rosetta-ce 1.4.8__py3.11.egg → 1.5.0__py3.11.egg

EGG-INFO/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: rosetta-ce
-Version: 1.4.8
+Version: 1.5.0
 Summary: Rosetta is a Python package that can be used to fake security logs and alerts for testing different detection and response use cases.
 Home-page: https://github.com/ayman-m/rosetta
 Author: Ayman Mahmoud

rosetta/rfaker.py

@@ -434,14 +434,14 @@ class Events:
         return field_value
 
     @classmethod
-    def syslog(cls, count: int, timestamp: Optional[datetime] = None, observables: Optional[Observables] = None,
+    def syslog(cls, count: int, datetime_iso: Optional[datetime] = None, observables: Optional[Observables] = None,
                required_fields: Optional[str] = None) -> List[str]:
         """
         Generate fake syslog messages.
 
         Args:
             count: The number of syslog messages to generate.
-            timestamp: Optional. The starting timestamp for the syslog messages. If not provided, a random time during
+            datetime_iso: Optional. The starting datetime_iso for the syslog messages. If not provided, a random time during
             the past hour from now will be used.
             observables: Optional. An observables object. If not provided, random objservable will be generated
             and used.
@@ -461,14 +461,14 @@ class Events:
         """
         syslog_messages = []
         faker = cls._create_faker()
-        if timestamp is None:
-            timestamp = datetime.now() - timedelta(hours=1)
-            timestamp += timedelta(seconds=faker.random_int(min=0, max=3599))
+        if datetime_iso is None:
+            datetime_iso = datetime.now() - timedelta(hours=1)
+            datetime_iso += timedelta(seconds=faker.random_int(min=0, max=3599))
         if not required_fields:
             required_fields = "pid,host,user,unix_process,unix_cmd"
         for i in range(count):
-            timestamp += timedelta(seconds=1)
-            syslog_message = f"{timestamp.strftime('%Y-%m-%d %H:%M:%S')}"
+            datetime_iso += timedelta(seconds=1)
+            syslog_message = f"{datetime_iso.strftime('%Y-%m-%d %H:%M:%S')}"
             for field in required_fields.split(","):
                 syslog_message += f" {cls.set_field(field, observables)}"
             if observables:
@@ -480,14 +480,14 @@ class Events:
 
     @classmethod
     def cef(cls, count: int, vendor: Optional[str] = None, product: Optional[str] = None,
-            version: Optional[str] = None, timestamp: Optional[datetime] = None,
+            version: Optional[str] = None, datetime_iso: Optional[datetime] = None,
             observables: Optional[Observables] = None, required_fields: Optional[str] = None) -> List[str]:
         """
         Generates fake CEF (Common Event Format) messages.
 
         Args:
             count: The number of CEF messages to generate.
-            timestamp: Optional. The starting timestamp for the syslog messages. If not provided, a random time during.
+            datetime_iso: Optional. The starting datetime_iso for the syslog messages. If not provided, a random time during.
             vendor: Optional. The vendor.
             product: Optional. The product value options include:
             - Firewall
@@ -519,9 +519,9 @@ class Events:
         faker = cls._create_faker()
         vendor = vendor or faker.company()
         version = version or faker.numerify("1.0.#")
-        if timestamp is None:
-            timestamp = datetime.now() - timedelta(hours=1)
-            timestamp += timedelta(seconds=faker.random_int(min=0, max=3599))
+        if datetime_iso is None:
+            datetime_iso = datetime.now() - timedelta(hours=1)
+            datetime_iso += timedelta(seconds=faker.random_int(min=0, max=3599))
         if not required_fields:
             if product == "Firewall":
                 required_fields = "local_ip,local_port,remote_ip,remote_port,dst_url,inbound_bytes," \
@@ -532,8 +532,8 @@ class Events:
             else:
                 required_fields = "local_ip,local_port,remote_ip,remote_port,protocol,rule_id,action"
         for i in range(count):
-            timestamp += timedelta(seconds=1)
-            cef_message = f"CEF:0|{vendor}|{product}|{version}|{cls.set_field('log_id', observables)}|{timestamp}" \
+            datetime_iso += timedelta(seconds=1)
+            cef_message = f"CEF:0|{vendor}|{product}|{version}|{cls.set_field('log_id', observables)}|{datetime_iso}" \
                           f"|{cls.set_field('severity', observables)}|"
             for field in required_fields.split(","):
                 cef_message += f" {field}={cls.set_field(field, observables)}"
@@ -545,7 +545,7 @@ class Events:
         return cef_messages
 
     @classmethod
-    def leef(cls, count, timestamp: Optional[datetime] = None, vendor: Optional[str] = None,
+    def leef(cls, count, datetime_iso: Optional[datetime] = None, vendor: Optional[str] = None,
              product: Optional[str] = None, version: Optional[str] = None,
              observables: Optional[Observables] = None, required_fields: Optional[str] = None) -> List[str]:
         """
@@ -553,7 +553,7 @@ class Events:
 
         Parameters:
             count (int): The number of LEEF messages to generate.
-            timestamp: Optional. The starting timestamp for the syslog messages. If not provided, a random time during.
+            datetime_iso: Optional. The starting datetime_iso for the syslog messages. If not provided, a random time during.
             vendor: Optional. The vendor.
             product: Optional. The product.
             version: Optional. The version.
@@ -583,9 +583,9 @@ class Events:
         faker = cls._create_faker()
         vendor = vendor or faker.company()
         version = version or faker.numerify("1.0.#")
-        if timestamp is None:
-            timestamp = datetime.now() - timedelta(hours=1)
-            timestamp += timedelta(seconds=faker.random_int(min=0, max=3599))
+        if datetime_iso is None:
+            datetime_iso = datetime.now() - timedelta(hours=1)
+            datetime_iso += timedelta(seconds=faker.random_int(min=0, max=3599))
         if not required_fields:
             if product == "WAF":
                 required_fields = "local_ip,local_port,host,method,url,protocol," \
@@ -593,8 +593,8 @@ class Events:
             else:
                 required_fields = "local_ip,local_port,host,url,protocol,response_code,action"
         for i in range(count):
-            timestamp += timedelta(seconds=1)
-            leef_message = f"LEEF:1.0|{vendor}|{product}|{version}|deviceEventDate={timestamp}|" \
+            datetime_iso += timedelta(seconds=1)
+            leef_message = f"LEEF:1.0|{vendor}|{product}|{version}|deviceEventDate={datetime_iso}|" \
                            f"severity={cls.set_field('severity', observables)}|"
             for field in required_fields.split(","):
                 leef_message += f" {field}={cls.set_field(field, observables)}"
@@ -606,14 +606,14 @@ class Events:
         return leef_messages
 
     @classmethod
-    def winevent(cls, count, timestamp: Optional[datetime] = None, observables: Optional[Observables] = None) -> \
+    def winevent(cls, count, datetime_iso: Optional[datetime] = None, observables: Optional[Observables] = None) -> \
             List[str]:
         """
         Generates fake Windows Event Log messages.
 
         Args:
             count (int): The number of fake messages to generate.
-            timestamp: Optional. The starting timestamp for the syslog messages. If not provided, a random time during
+            datetime_iso: Optional. The starting datetime_iso for the syslog messages. If not provided, a random time during
             observables: An observables object. If not provided, random objservable will be generated and used.
 
         Returns:
@@ -625,15 +625,15 @@ class Events:
         """
         winevent_messages = []
         faker = cls._create_faker()
-        if timestamp is None:
-            timestamp = datetime.now() - timedelta(hours=1)
-            timestamp += timedelta(seconds=faker.random_int(min=0, max=3599))
+        if datetime_iso is None:
+            datetime_iso = datetime.now() - timedelta(hours=1)
+            datetime_iso += timedelta(seconds=faker.random_int(min=0, max=3599))
         for i in range(count):
-            timestamp += timedelta(seconds=1)
+            datetime_iso += timedelta(seconds=1)
             guid = faker.uuid4()
             local_port = faker.random_int(min=1024, max=65535)
             transmitted_services = faker.sentence(nb_words=5)
-            system_time = timestamp
+            system_time = datetime_iso
             process_id = faker.random_int()
             new_process_id = faker.random_int()
             thread_id = faker.random_int()
@@ -671,7 +671,7 @@ class Events:
         return winevent_messages
 
     @classmethod
-    def json(cls, count, timestamp: Optional[datetime] = None, vendor: Optional[str] = None,
+    def json(cls, count, datetime_iso: Optional[datetime] = None, vendor: Optional[str] = None,
              product: Optional[str] = None, version: Optional[str] = None, observables: Optional[Observables] = None,
              required_fields: Optional[str] = None) -> List[dict]:
         """
@@ -679,7 +679,7 @@ class Events:
 
         Args:
             count (int): The number of JSON messages to generate.
-            timestamp: Optional. The starting timestamp for the syslog messages. If not provided, a random time during.
+            datetime_iso: Optional. The starting datetime_iso for the syslog messages. If not provided, a random time during.
             vendor: Optional. The vendor.
             product: Optional. The product value options include:
             - VulnScanner
@@ -702,21 +702,21 @@ class Events:
         faker = cls._create_faker()
         vendor = vendor or faker.company()
         version = version or faker.numerify("1.0.#")
-        if timestamp is None:
-            timestamp = datetime.now() - timedelta(hours=1)
-            timestamp += timedelta(seconds=faker.random_int(min=0, max=3599))
+        if datetime_iso is None:
+            datetime_iso = datetime.now() - timedelta(hours=1)
+            datetime_iso += timedelta(seconds=faker.random_int(min=0, max=3599))
         if not required_fields:
             if product == "VulnScanner":
                 required_fields = "cve_id,host,file_hash"
             else:
                 required_fields = "user,host"
         for i in range(count):
-            timestamp += timedelta(seconds=1)
+            datetime_iso += timedelta(seconds=1)
             event = {
                 'vendor': vendor,
                 'product': product,
                 'version': version,
-                'timestamp': str(timestamp),
+                'datetime_iso': str(datetime_iso),
                 'severity': cls.set_field("severity", observables)
             }
             for field in required_fields.split(","):
@@ -729,7 +729,7 @@ class Events:
         return json_messages
 
     @classmethod
-    def incidents(cls, count, fields: Optional[str] = None, timestamp: Optional[datetime] = None,
+    def incidents(cls, count, fields: Optional[str] = None, datetime_iso: Optional[datetime] = None,
                   vendor: Optional[str] = None, product: Optional[str] = None, version: Optional[str] = None,
                   observables: Optional[Observables] = None, required_fields: Optional[str] = None) -> List[dict]:
         """
@@ -743,7 +743,7 @@ class Events:
             vendor: Optional. The vendor.
             product: Optional. The product.
             version: Optional. The version.
-            timestamp: Optional. The starting timestamp for the syslog messages. If not provided, a random time during
+            datetime_iso: Optional. The starting datetime_iso for the syslog messages. If not provided, a random time during
             observables: An observables object. If not provided, random objservable will be generated and used.
             required_fields: Optional. A list of fields that are required to present in the generated data, whether from
             observables or randomely.
@@ -816,14 +816,14 @@ class Events:
                     incident['description'] = incident_description
                 if 'events' in field_list:
                     incident['events'] = [
-                        {"event": cls.syslog(count=1, timestamp=timestamp, observables=observables,
+                        {"event": cls.syslog(count=1, datetime_iso=datetime_iso, observables=observables,
                                              required_fields=required_fields)[0]},
-                        {"event": cls.cef(count=1, timestamp=timestamp, vendor=vendor, product=product, version=version
+                        {"event": cls.cef(count=1, datetime_iso=datetime_iso, vendor=vendor, product=product, version=version
                                           , observables=observables, required_fields=required_fields)[0]},
-                        {"event": cls.leef(count=1, timestamp=timestamp, vendor=vendor, product=product,
+                        {"event": cls.leef(count=1, datetime_iso=datetime_iso, vendor=vendor, product=product,
                                            version=version, observables=observables, required_fields=required_fields)[0]},
-                        {"event": cls.winevent(count=1, timestamp=timestamp, observables=observables)[0]},
-                        {"event": cls.json(count=1, timestamp=timestamp, vendor=vendor, product=product,
+                        {"event": cls.winevent(count=1, datetime_iso=datetime_iso, observables=observables)[0]},
+                        {"event": cls.json(count=1, datetime_iso=datetime_iso, vendor=vendor, product=product,
                                            version=version, observables=observables,
                                            required_fields=required_fields)[0]}
                     ]

rosetta/rsender.py

@@ -55,11 +55,13 @@ class Sender:
                 None.
     """
 
-    def __init__(self, data_type: str, destination: str,
+    def __init__(self, data_type: str, destination: str, headers: Optional[dict] = None,
                  worker_name: Optional[str] = 'worker_'+str(datetime.now()), count: Optional[int] = 1,
                  interval: Optional[int] = 1, vendor: Optional[str] = None, product: Optional[str] = None,
-                 version: Optional[str] = None, observables: Optional[Observables] = None, fields: Optional[str] = None,
-                 verify_ssl: Optional[bool] = None, datetime_obj: Optional[datetime] = None):
+                 version: Optional[str] = None, required_fields: Optional[str] = None,
+                 observables: Optional[Observables] = None, fields: Optional[str] = None,
+                 verify_ssl: Optional[bool] = None, datetime_obj: Optional[datetime] = None,
+                 data_json: Optional[dict] = None, data_text: Optional[str] = None):
         """
         Constructor for DataSenderWorker class.
 
@@ -77,12 +79,21 @@ class Sender:
         :param vendor: Optional. The vendor.
         :param product: Optional. The product.
         :param version: Optional. The version.
-        :param observables: Observables, list of observables.
-        :param fields: str, comma-separated list of fields to include in incident data.
-        :param verify_ssl: bool, handling ssl verification errors.
+        :param required_fields: Optional. A list of fields that are required to present in the generated data, whether
+         from observables or randomely.
+        :param observables: Optional. Observables, list of observables.
+        :param fields: Optional. comma-separated list of fields to include in incident data.
+        :param verify_ssl: Optional. handling ssl verification errors.
+        :param datetime_obj: Optional. time to start from.
+        :param data_json: Optional. JSON data to send.
+        :param data_text: Optional. Text data to send.
 
         :return: None
         """
+        if headers is None:
+            self.headers = {}
+        else:
+            self.headers = headers
         self.thread = None
         self.worker_name = worker_name
         self.data_type = data_type
@@ -91,6 +102,7 @@ class Sender:
         self.vendor = vendor
         self.product = product
         self.version = version
+        self.required_fields = required_fields
         self.destination = destination
         self.created_at = datetime.now()
         self.status = "Stopped"
@@ -98,6 +110,8 @@ class Sender:
         self.fields = fields
         self.verify_ssl = verify_ssl
         self.datetime_obj = datetime_obj
+        self.data_json = data_json
+        self.data_text = data_text
 
     def start(self) -> str:
         """
@@ -137,16 +151,21 @@ class Sender:
             try:
                 self.count -= 1
                 if self.data_type in ["SYSLOG", "CEF", "LEEF"]:
-                    if self.data_type == "SYSLOG":
-                        fake_message = Events.syslog(count=1, timestamp=self.datetime_obj, observables=self.observables)
-                    if self.data_type == "CEF":
-                        fake_message = Events.cef(count=1, timestamp=self.datetime_obj, vendor=self.vendor,
-                                                  product=self.product, version=self.version,
-                                                  observables=self.observables)
-                    if self.data_type == "LEEF":
-                        fake_message = Events.leef(count=1, timestamp=self.datetime_obj, vendor=self.vendor,
-                                                   product=self.product, version=self.version,
-                                                   observables=self.observables)
+                    if self.data_text:
+                        fake_message = [self.data_text]
+                    else:
+                        if self.data_type == "SYSLOG":
+                            fake_message = Events.syslog(count=1, datetime_iso=self.datetime_obj,
+                                                         observables=self.observables, required_fields=self.required_fields)
+                        if self.data_type == "CEF":
+                            fake_message = Events.cef(count=1, datetime_iso=self.datetime_obj, vendor=self.vendor,
+                                                      product=self.product, version=self.version,
+                                                      required_fields=self.required_fields, observables=self.observables)
+                        if self.data_type == "LEEF":
+                            fake_message = Events.leef(count=1, datetime_iso=self.datetime_obj, vendor=self.vendor,
+                                                       product=self.product, version=self.version,
+                                                       required_fields=self.required_fields,
+                                                       observables=self.observables)
                     ip_address = self.destination.split(':')[1]
                     port = self.destination.split(':')[2]
                     if 'tcp' in self.destination:
@@ -162,20 +181,29 @@ class Sender:
                         print(f"Worker: {self.worker_name} sending log message to {ip_address} ")
                         sock.sendto(fake_message[0].encode(), (ip_address, int(port)))
                 elif self.data_type in ["JSON", "INCIDENT"]:
-                    if self.data_type == "JSON":
-                        fake_message = Events.json(count=1, timestamp=self.datetime_obj, observables=self.observables)
-                    if self.data_type == "INCIDENT":
-                        fake_message = [{
-                            "alert": Events.incidents(count=1, observables=self.observables, vendor=self.vendor,
-                                                      version=self.version, product=self.product, fields=self.fields)
-                        }]
+                    if self.data_json:
+                        fake_message = [self.data_json]
+                    else:
+                        if self.data_type == "JSON":
+                            fake_message = Events.json(count=1, datetime_iso=self.datetime_obj,
+                                                       observables=self.observables, vendor=self.vendor,
+                                                       product=self.product, version=self.version,
+                                                       required_fields=self.required_fields,)
+                        if self.data_type == "INCIDENT":
+                            fake_message = [{
+                                "alert": Events.incidents(count=1, observables=self.observables, vendor=self.vendor,
+                                                          version=self.version, product=self.product,
+                                                          datetime_iso=self.datetime_obj,
+                                                          required_fields=self.required_fields, fields=self.fields)
+                            }]
                     if '://' not in self.destination:
                         url = 'http://' + self.destination
                     else:
                         url = self.destination
                     warnings.filterwarnings("ignore", category=InsecureRequestWarning)
                     print(f"Worker: {self.worker_name} sending log message to {url} ")
-                    response = requests.post(url, json=fake_message[0], timeout=(2, 5), verify=self.verify_ssl)
+                    response = requests.post(url, json=fake_message[0], timeout=(2, 5), headers=self.headers,
+                                             verify=self.verify_ssl)
                     response.raise_for_status()
             except (ConnectionRefusedError, socket.timeout, requests.exceptions.RequestException) as e:
                 print(f"Connection error: {e}")