rosetta-ce 1.5.3__py3.11.egg → 1.5.5__py3.11.egg

EGG-INFO/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: rosetta-ce
-Version: 1.5.3
+Version: 1.5.5
 Summary: Rosetta is a Python package that can be used to fake security logs and alerts for testing different detection and response use cases.
 Home-page: https://github.com/ayman-m/rosetta
 Author: Ayman Mahmoud

EGG-INFO/SOURCES.txt

@@ -6,6 +6,7 @@ rosetta/rconverter.py
 rosetta/rfaker.py
 rosetta/rsender.py
 rosetta/constants/__init__.py
+rosetta/constants/attributes.py
 rosetta/constants/sensors.py
 rosetta/constants/sources.py
 rosetta/constants/systems.py

rosetta/constants/attributes.py

@@ -0,0 +1,5 @@
+INCIDENTS_TYPES = [
+    'Malware', 'Phishing', 'Access Violation', 'Lateral Movement', 'Port Scan', 'Sql Injection', 'Brute Force',
+    'Control Avoidance', 'Rogue Device', 'Denial Of Service', 'Account Compromised'
+]
+SEVERITIES = ['Low', 'Medium', 'High', 'Critical']

rosetta/constants/systems.py

@@ -98,8 +98,3 @@ WIN_EVENTS = [
     '<Data Name="TokenElevationType">TokenElevationTypeLimited (3)</Data>'
     '<Data Name="ProcessCommandLine">{cmd}</Data>'
 ]
-
-INCIDENTS_TYPES = [
-    'Malware', 'Phishing', 'Access Violation', 'Lateral Movement', 'Port Scan', 'Sql Injection', 'Brute Force',
-    'Control Avoidance', 'Rogue Device', 'Denial Of Service', 'Account Compromised'
-]

rosetta/rfaker.py

@@ -12,7 +12,8 @@ from datetime import datetime, timedelta
 from typing import Optional, List
 from rosetta.constants.sources import BAD_IP_SOURCES, GOOD_IP_SOURCES, BAD_URL_SOURCES, GOOD_URL_SOURCES, \
     BAD_SHA256_SOURCES, GOOD_SHA256_SOURCES, CVE_SOURCES, TERMS_SOURCES
-from rosetta.constants.systems import UNIX_CMD, WINDOWS_CMD, WIN_PROCESSES, WIN_EVENTS, INCIDENTS_TYPES
+from rosetta.constants.systems import UNIX_CMD, WINDOWS_CMD, WIN_PROCESSES, WIN_EVENTS
+from rosetta.constants.attributes import INCIDENTS_TYPES, SEVERITIES
 from rosetta.constants.sensors import ACTIONS, PROTOCOLS, TECHNIQUES, ERROR_CODE
 
 
@@ -304,7 +305,7 @@ class Events:
                 else random.choice(UNIX_CMD)
         if field == "severity":
             field_value = random.choice(observables.severity) if observables and observables.severity \
-                else faker.random_int(min=1, max=5)
+                else random.choice(SEVERITIES)
         if field == "local_ip":
             field_value = random.choice(observables.local_ip) if observables and observables.local_ip \
                     else faker.ipv4()