souleyez 2.31.0__py3-none-any.whl → 2.35.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- souleyez/__init__.py +2 -1
- souleyez/docs/README.md +1 -1
- souleyez/integrations/siem/__init__.py +2 -0
- souleyez/integrations/siem/factory.py +26 -5
- souleyez/integrations/siem/googlesecops.py +614 -0
- souleyez/integrations/wazuh/config.py +143 -20
- souleyez/main.py +1 -1
- souleyez/storage/migrations/_027_multi_siem_persistence.py +119 -0
- souleyez/storage/migrations/__init__.py +2 -0
- souleyez/storage/schema.sql +8 -4
- souleyez/ui/interactive.py +95 -22
- {souleyez-2.31.0.dist-info → souleyez-2.35.0.dist-info}/METADATA +3 -3
- {souleyez-2.31.0.dist-info → souleyez-2.35.0.dist-info}/RECORD +17 -15
- {souleyez-2.31.0.dist-info → souleyez-2.35.0.dist-info}/WHEEL +0 -0
- {souleyez-2.31.0.dist-info → souleyez-2.35.0.dist-info}/entry_points.txt +0 -0
- {souleyez-2.31.0.dist-info → souleyez-2.35.0.dist-info}/licenses/LICENSE +0 -0
- {souleyez-2.31.0.dist-info → souleyez-2.35.0.dist-info}/top_level.txt +0 -0
souleyez/__init__.py
CHANGED
|
@@ -1 +1,2 @@
|
|
|
1
|
-
__version__ = '2.
|
|
1
|
+
__version__ = '2.35.0'
|
|
2
|
+
|
souleyez/docs/README.md
CHANGED
|
@@ -30,6 +30,7 @@ from souleyez.integrations.siem.wazuh import WazuhSIEMClient
|
|
|
30
30
|
from souleyez.integrations.siem.splunk import SplunkSIEMClient
|
|
31
31
|
from souleyez.integrations.siem.elastic import ElasticSIEMClient
|
|
32
32
|
from souleyez.integrations.siem.sentinel import SentinelSIEMClient
|
|
33
|
+
from souleyez.integrations.siem.googlesecops import GoogleSecOpsSIEMClient
|
|
33
34
|
from souleyez.integrations.siem.factory import SIEMFactory
|
|
34
35
|
|
|
35
36
|
__all__ = [
|
|
@@ -45,4 +46,5 @@ __all__ = [
|
|
|
45
46
|
'SplunkSIEMClient',
|
|
46
47
|
'ElasticSIEMClient',
|
|
47
48
|
'SentinelSIEMClient',
|
|
49
|
+
'GoogleSecOpsSIEMClient',
|
|
48
50
|
]
|
|
@@ -11,7 +11,8 @@ from souleyez.integrations.siem.base import SIEMClient, SIEMConnectionStatus
|
|
|
11
11
|
|
|
12
12
|
|
|
13
13
|
# Registry of available SIEM types
|
|
14
|
-
|
|
14
|
+
# Ordered: Open Source first, then Commercial
|
|
15
|
+
SIEM_TYPES = ['wazuh', 'elastic', 'splunk', 'sentinel', 'google_secops']
|
|
15
16
|
|
|
16
17
|
|
|
17
18
|
class SIEMFactory:
|
|
@@ -60,6 +61,10 @@ class SIEMFactory:
|
|
|
60
61
|
from souleyez.integrations.siem.sentinel import SentinelSIEMClient
|
|
61
62
|
return SentinelSIEMClient.from_config(config)
|
|
62
63
|
|
|
64
|
+
elif siem_type_lower == 'google_secops':
|
|
65
|
+
from souleyez.integrations.siem.googlesecops import GoogleSecOpsSIEMClient
|
|
66
|
+
return GoogleSecOpsSIEMClient.from_config(config)
|
|
67
|
+
|
|
63
68
|
else:
|
|
64
69
|
raise ValueError(
|
|
65
70
|
f"Unsupported SIEM type: {siem_type}. "
|
|
@@ -114,7 +119,7 @@ class SIEMFactory:
|
|
|
114
119
|
info_map = {
|
|
115
120
|
'wazuh': {
|
|
116
121
|
'name': 'Wazuh',
|
|
117
|
-
'description': 'Open
|
|
122
|
+
'description': '[Open Source] Security monitoring platform (OSSEC fork)',
|
|
118
123
|
'config_fields': [
|
|
119
124
|
{'name': 'api_url', 'label': 'Manager API URL', 'required': True,
|
|
120
125
|
'placeholder': 'https://wazuh.example.com:55000'},
|
|
@@ -130,7 +135,7 @@ class SIEMFactory:
|
|
|
130
135
|
},
|
|
131
136
|
'splunk': {
|
|
132
137
|
'name': 'Splunk',
|
|
133
|
-
'description': 'Enterprise SIEM and log management
|
|
138
|
+
'description': '[Commercial] Enterprise SIEM and log management',
|
|
134
139
|
'config_fields': [
|
|
135
140
|
{'name': 'api_url', 'label': 'REST API URL', 'required': True,
|
|
136
141
|
'placeholder': 'https://splunk.example.com:8089'},
|
|
@@ -144,7 +149,7 @@ class SIEMFactory:
|
|
|
144
149
|
},
|
|
145
150
|
'elastic': {
|
|
146
151
|
'name': 'Elastic Security',
|
|
147
|
-
'description': 'Elastic
|
|
152
|
+
'description': '[Open Source] Elastic Stack security solution (ELK SIEM)',
|
|
148
153
|
'config_fields': [
|
|
149
154
|
{'name': 'elasticsearch_url', 'label': 'Elasticsearch URL', 'required': True,
|
|
150
155
|
'placeholder': 'https://elastic.example.com:9200'},
|
|
@@ -159,7 +164,7 @@ class SIEMFactory:
|
|
|
159
164
|
},
|
|
160
165
|
'sentinel': {
|
|
161
166
|
'name': 'Microsoft Sentinel',
|
|
162
|
-
'description': 'Azure cloud-native SIEM',
|
|
167
|
+
'description': '[Commercial] Azure cloud-native SIEM',
|
|
163
168
|
'config_fields': [
|
|
164
169
|
{'name': 'tenant_id', 'label': 'Azure Tenant ID', 'required': True},
|
|
165
170
|
{'name': 'client_id', 'label': 'App Client ID', 'required': True},
|
|
@@ -170,6 +175,22 @@ class SIEMFactory:
|
|
|
170
175
|
{'name': 'workspace_id', 'label': 'Workspace ID (GUID)', 'required': True},
|
|
171
176
|
],
|
|
172
177
|
},
|
|
178
|
+
'google_secops': {
|
|
179
|
+
'name': 'Google SecOps',
|
|
180
|
+
'description': '[Commercial] Google Cloud security operations (Chronicle)',
|
|
181
|
+
'config_fields': [
|
|
182
|
+
{'name': 'customer_id', 'label': 'Chronicle Customer ID', 'required': True,
|
|
183
|
+
'placeholder': 'Your Chronicle customer ID'},
|
|
184
|
+
{'name': 'region', 'label': 'Chronicle Region', 'required': True,
|
|
185
|
+
'placeholder': 'us, europe, asia-southeast1'},
|
|
186
|
+
{'name': 'project_id', 'label': 'Google Cloud Project ID', 'required': False,
|
|
187
|
+
'placeholder': 'Optional if in service account JSON'},
|
|
188
|
+
{'name': 'credentials_json', 'label': 'Service Account JSON', 'required': True,
|
|
189
|
+
'secret': True, 'type': 'textarea',
|
|
190
|
+
'placeholder': 'Paste service account JSON key'},
|
|
191
|
+
{'name': 'verify_ssl', 'label': 'Verify SSL', 'required': False, 'type': 'boolean'},
|
|
192
|
+
],
|
|
193
|
+
},
|
|
173
194
|
}
|
|
174
195
|
|
|
175
196
|
return info_map.get(siem_type.lower(), {
|