rosetta-ce 1.7.6__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- rosetta_ce-1.7.6/LICENSE +21 -0
- rosetta_ce-1.7.6/PKG-INFO +151 -0
- rosetta_ce-1.7.6/README.md +124 -0
- rosetta_ce-1.7.6/rosetta/__init__.py +3 -0
- rosetta_ce-1.7.6/rosetta/constants/__init__.py +0 -0
- rosetta_ce-1.7.6/rosetta/constants/attributes.py +285 -0
- rosetta_ce-1.7.6/rosetta/constants/db.py +92 -0
- rosetta_ce-1.7.6/rosetta/constants/sensors.py +55 -0
- rosetta_ce-1.7.6/rosetta/constants/sources.py +67 -0
- rosetta_ce-1.7.6/rosetta/constants/systems.py +146 -0
- rosetta_ce-1.7.6/rosetta/rconverter.py +82 -0
- rosetta_ce-1.7.6/rosetta/rfaker.py +879 -0
- rosetta_ce-1.7.6/rosetta/rsender.py +236 -0
- rosetta_ce-1.7.6/rosetta_ce.egg-info/PKG-INFO +151 -0
- rosetta_ce-1.7.6/rosetta_ce.egg-info/SOURCES.txt +21 -0
- rosetta_ce-1.7.6/rosetta_ce.egg-info/dependency_links.txt +1 -0
- rosetta_ce-1.7.6/rosetta_ce.egg-info/requires.txt +3 -0
- rosetta_ce-1.7.6/rosetta_ce.egg-info/top_level.txt +1 -0
- rosetta_ce-1.7.6/setup.cfg +4 -0
- rosetta_ce-1.7.6/setup.py +28 -0
- rosetta_ce-1.7.6/tests/test_rconverter.py +31 -0
- rosetta_ce-1.7.6/tests/test_rfaker.py +164 -0
- rosetta_ce-1.7.6/tests/test_rsender.py +53 -0
rosetta_ce-1.7.6/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2023 Ayman Mahmoud
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
@@ -0,0 +1,151 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: rosetta-ce
|
|
3
|
+
Version: 1.7.6
|
|
4
|
+
Summary: Rosetta is a Python package that can be used to fake security logs and alerts for testing different detection and response use cases.
|
|
5
|
+
Home-page: https://github.com/ayman-m/rosetta
|
|
6
|
+
Author: Ayman Mahmoud
|
|
7
|
+
Author-email: content@ayman.online
|
|
8
|
+
Classifier: Programming Language :: Python :: 3
|
|
9
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
10
|
+
Classifier: Operating System :: OS Independent
|
|
11
|
+
Requires-Python: >=3.6
|
|
12
|
+
Description-Content-Type: text/markdown
|
|
13
|
+
License-File: LICENSE
|
|
14
|
+
Requires-Dist: requests
|
|
15
|
+
Requires-Dist: faker
|
|
16
|
+
Requires-Dist: urllib3
|
|
17
|
+
Dynamic: author
|
|
18
|
+
Dynamic: author-email
|
|
19
|
+
Dynamic: classifier
|
|
20
|
+
Dynamic: description
|
|
21
|
+
Dynamic: description-content-type
|
|
22
|
+
Dynamic: home-page
|
|
23
|
+
Dynamic: license-file
|
|
24
|
+
Dynamic: requires-dist
|
|
25
|
+
Dynamic: requires-python
|
|
26
|
+
Dynamic: summary
|
|
27
|
+
|
|
28
|
+
[](https://snyk.io/test/github/my-soc/Rosetta)
|
|
29
|
+
|
|
30
|
+
[](https://go-rosetta.slack.com)
|
|
31
|
+
|
|
32
|
+
# Rosetta
|
|
33
|
+
|
|
34
|
+
Rosetta is a Python package that can be used to fake security logs and alerts for testing different detection and response use cases. It provides the following functions:
|
|
35
|
+
- Generate bad and random observables/indicators that include IP Addresses, Urls, File hashes , CVE's and more
|
|
36
|
+
- Fake log messages in different formats like CEF, LEEF and JSON.
|
|
37
|
+
- Convert one log format into another, for example from CEF to LEEF.
|
|
38
|
+
- Send the fake log message to different log management and analytics tools.
|
|
39
|
+
|
|
40
|
+
## Installation
|
|
41
|
+
|
|
42
|
+
- You can install rosetta via pip:
|
|
43
|
+
```sh
|
|
44
|
+
pip install rosetta-ce
|
|
45
|
+
```
|
|
46
|
+
- Or you can install it from the source code:
|
|
47
|
+
```sh
|
|
48
|
+
git clone https://github.com/ayman-m/rosetta.git
|
|
49
|
+
cd rosetta
|
|
50
|
+
python setup.py install
|
|
51
|
+
```
|
|
52
|
+
- Once installed, you can import the library in your Python code like this:
|
|
53
|
+
```python
|
|
54
|
+
from rosetta import Observables, Events
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
## Usage
|
|
58
|
+
Here are some examples of how to use Rosetta:
|
|
59
|
+
```python
|
|
60
|
+
from rosetta import Converter, ConverterToEnum, ConverterFromEnum, Events, ObservableType, ObservableKnown, \
|
|
61
|
+
Observables, Sender
|
|
62
|
+
|
|
63
|
+
# Example usage of the Converter class to convert a CEF log into a LEEF log.
|
|
64
|
+
converted_log = Converter.convert(from_type=ConverterFromEnum.CEF, to_type=ConverterToEnum.LEEF,
|
|
65
|
+
data="cef_log=CEF:0|Security|Intrusion Detection System|1.0|Alert|10|src=192.168.0.1 dst=192.168.0.2 act=blocked")
|
|
66
|
+
print(
|
|
67
|
+
converted_log) # {'message': 'converted', 'data': 'LEEF=1.0!Vendor=Security!Product=Intrusion Detection System!Version=1.0!EventID=Alert!Name=10!src=192.168.0.1!dst=192.168.0.2!act=blocked'}
|
|
68
|
+
|
|
69
|
+
# Example usage of the Observables class to generate bad IP indicators.
|
|
70
|
+
bad_ip = Observables.generator(count=2, observable_type=ObservableType.IP, known=ObservableKnown.BAD)
|
|
71
|
+
print(bad_ip) # ['ip1', 'ip2']
|
|
72
|
+
|
|
73
|
+
# Example usage of the Observables class to generate good IP indicators.
|
|
74
|
+
good_ip = Observables.generator(count=2, observable_type=ObservableType.IP, known=ObservableKnown.GOOD)
|
|
75
|
+
print(good_ip) # ['ip1', 'ip2']
|
|
76
|
+
|
|
77
|
+
# Example usage of the Observables class to generate bad URL indicators.
|
|
78
|
+
bad_url = Observables.generator(count=2, observable_type=ObservableType.URL, known=ObservableKnown.BAD)
|
|
79
|
+
print(bad_url) # ['url1', 'url2']
|
|
80
|
+
|
|
81
|
+
# Example usage of the Observables class to generate good URL indicators.
|
|
82
|
+
good_url = Observables.generator(count=2, observable_type=ObservableType.URL, known=ObservableKnown.GOOD)
|
|
83
|
+
print(good_url) # ['url1', 'url2']
|
|
84
|
+
|
|
85
|
+
# Example usage of the Observables class to generate bad Hash indicators.
|
|
86
|
+
bad_hash = Observables.generator(count=2, observable_type=ObservableType.SHA256, known=ObservableKnown.BAD)
|
|
87
|
+
print(bad_hash) # ['hash1', 'hash2']
|
|
88
|
+
|
|
89
|
+
# Example usage of the Observables class to generate good Hash indicators.
|
|
90
|
+
good_hash = Observables.generator(count=2, observable_type=ObservableType.SHA256, known=ObservableKnown.GOOD)
|
|
91
|
+
print(good_hash) # ['hash1', 'hash2']
|
|
92
|
+
|
|
93
|
+
# Example usage of the Observables class to generate CVE indicators.
|
|
94
|
+
cve = Observables.generator(count=2, observable_type=ObservableType.CVE)
|
|
95
|
+
print(cve) # Example: ['CVE-2023-2136', 'CVE-2023-29582']
|
|
96
|
+
|
|
97
|
+
# Example usage of the Observables class to generate random Terms.
|
|
98
|
+
terms = Observables.generator(count=2, observable_type=ObservableType.TERMS)
|
|
99
|
+
print(terms) # Example: ['Create or Modify System Process', 'Stage Capabilities: Drive-by Target']
|
|
100
|
+
|
|
101
|
+
|
|
102
|
+
# You can create an instance of the Observables class to contain your own observables that are to be used in the fake security events
|
|
103
|
+
src_ip, dst_ip, src_host, dst_host = ["192.168.10.10", "192.168.10.20"], ["1.1.1.1", "1.1.1.2"], ["abc"], ["xyz", "wlv"]
|
|
104
|
+
url, port = ["https://example.org", "https://wikipedia.com"], ["555", "666"]
|
|
105
|
+
protocol, app = ["ftp", "dns", "ssl"], ["explorer.exe", "chrome.exe"]
|
|
106
|
+
user = ["ayman", "mahmoud"]
|
|
107
|
+
file_name, file_hash = ["test.zip", "image.ps"], ["719283fd5600eb631c23b290530e4dac9029bae72f15299711edbc800e8e02b2"]
|
|
108
|
+
cmd, process = ["sudo restart", "systemctl stop firewalld"], ["bind", "crond"]
|
|
109
|
+
severity = ["high", "critical"]
|
|
110
|
+
sensor = ["fw", "edr"]
|
|
111
|
+
action = ["block", "allow"]
|
|
112
|
+
observables_list = Observables(src_ip=src_ip, dst_ip=dst_ip, src_host=src_host, dst_host=dst_host, url=url, port=port,
|
|
113
|
+
protocol=protocol, app=app, user=user, file_name=file_name, file_hash=file_hash, cmd=cmd,
|
|
114
|
+
process=process, severity=severity, sensor=sensor, action=action)
|
|
115
|
+
|
|
116
|
+
# Example usage of the Events class to generate generic SYSLOG events.
|
|
117
|
+
generic_syslog_with_random_observables = Events.syslog(count=1)
|
|
118
|
+
print(generic_syslog_with_random_observables) # ['Jan 20 16:04:53 db-88.zuniga.net sudo[34675]: ryansandy : COMMAND ; iptables -F']
|
|
119
|
+
generic_syslog_with_my_observables = Events.syslog(count=1, observables=observables_list)
|
|
120
|
+
print(generic_syslog_with_my_observables) # ['Apr 07 10:21:43 abc crond[17458]: ayman : COMMAND ; sudo restart']
|
|
121
|
+
|
|
122
|
+
|
|
123
|
+
# Example usage of the Events class to generate CEF events.
|
|
124
|
+
generic_cef_with_my_observables = Events.cef(count=1, observables=observables_list)
|
|
125
|
+
print(generic_cef_with_my_observables) # ['CEF:0|Novak LLC|Firewall|1.0.6|3019ab69-2d0e-4b3f-a240-4e8c93042dc3|Firewall allow dns traffic from abc:33504 to 1.1.1.1:666|5|src=abc spt=33504 dst=1.1.1.1 url=https://example.org dpt=666 proto=dns act=allow']
|
|
126
|
+
|
|
127
|
+
|
|
128
|
+
leef_with_my_observables = Events.leef(count=1, observables=observables_list)
|
|
129
|
+
print(leef_with_my_observables) # ["LEEF:1.0|Leef|Payment Portal|1.0|210.12.108.86|abc|9a:1e:9d:00:4c:ba|3b:a0:4b:24:f7:59|src=192.168.10.10 dst=abc spt=61549 dpt=443 request=https://example.com/search.php?q=<script>alert('xss')</script> method=Web-GET proto=HTTP/1.1 status=500 hash=719283fd5600eb631c23b290530e4dac9029bae72f15299711edbc800e8e02b2request_size=6173 response_size=8611 user_agent=Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_5 like Mac OS X) AppleWebKit/536.1 (KHTML, like Gecko) FxiOS/12.1s4879.0 Mobile/00Y135 Safari/536.1"]
|
|
130
|
+
|
|
131
|
+
winevent_with_my_observables = Events.winevent(count=1, observables=observables_list)
|
|
132
|
+
print(winevent_with_my_observables) # ['<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="5fc4a88c-97b0-4061-adc3-052159c10ef4"/><EventID>4648</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2023-04-07T18:45:17"/><EventRecordID>575</EventRecordID><Correlation/><Execution ProcessID="1071" ThreadID="5317" Channel="Security"/><Computer>abc</Computer><Security UserID="S-1-2915"/><EventData><Data Name="SubjectUserSid">S-1-2915</Data><Data Name="SubjectUserName">mahmoud</Data><Data Name="SubjectDomainName">johnson.org</Data><Data Name="SubjectLogonId">S-1-2915</Data><Data Name="NewProcessId">3371</Data><Data Name="ProcessId">1071</Data><Data Name="CommandLine">sudo restart</Data><Data Name="TargetUserSid">S-1-2915</Data><Data Name="TargetUserName">mahmoud</Data><Data Name="TargetDomainName">johnson.org</Data><Data Name="TargetLogonId">S-1-2915</Data><Data Name="LogonType">3</Data></EventData></Event>']
|
|
133
|
+
|
|
134
|
+
json_with_my_observables = Events.json(count=1, observables=observables_list)
|
|
135
|
+
print(json_with_my_observables) # [{'event_type': 'vulnerability_discovered', 'timestamp': '2023-02-12T16:28:46', 'severity': 'high', 'host': 'abc', 'file_hash': '719283fd5600eb631c23b290530e4dac9029bae72f15299711edbc800e8e02b2', 'cve': ['CVE-3941-1955']}]
|
|
136
|
+
|
|
137
|
+
incident_with_my_observables = Events.incidents(count=1, fields="id,type,duration,analyst,description,events", observables=observables_list)
|
|
138
|
+
print(incident_with_my_observables) # [{'id': 1, 'duration': 2, 'type': 'Lateral Movement', 'analyst': 'Elizabeth', 'description': 'Software Discovery Forge Web Credentials: SAML Tokens Escape to Host System Binary Proxy Execution: Control Panel Hide Artifacts: Process Argument Spoofing Office Application Startup: Add-ins Compromise Infrastructure: Botnet.', 'events': [{'event': 'Apr 09 19:39:57 abc bind[56294]: ayman : COMMAND ; systemctl stop firewalld'}, {'event': 'CEF:0|Todd, Guzman and Morales|Firewall|1.0.4|afe3d30f-cff4-4084-a7a3-7de9ea21d0e9|Firewall block dns traffic from abc:26806 to 1.1.1.1:555|10|src=abc spt=26806 dst=1.1.1.1 url=https://example.org dpt=555 proto=dns act=block'}, {'event': 'LEEF:1.0|Leef|Payment Portal|1.0|19.90.247.108|abc|d4:27:4c:a7:40:50|2a:3f:f3:37:81:eb|src=192.168.10.20 dst=abc spt=47335 dpt=443 request=https://example.com/index.php method=Web-GET proto=HTTP/1.1 status=500 hash=719283fd5600eb631c23b290530e4dac9029bae72f15299711edbc800e8e02b2request_size=3640 response_size=4766 user_agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_1) AppleWebKit/533.0 (KHTML, like Gecko) Chrome/47.0.819.0 Safari/533.0'}, {'event': '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="67eb0bb0-ab24-43ce-b7f1-6d6a6bb0ac27"/><EventID>4672</EventID><Version>0</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2023-01-15T04:07:58"/><EventRecordID>38</EventRecordID><Correlation/><Execution ProcessID="7182" ThreadID="7703" Channel="Security"/><Computer>abc</Computer><Security UserID="S-1-7181"/><EventData><Data Name="SubjectUserSid">S-1-7181</Data><Data Name="SubjectUserName">mahmoud</Data><Data Name="SubjectDomainName">johnson.net</Data><Data Name="SubjectLogonId">9638</Data><Data Name="PrivilegeList">Through moment tonight.</Data></EventData></Event>'}, {'event': {'event_type': 'vulnerability_discovered', 'timestamp': '2023-01-18T23:49:45', 'severity': 'critical', 'host': 'abc', 'file_hash': '719283fd5600eb631c23b290530e4dac9029bae72f15299711edbc800e8e02b2', 'cve': ['CVE-2023-29067']}}]}]
|
|
139
|
+
|
|
140
|
+
# Example usage of the Sender class to send faked events to log analysis tool.
|
|
141
|
+
worker = Sender(data_type="SYSLOG", destination="udp:127.0.0.1:514", observables=observables_list, count=5, interval=2)
|
|
142
|
+
worker.start()
|
|
143
|
+
|
|
144
|
+
# Starting worker: worker_2023-04-26 17:50:15.671101
|
|
145
|
+
# Worker: worker_2023-04-26 17:50:15.671101 sending log message to 127.0.0.1
|
|
146
|
+
# Worker: worker_2023-04-26 17:50:15.671101 sending log message to 127.0.0.1
|
|
147
|
+
# Worker: worker_2023-04-26 17:50:15.671101 sending log message to 127.0.0.1
|
|
148
|
+
# Worker: worker_2023-04-26 17:50:15.671101 sending log message to 127.0.0.1
|
|
149
|
+
# Worker: worker_2023-04-26 17:50:15.671101 sending log message to 127.0.0.1
|
|
150
|
+
|
|
151
|
+
```
|
|
@@ -0,0 +1,124 @@
|
|
|
1
|
+
[](https://snyk.io/test/github/my-soc/Rosetta)
|
|
2
|
+
|
|
3
|
+
[](https://go-rosetta.slack.com)
|
|
4
|
+
|
|
5
|
+
# Rosetta
|
|
6
|
+
|
|
7
|
+
Rosetta is a Python package that can be used to fake security logs and alerts for testing different detection and response use cases. It provides the following functions:
|
|
8
|
+
- Generate bad and random observables/indicators that include IP Addresses, Urls, File hashes , CVE's and more
|
|
9
|
+
- Fake log messages in different formats like CEF, LEEF and JSON.
|
|
10
|
+
- Convert one log format into another, for example from CEF to LEEF.
|
|
11
|
+
- Send the fake log message to different log management and analytics tools.
|
|
12
|
+
|
|
13
|
+
## Installation
|
|
14
|
+
|
|
15
|
+
- You can install rosetta via pip:
|
|
16
|
+
```sh
|
|
17
|
+
pip install rosetta-ce
|
|
18
|
+
```
|
|
19
|
+
- Or you can install it from the source code:
|
|
20
|
+
```sh
|
|
21
|
+
git clone https://github.com/ayman-m/rosetta.git
|
|
22
|
+
cd rosetta
|
|
23
|
+
python setup.py install
|
|
24
|
+
```
|
|
25
|
+
- Once installed, you can import the library in your Python code like this:
|
|
26
|
+
```python
|
|
27
|
+
from rosetta import Observables, Events
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
## Usage
|
|
31
|
+
Here are some examples of how to use Rosetta:
|
|
32
|
+
```python
|
|
33
|
+
from rosetta import Converter, ConverterToEnum, ConverterFromEnum, Events, ObservableType, ObservableKnown, \
|
|
34
|
+
Observables, Sender
|
|
35
|
+
|
|
36
|
+
# Example usage of the Converter class to convert a CEF log into a LEEF log.
|
|
37
|
+
converted_log = Converter.convert(from_type=ConverterFromEnum.CEF, to_type=ConverterToEnum.LEEF,
|
|
38
|
+
data="cef_log=CEF:0|Security|Intrusion Detection System|1.0|Alert|10|src=192.168.0.1 dst=192.168.0.2 act=blocked")
|
|
39
|
+
print(
|
|
40
|
+
converted_log) # {'message': 'converted', 'data': 'LEEF=1.0!Vendor=Security!Product=Intrusion Detection System!Version=1.0!EventID=Alert!Name=10!src=192.168.0.1!dst=192.168.0.2!act=blocked'}
|
|
41
|
+
|
|
42
|
+
# Example usage of the Observables class to generate bad IP indicators.
|
|
43
|
+
bad_ip = Observables.generator(count=2, observable_type=ObservableType.IP, known=ObservableKnown.BAD)
|
|
44
|
+
print(bad_ip) # ['ip1', 'ip2']
|
|
45
|
+
|
|
46
|
+
# Example usage of the Observables class to generate good IP indicators.
|
|
47
|
+
good_ip = Observables.generator(count=2, observable_type=ObservableType.IP, known=ObservableKnown.GOOD)
|
|
48
|
+
print(good_ip) # ['ip1', 'ip2']
|
|
49
|
+
|
|
50
|
+
# Example usage of the Observables class to generate bad URL indicators.
|
|
51
|
+
bad_url = Observables.generator(count=2, observable_type=ObservableType.URL, known=ObservableKnown.BAD)
|
|
52
|
+
print(bad_url) # ['url1', 'url2']
|
|
53
|
+
|
|
54
|
+
# Example usage of the Observables class to generate good URL indicators.
|
|
55
|
+
good_url = Observables.generator(count=2, observable_type=ObservableType.URL, known=ObservableKnown.GOOD)
|
|
56
|
+
print(good_url) # ['url1', 'url2']
|
|
57
|
+
|
|
58
|
+
# Example usage of the Observables class to generate bad Hash indicators.
|
|
59
|
+
bad_hash = Observables.generator(count=2, observable_type=ObservableType.SHA256, known=ObservableKnown.BAD)
|
|
60
|
+
print(bad_hash) # ['hash1', 'hash2']
|
|
61
|
+
|
|
62
|
+
# Example usage of the Observables class to generate good Hash indicators.
|
|
63
|
+
good_hash = Observables.generator(count=2, observable_type=ObservableType.SHA256, known=ObservableKnown.GOOD)
|
|
64
|
+
print(good_hash) # ['hash1', 'hash2']
|
|
65
|
+
|
|
66
|
+
# Example usage of the Observables class to generate CVE indicators.
|
|
67
|
+
cve = Observables.generator(count=2, observable_type=ObservableType.CVE)
|
|
68
|
+
print(cve) # Example: ['CVE-2023-2136', 'CVE-2023-29582']
|
|
69
|
+
|
|
70
|
+
# Example usage of the Observables class to generate random Terms.
|
|
71
|
+
terms = Observables.generator(count=2, observable_type=ObservableType.TERMS)
|
|
72
|
+
print(terms) # Example: ['Create or Modify System Process', 'Stage Capabilities: Drive-by Target']
|
|
73
|
+
|
|
74
|
+
|
|
75
|
+
# You can create an instance of the Observables class to contain your own observables that are to be used in the fake security events
|
|
76
|
+
src_ip, dst_ip, src_host, dst_host = ["192.168.10.10", "192.168.10.20"], ["1.1.1.1", "1.1.1.2"], ["abc"], ["xyz", "wlv"]
|
|
77
|
+
url, port = ["https://example.org", "https://wikipedia.com"], ["555", "666"]
|
|
78
|
+
protocol, app = ["ftp", "dns", "ssl"], ["explorer.exe", "chrome.exe"]
|
|
79
|
+
user = ["ayman", "mahmoud"]
|
|
80
|
+
file_name, file_hash = ["test.zip", "image.ps"], ["719283fd5600eb631c23b290530e4dac9029bae72f15299711edbc800e8e02b2"]
|
|
81
|
+
cmd, process = ["sudo restart", "systemctl stop firewalld"], ["bind", "crond"]
|
|
82
|
+
severity = ["high", "critical"]
|
|
83
|
+
sensor = ["fw", "edr"]
|
|
84
|
+
action = ["block", "allow"]
|
|
85
|
+
observables_list = Observables(src_ip=src_ip, dst_ip=dst_ip, src_host=src_host, dst_host=dst_host, url=url, port=port,
|
|
86
|
+
protocol=protocol, app=app, user=user, file_name=file_name, file_hash=file_hash, cmd=cmd,
|
|
87
|
+
process=process, severity=severity, sensor=sensor, action=action)
|
|
88
|
+
|
|
89
|
+
# Example usage of the Events class to generate generic SYSLOG events.
|
|
90
|
+
generic_syslog_with_random_observables = Events.syslog(count=1)
|
|
91
|
+
print(generic_syslog_with_random_observables) # ['Jan 20 16:04:53 db-88.zuniga.net sudo[34675]: ryansandy : COMMAND ; iptables -F']
|
|
92
|
+
generic_syslog_with_my_observables = Events.syslog(count=1, observables=observables_list)
|
|
93
|
+
print(generic_syslog_with_my_observables) # ['Apr 07 10:21:43 abc crond[17458]: ayman : COMMAND ; sudo restart']
|
|
94
|
+
|
|
95
|
+
|
|
96
|
+
# Example usage of the Events class to generate CEF events.
|
|
97
|
+
generic_cef_with_my_observables = Events.cef(count=1, observables=observables_list)
|
|
98
|
+
print(generic_cef_with_my_observables) # ['CEF:0|Novak LLC|Firewall|1.0.6|3019ab69-2d0e-4b3f-a240-4e8c93042dc3|Firewall allow dns traffic from abc:33504 to 1.1.1.1:666|5|src=abc spt=33504 dst=1.1.1.1 url=https://example.org dpt=666 proto=dns act=allow']
|
|
99
|
+
|
|
100
|
+
|
|
101
|
+
leef_with_my_observables = Events.leef(count=1, observables=observables_list)
|
|
102
|
+
print(leef_with_my_observables) # ["LEEF:1.0|Leef|Payment Portal|1.0|210.12.108.86|abc|9a:1e:9d:00:4c:ba|3b:a0:4b:24:f7:59|src=192.168.10.10 dst=abc spt=61549 dpt=443 request=https://example.com/search.php?q=<script>alert('xss')</script> method=Web-GET proto=HTTP/1.1 status=500 hash=719283fd5600eb631c23b290530e4dac9029bae72f15299711edbc800e8e02b2request_size=6173 response_size=8611 user_agent=Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_5 like Mac OS X) AppleWebKit/536.1 (KHTML, like Gecko) FxiOS/12.1s4879.0 Mobile/00Y135 Safari/536.1"]
|
|
103
|
+
|
|
104
|
+
winevent_with_my_observables = Events.winevent(count=1, observables=observables_list)
|
|
105
|
+
print(winevent_with_my_observables) # ['<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="5fc4a88c-97b0-4061-adc3-052159c10ef4"/><EventID>4648</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2023-04-07T18:45:17"/><EventRecordID>575</EventRecordID><Correlation/><Execution ProcessID="1071" ThreadID="5317" Channel="Security"/><Computer>abc</Computer><Security UserID="S-1-2915"/><EventData><Data Name="SubjectUserSid">S-1-2915</Data><Data Name="SubjectUserName">mahmoud</Data><Data Name="SubjectDomainName">johnson.org</Data><Data Name="SubjectLogonId">S-1-2915</Data><Data Name="NewProcessId">3371</Data><Data Name="ProcessId">1071</Data><Data Name="CommandLine">sudo restart</Data><Data Name="TargetUserSid">S-1-2915</Data><Data Name="TargetUserName">mahmoud</Data><Data Name="TargetDomainName">johnson.org</Data><Data Name="TargetLogonId">S-1-2915</Data><Data Name="LogonType">3</Data></EventData></Event>']
|
|
106
|
+
|
|
107
|
+
json_with_my_observables = Events.json(count=1, observables=observables_list)
|
|
108
|
+
print(json_with_my_observables) # [{'event_type': 'vulnerability_discovered', 'timestamp': '2023-02-12T16:28:46', 'severity': 'high', 'host': 'abc', 'file_hash': '719283fd5600eb631c23b290530e4dac9029bae72f15299711edbc800e8e02b2', 'cve': ['CVE-3941-1955']}]
|
|
109
|
+
|
|
110
|
+
incident_with_my_observables = Events.incidents(count=1, fields="id,type,duration,analyst,description,events", observables=observables_list)
|
|
111
|
+
print(incident_with_my_observables) # [{'id': 1, 'duration': 2, 'type': 'Lateral Movement', 'analyst': 'Elizabeth', 'description': 'Software Discovery Forge Web Credentials: SAML Tokens Escape to Host System Binary Proxy Execution: Control Panel Hide Artifacts: Process Argument Spoofing Office Application Startup: Add-ins Compromise Infrastructure: Botnet.', 'events': [{'event': 'Apr 09 19:39:57 abc bind[56294]: ayman : COMMAND ; systemctl stop firewalld'}, {'event': 'CEF:0|Todd, Guzman and Morales|Firewall|1.0.4|afe3d30f-cff4-4084-a7a3-7de9ea21d0e9|Firewall block dns traffic from abc:26806 to 1.1.1.1:555|10|src=abc spt=26806 dst=1.1.1.1 url=https://example.org dpt=555 proto=dns act=block'}, {'event': 'LEEF:1.0|Leef|Payment Portal|1.0|19.90.247.108|abc|d4:27:4c:a7:40:50|2a:3f:f3:37:81:eb|src=192.168.10.20 dst=abc spt=47335 dpt=443 request=https://example.com/index.php method=Web-GET proto=HTTP/1.1 status=500 hash=719283fd5600eb631c23b290530e4dac9029bae72f15299711edbc800e8e02b2request_size=3640 response_size=4766 user_agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_1) AppleWebKit/533.0 (KHTML, like Gecko) Chrome/47.0.819.0 Safari/533.0'}, {'event': '<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="67eb0bb0-ab24-43ce-b7f1-6d6a6bb0ac27"/><EventID>4672</EventID><Version>0</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2023-01-15T04:07:58"/><EventRecordID>38</EventRecordID><Correlation/><Execution ProcessID="7182" ThreadID="7703" Channel="Security"/><Computer>abc</Computer><Security UserID="S-1-7181"/><EventData><Data Name="SubjectUserSid">S-1-7181</Data><Data Name="SubjectUserName">mahmoud</Data><Data Name="SubjectDomainName">johnson.net</Data><Data Name="SubjectLogonId">9638</Data><Data Name="PrivilegeList">Through moment tonight.</Data></EventData></Event>'}, {'event': {'event_type': 'vulnerability_discovered', 'timestamp': '2023-01-18T23:49:45', 'severity': 'critical', 'host': 'abc', 'file_hash': '719283fd5600eb631c23b290530e4dac9029bae72f15299711edbc800e8e02b2', 'cve': ['CVE-2023-29067']}}]}]
|
|
112
|
+
|
|
113
|
+
# Example usage of the Sender class to send faked events to log analysis tool.
|
|
114
|
+
worker = Sender(data_type="SYSLOG", destination="udp:127.0.0.1:514", observables=observables_list, count=5, interval=2)
|
|
115
|
+
worker.start()
|
|
116
|
+
|
|
117
|
+
# Starting worker: worker_2023-04-26 17:50:15.671101
|
|
118
|
+
# Worker: worker_2023-04-26 17:50:15.671101 sending log message to 127.0.0.1
|
|
119
|
+
# Worker: worker_2023-04-26 17:50:15.671101 sending log message to 127.0.0.1
|
|
120
|
+
# Worker: worker_2023-04-26 17:50:15.671101 sending log message to 127.0.0.1
|
|
121
|
+
# Worker: worker_2023-04-26 17:50:15.671101 sending log message to 127.0.0.1
|
|
122
|
+
# Worker: worker_2023-04-26 17:50:15.671101 sending log message to 127.0.0.1
|
|
123
|
+
|
|
124
|
+
```
|
|
File without changes
|
|
@@ -0,0 +1,285 @@
|
|
|
1
|
+
INCIDENTS_TYPES = [
|
|
2
|
+
'Malware', 'Phishing', 'Access Violation', 'Lateral Movement', 'Port Scan', 'Sql Injection', 'Brute Force',
|
|
3
|
+
'Control Avoidance', 'Rogue Device', 'Denial Of Service', 'Account Compromised'
|
|
4
|
+
]
|
|
5
|
+
SEVERITIES = ['Low', 'Medium', 'High', 'Critical']
|
|
6
|
+
|
|
7
|
+
ATTACK_TECHNIQUES = [
|
|
8
|
+
"T1548",
|
|
9
|
+
"T1548.002",
|
|
10
|
+
"T1548.004",
|
|
11
|
+
"T1548.001",
|
|
12
|
+
"T1548.003",
|
|
13
|
+
"T1548.006",
|
|
14
|
+
"T1548.005",
|
|
15
|
+
"T1134",
|
|
16
|
+
"T1134.002",
|
|
17
|
+
"T1134.003",
|
|
18
|
+
"T1134.004",
|
|
19
|
+
"T1134.005",
|
|
20
|
+
"T1134.001",
|
|
21
|
+
"T1531",
|
|
22
|
+
"T1087",
|
|
23
|
+
"T1087.004",
|
|
24
|
+
"T1087.002",
|
|
25
|
+
"T1087.003",
|
|
26
|
+
"T1087.001",
|
|
27
|
+
"T1098",
|
|
28
|
+
"T1098.001",
|
|
29
|
+
"T1098.003",
|
|
30
|
+
"T1098.006",
|
|
31
|
+
"T1098.002",
|
|
32
|
+
"T1098.005",
|
|
33
|
+
"T1098.004",
|
|
34
|
+
"T1650",
|
|
35
|
+
"T1583",
|
|
36
|
+
"T1583.005",
|
|
37
|
+
"T1583.002",
|
|
38
|
+
"T1583.001",
|
|
39
|
+
"T1583.008",
|
|
40
|
+
"T1583.004",
|
|
41
|
+
"T1583.007",
|
|
42
|
+
"T1583.003",
|
|
43
|
+
"T1583.006",
|
|
44
|
+
"T1595",
|
|
45
|
+
"T1595.001",
|
|
46
|
+
"T1595.002",
|
|
47
|
+
"T1595.003",
|
|
48
|
+
"T1557",
|
|
49
|
+
"T1557.002",
|
|
50
|
+
"T1557.003",
|
|
51
|
+
"T1557.001",
|
|
52
|
+
"T1071",
|
|
53
|
+
"T1071.004",
|
|
54
|
+
"T1071.002",
|
|
55
|
+
"T1071.003",
|
|
56
|
+
"T1071.001",
|
|
57
|
+
"T1010",
|
|
58
|
+
"T1560",
|
|
59
|
+
"T1560.003",
|
|
60
|
+
"T1560.002",
|
|
61
|
+
"T1560.001",
|
|
62
|
+
"T1123",
|
|
63
|
+
"T1119",
|
|
64
|
+
"T1020",
|
|
65
|
+
"T1020.001",
|
|
66
|
+
"T1197",
|
|
67
|
+
"T1547",
|
|
68
|
+
"T1547.014",
|
|
69
|
+
"T1547.002",
|
|
70
|
+
"T1547.006",
|
|
71
|
+
"T1547.008",
|
|
72
|
+
"T1547.015",
|
|
73
|
+
"T1547.010",
|
|
74
|
+
"T1547.012",
|
|
75
|
+
"T1547.007",
|
|
76
|
+
"T1547.001",
|
|
77
|
+
"T1547.005",
|
|
78
|
+
"T1547.009",
|
|
79
|
+
"T1547.003",
|
|
80
|
+
"T1547.004",
|
|
81
|
+
"T1547.013",
|
|
82
|
+
"T1037",
|
|
83
|
+
"T1037.002",
|
|
84
|
+
"T1037.001",
|
|
85
|
+
"T1037.003",
|
|
86
|
+
"T1037.004",
|
|
87
|
+
"T1037.005",
|
|
88
|
+
"T1176",
|
|
89
|
+
"T1217",
|
|
90
|
+
"T1185",
|
|
91
|
+
"T1110",
|
|
92
|
+
"T1110.004",
|
|
93
|
+
"T1110.002",
|
|
94
|
+
"T1110.001",
|
|
95
|
+
"T1110.003",
|
|
96
|
+
"T1612",
|
|
97
|
+
"T1115",
|
|
98
|
+
"T1651",
|
|
99
|
+
"T1580",
|
|
100
|
+
"T1538",
|
|
101
|
+
"T1526",
|
|
102
|
+
"T1619",
|
|
103
|
+
"T1059",
|
|
104
|
+
"T1059.002",
|
|
105
|
+
"T1059.010",
|
|
106
|
+
"T1059.009",
|
|
107
|
+
"T1059.007",
|
|
108
|
+
"T1059.008",
|
|
109
|
+
"T1059.001",
|
|
110
|
+
"T1059.006",
|
|
111
|
+
"T1059.004",
|
|
112
|
+
"T1059.005",
|
|
113
|
+
"T1059.003",
|
|
114
|
+
"T1092",
|
|
115
|
+
"T1586",
|
|
116
|
+
"T1586.003",
|
|
117
|
+
"T1586.002",
|
|
118
|
+
"T1586.001",
|
|
119
|
+
"T1554",
|
|
120
|
+
"T1584",
|
|
121
|
+
"T1584.005",
|
|
122
|
+
"T1584.002",
|
|
123
|
+
"T1584.001",
|
|
124
|
+
"T1584.008",
|
|
125
|
+
"T1584.004",
|
|
126
|
+
"T1584.007",
|
|
127
|
+
"T1584.003",
|
|
128
|
+
"T1584.006",
|
|
129
|
+
"T1609",
|
|
130
|
+
"T1613",
|
|
131
|
+
"T1659",
|
|
132
|
+
"T1136",
|
|
133
|
+
"T1136.003",
|
|
134
|
+
"T1136.002",
|
|
135
|
+
"T1136.001",
|
|
136
|
+
"T1543",
|
|
137
|
+
"T1543.005",
|
|
138
|
+
"T1543.001",
|
|
139
|
+
"T1543.004",
|
|
140
|
+
"T1543.002",
|
|
141
|
+
"T1543.003",
|
|
142
|
+
"T1555",
|
|
143
|
+
"T1555.006",
|
|
144
|
+
"T1555.003",
|
|
145
|
+
"T1555.001",
|
|
146
|
+
"T1555.005",
|
|
147
|
+
"T1555.002",
|
|
148
|
+
"T1555.004",
|
|
149
|
+
"T1485",
|
|
150
|
+
"T1132",
|
|
151
|
+
"T1132.002",
|
|
152
|
+
"T1132.001",
|
|
153
|
+
"T1486",
|
|
154
|
+
"T1565",
|
|
155
|
+
"T1565.003",
|
|
156
|
+
"T1565.001",
|
|
157
|
+
"T1565.002",
|
|
158
|
+
"T1001",
|
|
159
|
+
"T1001.001",
|
|
160
|
+
"T1001.003",
|
|
161
|
+
"T1001.002",
|
|
162
|
+
"T1074",
|
|
163
|
+
"T1074.001",
|
|
164
|
+
"T1074.002",
|
|
165
|
+
"T1030",
|
|
166
|
+
"T1530",
|
|
167
|
+
"T1602",
|
|
168
|
+
"T1602.002",
|
|
169
|
+
"T1602.001",
|
|
170
|
+
"T1213",
|
|
171
|
+
"T1213.003",
|
|
172
|
+
"T1213.001",
|
|
173
|
+
"T1213.002",
|
|
174
|
+
"T1005",
|
|
175
|
+
"T1039",
|
|
176
|
+
"T1025",
|
|
177
|
+
"T1622",
|
|
178
|
+
"T1491",
|
|
179
|
+
"T1491.002",
|
|
180
|
+
"T1491.001",
|
|
181
|
+
"T1140",
|
|
182
|
+
"T1610",
|
|
183
|
+
"T1587",
|
|
184
|
+
"T1587.002",
|
|
185
|
+
"T1587.003",
|
|
186
|
+
"T1587.004",
|
|
187
|
+
"T1587.001",
|
|
188
|
+
"T1652",
|
|
189
|
+
"T1006",
|
|
190
|
+
"T1561",
|
|
191
|
+
"T1561.001",
|
|
192
|
+
"T1561.002",
|
|
193
|
+
"T1482",
|
|
194
|
+
"T1484",
|
|
195
|
+
"T1484.001",
|
|
196
|
+
"T1484.002",
|
|
197
|
+
"T1189",
|
|
198
|
+
"T1568",
|
|
199
|
+
"T1568.003",
|
|
200
|
+
"T1568.002",
|
|
201
|
+
"T1568.001",
|
|
202
|
+
"T1114",
|
|
203
|
+
"T1114.003",
|
|
204
|
+
"T1114.001",
|
|
205
|
+
"T1114.002",
|
|
206
|
+
"T1573",
|
|
207
|
+
"T1573.002",
|
|
208
|
+
"T1573.001",
|
|
209
|
+
"T1499",
|
|
210
|
+
"T1499.003",
|
|
211
|
+
"T1499.004",
|
|
212
|
+
"T1499.001",
|
|
213
|
+
"T1499.002",
|
|
214
|
+
"T1611",
|
|
215
|
+
"T1585",
|
|
216
|
+
"T1585.003",
|
|
217
|
+
"T1585.002",
|
|
218
|
+
"T1585.001",
|
|
219
|
+
"T1546",
|
|
220
|
+
"T1546.008",
|
|
221
|
+
"T1546.009",
|
|
222
|
+
"T1546.010",
|
|
223
|
+
"T1546.011",
|
|
224
|
+
"T1546.001",
|
|
225
|
+
"T1546.015",
|
|
226
|
+
"T1546.014",
|
|
227
|
+
"T1546.012",
|
|
228
|
+
"T1546.016",
|
|
229
|
+
"T1546.006",
|
|
230
|
+
"T1546.007",
|
|
231
|
+
"T1546.013",
|
|
232
|
+
"T1546.002",
|
|
233
|
+
"T1546.005",
|
|
234
|
+
"T1546.004",
|
|
235
|
+
"T1546.003",
|
|
236
|
+
"T1480",
|
|
237
|
+
"T1480.001",
|
|
238
|
+
"T1048",
|
|
239
|
+
"T1048.002",
|
|
240
|
+
"T1048.001",
|
|
241
|
+
"T1048.003",
|
|
242
|
+
"T1041",
|
|
243
|
+
"T1011",
|
|
244
|
+
"T1011.001",
|
|
245
|
+
"T1052",
|
|
246
|
+
"T1052.001",
|
|
247
|
+
"T1567",
|
|
248
|
+
"T1567.004",
|
|
249
|
+
"T1567.002",
|
|
250
|
+
"T1567.001",
|
|
251
|
+
"T1567.003",
|
|
252
|
+
"T1190",
|
|
253
|
+
"T1203",
|
|
254
|
+
"T1212",
|
|
255
|
+
"T1211",
|
|
256
|
+
"T1068",
|
|
257
|
+
"T1210",
|
|
258
|
+
"T1133",
|
|
259
|
+
"T1008",
|
|
260
|
+
"T1083",
|
|
261
|
+
"T1222",
|
|
262
|
+
"T1222.002",
|
|
263
|
+
"T1222.001",
|
|
264
|
+
"T1657",
|
|
265
|
+
"T1495",
|
|
266
|
+
"T1187",
|
|
267
|
+
"T1606",
|
|
268
|
+
"T1606.002",
|
|
269
|
+
"T1606.001",
|
|
270
|
+
"T1592",
|
|
271
|
+
"T1592.004",
|
|
272
|
+
"T1592.003",
|
|
273
|
+
"T1592.001",
|
|
274
|
+
"T1592.002",
|
|
275
|
+
"T1589",
|
|
276
|
+
"T1589.001",
|
|
277
|
+
"T1589.002",
|
|
278
|
+
"T1589.003",
|
|
279
|
+
"T1590",
|
|
280
|
+
"T1590.002",
|
|
281
|
+
"T1590.001",
|
|
282
|
+
"T1590.005",
|
|
283
|
+
"T1590.006",
|
|
284
|
+
"T1590"
|
|
285
|
+
]
|