souleyez 2.43.29__py3-none-any.whl → 3.0.0__py3-none-any.whl

souleyez/integrations/siem/sentinel.py

@@ -60,8 +60,12 @@ class SentinelSIEMClient(SIEMClient):
         self._token_expiry: Optional[datetime] = None
 
         # Azure endpoints
-        self.login_url = f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token"
-        self.log_analytics_url = f"https://api.loganalytics.io/v1/workspaces/{workspace_id}"
+        self.login_url = (
+            f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token"
+        )
+        self.log_analytics_url = (
+            f"https://api.loganalytics.io/v1/workspaces/{workspace_id}"
+        )
         self.management_base = "https://management.azure.com"
         self.sentinel_base = (
             f"{self.management_base}/subscriptions/{subscription_id}"
@@ -71,7 +75,7 @@ class SentinelSIEMClient(SIEMClient):
         )
 
     @classmethod
-    def from_config(cls, config: Dict[str, Any]) -> 'SentinelSIEMClient':
+    def from_config(cls, config: Dict[str, Any]) -> "SentinelSIEMClient":
         """Create client from configuration dictionary.
 
         Args:
@@ -81,21 +85,23 @@ class SentinelSIEMClient(SIEMClient):
             SentinelSIEMClient instance
         """
         return cls(
-            tenant_id=config.get('tenant_id', ''),
-            client_id=config.get('client_id', ''),
-            client_secret=config.get('client_secret', ''),
-            subscription_id=config.get('subscription_id', ''),
-            resource_group=config.get('resource_group', ''),
-            workspace_name=config.get('workspace_name', ''),
-            workspace_id=config.get('workspace_id', ''),
+            tenant_id=config.get("tenant_id", ""),
+            client_id=config.get("client_id", ""),
+            client_secret=config.get("client_secret", ""),
+            subscription_id=config.get("subscription_id", ""),
+            resource_group=config.get("resource_group", ""),
+            workspace_name=config.get("workspace_name", ""),
+            workspace_id=config.get("workspace_id", ""),
         )
 
     @property
     def siem_type(self) -> str:
         """Return the SIEM type identifier."""
-        return 'sentinel'
+        return "sentinel"
 
-    def _get_access_token(self, scope: str = "https://api.loganalytics.io/.default") -> str:
+    def _get_access_token(
+        self, scope: str = "https://api.loganalytics.io/.default"
+    ) -> str:
         """Get Azure AD access token.
 
         Args:
@@ -111,22 +117,18 @@ class SentinelSIEMClient(SIEMClient):
 
         # Request new token
         data = {
-            'grant_type': 'client_credentials',
-            'client_id': self.client_id,
-            'client_secret': self.client_secret,
-            'scope': scope,
+            "grant_type": "client_credentials",
+            "client_id": self.client_id,
+            "client_secret": self.client_secret,
+            "scope": scope,
         }
 
-        response = requests.post(
-            self.login_url,
-            data=data,
-            timeout=30
-        )
+        response = requests.post(self.login_url, data=data, timeout=30)
         response.raise_for_status()
 
         token_data = response.json()
-        self._access_token = token_data['access_token']
-        expires_in = token_data.get('expires_in', 3600)
+        self._access_token = token_data["access_token"]
+        expires_in = token_data.get("expires_in", 3600)
         self._token_expiry = datetime.now() + timedelta(seconds=expires_in - 60)
 
         return self._access_token
@@ -143,28 +145,28 @@ class SentinelSIEMClient(SIEMClient):
         token = self._get_access_token("https://api.loganalytics.io/.default")
 
         headers = {
-            'Authorization': f'Bearer {token}',
-            'Content-Type': 'application/json',
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
         }
 
         response = requests.post(
             f"{self.log_analytics_url}/query",
             headers=headers,
-            json={'query': kql},
-            timeout=60
+            json={"query": kql},
+            timeout=60,
         )
         response.raise_for_status()
 
         data = response.json()
-        tables = data.get('tables', [])
+        tables = data.get("tables", [])
 
         if not tables:
             return []
 
         # Convert first table to list of dicts
         table = tables[0]
-        columns = [col['name'] for col in table.get('columns', [])]
-        rows = table.get('rows', [])
+        columns = [col["name"] for col in table.get("columns", [])]
+        rows = table.get("rows", [])
 
         return [dict(zip(columns, row)) for row in rows]
 
@@ -187,18 +189,14 @@ class SentinelSIEMClient(SIEMClient):
         token = self._get_access_token("https://management.azure.com/.default")
 
         headers = {
-            'Authorization': f'Bearer {token}',
-            'Content-Type': 'application/json',
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
         }
 
         url = f"{self.sentinel_base}{endpoint}?api-version=2023-02-01"
 
         return requests.request(
-            method=method,
-            url=url,
-            headers=headers,
-            json=json_data,
-            timeout=60
+            method=method, url=url, headers=headers, json=json_data, timeout=60
         )
 
     def test_connection(self) -> SIEMConnectionStatus:
@@ -214,32 +212,30 @@ class SentinelSIEMClient(SIEMClient):
             if result:
                 return SIEMConnectionStatus(
                     connected=True,
-                    version='Azure Sentinel',
-                    siem_type='sentinel',
+                    version="Azure Sentinel",
+                    siem_type="sentinel",
                     details={
-                        'workspace_id': self.workspace_id,
-                        'workspace_name': self.workspace_name,
-                        'subscription': self.subscription_id,
-                    }
+                        "workspace_id": self.workspace_id,
+                        "workspace_name": self.workspace_name,
+                        "subscription": self.subscription_id,
+                    },
                 )
             else:
                 return SIEMConnectionStatus(
                     connected=False,
-                    error='Query returned no results',
-                    siem_type='sentinel'
+                    error="Query returned no results",
+                    siem_type="sentinel",
                 )
 
         except requests.exceptions.ConnectionError as e:
             return SIEMConnectionStatus(
                 connected=False,
                 error=f"Connection failed: {str(e)}",
-                siem_type='sentinel'
+                siem_type="sentinel",
             )
         except Exception as e:
             return SIEMConnectionStatus(
-                connected=False,
-                error=str(e),
-                siem_type='sentinel'
+                connected=False, error=str(e), siem_type="sentinel"
             )
 
     def get_alerts(
@@ -250,7 +246,7 @@ class SentinelSIEMClient(SIEMClient):
         dest_ip: Optional[str] = None,
         rule_ids: Optional[List[str]] = None,
         search_text: Optional[str] = None,
-        limit: int = 100
+        limit: int = 100,
     ) -> List[SIEMAlert]:
         """Query alerts from Microsoft Sentinel.
 
@@ -280,21 +276,23 @@ class SentinelSIEMClient(SIEMClient):
 
         # Rule ID filter
         if rule_ids:
-            rule_filter = ' or '.join(f'AlertName == "{r}"' for r in rule_ids)
-            kql_parts.append(f'| where {rule_filter}')
+            rule_filter = " or ".join(f'AlertName == "{r}"' for r in rule_ids)
+            kql_parts.append(f"| where {rule_filter}")
 
         # Search text
         if search_text:
             kql_parts.append(f'| where * contains "{search_text}"')
 
         # Limit and project
-        kql_parts.extend([
-            f"| take {limit}",
-            "| project TimeGenerated, AlertName, AlertSeverity, Description, "
-            "Tactics, Entities, ExtendedProperties, ProviderName, SystemAlertId"
-        ])
+        kql_parts.extend(
+            [
+                f"| take {limit}",
+                "| project TimeGenerated, AlertName, AlertSeverity, Description, "
+                "Tactics, Entities, ExtendedProperties, ProviderName, SystemAlertId",
+            ]
+        )
 
-        kql = '\n'.join(kql_parts)
+        kql = "\n".join(kql_parts)
 
         try:
             results = self._log_analytics_query(kql)
@@ -314,26 +312,24 @@ class SentinelSIEMClient(SIEMClient):
         import json
 
         # Parse timestamp
-        timestamp_str = raw_alert.get('TimeGenerated', '')
+        timestamp_str = raw_alert.get("TimeGenerated", "")
         try:
-            timestamp = datetime.fromisoformat(
-                timestamp_str.replace('Z', '+00:00')
-            )
+            timestamp = datetime.fromisoformat(timestamp_str.replace("Z", "+00:00"))
         except (ValueError, AttributeError):
             timestamp = datetime.now()
 
         # Map severity
-        severity = self._map_severity(raw_alert.get('AlertSeverity', ''))
+        severity = self._map_severity(raw_alert.get("AlertSeverity", ""))
 
         # Parse entities for IPs
         source_ip = None
         dest_ip = None
-        entities_str = raw_alert.get('Entities', '[]')
+        entities_str = raw_alert.get("Entities", "[]")
         try:
             entities = json.loads(entities_str) if entities_str else []
             for entity in entities:
-                if entity.get('Type') == 'ip':
-                    addr = entity.get('Address', '')
+                if entity.get("Type") == "ip":
+                    addr = entity.get("Address", "")
                     if not source_ip:
                         source_ip = addr
                     elif not dest_ip:
@@ -342,23 +338,27 @@ class SentinelSIEMClient(SIEMClient):
             pass
 
         # Parse tactics
-        tactics_str = raw_alert.get('Tactics', '')
+        tactics_str = raw_alert.get("Tactics", "")
         mitre_tactics = []
         if tactics_str:
             try:
-                mitre_tactics = json.loads(tactics_str) if tactics_str.startswith('[') else [tactics_str]
+                mitre_tactics = (
+                    json.loads(tactics_str)
+                    if tactics_str.startswith("[")
+                    else [tactics_str]
+                )
             except json.JSONDecodeError:
                 mitre_tactics = [tactics_str] if tactics_str else []
 
         return SIEMAlert(
-            id=raw_alert.get('SystemAlertId', ''),
+            id=raw_alert.get("SystemAlertId", ""),
             timestamp=timestamp,
-            rule_id=raw_alert.get('AlertName', ''),
-            rule_name=raw_alert.get('AlertName', ''),
+            rule_id=raw_alert.get("AlertName", ""),
+            rule_name=raw_alert.get("AlertName", ""),
             severity=severity,
             source_ip=source_ip,
             dest_ip=dest_ip,
-            description=raw_alert.get('Description', ''),
+            description=raw_alert.get("Description", ""),
             raw_data=raw_alert,
             mitre_tactics=mitre_tactics,
             mitre_techniques=[],
@@ -367,18 +367,16 @@ class SentinelSIEMClient(SIEMClient):
     def _map_severity(self, severity: str) -> str:
         """Map Sentinel severity to normalized severity."""
         severity_lower = str(severity).lower()
-        if severity_lower == 'high':
-            return 'critical'
-        elif severity_lower == 'medium':
-            return 'high'
-        elif severity_lower == 'low':
-            return 'medium'
-        return 'low'
+        if severity_lower == "high":
+            return "critical"
+        elif severity_lower == "medium":
+            return "high"
+        elif severity_lower == "low":
+            return "medium"
+        return "low"
 
     def get_rules(
-        self,
-        rule_ids: Optional[List[str]] = None,
-        enabled_only: bool = True
+        self, rule_ids: Optional[List[str]] = None, enabled_only: bool = True
     ) -> List[SIEMRule]:
         """Get analytics rules from Microsoft Sentinel.
 
@@ -396,30 +394,30 @@ class SentinelSIEMClient(SIEMClient):
                 return []
 
             data = response.json()
-            raw_rules = data.get('value', [])
+            raw_rules = data.get("value", [])
 
             rules = []
             for raw_rule in raw_rules:
-                properties = raw_rule.get('properties', {})
+                properties = raw_rule.get("properties", {})
 
                 # Filter by rule_ids if provided
-                rule_id = raw_rule.get('name', '')
+                rule_id = raw_rule.get("name", "")
                 if rule_ids and rule_id not in rule_ids:
                     continue
 
                 # Filter disabled if requested
-                enabled = properties.get('enabled', True)
+                enabled = properties.get("enabled", True)
                 if enabled_only and not enabled:
                     continue
 
                 # Extract MITRE tactics
-                mitre_tactics = properties.get('tactics', [])
+                mitre_tactics = properties.get("tactics", [])
 
                 rule = SIEMRule(
                     id=rule_id,
-                    name=properties.get('displayName', ''),
-                    description=properties.get('description', ''),
-                    severity=self._map_severity(properties.get('severity', '')),
+                    name=properties.get("displayName", ""),
+                    description=properties.get("description", ""),
+                    severity=self._map_severity(properties.get("severity", "")),
                     enabled=enabled,
                     mitre_tactics=mitre_tactics,
                     mitre_techniques=[],
@@ -443,25 +441,25 @@ class SentinelSIEMClient(SIEMClient):
         """
         # Sentinel content hub rule templates
         recommendations_map = {
-            'nmap': [
+            "nmap": [
                 {
-                    'rule_id': 'port-scan-detection',
-                    'rule_name': 'Potential Port Scan Detection',
-                    'kql': 'AzureFirewall | where Action == "Deny" | summarize count() by SourceIP | where count_ > 100',
+                    "rule_id": "port-scan-detection",
+                    "rule_name": "Potential Port Scan Detection",
+                    "kql": 'AzureFirewall | where Action == "Deny" | summarize count() by SourceIP | where count_ > 100',
                 },
             ],
-            'hydra': [
+            "hydra": [
                 {
-                    'rule_id': 'brute-force-detection',
-                    'rule_name': 'Brute Force Attack Detection',
-                    'kql': 'SigninLogs | where ResultType != 0 | summarize count() by IPAddress | where count_ > 10',
+                    "rule_id": "brute-force-detection",
+                    "rule_name": "Brute Force Attack Detection",
+                    "kql": "SigninLogs | where ResultType != 0 | summarize count() by IPAddress | where count_ > 10",
                 },
             ],
-            'sqlmap': [
+            "sqlmap": [
                 {
-                    'rule_id': 'sql-injection-detection',
-                    'rule_name': 'SQL Injection Attack Detection',
-                    'kql': 'AzureDiagnostics | where Category == "SQLSecurityAuditEvents" | where action_name_s == "BATCH COMPLETED"',
+                    "rule_id": "sql-injection-detection",
+                    "rule_name": "SQL Injection Attack Detection",
+                    "kql": 'AzureDiagnostics | where Category == "SQLSecurityAuditEvents" | where action_name_s == "BATCH COMPLETED"',
                 },
             ],
         }
@@ -471,13 +469,13 @@ class SentinelSIEMClient(SIEMClient):
 
         return [
             {
-                'rule_id': r['rule_id'],
-                'rule_name': r['rule_name'],
-                'description': f"Sentinel analytics rule for {attack_type}",
-                'severity': 'high',
-                'enabled': True,
-                'siem_type': 'sentinel',
-                'kql_query': r.get('kql', ''),
+                "rule_id": r["rule_id"],
+                "rule_name": r["rule_name"],
+                "description": f"Sentinel analytics rule for {attack_type}",
+                "severity": "high",
+                "enabled": True,
+                "siem_type": "sentinel",
+                "kql_query": r.get("kql", ""),
             }
             for r in recommendations
         ]