souleyez 2.43.28__py3-none-any.whl → 2.43.32__py3-none-any.whl

souleyez/integrations/siem/elastic.py

@@ -49,8 +49,8 @@ class ElasticSIEMClient(SIEMClient):
             verify_ssl: Verify SSL certificates
             space: Kibana space (default: "default")
         """
-        self.elasticsearch_url = elasticsearch_url.rstrip('/')
-        self.kibana_url = (kibana_url or elasticsearch_url).rstrip('/')
+        self.elasticsearch_url = elasticsearch_url.rstrip("/")
+        self.kibana_url = (kibana_url or elasticsearch_url).rstrip("/")
         self.api_key = api_key
         self.username = username
         self.password = password
@@ -58,7 +58,7 @@ class ElasticSIEMClient(SIEMClient):
         self.space = space
 
     @classmethod
-    def from_config(cls, config: Dict[str, Any]) -> 'ElasticSIEMClient':
+    def from_config(cls, config: Dict[str, Any]) -> "ElasticSIEMClient":
         """Create client from configuration dictionary.
 
         Args:
@@ -68,19 +68,19 @@ class ElasticSIEMClient(SIEMClient):
             ElasticSIEMClient instance
         """
         return cls(
-            elasticsearch_url=config.get('elasticsearch_url', ''),
-            kibana_url=config.get('kibana_url'),
-            api_key=config.get('api_key'),
-            username=config.get('username'),
-            password=config.get('password'),
-            verify_ssl=config.get('verify_ssl', False),
-            space=config.get('space', 'default'),
+            elasticsearch_url=config.get("elasticsearch_url", ""),
+            kibana_url=config.get("kibana_url"),
+            api_key=config.get("api_key"),
+            username=config.get("username"),
+            password=config.get("password"),
+            verify_ssl=config.get("verify_ssl", False),
+            space=config.get("space", "default"),
         )
 
     @property
     def siem_type(self) -> str:
         """Return the SIEM type identifier."""
-        return 'elastic'
+        return "elastic"
 
     def _get_auth(self):
         """Get authentication for requests."""
@@ -93,11 +93,11 @@ class ElasticSIEMClient(SIEMClient):
     def _get_headers(self) -> Dict[str, str]:
         """Get headers for requests."""
         headers = {
-            'Content-Type': 'application/json',
-            'kbn-xsrf': 'true',  # Required for Kibana API
+            "Content-Type": "application/json",
+            "kbn-xsrf": "true",  # Required for Kibana API
         }
         if self.api_key:
-            headers['Authorization'] = f'ApiKey {self.api_key}'
+            headers["Authorization"] = f"ApiKey {self.api_key}"
         return headers
 
     def _es_request(
@@ -124,7 +124,7 @@ class ElasticSIEMClient(SIEMClient):
             auth=self._get_auth(),
             json=json_data,
             verify=self.verify_ssl,
-            timeout=60
+            timeout=60,
         )
 
     def _kibana_request(
@@ -144,7 +144,7 @@ class ElasticSIEMClient(SIEMClient):
             Response object
         """
         # Handle space in URL
-        if self.space != 'default':
+        if self.space != "default":
             url = f"{self.kibana_url}/s/{self.space}{endpoint}"
         else:
             url = f"{self.kibana_url}{endpoint}"
@@ -156,7 +156,7 @@ class ElasticSIEMClient(SIEMClient):
             auth=self._get_auth(),
             json=json_data,
             verify=self.verify_ssl,
-            timeout=60
+            timeout=60,
         )
 
     def test_connection(self) -> SIEMConnectionStatus:
@@ -171,30 +171,28 @@ class ElasticSIEMClient(SIEMClient):
             response.raise_for_status()
             data = response.json()
 
-            version = data.get('version', {}).get('number', 'unknown')
-            cluster_name = data.get('cluster_name', 'unknown')
+            version = data.get("version", {}).get("number", "unknown")
+            cluster_name = data.get("cluster_name", "unknown")
 
             return SIEMConnectionStatus(
                 connected=True,
                 version=version,
-                siem_type='elastic',
+                siem_type="elastic",
                 details={
-                    'cluster_name': cluster_name,
-                    'cluster_uuid': data.get('cluster_uuid', ''),
-                    'tagline': data.get('tagline', ''),
-                }
+                    "cluster_name": cluster_name,
+                    "cluster_uuid": data.get("cluster_uuid", ""),
+                    "tagline": data.get("tagline", ""),
+                },
             )
         except requests.exceptions.ConnectionError as e:
             return SIEMConnectionStatus(
                 connected=False,
                 error=f"Connection failed: {str(e)}",
-                siem_type='elastic'
+                siem_type="elastic",
             )
         except Exception as e:
             return SIEMConnectionStatus(
-                connected=False,
-                error=str(e),
-                siem_type='elastic'
+                connected=False, error=str(e), siem_type="elastic"
             )
 
     def get_alerts(
@@ -205,7 +203,7 @@ class ElasticSIEMClient(SIEMClient):
         dest_ip: Optional[str] = None,
         rule_ids: Optional[List[str]] = None,
         search_text: Optional[str] = None,
-        limit: int = 100
+        limit: int = 100,
     ) -> List[SIEMAlert]:
         """Query alerts from Elastic Security.
 
@@ -227,7 +225,7 @@ class ElasticSIEMClient(SIEMClient):
                 "range": {
                     "@timestamp": {
                         "gte": start_time.isoformat(),
-                        "lte": end_time.isoformat()
+                        "lte": end_time.isoformat(),
                     }
                 }
             }
@@ -235,49 +233,43 @@ class ElasticSIEMClient(SIEMClient):
 
         # IP filters
         if source_ip:
-            must_clauses.append({
-                "multi_match": {
-                    "query": source_ip,
-                    "fields": ["source.ip", "client.ip", "host.ip"]
+            must_clauses.append(
+                {
+                    "multi_match": {
+                        "query": source_ip,
+                        "fields": ["source.ip", "client.ip", "host.ip"],
+                    }
                 }
-            })
+            )
         if dest_ip:
-            must_clauses.append({
-                "multi_match": {
-                    "query": dest_ip,
-                    "fields": ["destination.ip", "server.ip"]
+            must_clauses.append(
+                {
+                    "multi_match": {
+                        "query": dest_ip,
+                        "fields": ["destination.ip", "server.ip"],
+                    }
                 }
-            })
+            )
 
         # Rule ID filter
         if rule_ids:
-            must_clauses.append({
-                "terms": {"signal.rule.id": rule_ids}
-            })
+            must_clauses.append({"terms": {"signal.rule.id": rule_ids}})
 
         # Search text
         if search_text:
-            must_clauses.append({
-                "query_string": {"query": f"*{search_text}*"}
-            })
+            must_clauses.append({"query_string": {"query": f"*{search_text}*"}})
 
         query = {
             "size": limit,
             "sort": [{"@timestamp": {"order": "desc"}}],
-            "query": {
-                "bool": {
-                    "must": must_clauses
-                }
-            }
+            "query": {"bool": {"must": must_clauses}},
         }
 
         # Query the signals index
         index_pattern = f".siem-signals-{self.space}"
         try:
             response = self._es_request(
-                "POST",
-                f"/{index_pattern}/_search",
-                json_data=query
+                "POST", f"/{index_pattern}/_search", json_data=query
             )
 
             if response.status_code == 404:
@@ -286,7 +278,7 @@ class ElasticSIEMClient(SIEMClient):
 
             response.raise_for_status()
             data = response.json()
-            hits = data.get('hits', {}).get('hits', [])
+            hits = data.get("hits", {}).get("hits", [])
             return [self._normalize_alert(hit) for hit in hits]
 
         except requests.exceptions.HTTPError:
@@ -301,61 +293,57 @@ class ElasticSIEMClient(SIEMClient):
         Returns:
             Normalized SIEMAlert
         """
-        source = hit.get('_source', {})
-        signal = source.get('signal', {})
-        rule = signal.get('rule', {})
+        source = hit.get("_source", {})
+        signal = source.get("signal", {})
+        rule = signal.get("rule", {})
 
         # Parse timestamp
-        timestamp_str = source.get('@timestamp', '')
+        timestamp_str = source.get("@timestamp", "")
         try:
-            timestamp = datetime.fromisoformat(
-                timestamp_str.replace('Z', '+00:00')
-            )
+            timestamp = datetime.fromisoformat(timestamp_str.replace("Z", "+00:00"))
         except (ValueError, AttributeError):
             timestamp = datetime.now()
 
         # Extract rule info
-        rule_id = rule.get('id', '')
-        rule_name = rule.get('name', '')
-        severity = rule.get('severity', 'low')
+        rule_id = rule.get("id", "")
+        rule_name = rule.get("name", "")
+        severity = rule.get("severity", "low")
 
         # Extract IPs
-        source_data = source.get('source', {})
-        dest_data = source.get('destination', {})
-        source_ip = source_data.get('ip')
-        dest_ip = dest_data.get('ip')
+        source_data = source.get("source", {})
+        dest_data = source.get("destination", {})
+        source_ip = source_data.get("ip")
+        dest_ip = dest_data.get("ip")
 
         # Extract MITRE info
-        threats = rule.get('threat', [])
+        threats = rule.get("threat", [])
         mitre_tactics = []
         mitre_techniques = []
         for threat in threats:
-            if threat.get('framework') == 'MITRE ATT&CK':
-                tactic = threat.get('tactic', {})
-                if tactic.get('name'):
-                    mitre_tactics.append(tactic.get('name'))
-                for technique in threat.get('technique', []):
-                    if technique.get('id'):
-                        mitre_techniques.append(technique.get('id'))
+            if threat.get("framework") == "MITRE ATT&CK":
+                tactic = threat.get("tactic", {})
+                if tactic.get("name"):
+                    mitre_tactics.append(tactic.get("name"))
+                for technique in threat.get("technique", []):
+                    if technique.get("id"):
+                        mitre_techniques.append(technique.get("id"))
 
         return SIEMAlert(
-            id=hit.get('_id', ''),
+            id=hit.get("_id", ""),
             timestamp=timestamp,
             rule_id=rule_id,
             rule_name=rule_name,
             severity=severity,
             source_ip=source_ip,
             dest_ip=dest_ip,
-            description=rule.get('description', ''),
+            description=rule.get("description", ""),
             raw_data=source,
             mitre_tactics=mitre_tactics,
             mitre_techniques=mitre_techniques,
         )
 
     def get_rules(
-        self,
-        rule_ids: Optional[List[str]] = None,
-        enabled_only: bool = True
+        self, rule_ids: Optional[List[str]] = None, enabled_only: bool = True
     ) -> List[SIEMRule]:
         """Get detection rules from Elastic Security.
 
@@ -368,52 +356,50 @@ class ElasticSIEMClient(SIEMClient):
         """
         # Use Kibana Detection Engine API
         params = {
-            'page': 1,
-            'per_page': 500,
+            "page": 1,
+            "per_page": 500,
         }
 
         try:
             response = self._kibana_request(
-                "GET",
-                "/api/detection_engine/rules/_find",
-                json_data=params
+                "GET", "/api/detection_engine/rules/_find", json_data=params
             )
 
             if response.status_code != 200:
                 return []
 
             data = response.json()
-            raw_rules = data.get('data', [])
+            raw_rules = data.get("data", [])
 
             rules = []
             for raw_rule in raw_rules:
                 # Filter by rule_ids if provided
-                if rule_ids and raw_rule.get('id') not in rule_ids:
+                if rule_ids and raw_rule.get("id") not in rule_ids:
                     continue
 
                 # Filter disabled if requested
-                if enabled_only and not raw_rule.get('enabled', True):
+                if enabled_only and not raw_rule.get("enabled", True):
                     continue
 
                 # Extract MITRE info
-                threats = raw_rule.get('threat', [])
+                threats = raw_rule.get("threat", [])
                 mitre_tactics = []
                 mitre_techniques = []
                 for threat in threats:
-                    if threat.get('framework') == 'MITRE ATT&CK':
-                        tactic = threat.get('tactic', {})
-                        if tactic.get('name'):
-                            mitre_tactics.append(tactic.get('name'))
-                        for technique in threat.get('technique', []):
-                            if technique.get('id'):
-                                mitre_techniques.append(technique.get('id'))
+                    if threat.get("framework") == "MITRE ATT&CK":
+                        tactic = threat.get("tactic", {})
+                        if tactic.get("name"):
+                            mitre_tactics.append(tactic.get("name"))
+                        for technique in threat.get("technique", []):
+                            if technique.get("id"):
+                                mitre_techniques.append(technique.get("id"))
 
                 rule = SIEMRule(
-                    id=raw_rule.get('id', ''),
-                    name=raw_rule.get('name', ''),
-                    description=raw_rule.get('description', ''),
-                    severity=raw_rule.get('severity', 'low'),
-                    enabled=raw_rule.get('enabled', True),
+                    id=raw_rule.get("id", ""),
+                    name=raw_rule.get("name", ""),
+                    description=raw_rule.get("description", ""),
+                    severity=raw_rule.get("severity", "low"),
+                    enabled=raw_rule.get("enabled", True),
                     mitre_tactics=mitre_tactics,
                     mitre_techniques=mitre_techniques,
                     raw_data=raw_rule,
@@ -436,25 +422,25 @@ class ElasticSIEMClient(SIEMClient):
         """
         # Elastic Security prebuilt rule recommendations
         recommendations_map = {
-            'nmap': [
+            "nmap": [
                 {
-                    'rule_id': 'port-scan-activity',
-                    'rule_name': 'Network Port Scan Activity',
-                    'index': 'filebeat-*,packetbeat-*',
+                    "rule_id": "port-scan-activity",
+                    "rule_name": "Network Port Scan Activity",
+                    "index": "filebeat-*,packetbeat-*",
                 },
             ],
-            'hydra': [
+            "hydra": [
                 {
-                    'rule_id': 'brute-force-ssh',
-                    'rule_name': 'SSH Brute Force Attempt',
-                    'index': 'auditbeat-*,filebeat-*',
+                    "rule_id": "brute-force-ssh",
+                    "rule_name": "SSH Brute Force Attempt",
+                    "index": "auditbeat-*,filebeat-*",
                 },
             ],
-            'sqlmap': [
+            "sqlmap": [
                 {
-                    'rule_id': 'sql-injection-attack',
-                    'rule_name': 'SQL Injection Attempt',
-                    'index': 'filebeat-*',
+                    "rule_id": "sql-injection-attack",
+                    "rule_name": "SQL Injection Attempt",
+                    "index": "filebeat-*",
                 },
             ],
         }
@@ -464,13 +450,13 @@ class ElasticSIEMClient(SIEMClient):
 
         return [
             {
-                'rule_id': r['rule_id'],
-                'rule_name': r['rule_name'],
-                'description': f"Elastic detection rule for {attack_type}",
-                'severity': 'high',
-                'enabled': True,
-                'siem_type': 'elastic',
-                'index_pattern': r.get('index', ''),
+                "rule_id": r["rule_id"],
+                "rule_name": r["rule_name"],
+                "description": f"Elastic detection rule for {attack_type}",
+                "severity": "high",
+                "enabled": True,
+                "siem_type": "elastic",
+                "index_pattern": r.get("index", ""),
             }
             for r in recommendations
         ]