rosetta-ce 1.7.1__py3-none-any.whl → 1.7.3__py3-none-any.whl

rosetta/constants/systems.py

@@ -104,7 +104,7 @@ WIN_EVENTS = [
     '<Data Name="SubjectDomainName">{src_domain}</Data><Data Name="SubjectLogonId">'
     '{user}</Data>'
     '<Data Name="NewProcessId">{new_process_id}</Data><Data Name="ProcessId">{process_id}</Data>'
-    '<Data Name="CommandLine">{cmd}</Data><Data Name="TargetUserSid">{user}</Data>'
+    '<Data Name="CommandLine">{win_cmd}</Data><Data Name="TargetUserSid">{user}</Data>'
     '<Data Name="TargetUserName">{user}</Data><Data Name="TargetDomainName">'
     '{src_domain}</Data>'
     '<Data Name="TargetLogonId">{user}</Data><Data Name="LogonType">3</Data></EventData></Event>',
@@ -142,5 +142,5 @@ WIN_EVENTS = [
     '<Data Name="NewProcessId">{new_process_id}</Data>'
     '<Data Name="CreatorProcessId">{process_id}</Data>'
     '<Data Name="TokenElevationType">TokenElevationTypeLimited (3)</Data>'
-    '<Data Name="ProcessCommandLine">{cmd}</Data>'
+    '<Data Name="ProcessCommandLine">{win_cmd}</Data>'
 ]

rosetta/rfaker.py

@@ -641,13 +641,13 @@ class Events:
             "thread_id",
             "target_pid",
             "subject_login_id",
-            "user_id",
+            "win_user_id",
             "destination_login_id",
             "privilege_list",
             "win_process",
             "src_host",
-            "user_name",
-            "cmd",
+            "user",
+            "win_cmd",
             "source_network_address",
             "local_port",
             "transmitted_services",
@@ -837,6 +837,7 @@ class Events:
         # Generate analyst list if not provided in observables
         incident_types = observables.incident_types if observables and observables.incident_types else INCIDENTS_TYPES
         analysts = observables.analysts if observables and observables.analysts else [faker.unique.first_name() for _ in range(10)]
+        severities = observables.severity if observables and observables.severity else [faker.random_int(min=1, max=5) for _ in range(10)]
 
         incident_type_cycle = itertools.cycle(incident_types)
         for i in range(count):
@@ -844,8 +845,8 @@ class Events:
             duration = random.randint(1, 5)
             incident_type = next(incident_type_cycle)
             analyst = random.choice(analysts)
-            severity = Events._set_field('severity', observables) or faker.random_int(min=1, max=5)
-            description = Events._set_field('terms', observables) or faker.sentence(nb_words=10)
+            severity =  random.choice(severities)
+            description = Events._set_field('terms')
 
             # Add base fields
             incident = {}

{rosetta_ce-1.7.1.dist-info → rosetta_ce-1.7.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: rosetta-ce
-Version: 1.7.1
+Version: 1.7.3
 Summary: Rosetta is a Python package that can be used to fake security logs and alerts for testing different detection and response use cases.
 Home-page: https://github.com/ayman-m/rosetta
 Author: Ayman Mahmoud

{rosetta_ce-1.7.1.dist-info → rosetta_ce-1.7.3.dist-info}/RECORD

@@ -1,15 +1,15 @@
 rosetta/__init__.py,sha256=9rqZF7bpDMRN5H-rjNRUfzQAOIqyc21hTTZfYufTy04,92
 rosetta/rconverter.py,sha256=oPdWMtO6_aeQC8PqCl4nHKEpVb1kaBACSaNXsz-o00Q,3008
-rosetta/rfaker.py,sha256=Ve7D-swOdN8dyTTZM1L2jXh7SCRfq6oLG_E1qVTT5mE,38446
+rosetta/rfaker.py,sha256=4O0xSEWKhdddGM6fF0XzWBbL19AERtDs55koWWnDkcw,38494
 rosetta/rsender.py,sha256=Zfj9MVckO49iabxCQ19fkGKpKnzOXB1iHOTb9CgkzsE,10463
 rosetta/constants/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 rosetta/constants/attributes.py,sha256=dxPzi5D00U8Fvo1B1u1bC5-kYqN3lCIpYwwroHHp-hw,4622
 rosetta/constants/db.py,sha256=ZobruGzgijbbFHEnLGuwVwZTxLCBL-_vdmUDPVv3OAo,4708
 rosetta/constants/sensors.py,sha256=ZxPWFrNqDFKRVn9ai-5vtvIiU4-3FAXQIRj7gFoBRPk,1936
 rosetta/constants/sources.py,sha256=b3ynlKGw1gw7VBA4yCYkJ7aq4vVPfypqA8W_kuAZaBA,1658
-rosetta/constants/systems.py,sha256=LxrokxCqv-CKTSEK8199Qxlv5eSKAvp2OYKI28o-Lpw,7403
-rosetta_ce-1.7.1.dist-info/LICENSE,sha256=jF5fCbmI1A-yyvPAEeQ5VHM094tRLlWsMyun-UlX-pQ,1070
-rosetta_ce-1.7.1.dist-info/METADATA,sha256=-6hMIFZXghZcjb9oHRMxIxcE02SSFAT0IJDVf8oI65M,11321
-rosetta_ce-1.7.1.dist-info/WHEEL,sha256=PZUExdf71Ui_so67QXpySuHtCi3-J3wvF4ORK6k_S8U,91
-rosetta_ce-1.7.1.dist-info/top_level.txt,sha256=HLxDc6BJxHZDzVIlOwpCGH0DqIf65OhZcHniRDaUUZc,8
-rosetta_ce-1.7.1.dist-info/RECORD,,
+rosetta/constants/systems.py,sha256=_6_qf8PaQGgxh1btJqBP_BtprdvvmLwMLu2hF_DVGWk,7411
+rosetta_ce-1.7.3.dist-info/LICENSE,sha256=jF5fCbmI1A-yyvPAEeQ5VHM094tRLlWsMyun-UlX-pQ,1070
+rosetta_ce-1.7.3.dist-info/METADATA,sha256=chFlicQ0wemKkxCrDDb7Ou99PZma5Rc30w5Z-v3HNvA,11321
+rosetta_ce-1.7.3.dist-info/WHEEL,sha256=A3WOREP4zgxI0fKrHUG8DC8013e3dK3n7a6HDbcEIwE,91
+rosetta_ce-1.7.3.dist-info/top_level.txt,sha256=HLxDc6BJxHZDzVIlOwpCGH0DqIf65OhZcHniRDaUUZc,8
+rosetta_ce-1.7.3.dist-info/RECORD,,

{rosetta_ce-1.7.1.dist-info → rosetta_ce-1.7.3.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (75.6.0)
+Generator: setuptools (75.7.0)
 Root-Is-Purelib: true
 Tag: py3-none-any