rosetta-ce 1.3.4__py3.11.egg → 1.3.6__py3.11.egg

EGG-INFO/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: rosetta-ce
-Version: 1.3.4
+Version: 1.3.6
 Summary: Rosetta is a Python package that can be used to fake security logs and alerts for testing different detection and response use cases.
 Home-page: https://github.com/ayman-m/rosetta
 Author: Ayman Mahmoud

rosetta/rfaker.py

@@ -438,7 +438,8 @@ class Events:
                               f"rule={rule_id} act={action}"
                 if observables:
                     for observable, observable_value in vars(observables).items():
-                        generic_cef += f" {observable}={observable_value}"
+                        if observable_value:
+                            generic_cef += f" {observable}={random.choice(observable_value)}"
                 cef_messages.append(generic_cef)
         return cef_messages
 
@@ -477,39 +478,74 @@ class Events:
         """
         leef_messages = []
         faker = cls._create_faker()
+        vendor = vendor or faker.company()
         version = version or faker.numerify("1.0.#")
         if timestamp is None:
             timestamp = datetime.now() - timedelta(hours=1)
             timestamp += timedelta(seconds=faker.random_int(min=0, max=3599))
-        for i in range(count):
-            timestamp += timedelta(seconds=1)
-            vendor = vendor or faker.company()
-            product = product or "Application Server"
-            src_port = faker.random_int(min=1024, max=65535)
-            request_size = faker.random_int(min=100, max=10000)
-            response_size = faker.random_int(min=100, max=10000)
-            user_agent = faker.user_agent()
-            host = random.choice(observables.src_host) if observables and observables.src_host \
-                else faker.hostname()
-            src_ip = random.choice(observables.src_ip) if observables and observables.src_ip \
-                else faker.ipv4()
-            url = random.choice(observables.technique).get('indicator') if observables and observables.technique \
-                else random.choice(TECHNIQUES).get('indicator')
-            file_hash = random.choice(observables.file_hash) if observables and observables.file_hash \
-                else Observables.generator(observable_type=ObservableType.SHA256, known=ObservableKnown.BAD, count=1)
-            method = random.choice(observables.technique).get('mechanism') if observables and observables.technique \
-                else random.choice(TECHNIQUES).get('mechanism')
-            error_code = random.choice(observables.error_code) if observables and observables.error_code \
-                else random.choice(ERROR_CODE)
-
-            leef_log = f"LEEF:1.0|{vendor}|{product}|{version}|deviceEventDate={timestamp}|{faker.ipv4()}|{host}|" \
-                       f"{faker.mac_address()}|{faker.mac_address()}|"
-            leef_log += f"src={src_ip} dst={host} spt={src_port} dpt=443 request={url} "
-            leef_log += f"method={method} proto=HTTP/1.1 status={str(error_code)} hash={file_hash}"
-            leef_log += f"request_size={request_size} " \
-                        f"response_size={response_size} "
-            leef_log += f"user_agent={user_agent}"
-            leef_messages.append(leef_log)
+        if product == "WAF":
+            for i in range(count):
+                timestamp += timedelta(seconds=1)
+                severity = random.choice(observables.severity) if observables and observables.severity \
+                    else faker.random_int(min=1, max=5)
+                src_ip = random.choice(observables.src_ip) if observables and observables.src_ip \
+                    else faker.ipv4()
+                src_port = faker.random_int(min=1024, max=65535)
+                host = random.choice(observables.src_host) if observables and observables.src_host \
+                    else faker.hostname()
+                method = random.choice(observables.technique).get('mechanism') if observables and observables.technique \
+                    else random.choice(TECHNIQUES).get('mechanism')
+                url = random.choice(observables.technique).get('indicator') if observables and observables.technique \
+                    else random.choice(TECHNIQUES).get('indicator')
+                protocol = random.choice(observables.protocol) if observables and observables.protocol \
+                    else random.choice(PROTOCOLS)
+                user_agent = faker.user_agent()
+                referer = random.choice(observables.url) if observables and observables.url \
+                    else Observables.generator(observable_type=ObservableType.URL, known=ObservableKnown.BAD, count=1)
+                response_code = random.choice(observables.error_code) if observables and observables.error_code \
+                    else random.choice(ERROR_CODE)
+                response_size = faker.random_int(min=100, max=10000)
+                rule_id = random.choice(observables.event_id) if observables and observables.event_id \
+                    else faker.random_int(min=1, max=200)
+                action = random.choice(observables.action) if observables and observables.action \
+                    else random.choice(ACTIONS)
+                attack_type = random.choice(observables.technique).get('technique') if observables and \
+                    observables.technique else random.choice(TECHNIQUES).get('technique')
+                cookie_name = faker.word()
+                cookie_value = faker.uuid4()
+                cookies = f"{cookie_name}={cookie_value}"
+                leef_log = f"LEEF:1.0|{vendor}|{product}|{version}|deviceEventDate={timestamp}|{faker.ipv4()}|{host}|"
+                leef_log += f"src_ip={src_ip} src_port={src_port} request_url={url} method={method} referer={referer} "
+                leef_log += f"protocol={protocol} status={str(response_code)} action={action} attack_type={attack_type}"
+                leef_log += f" response_size={response_size} rule_id={rule_id} user_agent={user_agent} "
+                leef_log += f"severity={severity} cookie={cookies}"
+                leef_messages.append(leef_log)
+        else:
+            for i in range(count):
+                timestamp += timedelta(seconds=1)
+                severity = random.choice(observables.severity) if observables and observables.severity \
+                    else faker.random_int(min=1, max=5)
+                src_ip = random.choice(observables.src_ip) if observables and observables.src_ip \
+                    else faker.ipv4()
+                src_port = faker.random_int(min=1024, max=65535)
+                host = random.choice(observables.src_host) if observables and observables.src_host \
+                    else faker.hostname()
+                url = random.choice(observables.technique).get('indicator') if observables and observables.technique \
+                    else random.choice(TECHNIQUES).get('indicator')
+                protocol = random.choice(observables.protocol) if observables and observables.protocol \
+                    else random.choice(PROTOCOLS)
+                response_code = random.choice(observables.error_code) if observables and observables.error_code \
+                    else random.choice(ERROR_CODE)
+                action = random.choice(observables.action) if observables and observables.action \
+                    else random.choice(ACTIONS)
+                leef_log = f"LEEF:1.0|{vendor}|{product}|{version}|deviceEventDate={timestamp}|{faker.ipv4()}|{host}|"
+                leef_log += f"src_ip={src_ip} src_port={src_port} request_url={url} protocol={protocol} "
+                leef_log += f"status={str(response_code)} action={action} severity={severity}"
+                if observables:
+                    for observable, observable_value in vars(observables).items():
+                        if observable_value:
+                            leef_log += f" {observable}={random.choice(observable_value)}"
+                leef_messages.append(leef_log)
         return leef_messages
 
     @classmethod