| 1 | from fastapi import HTTPException |
| 2 | from loguru import logger |
| 3 | |
| 4 | from app.connectors.velociraptor.schema.artifacts import CollectArtifactResponse |
| 5 | from app.connectors.velociraptor.schema.flows import FlowClientSession |
| 6 | from app.connectors.velociraptor.schema.flows import FlowResponse |
| 7 | from app.connectors.velociraptor.schema.flows import RetrieveFlowRequest |
| 8 | from app.connectors.velociraptor.utils.universal import UniversalService |
| 9 | |
| 10 | |
| 11 | def create_query(query: str) -> str: |
| 12 | """ |
| 13 | Create a query string. |
| 14 | |
| 15 | Args: |
| 16 | query (str): The query to be executed. |
| 17 | |
| 18 | Returns: |
| 19 | str: The created query string. |
| 20 | """ |
| 21 | return query |
| 22 | |
| 23 | |
| 24 | async def get_flows(velociraptor_id: str, velociraptor_org: str = "root") -> FlowResponse: |
| 25 | """ |
| 26 | Get all artifacts from Velociraptor. |
| 27 | |
| 28 | Returns: |
| 29 | ArtifactsResponse: A dictionary containing the artifacts. |
| 30 | """ |
| 31 | logger.info("Fetching artifacts from Velociraptor") |
| 32 | velociraptor_service = await UniversalService.create("Velociraptor") |
| 33 | query = create_query( |
| 34 | f"SELECT * FROM flows(client_id='{velociraptor_id}')", |
| 35 | ) |
| 36 | all_flows = velociraptor_service.execute_query(query, org_id=velociraptor_org) |
| 37 | flows = [FlowClientSession(**flow) for flow in all_flows["results"]] |
| 38 | try: |
| 39 | if all_flows["success"]: |
| 40 | flows = [FlowClientSession(**flow) for flow in all_flows["results"]] |
| 41 | logger.info(f"flows: {flows}") |
| 42 | return FlowResponse( |
| 43 | success=True, |
| 44 | message="All flows retrieved.", |
| 45 | results=flows, |
| 46 | ) |
| 47 | else: |
| 48 | raise HTTPException( |
| 49 | status_code=500, |
| 50 | detail=f"Failed to retrieve flows from Velociraptor: {all_flows['message']}", |
| 51 | ) |
| 52 | except Exception as e: |
| 53 | logger.error(f"Failed to retrieve flows from Velociraptor: {e}") |
| 54 | raise HTTPException( |
| 55 | status_code=500, |
| 56 | detail=f"Failed to retrieve flows from Velociraptor: {e}", |
| 57 | ) |
| 58 | |
| 59 | |
| 60 | async def get_flow(retrieve_flow_request: RetrieveFlowRequest, velociraptor_org: str = "root"): |
| 61 | """ |
| 62 | Get all artifacts from Velociraptor. |
| 63 | |
| 64 | Returns: |
| 65 | ArtifactsResponse: A dictionary containing the artifacts. |
| 66 | """ |
| 67 | logger.info("Fetching artifacts from Velociraptor") |
| 68 | velociraptor_service = await UniversalService.create("Velociraptor") |
| 69 | query = create_query( |
| 70 | f"SELECT * FROM flow_results(client_id='{retrieve_flow_request.client_id}', flow_id='{retrieve_flow_request.session_id}')", |
| 71 | ) |
| 72 | flow_results = velociraptor_service.execute_query(query, org_id=velociraptor_org) |
| 73 | logger.info(f"flow_results: {flow_results}") |
| 74 | try: |
| 75 | if flow_results["success"]: |
| 76 | return CollectArtifactResponse( |
| 77 | success=flow_results["success"], |
| 78 | message=flow_results["message"], |
| 79 | results=flow_results["results"], |
| 80 | ) |
| 81 | else: |
| 82 | raise HTTPException( |
| 83 | status_code=500, |
| 84 | detail=f"Failed to retrieve flow results from Velociraptor: {flow_results['message']}", |
| 85 | ) |
| 86 | except Exception as e: |
| 87 | logger.error(f"Failed to retrieve flow results from Velociraptor: {e}") |
| 88 | raise HTTPException( |
| 89 | status_code=500, |
| 90 | detail=f"Failed to retrieve flow results from Velociraptor: {e}", |
| 91 | ) |