| 1 | from enum import Enum |
| 2 | from typing import List |
| 3 | |
| 4 | from pydantic import BaseModel |
| 5 | from pydantic import Field |
| 6 | from pydantic import field_validator |
| 7 | |
| 8 | |
| 9 | class GrafanaDashboard(BaseModel): |
| 10 | id: int |
| 11 | slug: str |
| 12 | status: str |
| 13 | uid: str |
| 14 | url: str |
| 15 | version: int |
| 16 | |
| 17 | |
| 18 | class GrafanaDashboardResponse(BaseModel): |
| 19 | provisioned_dashboards: list[GrafanaDashboard] |
| 20 | success: bool |
| 21 | message: str |
| 22 | |
| 23 | |
| 24 | # ! DASHBOARD CLASSES NEED TO BE DEFINED HERE ! |
| 25 | class WazuhDashboard(Enum): |
| 26 | WAZUH_SUMMARY = ("Wazuh", "summary.json") |
| 27 | EDR_WINDOWS_EVENT_LOGS = ("Wazuh", "edr_windows_event_logs.json") |
| 28 | # EDR_WAZUH_INVENOTRY = ("Wazuh", "edr_wazuh_inventory.json") |
| 29 | EDR_USERS_AND_GROUPS = ("Wazuh", "edr_users_and_groups.json") |
| 30 | # EDR_SYSTEM_VULNERABILITIES = ("Wazuh", "edr_system_vulnerabilities.json") |
| 31 | EDR_SYSTEM_SECURITY_AUDIT = ("Wazuh", "edr_system_security_audit.json") |
| 32 | EDR_SYSTEM_PROCESSES = ("Wazuh", "edr_system_processes.json") |
| 33 | EDR_PROCESS_INJECTION = ("Wazuh", "edr_process_injection.json") |
| 34 | EDR_OPEN_AUDIT = ("Wazuh", "edr_open_audit.json") |
| 35 | EDR_NETWORK_SCAN = ("Wazuh", "edr_network_scan.json") |
| 36 | EDR_NETWORK_CONNECTIONS = ("Wazuh", "edr_network_connections.json") |
| 37 | EDR_MITRE = ("Wazuh", "edr_mitre.json") |
| 38 | EDR_FIM = ("Wazuh", "edr_fim.json") |
| 39 | EDR_DOCKER_MONITORING = ("Wazuh", "edr_docker_monitoring.json") |
| 40 | EDR_DNS_REQUESTS = ("Wazuh", "edr_dns_requests.json") |
| 41 | EDR_DLL_SIDE_LOADING = ("Wazuh", "edr_dll_side_loading.json") |
| 42 | EDR_COMPLIANCE = ("Wazuh", "edr_compliance.json") |
| 43 | EDR_AV_MALWARE_IOC = ("Wazuh", "edr_av_malware_ioc.json") |
| 44 | EDR_AGENT_INVENTORY = ("Wazuh", "edr_agent_inventory.json") |
| 45 | EDR_AD_INVENTORY = ("Wazuh", "edr_ad_inventory.json") |
| 46 | # EDR_SYSTEM_VULNERABILITIES_NEW = ("Wazuh", "edr_system_vulnerabilities_new.json") |
| 47 | |
| 48 | |
| 49 | class Office365Dashboard(Enum): |
| 50 | ACTIVE_DIRECTORY = ("Office365", "active_directory.json") |
| 51 | APPLICATIONS = ("Office365", "applications.json") |
| 52 | COMPLIANCE_CENTER = ("Office365", "compliance_center.json") |
| 53 | DEFENDER_FOR_IDENTITIY = ("Office365", "defender_for_identity.json") |
| 54 | DLP = ("Office365", "dlp.json") |
| 55 | ENDPOINT = ("Office365", "endpoint.json") |
| 56 | EXCHANGE = ("Office365", "exchange.json") |
| 57 | FORMS = ("Office365", "forms.json") |
| 58 | MITRE = ("Office365", "mitre.json") |
| 59 | ONEDRIVE = ("Office365", "onedrive.json") |
| 60 | POWERBI = ("Office365", "powerbi.json") |
| 61 | SHAREPOINT = ("Office365", "sharepoint.json") |
| 62 | OFFICE365_SUMMARY = ("Office365", "summary.json") |
| 63 | TEAMS = ("Office365", "teams.json") |
| 64 | THREAT_INTELLIGENCE = ("Office365", "threat_intelligence.json") |
| 65 | |
| 66 | |
| 67 | class MimecastDashboard(Enum): |
| 68 | MIMECAST_SUMMARY = ("Mimecast", "summary.json") |
| 69 | |
| 70 | |
| 71 | class SapSiemDashboard(Enum): |
| 72 | USERS_AUTH = ("SapSiem", "users_auth.json") |
| 73 | |
| 74 | |
| 75 | class HuntressDashboard(Enum): |
| 76 | HUNTRESS_SUMMARY = ("Huntress", "summary.json") |
| 77 | |
| 78 | |
| 79 | class CarbonBlackDashboard(Enum): |
| 80 | CARBONBLACK_SUMMARY = ("CarbonBlack", "summary.json") |
| 81 | |
| 82 | |
| 83 | class FortinetDashboard(Enum): |
| 84 | FORTINET_SYSTEM_LOGS = ("Fortinet", "fortinet_system_logs.json") |
| 85 | FORTINET_UTM_ANOMALIES = ("Fortinet", "fortinet_utm_anomalies.json") |
| 86 | FORTINET_UTM_APP_CONTROL = ("Fortinet", "fortinet_utm_app_control.json") |
| 87 | FOTINET_UTM_DLP = ("Fortinet", "fortinet_utm_dlp.json") |
| 88 | FORTINET_UTM_DNS = ("Fortinet", "fortinet_utm_dns.json") |
| 89 | FORTINET_UTM_IPS = ("Fortinet", "fortinet_utm_ips.json") |
| 90 | FORTINET_UTM_SSL = ("Fortinet", "fortinet_utm_ssl.json") |
| 91 | FORTINET_UTM_SUMMARY = ("Fortinet", "fortinet_utm_summary.json") |
| 92 | FORTINET_UTM_VIRUS = ("Fortinet", "fortinet_utm_virus.json") |
| 93 | FORTINET_UTM_WEBFILTER = ("Fortinet", "fortinet_utm_webfilter.json") |
| 94 | FORTINET_VPN = ("Fortinet", "fortinet_vpn.json") |
| 95 | |
| 96 | |
| 97 | class CrowdstrikeDashboard(Enum): |
| 98 | CROWDSTRIKE_SUMMARY = ("Crowdstrike", "summary.json") |
| 99 | |
| 100 | |
| 101 | class DuoDashboard(Enum): |
| 102 | DUO_AUTH = ("Duo", "duo_auth.json") |
| 103 | |
| 104 | |
| 105 | class DarktraceDashboard(Enum): |
| 106 | DARKTRACE_SUMMARY = ("Darktrace", "summary.json") |
| 107 | |
| 108 | |
| 109 | class BitdefenderDashboard(Enum): |
| 110 | BITDEFENDER_SUMMARY = ("Bitdefender", "summary.json") |
| 111 | |
| 112 | |
| 113 | class CatoDashboard(Enum): |
| 114 | CATO_SUMMARY = ("Cato", "summary.json") |
| 115 | |
| 116 | |
| 117 | class DefenderForEndpointDashboard(Enum): |
| 118 | DEFENDERFORENDPOINT_SUMMARY = ("DefenderForEndpoint", "summary.json") |
| 119 | |
| 120 | |
| 121 | class SonicwallDashboard(Enum): |
| 122 | SONICWALL_SUMMARY = ("Sonicwall", "sonicwall_summary.json") |
| 123 | SONICWALL_VPN = ("Sonicwall", "sonicwall_vpn.json") |
| 124 | SONICWALL_APP_CONTROL = ("Sonicwall", "sonicwall_app_control.json") |
| 125 | SONICWALL_SD_WAN = ("Sonicwall", "sonicwall_sdwan.json") |
| 126 | SONICWALL_IPS = ("Sonicwall", "sonicwall_ips.json") |
| 127 | |
| 128 | |
| 129 | class SentinelOneDashboard(Enum): |
| 130 | SENTINELONE_EPP_ADMINISTRATIVE = ("Sentinelone", "sentinelone_epp_administrative.json") |
| 131 | SENTINELONE_EPP_MITIGATION = ("Sentinelone", "sentinelone_epp_mitigation.json") |
| 132 | SENTINELONE_EPP_RANGER = ("Sentinelone", "sentinelone_epp_ranger.json") |
| 133 | SENTINELONE_EPP_WHITELISTBLACKLIST = ("Sentinelone", "sentinelone_epp_whitelistblacklist.json") |
| 134 | SENTINELONE_EPP_MALWARE = ("Sentinelone", "sentinelone_epp_malware.json") |
| 135 | SENTINELONE_EPP_OPERATIONS = ("Sentinelone", "sentinelone_epp_operations.json") |
| 136 | SENTINELONE_EPP_SUMMARY = ("Sentinelone", "sentinelone_epp_summary.json") |
| 137 | |
| 138 | |
| 139 | class DashboardProvisionRequest(BaseModel): |
| 140 | dashboards: List[str] = Field( |
| 141 | ..., |
| 142 | description="List of dashboard identifiers to provision", |
| 143 | ) |
| 144 | organizationId: int = Field( |
| 145 | 0, |
| 146 | description="Organization ID to provision dashboards to", |
| 147 | ) |
| 148 | folderId: int = Field(0, description="Folder ID to provision dashboards to") |
| 149 | datasourceUid: str = Field( |
| 150 | "uid-to-be-replaced", |
| 151 | description="Datasource UID to use for dashboards", |
| 152 | ) |
| 153 | grafana_url: str = Field( |
| 154 | "https://grafana.company.local", |
| 155 | description="URL of the Grafana instance for the links within the dashboards.", |
| 156 | ) |
| 157 | |
| 158 | @field_validator("dashboards") |
| 159 | @classmethod |
| 160 | def check_dashboards_exist(cls, dashboards): |
| 161 | valid_dashboards = { |
| 162 | item.name: item |
| 163 | for item in list(WazuhDashboard) |
| 164 | + list(Office365Dashboard) |
| 165 | + list(MimecastDashboard) |
| 166 | + list(SapSiemDashboard) |
| 167 | + list(HuntressDashboard) |
| 168 | + list(CarbonBlackDashboard) |
| 169 | + list(FortinetDashboard) |
| 170 | + list(CrowdstrikeDashboard) |
| 171 | + list(DuoDashboard) |
| 172 | + list(DarktraceDashboard) |
| 173 | + list(BitdefenderDashboard) |
| 174 | + list(CatoDashboard) |
| 175 | + list(DefenderForEndpointDashboard) |
| 176 | + list(SonicwallDashboard) |
| 177 | + list(SentinelOneDashboard) |
| 178 | } |
| 179 | for e in dashboards: |
| 180 | if e not in valid_dashboards: |
| 181 | raise ValueError(f'Dashboard identifier "{e}" is not recognized.') |
| 182 | return dashboards |