -132,7 +143,7 @@ class Observables:
         - A list of generated observables.
 
         Raises:
-        - Exception: If the function fails to retrieve data from any configured source with a HTTP status code other
+        - Exception: If the function fails to retrieve data from any configured source with an HTTP status code other
             than 200.
         """
         faker = cls._create_faker()
@@ -258,7 +269,8 @@ class Events:
         return Observables()
 
     @classmethod
-    def syslog(cls, count: int, timestamp: Optional[datetime] = None, observables: Optional[Observables] = None) -> List[str]:
+    def syslog(cls, count: int, timestamp: Optional[datetime] = None, observables: Optional[Observables] = None) -> \
+            List[str]:
         """
         Generate fake syslog messages.
 
@@ -266,7 +278,8 @@ class Events:
             count: The number of syslog messages to generate.
             timestamp: Optional. The starting timestamp for the syslog messages. If not provided, a random time during
             the past hour from now will be used.
-            observables: Optional. An observables object. If not provided, random objservable will be generated and used.
+            observables: Optional. An observables object. If not provided, random objservable will be generated
+            and used.
         Returns:
             A list of syslog messages.
 
@@ -301,8 +314,9 @@ class Events:
         return syslog_messages
 
     @classmethod
-    def cef(cls, count: int, vendor: Optional[str] = None, product: Optional[str] = None, version: Optional[str] = None,
-            timestamp: Optional[datetime] = None, observables: Optional[Observables] = None) -> List[str]:
+    def cef(cls, count: int, vendor: Optional[str] = None, product: Optional[str] = None,
+            version: Optional[str] = None, timestamp: Optional[datetime] = None,
+            observables: Optional[Observables] = None) -> List[str]:
         """
         Generates fake CEF (Common Event Format) messages.
 
@@ -310,9 +324,12 @@ class Events:
             count: The number of CEF messages to generate.
             timestamp: Optional. The starting timestamp for the syslog messages. If not provided, a random time during.
             vendor: Optional. The vendor.
-            product: Optional. The product.
+            product: Optional. The product value options include:
+            - Firewall
+            - EmailGW
             version: Optional. The version.
-            observables: Optional. An observables object. If not provided, random objservable will be generated and used.
+            observables: Optional. An observables object. If not provided, random objservable will be generated
+            and used.
         Returns:
             A list of fake CEF messages in string format.
 
@@ -333,34 +350,96 @@ class Events:
         """
         cef_messages = []
         faker = cls._create_faker()
+        vendor = vendor or faker.company()
         version = version or faker.numerify("1.0.#")
         if timestamp is None:
             timestamp = datetime.now() - timedelta(hours=1)
             timestamp += timedelta(seconds=faker.random_int(min=0, max=3599))
-        for i in range(count):
-            timestamp += timedelta(seconds=1)
-            uuid = faker.uuid4()
-            vendor = vendor or faker.company()
-            product = product or "Firewall"
-            src_port = faker.random_int(min=1024, max=65535)
-            host = random.choice(observables.src_host) if observables and observables.src_host \
-                else faker.hostname()
-            dst_ip = random.choice(observables.dst_ip) if observables and observables.dst_ip \
-                else Observables.generator(observable_type=ObservableType.IP, known=ObservableKnown.BAD, count=1)
-            url = random.choice(observables.url) if observables and observables.url \
-                else Observables.generator(observable_type=ObservableType.URL, known=ObservableKnown.BAD, count=1)
-            dst_port = random.choice(observables.port) if observables and observables.port \
-                else faker.random_int(min=1024, max=65535)
-            protocol = random.choice(observables.protocol) if observables and observables.protocol \
-                else random.choice(PROTOCOLS)
-            action = random.choice(observables.action) if observables and observables.action \
-                else random.choice(ACTIONS)
-            event_id = random.choice(observables.event_id) if observables and observables.event_id \
-                else faker.random_int(min=1, max=10)
-            event_description = f"Firewall {action} {protocol} traffic from {host}:{src_port} to {dst_ip}:{dst_port}"
-            cef_messages.append(f"CEF:0|{vendor}|{product}|{version}|{uuid}|{timestamp}|"
-                                f"{event_description}|{event_id}|src={host} spt={src_port} dst={dst_ip} url={url}"
-                                f"dpt={dst_port} proto={protocol} act={action}")
+        if product == "Firewall":
+            for i in range(count):
+                log_id = faker.uuid4()
+                timestamp += timedelta(seconds=1)
+                severity = random.choice(observables.severity) if observables and observables.severity \
+                    else faker.random_int(min=1, max=5)
+                src_ip = random.choice(observables.src_ip) if observables and observables.src_ip \
+                    else faker.ipv4()
+                src_port = faker.random_int(min=1024, max=65535)
+                dst_ip = random.choice(observables.dst_ip) if observables and observables.dst_ip \
+                    else Observables.generator(observable_type=ObservableType.IP, known=ObservableKnown.BAD, count=1)
+                dst_port = random.choice(observables.port) if observables and observables.port \
+                    else faker.random_int(min=1024, max=65535)
+                dst_url = random.choice(observables.url) if observables and observables.url \
+                    else Observables.generator(observable_type=ObservableType.URL, known=ObservableKnown.BAD, count=1)
+                inbound_bytes = random.choice(observables.inbound_bytes) if observables and observables.inbound_bytes \
+                    else faker.random_int(min=10, max=1073741824)
+                outbound_bytes = random.choice(observables.outbound_bytes) if observables and \
+                    observables.outbound_bytes \
+                    else faker.random_int(min=10, max=1073741824)
+                protocol = random.choice(observables.protocol) if observables and observables.protocol \
+                    else random.choice(PROTOCOLS)
+                rule_id = random.choice(observables.event_id) if observables and observables.event_id \
+                    else faker.random_int(min=1, max=200)
+                action = random.choice(observables.action) if observables and observables.action \
+                    else random.choice(ACTIONS)
+                event_description = f"Firewall {action} {protocol} traffic from {src_ip}:{src_port} to " \
+                                    f"{dst_ip}:{dst_port}"
+                cef_messages.append(f"CEF:0|{vendor}|{product}|{version}|{log_id}|{timestamp}|{severity}|"
+                                    f"{event_description}|src_ip={src_ip} src_port={src_port} dst_ip={dst_ip} "
+                                    f"url={dst_url} dst_port={dst_port} in_bytes={inbound_bytes} "
+                                    f"out_bytes={outbound_bytes} proto={protocol} rule={rule_id} act={action}")
+        elif product == "EmailGW":
+            for i in range(count):
+                mail_id = faker.uuid4()
+                timestamp += timedelta(seconds=1)
+                src_ip = random.choice(observables.src_ip) if observables and observables.src_ip \
+                    else faker.ipv4()
+                src_domain = random.choice(observables.src_domain) if observables and observables.src_domain \
+                    else faker.domain_name()
+                sender_email = random.choice(observables.sender_email) if observables and observables.sender_email \
+                    else faker.email()
+                recipient_email = random.choice(observables.recipient_email) if observables and \
+                    observables.recipient_email else faker.email()
+                email_subject = random.choice(observables.email_subject) if observables and observables.email_subject \
+                    else faker.sentence(nb_words=6)
+                email_body = random.choice(observables.email_body) if observables and observables.email_body else \
+                    faker.sentence(nb_words=50)
+                attachment_hash = random.choice(observables.file_hash) if observables and observables.file_hash \
+                    else Observables.generator(observable_type=ObservableType.SHA256, known=ObservableKnown.BAD,
+                                               count=1)
+                spam_score = faker.random_int(min=1, max=5)
+                action = random.choice(observables.action) if observables and observables.action \
+                    else random.choice(ACTIONS)
+                cef_messages.append(f"CEF:0|{vendor}|{product}|{version}|{mail_id}|{timestamp}|"
+                                    f"src_ip={src_ip} src_domain={src_domain} sender_email={sender_email} "
+                                    f"recipient_email={recipient_email} email_subject={email_subject} "
+                                    f"email_body={email_body} attachment_hash={attachment_hash} spam_score={spam_score}"
+                                    f" action={action}")
+        else:
+            for i in range(count):
+                log_id = faker.uuid4()
+                timestamp += timedelta(seconds=1)
+                severity = random.choice(observables.severity) if observables and observables.severity \
+                    else faker.random_int(min=1, max=5)
+                src_ip = random.choice(observables.src_ip) if observables and observables.src_ip \
+                    else faker.ipv4()
+                src_port = faker.random_int(min=1024, max=65535)
+                dst_ip = random.choice(observables.dst_ip) if observables and observables.dst_ip \
+                    else Observables.generator(observable_type=ObservableType.IP, known=ObservableKnown.BAD, count=1)
+                dst_port = random.choice(observables.port) if observables and observables.port \
+                    else faker.random_int(min=1024, max=65535)
+                protocol = random.choice(observables.protocol) if observables and observables.protocol \
+                    else random.choice(PROTOCOLS)
+                rule_id = random.choice(observables.event_id) if observables and observables.event_id \
+                    else faker.random_int(min=1, max=200)
+                action = random.choice(observables.action) if observables and observables.action \
+                    else random.choice(ACTIONS)
+                generic_cef = f"CEF:0|{vendor}|{product}|{version}|{log_id}|{timestamp}|{severity}|src_ip={src_ip} " \
+                              f"src_port={src_port} dst_ip={dst_ip} dst_port={dst_port} proto={protocol} " \
+                              f"rule={rule_id} act={action}"
+                if observables:
+                    for observable, observable_value in vars(observables).items():
+                        generic_cef += f" {observable}={observable_value}"
+                cef_messages.append(generic_cef)
         return cef_messages
 
     @classmethod
@@ -434,7 +513,8 @@ class Events:
         return leef_messages
 
     @classmethod
-    def winevent(cls, count, timestamp: Optional[datetime] = None, observables: Optional[Observables] = None) -> List[str]:
+    def winevent(cls, count, timestamp: Optional[datetime] = None, observables: Optional[Observables] = None) -> \
+            List[str]:
         """
         Generates fake Windows Event Log messages.