| 1 | from contextvars import ContextVar |
| 2 | from enum import Enum |
| 3 | from typing import Optional |
| 4 | |
| 5 | from loguru import logger |
| 6 | |
| 7 | |
| 8 | class GraylogContext(Enum): |
| 9 | """ |
| 10 | Enum to define the context/purpose for Graylog connections. |
| 11 | |
| 12 | WAZUH: Default Graylog instance for Wazuh and third-party integrations (Graylog01) |
| 13 | NETWORK: Graylog instance for network logs and syslog ingestion (Graylog02) |
| 14 | """ |
| 15 | |
| 16 | WAZUH = "Graylog" |
| 17 | NETWORK = "Graylog-Network" |
| 18 | |
| 19 | |
| 20 | # Context variable to hold the current Graylog context |
| 21 | _graylog_context: ContextVar[Optional[GraylogContext]] = ContextVar( |
| 22 | "graylog_context", |
| 23 | default=None, |
| 24 | ) |
| 25 | |
| 26 | |
| 27 | def set_graylog_context(context: GraylogContext) -> None: |
| 28 | """ |
| 29 | Sets the Graylog context for the current async context. |
| 30 | This should be called at the route/entry point level. |
| 31 | |
| 32 | Args: |
| 33 | context (GraylogContext): The Graylog context to use for subsequent calls. |
| 34 | """ |
| 35 | logger.debug(f"Setting Graylog context to: {context.value}") |
| 36 | _graylog_context.set(context) |
| 37 | |
| 38 | |
| 39 | def clear_graylog_context() -> None: |
| 40 | """ |
| 41 | Clears the Graylog context, reverting to default behavior. |
| 42 | """ |
| 43 | logger.debug("Clearing Graylog context") |
| 44 | _graylog_context.set(None) |
| 45 | |
| 46 | |
| 47 | def get_current_graylog_connector() -> str: |
| 48 | """ |
| 49 | Gets the current Graylog connector name based on the context. |
| 50 | Falls back to the default "Graylog" if no context is set. |
| 51 | |
| 52 | Returns: |
| 53 | str: The connector name to use. |
| 54 | """ |
| 55 | context = _graylog_context.get() |
| 56 | if context is not None: |
| 57 | return context.value |
| 58 | return GraylogContext.WAZUH.value |
| 59 | |
| 60 | |
| 61 | # Mapping of specific use cases to their Graylog context |
| 62 | CONTEXT_MAPPING = { |
| 63 | # Network-related integrations -> Graylog-Network |
| 64 | "sonicwall": GraylogContext.NETWORK, |
| 65 | "syslog": GraylogContext.NETWORK, |
| 66 | "firewall": GraylogContext.NETWORK, |
| 67 | "network": GraylogContext.NETWORK, |
| 68 | # Wazuh/default integrations -> Graylog (default) |
| 69 | "wazuh": GraylogContext.WAZUH, |
| 70 | "default": GraylogContext.WAZUH, |
| 71 | } |
| 72 | |
| 73 | |
| 74 | def get_graylog_connector_name( |
| 75 | context: Optional[GraylogContext] = None, |
| 76 | use_case: Optional[str] = None, |
| 77 | ) -> str: |
| 78 | """ |
| 79 | Returns the appropriate Graylog connector name based on context or use case. |
| 80 | If neither is provided, checks for a context variable, then falls back to default. |
| 81 | |
| 82 | Args: |
| 83 | context (Optional[GraylogContext]): The explicit context to use. |
| 84 | use_case (Optional[str]): A string identifier for the use case. |
| 85 | |
| 86 | Returns: |
| 87 | str: The connector name to use for database lookup. |
| 88 | """ |
| 89 | if context is not None: |
| 90 | return context.value |
| 91 | |
| 92 | if use_case is not None: |
| 93 | use_case_lower = use_case.lower() |
| 94 | mapped_context = CONTEXT_MAPPING.get(use_case_lower, GraylogContext.WAZUH) |
| 95 | return mapped_context.value |
| 96 | |
| 97 | # Fall back to context variable or default |
| 98 | return get_current_graylog_connector() |