souleyez 2.43.26__py3-none-any.whl → 2.43.34__py3-none-any.whl

souleyez/integrations/siem/googlesecops.py

@@ -33,16 +33,16 @@ class GoogleSecOpsSIEMClient(SIEMClient):
 
     # Chronicle API regions
     REGIONS = {
-        'us': 'https://backstory.googleapis.com',
-        'europe': 'https://europe-backstory.googleapis.com',
-        'asia-southeast1': 'https://asia-southeast1-backstory.googleapis.com',
+        "us": "https://backstory.googleapis.com",
+        "europe": "https://europe-backstory.googleapis.com",
+        "asia-southeast1": "https://asia-southeast1-backstory.googleapis.com",
     }
 
     def __init__(
         self,
         credentials_json: str,
         customer_id: str,
-        region: str = 'us',
+        region: str = "us",
         project_id: Optional[str] = None,
         verify_ssl: bool = True,
     ):
@@ -70,13 +70,13 @@ class GoogleSecOpsSIEMClient(SIEMClient):
         except json.JSONDecodeError as e:
             raise ValueError(f"Invalid service account JSON: {e}")
 
-        self.project_id = project_id or self._credentials.get('project_id', '')
+        self.project_id = project_id or self._credentials.get("project_id", "")
 
         # Set API base URL
-        self.api_base = self.REGIONS.get(self.region, self.REGIONS['us'])
+        self.api_base = self.REGIONS.get(self.region, self.REGIONS["us"])
 
     @classmethod
-    def from_config(cls, config: Dict[str, Any]) -> 'GoogleSecOpsSIEMClient':
+    def from_config(cls, config: Dict[str, Any]) -> "GoogleSecOpsSIEMClient":
         """Create client from configuration dictionary.
 
         Args:
@@ -86,17 +86,17 @@ class GoogleSecOpsSIEMClient(SIEMClient):
             GoogleSecOpsSIEMClient instance
         """
         return cls(
-            credentials_json=config.get('credentials_json', '{}'),
-            customer_id=config.get('customer_id', ''),
-            region=config.get('region', 'us'),
-            project_id=config.get('project_id'),
-            verify_ssl=config.get('verify_ssl', True),
+            credentials_json=config.get("credentials_json", "{}"),
+            customer_id=config.get("customer_id", ""),
+            region=config.get("region", "us"),
+            project_id=config.get("project_id"),
+            verify_ssl=config.get("verify_ssl", True),
         )
 
     @property
     def siem_type(self) -> str:
         """Return the SIEM type identifier."""
-        return 'google_secops'
+        return "google_secops"
 
     def _create_jwt(self) -> str:
         """Create a signed JWT for service account authentication.
@@ -113,45 +113,43 @@ class GoogleSecOpsSIEMClient(SIEMClient):
 
         # JWT header
         header = {
-            'alg': 'RS256',
-            'typ': 'JWT',
-            'kid': self._credentials.get('private_key_id', '')
+            "alg": "RS256",
+            "typ": "JWT",
+            "kid": self._credentials.get("private_key_id", ""),
         }
 
         # JWT claims
         claims = {
-            'iss': self._credentials.get('client_email', ''),
-            'sub': self._credentials.get('client_email', ''),
-            'aud': 'https://oauth2.googleapis.com/token',
-            'iat': now,
-            'exp': expiry,
-            'scope': 'https://www.googleapis.com/auth/chronicle-backstory'
+            "iss": self._credentials.get("client_email", ""),
+            "sub": self._credentials.get("client_email", ""),
+            "aud": "https://oauth2.googleapis.com/token",
+            "iat": now,
+            "exp": expiry,
+            "scope": "https://www.googleapis.com/auth/chronicle-backstory",
         }
 
         # Encode header and claims
         def b64_encode(data: dict) -> str:
-            return base64.urlsafe_b64encode(
-                json.dumps(data, separators=(',', ':')).encode()
-            ).rstrip(b'=').decode()
+            return (
+                base64.urlsafe_b64encode(
+                    json.dumps(data, separators=(",", ":")).encode()
+                )
+                .rstrip(b"=")
+                .decode()
+            )
 
         header_b64 = b64_encode(header)
         claims_b64 = b64_encode(claims)
         message = f"{header_b64}.{claims_b64}".encode()
 
         # Sign with private key
-        private_key_pem = self._credentials.get('private_key', '')
+        private_key_pem = self._credentials.get("private_key", "")
         private_key = serialization.load_pem_private_key(
-            private_key_pem.encode(),
-            password=None,
-            backend=default_backend()
+            private_key_pem.encode(), password=None, backend=default_backend()
         )
 
-        signature = private_key.sign(
-            message,
-            padding.PKCS1v15(),
-            hashes.SHA256()
-        )
-        signature_b64 = base64.urlsafe_b64encode(signature).rstrip(b'=').decode()
+        signature = private_key.sign(message, padding.PKCS1v15(), hashes.SHA256())
+        signature_b64 = base64.urlsafe_b64encode(signature).rstrip(b"=").decode()
 
         return f"{header_b64}.{claims_b64}.{signature_b64}"
 
@@ -171,19 +169,19 @@ class GoogleSecOpsSIEMClient(SIEMClient):
 
         # Exchange JWT for access token
         response = requests.post(
-            'https://oauth2.googleapis.com/token',
+            "https://oauth2.googleapis.com/token",
             data={
-                'grant_type': 'urn:ietf:params:oauth:grant-type:jwt-bearer',
-                'assertion': jwt,
+                "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
+                "assertion": jwt,
             },
             timeout=30,
-            verify=self.verify_ssl
+            verify=self.verify_ssl,
         )
         response.raise_for_status()
 
         token_data = response.json()
-        self._access_token = token_data['access_token']
-        expires_in = token_data.get('expires_in', 3600)
+        self._access_token = token_data["access_token"]
+        expires_in = token_data.get("expires_in", 3600)
         self._token_expiry = datetime.now() + timedelta(seconds=expires_in - 60)
 
         return self._access_token
@@ -210,8 +208,8 @@ class GoogleSecOpsSIEMClient(SIEMClient):
         url = f"{self.api_base}{endpoint}"
 
         headers = {
-            'Authorization': f'Bearer {token}',
-            'Content-Type': 'application/json',
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
         }
 
         response = requests.request(
@@ -221,7 +219,7 @@ class GoogleSecOpsSIEMClient(SIEMClient):
             params=params,
             json=json_data,
             verify=self.verify_ssl,
-            timeout=60
+            timeout=60,
         )
         return response
 
@@ -237,52 +235,48 @@ class GoogleSecOpsSIEMClient(SIEMClient):
 
             # Query for a small time window to verify API access
             response = self._request(
-                'GET',
-                '/v1alpha/detect/rules',
-                params={'page_size': 1}
+                "GET", "/v1alpha/detect/rules", params={"page_size": 1}
             )
 
             if response.status_code == 200:
                 return SIEMConnectionStatus(
                     connected=True,
-                    version='Chronicle API v1alpha',
-                    siem_type='google_secops',
+                    version="Chronicle API v1alpha",
+                    siem_type="google_secops",
                     details={
-                        'region': self.region,
-                        'customer_id': self.customer_id,
-                        'project_id': self.project_id,
-                    }
+                        "region": self.region,
+                        "customer_id": self.customer_id,
+                        "project_id": self.project_id,
+                    },
                 )
             elif response.status_code == 403:
                 return SIEMConnectionStatus(
                     connected=False,
-                    error='Permission denied. Check service account permissions.',
-                    siem_type='google_secops'
+                    error="Permission denied. Check service account permissions.",
+                    siem_type="google_secops",
                 )
             else:
                 return SIEMConnectionStatus(
                     connected=False,
-                    error=f'API error: {response.status_code} - {response.text[:200]}',
-                    siem_type='google_secops'
+                    error=f"API error: {response.status_code} - {response.text[:200]}",
+                    siem_type="google_secops",
                 )
 
         except requests.exceptions.ConnectionError as e:
             return SIEMConnectionStatus(
                 connected=False,
-                error=f'Connection failed: {str(e)}',
-                siem_type='google_secops'
+                error=f"Connection failed: {str(e)}",
+                siem_type="google_secops",
             )
         except ValueError as e:
             return SIEMConnectionStatus(
                 connected=False,
-                error=f'Configuration error: {str(e)}',
-                siem_type='google_secops'
+                error=f"Configuration error: {str(e)}",
+                siem_type="google_secops",
             )
         except Exception as e:
             return SIEMConnectionStatus(
-                connected=False,
-                error=str(e),
-                siem_type='google_secops'
+                connected=False, error=str(e), siem_type="google_secops"
             )
 
     def get_alerts(
@@ -293,7 +287,7 @@ class GoogleSecOpsSIEMClient(SIEMClient):
         dest_ip: Optional[str] = None,
         rule_ids: Optional[List[str]] = None,
         search_text: Optional[str] = None,
-        limit: int = 100
+        limit: int = 100,
     ) -> List[SIEMAlert]:
         """Query detections/alerts from Google SecOps.
 
@@ -310,27 +304,23 @@ class GoogleSecOpsSIEMClient(SIEMClient):
             List of normalized SIEMAlert objects
         """
         # Format times for Chronicle API (RFC 3339)
-        start_str = start_time.strftime('%Y-%m-%dT%H:%M:%SZ')
-        end_str = end_time.strftime('%Y-%m-%dT%H:%M:%SZ')
+        start_str = start_time.strftime("%Y-%m-%dT%H:%M:%SZ")
+        end_str = end_time.strftime("%Y-%m-%dT%H:%M:%SZ")
 
         # Query detections endpoint
         params = {
-            'start_time': start_str,
-            'end_time': end_str,
-            'page_size': min(limit, 1000),
+            "start_time": start_str,
+            "end_time": end_str,
+            "page_size": min(limit, 1000),
         }
 
-        response = self._request(
-            'GET',
-            '/v1alpha/detect/detections',
-            params=params
-        )
+        response = self._request("GET", "/v1alpha/detect/detections", params=params)
 
         if response.status_code != 200:
             return []
 
         data = response.json()
-        detections = data.get('detections', [])
+        detections = data.get("detections", [])
 
         # Filter and normalize results
         alerts = []
@@ -346,8 +336,10 @@ class GoogleSecOpsSIEMClient(SIEMClient):
                 continue
             if search_text:
                 search_lower = search_text.lower()
-                if (search_lower not in alert.rule_name.lower() and
-                        search_lower not in alert.description.lower()):
+                if (
+                    search_lower not in alert.rule_name.lower()
+                    and search_lower not in alert.description.lower()
+                ):
                     continue
 
             alerts.append(alert)
@@ -367,47 +359,51 @@ class GoogleSecOpsSIEMClient(SIEMClient):
             Normalized SIEMAlert
         """
         # Parse timestamp
-        timestamp_str = detection.get('detectionTime', '')
+        timestamp_str = detection.get("detectionTime", "")
         try:
-            timestamp = datetime.fromisoformat(timestamp_str.replace('Z', '+00:00'))
+            timestamp = datetime.fromisoformat(timestamp_str.replace("Z", "+00:00"))
         except (ValueError, AttributeError):
             timestamp = datetime.now()
 
         # Extract rule info
-        rule_info = detection.get('detection', [{}])[0] if detection.get('detection') else {}
-        rule_id = rule_info.get('ruleId', detection.get('ruleId', ''))
-        rule_name = rule_info.get('ruleName', detection.get('ruleName', rule_id))
+        rule_info = (
+            detection.get("detection", [{}])[0] if detection.get("detection") else {}
+        )
+        rule_id = rule_info.get("ruleId", detection.get("ruleId", ""))
+        rule_name = rule_info.get("ruleName", detection.get("ruleName", rule_id))
 
         # Map severity
-        severity_raw = detection.get('severity', rule_info.get('severity', 'INFORMATIONAL'))
+        severity_raw = detection.get(
+            "severity", rule_info.get("severity", "INFORMATIONAL")
+        )
         severity = self._map_severity(severity_raw)
 
         # Extract IPs from UDM events
         source_ip = None
         dest_ip = None
-        events = detection.get('collectionElements', [])
+        events = detection.get("collectionElements", [])
         for element in events:
-            references = element.get('references', [])
+            references = element.get("references", [])
             for ref in references:
-                event = ref.get('event', {})
-                principal = event.get('principal', {})
-                target = event.get('target', {})
+                event = ref.get("event", {})
+                principal = event.get("principal", {})
+                target = event.get("target", {})
 
-                if not source_ip and principal.get('ip'):
-                    ips = principal.get('ip', [])
+                if not source_ip and principal.get("ip"):
+                    ips = principal.get("ip", [])
                     source_ip = ips[0] if ips else None
 
-                if not dest_ip and target.get('ip'):
-                    ips = target.get('ip', [])
+                if not dest_ip and target.get("ip"):
+                    ips = target.get("ip", [])
                     dest_ip = ips[0] if ips else None
 
         # Extract description
-        description = detection.get('description', rule_info.get('ruleText', ''))
+        description = detection.get("description", rule_info.get("ruleText", ""))
         if not description:
             description = f"Chronicle detection: {rule_name}"
 
         return SIEMAlert(
-            id=detection.get('id', str(hash(str(detection)))[:12]),
+            id=detection.get("id", str(hash(str(detection)))[:12]),
             timestamp=timestamp,
             rule_id=str(rule_id),
             rule_name=str(rule_name),
@@ -424,19 +420,17 @@ class GoogleSecOpsSIEMClient(SIEMClient):
         """Map Chronicle severity to normalized severity."""
         severity_upper = str(severity).upper()
         severity_map = {
-            'CRITICAL': 'critical',
-            'HIGH': 'high',
-            'MEDIUM': 'medium',
-            'LOW': 'low',
-            'INFORMATIONAL': 'info',
-            'INFO': 'info',
+            "CRITICAL": "critical",
+            "HIGH": "high",
+            "MEDIUM": "medium",
+            "LOW": "low",
+            "INFORMATIONAL": "info",
+            "INFO": "info",
         }
-        return severity_map.get(severity_upper, 'info')
+        return severity_map.get(severity_upper, "info")
 
     def get_rules(
-        self,
-        rule_ids: Optional[List[str]] = None,
-        enabled_only: bool = True
+        self, rule_ids: Optional[List[str]] = None, enabled_only: bool = True
     ) -> List[SIEMRule]:
         """Get YARA-L detection rules from Google SecOps.
 
@@ -448,38 +442,40 @@ class GoogleSecOpsSIEMClient(SIEMClient):
             List of normalized SIEMRule objects
         """
         response = self._request(
-            'GET',
-            '/v1alpha/detect/rules',
-            params={'page_size': 1000}
+            "GET", "/v1alpha/detect/rules", params={"page_size": 1000}
         )
 
         if response.status_code != 200:
             return []
 
         data = response.json()
-        raw_rules = data.get('rules', [])
+        raw_rules = data.get("rules", [])
 
         rules = []
         for raw_rule in raw_rules:
-            rule_id = raw_rule.get('ruleId', '')
+            rule_id = raw_rule.get("ruleId", "")
 
             # Filter by rule_ids if provided
             if rule_ids and rule_id not in rule_ids:
                 continue
 
             # Check if enabled
-            is_enabled = raw_rule.get('liveRuleEnabled', True)
+            is_enabled = raw_rule.get("liveRuleEnabled", True)
             if enabled_only and not is_enabled:
                 continue
 
             rule = SIEMRule(
                 id=rule_id,
-                name=raw_rule.get('ruleName', rule_id),
-                description=raw_rule.get('metadata', {}).get('description', ''),
-                severity=self._map_severity(raw_rule.get('metadata', {}).get('severity', '')),
+                name=raw_rule.get("ruleName", rule_id),
+                description=raw_rule.get("metadata", {}).get("description", ""),
+                severity=self._map_severity(
+                    raw_rule.get("metadata", {}).get("severity", "")
+                ),
                 enabled=is_enabled,
-                mitre_tactics=raw_rule.get('metadata', {}).get('mitreTactics', []),
-                mitre_techniques=raw_rule.get('metadata', {}).get('mitreTechniques', []),
+                mitre_tactics=raw_rule.get("metadata", {}).get("mitreTactics", []),
+                mitre_techniques=raw_rule.get("metadata", {}).get(
+                    "mitreTechniques", []
+                ),
                 raw_data=raw_rule,
             )
             rules.append(rule)
@@ -497,11 +493,11 @@ class GoogleSecOpsSIEMClient(SIEMClient):
         """
         # Chronicle/Google SecOps rule recommendations
         recommendations_map = {
-            'nmap': [
+            "nmap": [
                 {
-                    'rule_id': 'network_port_scan',
-                    'rule_name': 'Network Port Scan Detection',
-                    'yaral': '''
+                    "rule_id": "network_port_scan",
+                    "rule_name": "Network Port Scan Detection",
+                    "yaral": """
 rule network_port_scan {
   meta:
     description = "Detects potential port scanning activity"
@@ -513,14 +509,14 @@ rule network_port_scan {
     $src_ip over 5m
   condition:
     #e > 100
-}''',
+}""",
                 },
             ],
-            'hydra': [
+            "hydra": [
                 {
-                    'rule_id': 'brute_force_auth',
-                    'rule_name': 'Brute Force Authentication',
-                    'yaral': '''
+                    "rule_id": "brute_force_auth",
+                    "rule_name": "Brute Force Authentication",
+                    "yaral": """
 rule brute_force_authentication {
   meta:
     description = "Detects brute force login attempts"
@@ -533,14 +529,14 @@ rule brute_force_authentication {
     $src_ip over 5m
   condition:
     #e > 10
-}''',
+}""",
                 },
             ],
-            'sqlmap': [
+            "sqlmap": [
                 {
-                    'rule_id': 'sql_injection',
-                    'rule_name': 'SQL Injection Attempt',
-                    'yaral': '''
+                    "rule_id": "sql_injection",
+                    "rule_name": "SQL Injection Attempt",
+                    "yaral": """
 rule sql_injection_attempt {
   meta:
     description = "Detects SQL injection patterns in requests"
@@ -550,7 +546,7 @@ rule sql_injection_attempt {
     re.regex($e.target.url, `(?i)(union|select|insert|update|delete|drop).*`)
   condition:
     $e
-}''',
+}""",
                 },
             ],
         }
@@ -560,23 +556,19 @@ rule sql_injection_attempt {
 
         return [
             {
-                'rule_id': r['rule_id'],
-                'rule_name': r['rule_name'],
-                'description': f"YARA-L rule for detecting {attack_type}",
-                'severity': 'high',
-                'enabled': False,  # These are recommendations, not deployed
-                'siem_type': 'google_secops',
-                'yaral_rule': r.get('yaral', ''),
+                "rule_id": r["rule_id"],
+                "rule_name": r["rule_name"],
+                "description": f"YARA-L rule for detecting {attack_type}",
+                "severity": "high",
+                "enabled": False,  # These are recommendations, not deployed
+                "siem_type": "google_secops",
+                "yaral_rule": r.get("yaral", ""),
             }
             for r in recommendations
         ]
 
     def search_udm_events(
-        self,
-        query: str,
-        start_time: datetime,
-        end_time: datetime,
-        limit: int = 100
+        self, query: str, start_time: datetime, end_time: datetime, limit: int = 100
     ) -> List[Dict[str, Any]]:
         """Search UDM events with a custom query.
 
@@ -591,24 +583,24 @@ rule sql_injection_attempt {
         Returns:
             List of UDM events
         """
-        start_str = start_time.strftime('%Y-%m-%dT%H:%M:%SZ')
-        end_str = end_time.strftime('%Y-%m-%dT%H:%M:%SZ')
+        start_str = start_time.strftime("%Y-%m-%dT%H:%M:%SZ")
+        end_str = end_time.strftime("%Y-%m-%dT%H:%M:%SZ")
 
         response = self._request(
-            'POST',
-            '/v1alpha/events:udmSearch',
+            "POST",
+            "/v1alpha/events:udmSearch",
             json_data={
-                'query': query,
-                'time_range': {
-                    'start_time': start_str,
-                    'end_time': end_str,
+                "query": query,
+                "time_range": {
+                    "start_time": start_str,
+                    "end_time": end_str,
                 },
-                'limit': limit,
-            }
+                "limit": limit,
+            },
         )
 
         if response.status_code != 200:
             return []
 
         data = response.json()
-        return data.get('events', {}).get('events', [])
+        return data.get("events", {}).get("events", [])

souleyez/integrations/siem/rule_mappings/__init__.py

@@ -7,5 +7,5 @@ Maps attack types to SIEM-specific detection rules.
 from souleyez.integrations.siem.rule_mappings.wazuh_rules import WAZUH_ATTACK_RULES
 
 __all__ = [
-    'WAZUH_ATTACK_RULES',
+    "WAZUH_ATTACK_RULES",
 ]

souleyez/integrations/siem/rule_mappings/wazuh_rules.py

@@ -202,11 +202,14 @@ def get_wazuh_rules_for_attack(attack_type: str) -> Dict[str, Any]:
         Dict with rule_ids, rule_names, detection_guidance
     """
     attack_lower = attack_type.lower()
-    return WAZUH_ATTACK_RULES.get(attack_lower, {
-        "rule_ids": [],
-        "rule_names": {},
-        "detection_guidance": "Review SIEM rule configuration for this attack category.",
-    })
+    return WAZUH_ATTACK_RULES.get(
+        attack_lower,
+        {
+            "rule_ids": [],
+            "rule_names": {},
+            "detection_guidance": "Review SIEM rule configuration for this attack category.",
+        },
+    )
 
 
 def get_all_wazuh_rule_ids() -> List[int]: