synapse 2.155.0__py311-none-any.whl → 2.156.0__py311-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of synapse might be problematic. Click here for more details.
- synapse/cmds/cortex.py +2 -14
- synapse/common.py +1 -28
- synapse/cortex.py +10 -510
- synapse/lib/ast.py +60 -1
- synapse/lib/cell.py +33 -8
- synapse/lib/certdir.py +11 -0
- synapse/lib/cmdr.py +0 -5
- synapse/lib/gis.py +2 -2
- synapse/lib/httpapi.py +1 -43
- synapse/lib/layer.py +64 -201
- synapse/lib/lmdbslab.py +11 -0
- synapse/lib/node.py +1 -3
- synapse/lib/parser.py +10 -0
- synapse/lib/snap.py +121 -21
- synapse/lib/storm.lark +23 -6
- synapse/lib/storm.py +15 -338
- synapse/lib/storm_format.py +5 -0
- synapse/lib/stormlib/gen.py +1 -2
- synapse/lib/stormlib/gis.py +41 -0
- synapse/lib/stormlib/stats.py +21 -2
- synapse/lib/stormlib/storm.py +16 -1
- synapse/lib/stormtypes.py +225 -12
- synapse/lib/version.py +2 -2
- synapse/lib/view.py +96 -21
- synapse/models/inet.py +60 -30
- synapse/models/infotech.py +56 -1
- synapse/models/orgs.py +3 -0
- synapse/models/risk.py +15 -0
- synapse/models/syn.py +0 -38
- synapse/tests/test_cmds_cortex.py +1 -1
- synapse/tests/test_cortex.py +32 -336
- synapse/tests/test_lib_agenda.py +19 -54
- synapse/tests/test_lib_aha.py +97 -0
- synapse/tests/test_lib_ast.py +402 -0
- synapse/tests/test_lib_grammar.py +30 -10
- synapse/tests/test_lib_httpapi.py +0 -46
- synapse/tests/test_lib_layer.py +19 -234
- synapse/tests/test_lib_lmdbslab.py +22 -0
- synapse/tests/test_lib_snap.py +9 -0
- synapse/tests/test_lib_storm.py +16 -309
- synapse/tests/test_lib_stormlib_gis.py +21 -0
- synapse/tests/test_lib_stormlib_stats.py +107 -20
- synapse/tests/test_lib_stormlib_storm.py +25 -0
- synapse/tests/test_lib_stormtypes.py +231 -8
- synapse/tests/test_lib_view.py +6 -13
- synapse/tests/test_model_base.py +1 -1
- synapse/tests/test_model_inet.py +15 -0
- synapse/tests/test_model_infotech.py +60 -0
- synapse/tests/test_model_orgs.py +10 -0
- synapse/tests/test_model_person.py +0 -3
- synapse/tests/test_model_risk.py +20 -0
- synapse/tests/test_model_syn.py +20 -34
- synapse/tests/test_tools_csvtool.py +2 -1
- synapse/tests/test_tools_feed.py +4 -30
- synapse/tools/csvtool.py +2 -1
- {synapse-2.155.0.dist-info → synapse-2.156.0.dist-info}/METADATA +3 -3
- {synapse-2.155.0.dist-info → synapse-2.156.0.dist-info}/RECORD +60 -62
- {synapse-2.155.0.dist-info → synapse-2.156.0.dist-info}/WHEEL +1 -1
- synapse/cmds/cron.py +0 -726
- synapse/cmds/trigger.py +0 -319
- synapse/tests/test_cmds_cron.py +0 -453
- synapse/tests/test_cmds_trigger.py +0 -176
- {synapse-2.155.0.dist-info → synapse-2.156.0.dist-info}/LICENSE +0 -0
- {synapse-2.155.0.dist-info → synapse-2.156.0.dist-info}/top_level.txt +0 -0
synapse/cmds/trigger.py
DELETED
|
@@ -1,319 +0,0 @@
|
|
|
1
|
-
import functools
|
|
2
|
-
|
|
3
|
-
import synapse.exc as s_exc
|
|
4
|
-
import synapse.common as s_common
|
|
5
|
-
|
|
6
|
-
import synapse.lib.cli as s_cli
|
|
7
|
-
import synapse.lib.cmd as s_cmd
|
|
8
|
-
import synapse.lib.parser as s_parser
|
|
9
|
-
import synapse.lib.trigger as s_trigger
|
|
10
|
-
|
|
11
|
-
AddHelp = '''
|
|
12
|
-
Add triggers in a cortex.
|
|
13
|
-
|
|
14
|
-
Syntax: trigger add condition <object> [#tag] query
|
|
15
|
-
|
|
16
|
-
Notes:
|
|
17
|
-
Valid values for condition are:
|
|
18
|
-
* tag:add
|
|
19
|
-
* tag:del
|
|
20
|
-
* node:add
|
|
21
|
-
* node:del
|
|
22
|
-
* prop:set
|
|
23
|
-
|
|
24
|
-
When condition is tag:add or tag:del, you may optionally provide a form name
|
|
25
|
-
to restrict the trigger to fire only on tags added or deleted from nodes of
|
|
26
|
-
those forms.
|
|
27
|
-
|
|
28
|
-
Tag names must start with #.
|
|
29
|
-
|
|
30
|
-
The added tag is provided to the query as an embedded variable '$tag'.
|
|
31
|
-
|
|
32
|
-
Simple one level tag globbing is supported, only at the end after a period,
|
|
33
|
-
that is aka.* matches aka.foo and aka.bar but not aka.foo.bar. aka* is not
|
|
34
|
-
supported.
|
|
35
|
-
|
|
36
|
-
Examples:
|
|
37
|
-
# Adds a tag to every inet:ipv4 added
|
|
38
|
-
trigger add node:add inet:ipv4 {[ +#mytag ]}
|
|
39
|
-
|
|
40
|
-
# Adds a tag #todo to every node as it is tagged #aka
|
|
41
|
-
trigger add tag:add #aka {[ +#todo ]}
|
|
42
|
-
|
|
43
|
-
# Adds a tag #todo to every inet:ipv4 as it is tagged #aka
|
|
44
|
-
trigger add tag:add inet:ipv4 #aka {[ +#todo ]}
|
|
45
|
-
'''
|
|
46
|
-
|
|
47
|
-
ListHelp = '''
|
|
48
|
-
List existing triggers in a cortex.
|
|
49
|
-
|
|
50
|
-
Syntax:
|
|
51
|
-
trigger list
|
|
52
|
-
|
|
53
|
-
Example:
|
|
54
|
-
cli> trigger list
|
|
55
|
-
user iden en? cond object storm query
|
|
56
|
-
root 607e9d97.. Y prop:set test:type10.intprop [test:int=6]
|
|
57
|
-
|
|
58
|
-
'''
|
|
59
|
-
|
|
60
|
-
DelHelp = '''
|
|
61
|
-
Delete an existing trigger.
|
|
62
|
-
|
|
63
|
-
Syntax:
|
|
64
|
-
trigger del <iden prefix>
|
|
65
|
-
|
|
66
|
-
Notes:
|
|
67
|
-
Any prefix that matches exactly one valid trigger iden is accepted.
|
|
68
|
-
'''
|
|
69
|
-
|
|
70
|
-
ModHelp = '''
|
|
71
|
-
Changes an existing trigger's query.
|
|
72
|
-
|
|
73
|
-
Syntax:
|
|
74
|
-
trigger mod <iden prefix> <new query>
|
|
75
|
-
|
|
76
|
-
Notes:
|
|
77
|
-
Any prefix that matches exactly one valid trigger iden is accepted.
|
|
78
|
-
'''
|
|
79
|
-
|
|
80
|
-
EnableHelp = '''
|
|
81
|
-
Enable an existing trigger.
|
|
82
|
-
|
|
83
|
-
Syntax:
|
|
84
|
-
trigger enable <iden prefix>
|
|
85
|
-
|
|
86
|
-
Notes:
|
|
87
|
-
Any prefix that matches exactly one valid trigger iden is accepted.
|
|
88
|
-
'''
|
|
89
|
-
|
|
90
|
-
DisableHelp = '''
|
|
91
|
-
Disable an existing trigger.
|
|
92
|
-
|
|
93
|
-
Syntax:
|
|
94
|
-
trigger disable <iden prefix>
|
|
95
|
-
|
|
96
|
-
Notes:
|
|
97
|
-
Any prefix that matches exactly one valid trigger is accepted.
|
|
98
|
-
'''
|
|
99
|
-
|
|
100
|
-
class Trigger(s_cli.Cmd):
|
|
101
|
-
'''
|
|
102
|
-
Manipulate triggers in a cortex.
|
|
103
|
-
|
|
104
|
-
Triggers are rules persistently stored in a cortex such that storm queries
|
|
105
|
-
automatically run when a particular event happens.
|
|
106
|
-
|
|
107
|
-
A subcommand is required. Use `trigger -h` for more detailed help.
|
|
108
|
-
'''
|
|
109
|
-
_cmd_name = 'trigger'
|
|
110
|
-
|
|
111
|
-
_cmd_syntax = (('line', {'type': 'glob'}),) # type: ignore
|
|
112
|
-
|
|
113
|
-
async def _match_idens(self, core, prefix, view=None):
|
|
114
|
-
'''
|
|
115
|
-
Returns the iden that starts with prefix. Prints out error and returns None if it doesn't match
|
|
116
|
-
exactly one.
|
|
117
|
-
'''
|
|
118
|
-
triglist = await self._get_list(core, view)
|
|
119
|
-
matches = [trig['iden'] for trig in triglist if trig['iden'].startswith(prefix)]
|
|
120
|
-
if len(matches) == 1:
|
|
121
|
-
return matches[0]
|
|
122
|
-
elif len(matches) == 0:
|
|
123
|
-
self.printf('Error: provided iden does not match any valid authorized triggers')
|
|
124
|
-
else:
|
|
125
|
-
self.printf('Error: provided iden matches more than one trigger')
|
|
126
|
-
return None
|
|
127
|
-
|
|
128
|
-
def _make_argparser(self):
|
|
129
|
-
|
|
130
|
-
parser = s_cmd.Parser(prog='trigger', outp=self, description=self.__doc__)
|
|
131
|
-
help = 'The iden of the view where the trigger is/will be applied. Defaults to the cortex default view.'
|
|
132
|
-
parser.add_argument('--view', type=str, default=None, help=help)
|
|
133
|
-
|
|
134
|
-
subparsers = parser.add_subparsers(title='subcommands', required=True, dest='cmd',
|
|
135
|
-
parser_class=functools.partial(s_cmd.Parser, outp=self))
|
|
136
|
-
|
|
137
|
-
subparsers.add_parser('list', help="List triggers you're allowed to manipulate", usage=ListHelp)
|
|
138
|
-
|
|
139
|
-
parser_add = subparsers.add_parser('add', help='add a trigger', usage=AddHelp)
|
|
140
|
-
parser_add.add_argument('condition', choices=s_trigger.Conditions, type=str.lower,
|
|
141
|
-
help='Condition on which to trigger')
|
|
142
|
-
parser_add.add_argument('--disabled', action='store_true', help='Create the trigger in disabled state')
|
|
143
|
-
parser_add.add_argument('args', metavar='arguments', nargs='+', help='[form] [#tag] [prop] {query}')
|
|
144
|
-
|
|
145
|
-
parser_del = subparsers.add_parser('del', help='delete a trigger', usage=DelHelp)
|
|
146
|
-
parser_del.add_argument('prefix', help='Trigger iden prefix')
|
|
147
|
-
|
|
148
|
-
parser_mod = subparsers.add_parser('mod', help='change an existing trigger query', usage=ModHelp)
|
|
149
|
-
parser_mod.add_argument('prefix', help='Trigger iden prefix')
|
|
150
|
-
parser_mod.add_argument('query', help='Storm query in curly braces')
|
|
151
|
-
|
|
152
|
-
parser_en = subparsers.add_parser('enable', help='enable an existing trigger', usage=EnableHelp)
|
|
153
|
-
parser_en.add_argument('prefix', help='trigger iden prefix')
|
|
154
|
-
|
|
155
|
-
parser_dis = subparsers.add_parser('disable', help='disable an existing trigger', usage=DisableHelp)
|
|
156
|
-
parser_dis.add_argument('prefix', help='trigger iden prefix')
|
|
157
|
-
|
|
158
|
-
return parser
|
|
159
|
-
|
|
160
|
-
async def _handle_add(self, core, opts):
|
|
161
|
-
if len(opts.args) < 2:
|
|
162
|
-
self.printf('Missing argument for trigger add')
|
|
163
|
-
return
|
|
164
|
-
form, tag, prop, query = None, None, None, None
|
|
165
|
-
cond = opts.condition
|
|
166
|
-
|
|
167
|
-
query = opts.args[-1]
|
|
168
|
-
|
|
169
|
-
for arg in opts.args[:-1]:
|
|
170
|
-
if arg.startswith('#'):
|
|
171
|
-
if tag is not None:
|
|
172
|
-
self.printf('Only a single tag is allowed')
|
|
173
|
-
return
|
|
174
|
-
tag = arg[1:]
|
|
175
|
-
else:
|
|
176
|
-
if cond.startswith('prop'):
|
|
177
|
-
if prop is not None:
|
|
178
|
-
self.printf('Only a single prop is allowed')
|
|
179
|
-
return
|
|
180
|
-
prop = arg
|
|
181
|
-
else:
|
|
182
|
-
if form is not None:
|
|
183
|
-
self.printf('Only a single form is allowed')
|
|
184
|
-
return
|
|
185
|
-
form = arg
|
|
186
|
-
|
|
187
|
-
if cond.startswith('tag') and tag is None:
|
|
188
|
-
self.printf('Missing tag parameter')
|
|
189
|
-
return
|
|
190
|
-
|
|
191
|
-
elif cond.startswith('node'):
|
|
192
|
-
if form is None:
|
|
193
|
-
self.printf('Missing form parameter')
|
|
194
|
-
return
|
|
195
|
-
if tag is not None:
|
|
196
|
-
self.printf('node:* does not support a tag')
|
|
197
|
-
return
|
|
198
|
-
|
|
199
|
-
elif cond.startswith('prop'):
|
|
200
|
-
if prop is None:
|
|
201
|
-
self.printf('Missing prop parameter')
|
|
202
|
-
return
|
|
203
|
-
if tag is not None:
|
|
204
|
-
self.printf('prop:set does not support a tag')
|
|
205
|
-
return
|
|
206
|
-
|
|
207
|
-
tdef = {'cond': cond, 'storm': query}
|
|
208
|
-
|
|
209
|
-
if form is not None:
|
|
210
|
-
tdef['form'] = form
|
|
211
|
-
|
|
212
|
-
if prop is not None:
|
|
213
|
-
tdef['prop'] = prop
|
|
214
|
-
|
|
215
|
-
if tag is not None:
|
|
216
|
-
tdef['tag'] = tag
|
|
217
|
-
|
|
218
|
-
opts = {'vars': {'tdef': tdef}, 'view': opts.view}
|
|
219
|
-
|
|
220
|
-
iden = await core.callStorm('return($lib.trigger.add($tdef).iden)', opts=opts)
|
|
221
|
-
|
|
222
|
-
self.printf(f'Added trigger {iden}')
|
|
223
|
-
|
|
224
|
-
async def _get_list(self, core, view):
|
|
225
|
-
opts = {'view': view}
|
|
226
|
-
return await core.callStorm('return($lib.trigger.list())', opts=opts)
|
|
227
|
-
|
|
228
|
-
async def _handle_list(self, core, opts):
|
|
229
|
-
triglist = await self._get_list(core, opts.view)
|
|
230
|
-
|
|
231
|
-
if not triglist:
|
|
232
|
-
self.printf('No triggers found')
|
|
233
|
-
return
|
|
234
|
-
|
|
235
|
-
self.printf(f'{"user":10} {"iden":12} {"en?":3} {"cond":9} {"object":14} {"":10} {"storm query"}')
|
|
236
|
-
|
|
237
|
-
for trig in triglist:
|
|
238
|
-
iden = trig['iden']
|
|
239
|
-
idenf = iden[:8] + '..'
|
|
240
|
-
user = trig.get('username', '<None>')
|
|
241
|
-
query = trig.get('storm', '<missing>')
|
|
242
|
-
cond = trig.get('cond', '<missing')
|
|
243
|
-
enabled = 'Y' if trig.get('enabled', True) else 'N'
|
|
244
|
-
if cond.startswith('tag:'):
|
|
245
|
-
tag = '#' + trig.get('tag', '<missing>')
|
|
246
|
-
form = trig.get('form', '')
|
|
247
|
-
obj, obj2 = form, tag
|
|
248
|
-
else:
|
|
249
|
-
obj = trig.get('prop', trig.get('form', '<missing>'))
|
|
250
|
-
obj2 = ''
|
|
251
|
-
|
|
252
|
-
self.printf(f'{user:10} {idenf:12} {enabled:3} {cond:9} {obj:14} {obj2:10} {query}')
|
|
253
|
-
|
|
254
|
-
async def _handle_mod(self, core, opts):
|
|
255
|
-
prefix = opts.prefix
|
|
256
|
-
iden = await self._match_idens(core, prefix, view=opts.view)
|
|
257
|
-
if iden is None:
|
|
258
|
-
return
|
|
259
|
-
|
|
260
|
-
opts = {'vars': {'iden': iden, 'storm': opts.query}, 'view': opts.view}
|
|
261
|
-
await core.callStorm('$lib.trigger.get($iden).set(storm, $storm)', opts=opts)
|
|
262
|
-
|
|
263
|
-
self.printf(f'Modified trigger {iden}')
|
|
264
|
-
|
|
265
|
-
async def _handle_del(self, core, opts):
|
|
266
|
-
prefix = opts.prefix
|
|
267
|
-
iden = await self._match_idens(core, prefix, view=opts.view)
|
|
268
|
-
if iden is None:
|
|
269
|
-
return
|
|
270
|
-
|
|
271
|
-
opts = {'vars': {'iden': iden}, 'view': opts.view}
|
|
272
|
-
await core.callStorm('$lib.trigger.del($iden)', opts=opts)
|
|
273
|
-
|
|
274
|
-
self.printf(f'Deleted trigger {iden}')
|
|
275
|
-
|
|
276
|
-
async def _handle_enable(self, core, opts):
|
|
277
|
-
prefix = opts.prefix
|
|
278
|
-
iden = await self._match_idens(core, prefix, view=opts.view)
|
|
279
|
-
if iden is None:
|
|
280
|
-
return
|
|
281
|
-
opts = {'vars': {'iden': iden}, 'view': opts.view}
|
|
282
|
-
await core.callStorm('$lib.trigger.get($iden).set(enabled, $(1))', opts=opts)
|
|
283
|
-
self.printf(f'Enabled trigger {iden}')
|
|
284
|
-
|
|
285
|
-
async def _handle_disable(self, core, opts):
|
|
286
|
-
prefix = opts.prefix
|
|
287
|
-
iden = await self._match_idens(core, prefix, view=opts.view)
|
|
288
|
-
if iden is None:
|
|
289
|
-
return
|
|
290
|
-
opts = {'vars': {'iden': iden}, 'view': opts.view}
|
|
291
|
-
await core.callStorm('$lib.trigger.get($iden).set(enabled, $(0))', opts=opts)
|
|
292
|
-
self.printf(f'Disabled trigger {iden}')
|
|
293
|
-
|
|
294
|
-
async def runCmdOpts(self, opts):
|
|
295
|
-
|
|
296
|
-
s_common.deprdate('cmdr> trigger', s_common._splicedepr)
|
|
297
|
-
|
|
298
|
-
line = opts.get('line')
|
|
299
|
-
if line is None:
|
|
300
|
-
self.printf(self.__doc__)
|
|
301
|
-
return
|
|
302
|
-
|
|
303
|
-
core = self.getCmdItem()
|
|
304
|
-
|
|
305
|
-
argv = s_parser.Parser(line).cmdrargs()
|
|
306
|
-
try:
|
|
307
|
-
opts = self._make_argparser().parse_args(argv)
|
|
308
|
-
except s_exc.ParserExit:
|
|
309
|
-
return
|
|
310
|
-
|
|
311
|
-
handlers = {
|
|
312
|
-
'add': self._handle_add,
|
|
313
|
-
'del': self._handle_del,
|
|
314
|
-
'disable': self._handle_disable,
|
|
315
|
-
'enable': self._handle_enable,
|
|
316
|
-
'list': self._handle_list,
|
|
317
|
-
'mod': self._handle_mod,
|
|
318
|
-
}
|
|
319
|
-
await handlers[opts.cmd](core, opts)
|