souleyez 2.32.0__py3-none-any.whl → 2.40.0__py3-none-any.whl

souleyez/__init__.py

@@ -1 +1,2 @@
-__version__ = '2.32.0'
+__version__ = '2.40.0'
+

souleyez/core/msf_auto_mapper.py

@@ -49,8 +49,9 @@ class MSFAutoMapper:
                         risk_levels=['safe', 'noisy', 'moderate', 'dangerous']
                     )
 
-                    # Filter to top 10 recommendations
-                    service_map[service_id] = recommendations[:10]
+                    # Only store services with actual recommendations
+                    if recommendations:
+                        service_map[service_id] = recommendations[:10]
 
             return service_map
         except Exception as e:

souleyez/core/tool_chaining.py

@@ -3972,7 +3972,7 @@ class ToolChaining:
                     # This reduces noise and focuses on high-value targets
                     from souleyez.intelligence.sensitive_tables import is_sensitive_table, is_system_table
 
-                    MAX_TABLES_FOR_COLUMN_ENUM = 15  # Focused on sensitive tables only
+                    MAX_TABLES_FOR_COLUMN_ENUM = 10  # Focused on sensitive tables only
                     tables_queued = 0
                     skipped_tables = 0
 
@@ -5770,6 +5770,17 @@ class ToolChaining:
 
                             status = existing_job.get('status')
 
+                            # === SQLMAP RULE-BASED DEDUP (check ALL completed jobs, not just recent) ===
+                            # For sqlmap: if same rule was already applied to this URL, skip it entirely
+                            # This prevents infinite loops where each sqlmap job re-triggers the same rules
+                            if cmd['tool'] == 'sqlmap' and status in ['done', 'queued', 'running']:
+                                cmd_rule_id = cmd.get('rule_id')
+                                existing_rule_id = existing_job.get('rule_id')
+                                if cmd_rule_id and existing_rule_id and cmd_rule_id == existing_rule_id:
+                                    similar_exists = True
+                                    print(f"  ⏭️  Skipping sqlmap for {cmd_target}: rule #{cmd_rule_id} already applied (job #{existing_job['id']} {status})")
+                                    break
+
                             # Check if job is active (queued/running)
                             is_active = status in ['queued', 'running']
 
@@ -5784,11 +5795,28 @@ class ToolChaining:
                                         current_time = datetime.now(finished_time.tzinfo) if finished_time.tzinfo else datetime.now()
                                         time_delta = (current_time - finished_time).total_seconds()
 
-                                        # Only block if same args AND finished < 5 min ago
+                                        # Only block if finished < 5 min ago AND (same args OR same rule_id for sqlmap)
                                         if time_delta < DUPLICATE_WINDOW_SECONDS:
                                             existing_args = existing_job.get('args', [])
                                             cmd_args = cmd.get('args', [])
-                                            if existing_args == cmd_args:
+
+                                            # For sqlmap: also check rule_id (same rule = duplicate even with different parent)
+                                            if cmd['tool'] == 'sqlmap':
+                                                cmd_rule_id = cmd.get('rule_id')
+                                                existing_rule_id = existing_job.get('rule_id')
+                                                if cmd_rule_id and existing_rule_id and cmd_rule_id == existing_rule_id:
+                                                    is_recent_duplicate = True
+                                                    minutes_ago = int(time_delta // 60)
+                                                    seconds_ago = int(time_delta % 60)
+                                                    time_str = f"{minutes_ago}m {seconds_ago}s ago" if minutes_ago > 0 else f"{seconds_ago}s ago"
+                                                    print(f"  ⏭️  Skipping sqlmap for {cmd_target}: rule #{cmd_rule_id} completed {time_str} (duplicate)")
+                                                elif existing_args == cmd_args:
+                                                    is_recent_duplicate = True
+                                                    minutes_ago = int(time_delta // 60)
+                                                    seconds_ago = int(time_delta % 60)
+                                                    time_str = f"{minutes_ago}m {seconds_ago}s ago" if minutes_ago > 0 else f"{seconds_ago}s ago"
+                                                    print(f"  ⏭️  Skipping sqlmap for {cmd_target}: job #{existing_job['id']} completed {time_str} (duplicate)")
+                                            elif existing_args == cmd_args:
                                                 is_recent_duplicate = True
                                                 minutes_ago = int(time_delta // 60)
                                                 seconds_ago = int(time_delta % 60)
@@ -5810,16 +5838,34 @@ class ToolChaining:
                                             print(f"  ⏭️  Skipping {cmd['tool']} for {cmd_target}: similar job #{existing_job['id']} already exists ({existing_job['status']})")
                                             break
 
-                                    # For sqlmap, gobuster: check if args match (allow different ports/phases)
-                                    elif cmd['tool'] in ['sqlmap', 'gobuster']:
+                                    # For sqlmap: check by rule_id to prevent same rule firing twice on same URL
+                                    elif cmd['tool'] == 'sqlmap':
+                                        cmd_rule_id = cmd.get('rule_id')
+                                        existing_rule_id = existing_job.get('rule_id')
+                                        existing_args = existing_job.get('args', [])
+                                        cmd_args = cmd.get('args', [])
+
+                                        # If both have rule_id and they match, it's a duplicate
+                                        # (same rule already applied to this injection point)
+                                        if cmd_rule_id and existing_rule_id and cmd_rule_id == existing_rule_id:
+                                            similar_exists = True
+                                            print(f"  ⏭️  Skipping sqlmap for {cmd_target}: rule #{cmd_rule_id} already applied (job #{existing_job['id']} {existing_job['status']})")
+                                            break
+                                        # Also check if exact same args (covers manual/no-rule jobs)
+                                        elif existing_args == cmd_args:
+                                            similar_exists = True
+                                            print(f"  ⏭️  Skipping sqlmap for {cmd_target}: similar job #{existing_job['id']} already exists ({existing_job['status']})")
+                                            break
+                                        # If different rule_id and different args, allow it (different SQLMap phase)
+
+                                    # For gobuster: check if args match
+                                    elif cmd['tool'] == 'gobuster':
                                         existing_args = existing_job.get('args', [])
                                         cmd_args = cmd.get('args', [])
-                                        # Compare args - if they're the same, it's a duplicate
                                         if existing_args == cmd_args:
                                             similar_exists = True
                                             print(f"  ⏭️  Skipping {cmd['tool']} for {cmd_target}: similar job #{existing_job['id']} already exists ({existing_job['status']})")
                                             break
-                                        # If args are different, allow it (different SQLMap phase)
 
                                     # For quick lookup tools (whois, dnsrecon), skip 5-min duplicate check
                                     # They're fast and each theHarvester run should trigger them

souleyez/docs/README.md

@@ -1,6 +1,6 @@
 # SoulEyez Documentation
 
-**Version:** 2.32.0
+**Version:** 2.40.0
 **Last Updated:** January 9, 2026
 **Organization:** CyberSoul Security
 

souleyez/integrations/siem/__init__.py

@@ -30,6 +30,7 @@ from souleyez.integrations.siem.wazuh import WazuhSIEMClient
 from souleyez.integrations.siem.splunk import SplunkSIEMClient
 from souleyez.integrations.siem.elastic import ElasticSIEMClient
 from souleyez.integrations.siem.sentinel import SentinelSIEMClient
+from souleyez.integrations.siem.googlesecops import GoogleSecOpsSIEMClient
 from souleyez.integrations.siem.factory import SIEMFactory
 
 __all__ = [
@@ -45,4 +46,5 @@ __all__ = [
     'SplunkSIEMClient',
     'ElasticSIEMClient',
     'SentinelSIEMClient',
+    'GoogleSecOpsSIEMClient',
 ]

souleyez/integrations/siem/factory.py

@@ -11,7 +11,8 @@ from souleyez.integrations.siem.base import SIEMClient, SIEMConnectionStatus
 
 
 # Registry of available SIEM types
-SIEM_TYPES = ['wazuh', 'splunk', 'elastic', 'sentinel']
+# Ordered: Open Source first, then Commercial
+SIEM_TYPES = ['wazuh', 'elastic', 'splunk', 'sentinel', 'google_secops']
 
 
 class SIEMFactory:
@@ -60,6 +61,10 @@ class SIEMFactory:
             from souleyez.integrations.siem.sentinel import SentinelSIEMClient
             return SentinelSIEMClient.from_config(config)
 
+        elif siem_type_lower == 'google_secops':
+            from souleyez.integrations.siem.googlesecops import GoogleSecOpsSIEMClient
+            return GoogleSecOpsSIEMClient.from_config(config)
+
         else:
             raise ValueError(
                 f"Unsupported SIEM type: {siem_type}. "
@@ -114,7 +119,7 @@ class SIEMFactory:
         info_map = {
             'wazuh': {
                 'name': 'Wazuh',
-                'description': 'Open source security monitoring (OSSEC fork)',
+                'description': '[Open Source] Security monitoring platform (OSSEC fork)',
                 'config_fields': [
                     {'name': 'api_url', 'label': 'Manager API URL', 'required': True,
                      'placeholder': 'https://wazuh.example.com:55000'},
@@ -130,7 +135,7 @@ class SIEMFactory:
             },
             'splunk': {
                 'name': 'Splunk',
-                'description': 'Enterprise SIEM and log management platform',
+                'description': '[Commercial] Enterprise SIEM and log management',
                 'config_fields': [
                     {'name': 'api_url', 'label': 'REST API URL', 'required': True,
                      'placeholder': 'https://splunk.example.com:8089'},
@@ -144,7 +149,7 @@ class SIEMFactory:
             },
             'elastic': {
                 'name': 'Elastic Security',
-                'description': 'Elastic SIEM (formerly Elastic Security)',
+                'description': '[Open Source] Elastic Stack security solution (ELK SIEM)',
                 'config_fields': [
                     {'name': 'elasticsearch_url', 'label': 'Elasticsearch URL', 'required': True,
                      'placeholder': 'https://elastic.example.com:9200'},
@@ -159,7 +164,7 @@ class SIEMFactory:
             },
             'sentinel': {
                 'name': 'Microsoft Sentinel',
-                'description': 'Azure cloud-native SIEM',
+                'description': '[Commercial] Azure cloud-native SIEM',
                 'config_fields': [
                     {'name': 'tenant_id', 'label': 'Azure Tenant ID', 'required': True},
                     {'name': 'client_id', 'label': 'App Client ID', 'required': True},
@@ -170,6 +175,22 @@ class SIEMFactory:
                     {'name': 'workspace_id', 'label': 'Workspace ID (GUID)', 'required': True},
                 ],
             },
+            'google_secops': {
+                'name': 'Google SecOps',
+                'description': '[Commercial] Google Cloud security operations (Chronicle)',
+                'config_fields': [
+                    {'name': 'customer_id', 'label': 'Chronicle Customer ID', 'required': True,
+                     'placeholder': 'Your Chronicle customer ID'},
+                    {'name': 'region', 'label': 'Chronicle Region', 'required': True,
+                     'placeholder': 'us, europe, asia-southeast1'},
+                    {'name': 'project_id', 'label': 'Google Cloud Project ID', 'required': False,
+                     'placeholder': 'Optional if in service account JSON'},
+                    {'name': 'credentials_json', 'label': 'Service Account JSON', 'required': True,
+                     'secret': True, 'type': 'textarea',
+                     'placeholder': 'Paste service account JSON key'},
+                    {'name': 'verify_ssl', 'label': 'Verify SSL', 'required': False, 'type': 'boolean'},
+                ],
+            },
         }
 
         return info_map.get(siem_type.lower(), {