| 1 | from datetime import datetime |
| 2 | from typing import Any |
| 3 | from typing import Dict |
| 4 | from typing import List |
| 5 | from typing import Optional |
| 6 | |
| 7 | from pydantic import BaseModel |
| 8 | from pydantic import ConfigDict |
| 9 | from pydantic import Field |
| 10 | |
| 11 | |
| 12 | class ReplayInfo(BaseModel): |
| 13 | timerange_start: datetime |
| 14 | timerange_end: datetime |
| 15 | query: str |
| 16 | streams: List[str] |
| 17 | filters: List[Any] = Field(default_factory=list) |
| 18 | |
| 19 | |
| 20 | class GraylogEventFields(BaseModel): |
| 21 | COMMAND: str |
| 22 | AGENT_ID: str |
| 23 | ACTION: str |
| 24 | VALUE: str |
| 25 | # Allow additional fields |
| 26 | additional_fields: Dict[str, Any] = Field(default_factory=dict, alias="__extra__") |
| 27 | model_config = ConfigDict(extra="allow", populate_by_name=True) |
| 28 | |
| 29 | |
| 30 | class GraylogThresholdEventFields(BaseModel): |
| 31 | CUSTOMER_CODE: str |
| 32 | SOURCE: str |
| 33 | ALERT_DESCRIPTION: str |
| 34 | ASSET_NAME: Optional[str] = None |
| 35 | # Allow additional fields |
| 36 | additional_fields: Dict[str, Any] = Field(default_factory=dict, alias="__extra__") |
| 37 | model_config = ConfigDict(extra="allow", populate_by_name=True) |
| 38 | |
| 39 | |
| 40 | class GraylogEvent(BaseModel): |
| 41 | id: str |
| 42 | event_definition_type: str |
| 43 | event_definition_id: str |
| 44 | origin_context: str |
| 45 | timestamp: datetime |
| 46 | timestamp_processing: datetime |
| 47 | timerange_start: Optional[datetime] = None |
| 48 | timerange_end: Optional[datetime] = None |
| 49 | streams: List[str] = Field(default_factory=list) |
| 50 | source_streams: List[str] |
| 51 | message: str |
| 52 | source: str |
| 53 | key_tuple: List[Any] = Field(default_factory=list) |
| 54 | key: str |
| 55 | priority: int |
| 56 | scores: Dict[str, Any] = Field(default_factory=dict) |
| 57 | associated_assets: List[Any] = Field(default_factory=list) |
| 58 | alert: bool |
| 59 | fields: GraylogEventFields |
| 60 | group_by_fields: Dict[str, Any] = Field(default_factory=dict) |
| 61 | replay_info: ReplayInfo |
| 62 | |
| 63 | |
| 64 | class GraylogEventNotification(BaseModel): |
| 65 | event_definition_id: str |
| 66 | event_definition_type: str |
| 67 | event_definition_title: str |
| 68 | event_definition_description: str = "" |
| 69 | job_definition_id: str |
| 70 | job_trigger_id: str |
| 71 | event: GraylogEvent |
| 72 | backlog: List[Any] = Field(default_factory=list) |
| 73 | model_config = ConfigDict( |
| 74 | json_schema_extra={ |
| 75 | "example": { |
| 76 | "event_definition_id": "67c78b93cf26aa2045bdc2ea", |
| 77 | "event_definition_type": "aggregation-v1", |
| 78 | "event_definition_title": "ACTIVE RESPONSE WEBSERVER THREAT INTEL", |
| 79 | "event_definition_description": "", |
| 80 | "job_definition_id": "67c78befcf26aa2045bdc4e9", |
| 81 | "job_trigger_id": "67c78c0bcf26aa2045bdc5b5", |
| 82 | "event": { |
| 83 | "id": "01JNHQP35THD48VH8601F6EMHE", |
| 84 | "event_definition_type": "aggregation-v1", |
| 85 | "event_definition_id": "67c78b93cf26aa2045bdc2ea", |
| 86 | "origin_context": "urn:graylog:message:es:graylog-01_3:766b70b4-f94f-11ef-be9a-005056b6f13d", |
| 87 | "timestamp": "2025-03-04T23:21:55.840Z", |
| 88 | "timestamp_processing": "2025-03-04T23:26:03.450Z", |
| 89 | "timerange_start": None, |
| 90 | "timerange_end": None, |
| 91 | "streams": [], |
| 92 | "source_streams": ["679945aa7c4dd06afcef5feb", "679945a47c4dd06afcef5ef3"], |
| 93 | "message": "ACTIVE RESPONSE WEBSERVER THREAT INTEL", |
| 94 | "source": "soc-grlog01", |
| 95 | "key_tuple": [], |
| 96 | "key": "", |
| 97 | "priority": 2, |
| 98 | "scores": {}, |
| 99 | "associated_assets": [], |
| 100 | "alert": True, |
| 101 | "fields": {"COMMAND": "domain_sinkhole", "AGENT_ID": "032", "ACTION": "sinkhole", "VALUE": "example.com"}, |
| 102 | "group_by_fields": {}, |
| 103 | "replay_info": { |
| 104 | "timerange_start": "2025-03-04T23:21:03.360Z", |
| 105 | "timerange_end": "2025-03-04T23:26:03.360Z", |
| 106 | "query": "_exists_:threat_intel_score", |
| 107 | "streams": ["679945aa7c4dd06afcef5feb", "679945a47c4dd06afcef5ef3"], |
| 108 | "filters": [], |
| 109 | }, |
| 110 | }, |
| 111 | "backlog": [], |
| 112 | }, |
| 113 | }, |
| 114 | ) |
| 115 | |
| 116 | |
| 117 | class GraylogThresholdEvent(BaseModel): |
| 118 | id: str |
| 119 | event_definition_type: str |
| 120 | event_definition_id: str |
| 121 | origin_context: Optional[str] = None |
| 122 | timestamp: datetime |
| 123 | timestamp_processing: datetime |
| 124 | timerange_start: Optional[datetime] = None |
| 125 | timerange_end: Optional[datetime] = None |
| 126 | streams: List[str] = Field(default_factory=list) |
| 127 | source_streams: List[str] |
| 128 | message: str |
| 129 | source: str |
| 130 | key_tuple: List[Any] = Field(default_factory=list) |
| 131 | key: str |
| 132 | priority: int |
| 133 | scores: Dict[str, Any] = Field(default_factory=dict) |
| 134 | associated_assets: List[Any] = Field(default_factory=list) |
| 135 | alert: bool |
| 136 | fields: GraylogThresholdEventFields |
| 137 | group_by_fields: Dict[str, Any] = Field(default_factory=dict) |
| 138 | replay_info: ReplayInfo |
| 139 | |
| 140 | |
| 141 | class GraylogThresholdEventNotification(BaseModel): |
| 142 | event_definition_id: str |
| 143 | event_definition_type: str |
| 144 | event_definition_title: str |
| 145 | event_definition_description: str = "" |
| 146 | job_definition_id: str |
| 147 | job_trigger_id: str |
| 148 | event: GraylogThresholdEvent |
| 149 | backlog: List[Any] = Field(default_factory=list) |
| 150 | model_config = ConfigDict( |
| 151 | json_schema_extra={ |
| 152 | "example": { |
| 153 | "event_definition_id": "67b6687184088513bdc6cd1b", |
| 154 | "event_definition_type": "aggregation-v1", |
| 155 | "event_definition_title": "DELL SWITCHES - MULTIPLE AUTH FAILURES", |
| 156 | "event_definition_description": "DELL SWITCHES - MULTIPLE AUTH FAILURES", |
| 157 | "job_definition_id": "67dde9bc84088513bde5ce29", |
| 158 | "job_trigger_id": "67ddeabf84088513bde5d283", |
| 159 | "event": { |
| 160 | "id": "01JPXDSZ8AECWZ88HR9JQPYHJP", |
| 161 | "event_definition_type": "aggregation-v1", |
| 162 | "event_definition_id": "67b6687184088513bdc6cd1b", |
| 163 | "origin_context": None, |
| 164 | "timestamp": "2025-03-21T22:39:54.219Z", |
| 165 | "timestamp_processing": "2025-03-21T22:39:59.754Z", |
| 166 | "timerange_start": "2024-08-25T14:39:54.219Z", |
| 167 | "timerange_end": "2025-03-21T22:39:54.219Z", |
| 168 | "streams": [], |
| 169 | "source_streams": ["67abcb0a84088513bdc09e32"], |
| 170 | "message": "DELL SWITCHES - MULTIPLE AUTH FAILURES: 10.0.64.233 - count()=14.0", |
| 171 | "source": "soc-grlog02", |
| 172 | "key_tuple": [], |
| 173 | "key": "", |
| 174 | "priority": 2, |
| 175 | "scores": {}, |
| 176 | "associated_assets": [], |
| 177 | "alert": True, |
| 178 | "fields": { |
| 179 | "CUSTOMER_CODE": "6bdd96a0-06a5-11f0-a499-005056b6c109", |
| 180 | "SOURCE": "DELLSWITCH", |
| 181 | "ALERT_DESCRIPTION": "THIS IS A TEST", |
| 182 | }, |
| 183 | "group_by_fields": {"source": "10.0.64.233"}, |
| 184 | "replay_info": { |
| 185 | "timerange_start": "2024-08-25T14:39:54.219Z", |
| 186 | "timerange_end": "2025-03-21T22:39:54.219Z", |
| 187 | "query": '"An invalid user tried to login"', |
| 188 | "streams": ["67abcb0a84088513bdc09e32"], |
| 189 | "filters": [], |
| 190 | }, |
| 191 | }, |
| 192 | "backlog": [], |
| 193 | }, |
| 194 | }, |
| 195 | ) |