synapse 2.178.0__py311-none-any.whl → 2.180.0__py311-none-any.whl

synapse/models/infotech.py

@@ -757,30 +757,37 @@ class ItModule(s_module.CoreModule):
                     'doc': 'A developer selected label.',
                 }),
                 ('it:dev:repo', ('guid', {}), {
+                    'interfaces': ('inet:service:object',),
                     'doc': 'A version control system instance.',
                 }),
                 ('it:dev:repo:remote', ('guid', {}), {
                     'doc': 'A remote repo that is tracked for changes/branches/etc.',
                 }),
                 ('it:dev:repo:branch', ('guid', {}), {
+                    'interfaces': ('inet:service:object',),
                     'doc': 'A branch in a version control system instance.',
                 }),
                 ('it:dev:repo:commit', ('guid', {}), {
+                    'interfaces': ('inet:service:object',),
                     'doc': 'A commit to a repository.',
                 }),
                 ('it:dev:repo:diff', ('guid', {}), {
                     'doc': 'A diff of a file being applied in a single commit.',
                 }),
                 ('it:dev:repo:issue:label', ('guid', {}), {
+                    'interfaces': ('inet:service:object',),
                     'doc': 'A label applied to a repository issue.',
                 }),
                 ('it:dev:repo:issue', ('guid', {}), {
+                    'interfaces': ('inet:service:object',),
                     'doc': 'An issue raised in a repository.',
                 }),
                 ('it:dev:repo:issue:comment', ('guid', {}), {
+                    'interfaces': ('inet:service:object',),
                     'doc': 'A comment on an issue in a repository.',
                 }),
                 ('it:dev:repo:diff:comment', ('guid', {}), {
+                    'interfaces': ('inet:service:object',),
                     'doc': 'A comment on a diff in a repository.',
                 }),
                 ('it:prod:soft', ('guid', {}), {
@@ -983,6 +990,9 @@ class ItModule(s_module.CoreModule):
                 ('it:app:yara:match', ('comp', {'fields': (('rule', 'it:app:yara:rule'), ('file', 'file:bytes'))}), {
                     'doc': 'A YARA rule match to a file.',
                 }),
+                ('it:app:yara:netmatch', ('guid', {}), {
+                    'doc': 'An instance of a YARA rule network hunting match.',
+                }),
                 ('it:app:yara:procmatch', ('guid', {}), {
                     'doc': 'An instance of a YARA rule match to a process.',
                 }),
@@ -1797,21 +1807,22 @@ class ItModule(s_module.CoreModule):
                     }),
                     ('desc', ('str', {}), {
                         'disp': {'hint': 'text'},
-                        'doc': 'A free-form description of the repository.',
-                    }),
+                        'doc': 'A free-form description of the repository.'}),
+
                     ('created', ('time', {}), {
-                        'doc': 'When the repository was created.',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :period.'}),
+
                     ('url', ('inet:url', {}), {
-                        'doc': 'A URL where the repository is hosted.',
-                    }),
+                        'doc': 'The URL where the repository is hosted.'}),
+
                     ('type', ('it:dev:repo:type:taxonomy', {}), {
                         'doc': 'The type of the version control system used.',
-                        'ex': 'svn'
-                    }),
+                        'ex': 'svn'}),
+
                     ('submodules', ('array', {'type': 'it:dev:repo:commit'}), {
-                        'doc': "An array of other repos that this repo has as submodules, pinned at specific commits.",
-                    }),
+                        'doc': "An array of other repos that this repo has as submodules, pinned at specific commits."}),
+
                 )),
 
                 ('it:dev:repo:remote', {}, (
@@ -1831,120 +1842,127 @@ class ItModule(s_module.CoreModule):
                 )),
 
                 ('it:dev:repo:branch', {}, (
+
                     ('parent', ('it:dev:repo:branch', {}), {
-                        'doc': 'The branch this branch was branched from.',
-                    }),
+                        'doc': 'The branch this branch was branched from.'}),
+
                     ('start', ('it:dev:repo:commit', {}), {
-                        'doc': 'The commit in the parent branch this branch was created at.'
-                    }),
+                        'doc': 'The commit in the parent branch this branch was created at.'}),
+
                     ('name', ('str', {'strip': True}), {
-                        'doc': 'The name of the branch.',
-                    }),
+                        'doc': 'The name of the branch.'}),
+
                     ('url', ('inet:url', {}), {
-                        'doc': 'The URL where the branch is hosted.',
-                    }),
+                        'doc': 'The URL where the branch is hosted.'}),
+
                     ('created', ('time', {}), {
-                        'doc': 'The time this branch was created',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :period.'}),
+
                     ('merged', ('time', {}), {
-                        'doc': 'The time this branch was merged back into its parent.',
-                    }),
+                        'doc': 'The time this branch was merged back into its parent.'}),
+
                     ('deleted', ('time', {}), {
-                        'doc': 'The time this branch was deleted.',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :period.'}),
                 )),
 
                 ('it:dev:repo:commit', {}, (
                     ('repo', ('it:dev:repo', {}), {
-                        'doc': 'The repository the commit lives in.',
-                    }),
+                        'doc': 'The repository the commit lives in.'}),
+
                     ('parents', ('array', {'type': 'it:dev:repo:commit'}), {
-                        'doc': 'The commit or commits this commit is immediately based on.',
-                    }),
+                        'doc': 'The commit or commits this commit is immediately based on.'}),
+
                     ('branch', ('it:dev:repo:branch', {}), {
-                        'doc': 'The name of the branch the commit was made to.',
-                    }),
+                        'doc': 'The name of the branch the commit was made to.'}),
+
                     ('mesg', ('str', {}), {
                         'disp': {'hint': 'text'},
-                        'doc': 'The commit message describing the changes in the commit.',
-                    }),
+                        'doc': 'The commit message describing the changes in the commit.'}),
+
                     ('id', ('str', {}), {
-                        'doc': 'The version control system specific commit identifier.',
-                    }),
+                        'doc': 'The version control system specific commit identifier.'}),
+
                     ('created', ('time', {}), {
-                        'doc': 'The time the commit was made.',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :period.'}),
+
                     ('url', ('inet:url', {}), {
-                        'doc': 'The URL where the commit is hosted.',
-                    }),
+                        'doc': 'The URL where the commit is hosted.'}),
                 )),
 
                 ('it:dev:repo:diff', {}, (
+
                     ('commit', ('it:dev:repo:commit', {}), {
-                        'doc': 'The commit that produced this diff.',
-                    }),
+                        'doc': 'The commit that produced this diff.'}),
+
                     ('file', ('file:bytes', {}), {
-                        'doc': 'The file after the commit has been applied',
-                    }),
+                        'doc': 'The file after the commit has been applied'}),
+
                     ('path', ('file:path', {}), {
-                        'doc': 'The path to the file in the repo that the diff is being applied to.',
-                    }),
+                        'doc': 'The path to the file in the repo that the diff is being applied to.'}),
+
                     ('url', ('inet:url', {}), {
-                        'doc': 'The URL where the diff is hosted.',
-                    }),
+                        'doc': 'The URL where the diff is hosted.'}),
                 )),
 
                 ('it:dev:repo:issue', {}, (
+
                     ('repo', ('it:dev:repo', {}), {
-                        'doc': 'The repo where the issue was logged.',
-                    }),
+                        'doc': 'The repo where the issue was logged.'}),
+
                     ('title', ('str', {'lower': True, 'strip': True}), {
-                        'doc': 'The title of the issue.'
-                    }),
+                        'doc': 'The title of the issue.'}),
+
                     ('desc', ('str', {}), {
                         'disp': {'hint': 'text'},
-                        'doc': 'The text describing the issue.'
-                    }),
+                        'doc': 'The text describing the issue.'}),
+
                     ('created', ('time', {}), {
-                        'doc': 'The time the issue was created.',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :period.'}),
+
                     ('updated', ('time', {}), {
-                        'doc': 'The time the issue was updated.',
-                    }),
+                        'doc': 'The time the issue was updated.'}),
+
                     ('url', ('inet:url', {}), {
-                        'doc': 'The URL where the issue is hosted.',
-                    }),
+                        'doc': 'The URL where the issue is hosted.'}),
+
                     ('id', ('str', {'strip': True}), {
-                        'doc': 'The ID of the issue in the repository system.',
-                    }),
+                        'doc': 'The ID of the issue in the repository system.'}),
                 )),
 
                 ('it:dev:repo:label', {}, (
+
                     ('id', ('str', {'strip': True}), {
-                        'doc': 'The ID of the label.',
-                    }),
+                        'doc': 'The ID of the label.'}),
+
                     ('title', ('str', {'lower': True, 'strip': True}), {
-                        'doc': 'The human friendly name of the label.',
-                    }),
+                        'doc': 'The human friendly name of the label.'}),
+
                     ('desc', ('str', {}), {
                         'disp': {'hint': 'text'},
-                        'doc': 'The description of the label.',
-                    }),
+                        'doc': 'The description of the label.'}),
+
                 )),
 
                 ('it:dev:repo:issue:label', {}, (
+
                     ('issue', ('it:dev:repo:issue', {}), {
-                        'doc': 'The issue the label was applied to.',
-                    }),
+                        'doc': 'The issue the label was applied to.'}),
+
                     ('label', ('it:dev:repo:label', {}), {
-                        'doc': 'The label that was applied to the issue.',
-                    }),
+                        'doc': 'The label that was applied to the issue.'}),
+
                     ('applied', ('time', {}), {
-                        'doc': 'The time the label was applied.',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :period.'}),
+
                     ('removed', ('time', {}), {
-                        'doc': 'The time the label was removed.',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :period.'}),
+
                 )),
 
                 ('it:dev:repo:issue:comment', {}, (
@@ -1962,7 +1980,8 @@ class ItModule(s_module.CoreModule):
                         'doc': 'The URL where the comment is hosted.',
                     }),
                     ('created', ('time', {}), {
-                        'doc': 'The time the comment was created.',
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :period.',
                     }),
                     ('updated', ('time', {}), {
                         'doc': 'The time the comment was updated.',
@@ -1970,31 +1989,33 @@ class ItModule(s_module.CoreModule):
                 )),
 
                 ('it:dev:repo:diff:comment', {}, (
+
                     ('diff', ('it:dev:repo:diff', {}), {
-                        'doc': 'The diff the comment is being added to.',
-                    }),
+                        'doc': 'The diff the comment is being added to.'}),
+
                     ('text', ('str', {}), {
                         'disp': {'hint': 'text'},
-                        'doc': 'The body of the comment.',
-                    }),
+                        'doc': 'The body of the comment.'}),
+
                     ('replyto', ('it:dev:repo:diff:comment', {}), {
-                        'doc': 'The comment that this comment is replying to.',
-                    }),
+                        'doc': 'The comment that this comment is replying to.'}),
+
                     ('line', ('int', {}), {
-                        'doc': 'The line in the file that is being commented on.',
-                    }),
+                        'doc': 'The line in the file that is being commented on.'}),
+
                     ('offset', ('int', {}), {
-                        'doc': 'The offset in the line in the file that is being commented on.',
-                    }),
+                        'doc': 'The offset in the line in the file that is being commented on.'}),
+
                     ('url', ('inet:url', {}), {
-                        'doc': 'The URL where the comment is hosted.',
-                    }),
+                        'doc': 'The URL where the comment is hosted.'}),
+
                     ('created', ('time', {}), {
-                        'doc': 'The time the comment was created.',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use :period.'}),
+
                     ('updated', ('time', {}), {
-                        'doc': 'The time the comment was updated.',
-                    }),
+                        'doc': 'The time the comment was updated.'}),
+
                 )),
 
                 ('it:prod:hardwaretype', {}, ()),
@@ -2991,14 +3012,27 @@ class ItModule(s_module.CoreModule):
                         'doc': 'The STIX id field from the indicator pattern.'}),
                     ('name', ('str', {}), {
                         'doc': 'The name of the STIX indicator pattern.'}),
+                    ('confidence', ('int', {'min': 0, 'max': 100}), {
+                        'doc': 'The confidence field from the STIX indicator.'}),
+                    ('revoked', ('bool', {}), {
+                        'doc': 'The revoked field from the STIX indicator.'}),
+                    ('description', ('str', {}), {
+                        'doc': 'The description field from the STIX indicator.'}),
                     ('pattern', ('str', {}), {
                         'doc': 'The STIX indicator pattern text.'}),
+                    ('pattern_type', ('str', {'strip': True, 'lower': True,
+                                              'enums': 'stix,pcre,sigma,snort,suricata,yara'}), {
+                        'doc': 'The STIX indicator pattern type.'}),
                     ('created', ('time', {}), {
                         'doc': 'The time that the indicator pattern was first created.'}),
                     ('updated', ('time', {}), {
                         'doc': 'The time that the indicator pattern was last modified.'}),
                     ('labels', ('array', {'type': 'str', 'uniq': True, 'sorted': True}), {
                         'doc': 'The label strings embedded in the STIX indicator pattern.'}),
+                    ('valid_from', ('time', {}), {
+                        'doc': 'The valid_from field from the STIX indicator.'}),
+                    ('valid_until', ('time', {}), {
+                        'doc': 'The valid_until field from the STIX indicator.'}),
                 )),
 
                 ('it:app:yara:rule', {}, (
@@ -3046,9 +3080,18 @@ class ItModule(s_module.CoreModule):
                         'doc': 'The most recent version of the rule evaluated as a match.'}),
                 )),
 
+                ('it:app:yara:netmatch', {}, (
+                    ('rule', ('it:app:yara:rule', {}), {
+                        'doc': 'The YARA rule that triggered the match.'}),
+                    ('version', ('it:semver', {}), {
+                        'doc': 'The most recent version of the rule evaluated as a match.'}),
+                    ('node', ('ndef', {'forms': ('inet:fqdn', 'inet:ipv4', 'inet:ipv6', 'inet:url')}), {
+                        'doc': 'The node which matched the rule.'}),
+                )),
+
                 ('it:app:yara:procmatch', {}, (
                     ('rule', ('it:app:yara:rule', {}), {
-                        'doc': 'The YARA rule that matched the file.'}),
+                        'doc': 'The YARA rule that matched the process.'}),
                     ('proc', ('it:exec:proc', {}), {
                         'doc': 'The process that matched the YARA rule.'}),
                     ('time', ('time', {}), {

synapse/models/person.py

@@ -371,8 +371,11 @@ class PsModule(s_module.CoreModule):
                         'doc': 'The listed org/company FQDN for this contact.',
                     }),
                     ('user', ('inet:user', {}), {
-                        'doc': 'The username or handle for this contact.',
-                    }),
+                        'doc': 'The username or handle for this contact.'}),
+
+                    ('service:accounts', ('array', {'type': 'inet:service:account', 'sorted': True, 'uniq': True}), {
+                        'doc': 'The service accounts associated with this contact.'}),
+
                     ('web:acct', ('inet:web:acct', {}), {
                         'doc': 'The social media account for this contact.',
                     }),

synapse/models/telco.py

@@ -378,6 +378,9 @@ class TelcoModule(s_module.CoreModule):
                     ('email', ('inet:email', {}), {}),
                     ('acct', ('inet:web:acct', {}), {}),
 
+                    ('account', ('inet:service:account', {}), {
+                        'doc': 'The service account which is associated with the tracked device.'}),
+
                     # reporting related data
                     ('app', ('it:prod:softver', {}), {}),
 

synapse/tests/test_cortex.py

@@ -41,6 +41,50 @@ class CortexTest(s_t_utils.SynTest):
     '''
     The tests that should be run with different types of layers
     '''
+    async def test_cortex_basics(self):
+
+        with self.getTestDir() as dirn:
+
+            async with self.getTestCore(dirn=dirn) as core:
+
+                with self.raises(s_exc.NoSuchProp):
+                    await core.setPropLocked('newp', True)
+
+                with self.raises(s_exc.NoSuchUniv):
+                    await core.setUnivLocked('newp', True)
+
+                with self.raises(s_exc.NoSuchTagProp):
+                    await core.setTagPropLocked('newp', True)
+
+                await core.addTagProp('score', ('int', {}), {})
+
+                await core.setPropLocked('inet:ipv4:asn', True)
+                await core.setUnivLocked('.seen', True)
+                await core.setTagPropLocked('score', True)
+
+                with self.raises(s_exc.IsDeprLocked):
+                    await core.nodes('[ inet:ipv4=1.2.3.4 :asn=99 ]')
+                with self.raises(s_exc.IsDeprLocked):
+                    await core.nodes('[ inet:ipv4=1.2.3.4 .seen=now ]')
+                with self.raises(s_exc.IsDeprLocked):
+                    await core.nodes('[ inet:ipv4=1.2.3.4 +#foo:score=10 ]')
+
+            # test persistence...
+            async with self.getTestCore(dirn=dirn) as core:
+
+                with self.raises(s_exc.IsDeprLocked):
+                    await core.nodes('[ inet:ipv4=1.2.3.4 :asn=99 ]')
+                with self.raises(s_exc.IsDeprLocked):
+                    await core.nodes('[ inet:ipv4=1.2.3.4 .seen=now ]')
+                with self.raises(s_exc.IsDeprLocked):
+                    await core.nodes('[ inet:ipv4=1.2.3.4 +#foo:score=10 ]')
+
+                await core.setPropLocked('inet:ipv4:asn', False)
+                await core.setUnivLocked('.seen', False)
+                await core.setTagPropLocked('score', False)
+
+                await core.nodes('[ inet:ipv4=1.2.3.4 :asn=99 .seen=now +#foo:score=10 ]')
+
     async def test_cortex_cellguid(self):
         iden = s_common.guid()
         conf = {'cell:guid': iden}
@@ -1302,7 +1346,7 @@ class CortexTest(s_t_utils.SynTest):
 
                 await core.delTagProp('score')
 
-                with self.raises(s_exc.NoSuchProp):
+                with self.raises(s_exc.NoSuchTagProp):
                     await core.delTagProp('score')
 
                 modl = await core.getModelDict()

synapse/tests/test_lib_aha.py

@@ -1292,3 +1292,20 @@ class AhaTest(s_test.SynTest):
                 async with await s_cell.Cell.anit(dirn=clldir, conf=cllconf) as cell:
                     self.none(await cell.ahaclient.waitready(timeout=12))
                     self.eq(cell.conf.get('aha:registry'), ahaurl)
+
+    async def test_aha_provision_listen_dns_name(self):
+        # Ensure that we use the dns:name for the provisioning listener when
+        # the provision:listen value is not provided.
+        conf = {
+            'aha:network': 'synapse',
+            'dns:name': 'here.loop.vertex.link',
+        }
+        mesg = 'provision listening: ssl://0.0.0.0:27272?hostname=here.loop.vertex.link'
+        with self.getAsyncLoggerStream('synapse.lib.aha', mesg) as stream:
+            async with self.getTestCell(s_aha.AhaCell, conf=conf) as aha:
+                self.true(await stream.wait(timeout=6))
+                # And the URL works with our listener :)
+                provurl = await aha.addAhaUserEnroll('bob.grey')
+                async with await s_telepath.openurl(provurl) as prox:
+                    info = await prox.getUserInfo()
+                    self.eq(info.get('aha:user'), 'bob.grey')