souleyez 2.43.28__py3-none-any.whl → 2.43.32__py3-none-any.whl

souleyez/integrations/siem/wazuh.py

@@ -35,7 +35,7 @@ class WazuhSIEMClient(SIEMClient):
         verify_ssl: bool = False,
         indexer_url: Optional[str] = None,
         indexer_user: Optional[str] = None,
-        indexer_password: Optional[str] = None
+        indexer_password: Optional[str] = None,
     ):
         """Initialize Wazuh SIEM client.
 
@@ -57,11 +57,11 @@ class WazuhSIEMClient(SIEMClient):
             verify_ssl=verify_ssl,
             indexer_url=indexer_url,
             indexer_user=indexer_user,
-            indexer_password=indexer_password
+            indexer_password=indexer_password,
         )
 
     @classmethod
-    def from_config(cls, config: Dict[str, Any]) -> 'WazuhSIEMClient':
+    def from_config(cls, config: Dict[str, Any]) -> "WazuhSIEMClient":
         """Create client from configuration dictionary.
 
         Args:
@@ -71,19 +71,19 @@ class WazuhSIEMClient(SIEMClient):
             WazuhSIEMClient instance
         """
         return cls(
-            api_url=config.get('api_url', ''),
-            username=config.get('username', ''),
-            password=config.get('password', ''),
-            verify_ssl=config.get('verify_ssl', False),
-            indexer_url=config.get('indexer_url'),
-            indexer_user=config.get('indexer_user'),
-            indexer_password=config.get('indexer_password'),
+            api_url=config.get("api_url", ""),
+            username=config.get("username", ""),
+            password=config.get("password", ""),
+            verify_ssl=config.get("verify_ssl", False),
+            indexer_url=config.get("indexer_url"),
+            indexer_user=config.get("indexer_user"),
+            indexer_password=config.get("indexer_password"),
         )
 
     @property
     def siem_type(self) -> str:
         """Return the SIEM type identifier."""
-        return 'wazuh'
+        return "wazuh"
 
     def test_connection(self) -> SIEMConnectionStatus:
         """Test connection to Wazuh Manager.
@@ -94,14 +94,14 @@ class WazuhSIEMClient(SIEMClient):
         result = self._client.test_connection()
 
         return SIEMConnectionStatus(
-            connected=result.get('connected', False),
-            version=result.get('version', ''),
-            error=result.get('error', ''),
-            siem_type='wazuh',
+            connected=result.get("connected", False),
+            version=result.get("version", ""),
+            error=result.get("error", ""),
+            siem_type="wazuh",
             details={
-                'hostname': result.get('hostname', ''),
-                'cluster': result.get('cluster', False),
-            }
+                "hostname": result.get("hostname", ""),
+                "cluster": result.get("cluster", False),
+            },
         )
 
     def get_alerts(
@@ -112,7 +112,7 @@ class WazuhSIEMClient(SIEMClient):
         dest_ip: Optional[str] = None,
         rule_ids: Optional[List[str]] = None,
         search_text: Optional[str] = None,
-        limit: int = 100
+        limit: int = 100,
     ) -> List[SIEMAlert]:
         """Query alerts from Wazuh Indexer.
 
@@ -143,7 +143,7 @@ class WazuhSIEMClient(SIEMClient):
             agent_ip=filter_ip,
             rule_ids=int_rule_ids,
             search_text=search_text,
-            limit=limit
+            limit=limit,
         )
 
         return [self._normalize_alert(alert) for alert in raw_alerts]
@@ -158,37 +158,31 @@ class WazuhSIEMClient(SIEMClient):
             Normalized SIEMAlert
         """
         # Extract timestamp
-        timestamp_str = raw_alert.get('timestamp', '')
+        timestamp_str = raw_alert.get("timestamp", "")
         try:
-            timestamp = datetime.fromisoformat(
-                timestamp_str.replace('Z', '+00:00')
-            )
+            timestamp = datetime.fromisoformat(timestamp_str.replace("Z", "+00:00"))
         except (ValueError, AttributeError):
             timestamp = datetime.now()
 
         # Extract rule info
-        rule = raw_alert.get('rule', {})
-        rule_id = str(rule.get('id', ''))
-        rule_name = rule.get('description', '')
-        severity = self._map_level_to_severity(rule.get('level', 0))
+        rule = raw_alert.get("rule", {})
+        rule_id = str(rule.get("id", ""))
+        rule_name = rule.get("description", "")
+        severity = self._map_level_to_severity(rule.get("level", 0))
 
         # Extract IPs from various fields
-        data = raw_alert.get('data', {})
+        data = raw_alert.get("data", {})
         source_ip = (
-            data.get('srcip') or
-            data.get('src_ip') or
-            raw_alert.get('agent', {}).get('ip')
-        )
-        dest_ip = (
-            data.get('dstip') or
-            data.get('dst_ip') or
-            data.get('dstIp')
+            data.get("srcip")
+            or data.get("src_ip")
+            or raw_alert.get("agent", {}).get("ip")
         )
+        dest_ip = data.get("dstip") or data.get("dst_ip") or data.get("dstIp")
 
         # Extract MITRE info
-        mitre = rule.get('mitre', {})
-        mitre_tactics = mitre.get('tactic', [])
-        mitre_techniques = mitre.get('id', [])
+        mitre = rule.get("mitre", {})
+        mitre_tactics = mitre.get("tactic", [])
+        mitre_techniques = mitre.get("id", [])
 
         # Ensure lists
         if isinstance(mitre_tactics, str):
@@ -197,14 +191,14 @@ class WazuhSIEMClient(SIEMClient):
             mitre_techniques = [mitre_techniques]
 
         return SIEMAlert(
-            id=raw_alert.get('_id', raw_alert.get('id', '')),
+            id=raw_alert.get("_id", raw_alert.get("id", "")),
             timestamp=timestamp,
             rule_id=rule_id,
             rule_name=rule_name,
             severity=severity,
             source_ip=source_ip,
             dest_ip=dest_ip,
-            description=rule.get('description', ''),
+            description=rule.get("description", ""),
             raw_data=raw_alert,
             mitre_tactics=mitre_tactics,
             mitre_techniques=mitre_techniques,
@@ -220,18 +214,16 @@ class WazuhSIEMClient(SIEMClient):
         - 12-15: Critical
         """
         if level >= 12:
-            return 'critical'
+            return "critical"
         elif level >= 8:
-            return 'high'
+            return "high"
         elif level >= 4:
-            return 'medium'
+            return "medium"
         else:
-            return 'low'
+            return "low"
 
     def get_rules(
-        self,
-        rule_ids: Optional[List[str]] = None,
-        enabled_only: bool = True
+        self, rule_ids: Optional[List[str]] = None, enabled_only: bool = True
     ) -> List[SIEMRule]:
         """Get detection rules from Wazuh Manager.
 
@@ -252,14 +244,14 @@ class WazuhSIEMClient(SIEMClient):
         rules = []
         for raw_rule in raw_rules:
             # Skip disabled rules if requested
-            status = raw_rule.get('status', 'enabled')
-            if enabled_only and status != 'enabled':
+            status = raw_rule.get("status", "enabled")
+            if enabled_only and status != "enabled":
                 continue
 
             # Extract MITRE info
-            mitre = raw_rule.get('mitre', {})
-            mitre_tactics = mitre.get('tactic', [])
-            mitre_techniques = mitre.get('id', [])
+            mitre = raw_rule.get("mitre", {})
+            mitre_tactics = mitre.get("tactic", [])
+            mitre_techniques = mitre.get("id", [])
 
             if isinstance(mitre_tactics, str):
                 mitre_tactics = [mitre_tactics]
@@ -267,11 +259,11 @@ class WazuhSIEMClient(SIEMClient):
                 mitre_techniques = [mitre_techniques]
 
             rule = SIEMRule(
-                id=str(raw_rule.get('id', '')),
-                name=raw_rule.get('description', ''),
-                description=raw_rule.get('description', ''),
-                severity=self._map_level_to_severity(raw_rule.get('level', 0)),
-                enabled=(status == 'enabled'),
+                id=str(raw_rule.get("id", "")),
+                name=raw_rule.get("description", ""),
+                description=raw_rule.get("description", ""),
+                severity=self._map_level_to_severity(raw_rule.get("level", 0)),
+                enabled=(status == "enabled"),
                 mitre_tactics=mitre_tactics,
                 mitre_techniques=mitre_techniques,
                 raw_data=raw_rule,
@@ -292,18 +284,20 @@ class WazuhSIEMClient(SIEMClient):
         rules_info = get_wazuh_rules_for_attack(attack_type)
         recommendations = []
 
-        rule_ids = rules_info.get('rule_ids', [])
-        rule_names = rules_info.get('rule_names', {})
+        rule_ids = rules_info.get("rule_ids", [])
+        rule_names = rules_info.get("rule_names", {})
 
         for rule_id in rule_ids:
-            recommendations.append({
-                'rule_id': str(rule_id),
-                'rule_name': rule_names.get(rule_id, f'Rule {rule_id}'),
-                'description': f'Wazuh rule for detecting {attack_type} attacks',
-                'severity': 'high',
-                'enabled': True,  # Assume enabled by default
-                'siem_type': 'wazuh',
-            })
+            recommendations.append(
+                {
+                    "rule_id": str(rule_id),
+                    "rule_name": rule_names.get(rule_id, f"Rule {rule_id}"),
+                    "description": f"Wazuh rule for detecting {attack_type} attacks",
+                    "severity": "high",
+                    "enabled": True,  # Assume enabled by default
+                    "siem_type": "wazuh",
+                }
+            )
 
         return recommendations
 
@@ -318,6 +312,6 @@ class WazuhSIEMClient(SIEMClient):
         """
         rules_info = get_wazuh_rules_for_attack(attack_type)
         return rules_info.get(
-            'detection_guidance',
-            'Review SIEM rule configuration for this attack category.'
+            "detection_guidance",
+            "Review SIEM rule configuration for this attack category.",
         )

souleyez/integrations/wazuh/__init__.py

@@ -5,9 +5,9 @@ from .host_mapper import WazuhHostMapper
 from .sync import WazuhVulnSync, SyncResult
 
 __all__ = [
-    'WazuhClient',
-    'WazuhConfig',
-    'WazuhHostMapper',
-    'WazuhVulnSync',
-    'SyncResult'
+    "WazuhClient",
+    "WazuhConfig",
+    "WazuhHostMapper",
+    "WazuhVulnSync",
+    "SyncResult",
 ]