| 1 | from typing import Dict |
| 2 | |
| 3 | from pydantic import BaseModel |
| 4 | from pydantic import Field |
| 5 | |
| 6 | |
| 7 | class Indices(BaseModel): |
| 8 | indices_list: list |
| 9 | success: bool |
| 10 | message: str |
| 11 | |
| 12 | |
| 13 | class IndexConfigModel(BaseModel): |
| 14 | SKIP_INDEX_NAMES: Dict[str, bool] = Field( |
| 15 | default={ |
| 16 | "wazuh-statistics": True, |
| 17 | "wazuh-monitoring": True, |
| 18 | ".opendistro": True, |
| 19 | ".opensearch": True, |
| 20 | ".kibana": True, |
| 21 | "praeco": True, |
| 22 | "filebeat": True, |
| 23 | ".tasks": True, |
| 24 | ".task": True, |
| 25 | "wazuh-states-vulnerabilities": True, |
| 26 | ".plugins": True, |
| 27 | ".ql": True, |
| 28 | }, |
| 29 | description="A dictionary containing index names to be skipped and their skip status.", |
| 30 | ) |
| 31 | |
| 32 | def is_index_skipped(self, index_name: str) -> bool: |
| 33 | """ |
| 34 | Checks whether the given index name should be skipped. |
| 35 | |
| 36 | Args: |
| 37 | index_name (str): The name of the index to check. |
| 38 | |
| 39 | Returns: |
| 40 | bool: True if the index should be skipped, False otherwise. |
| 41 | """ |
| 42 | return any(index_name.startswith(skipped) for skipped in self.SKIP_INDEX_NAMES) |
| 43 | |
| 44 | def is_valid_index(self, index_name: str) -> bool: |
| 45 | """ |
| 46 | Checks if the index name starts with "wazuh_" and is not in the SKIP_INDEX_NAMES list. |
| 47 | UPDATE: Modifying this method to return not self.is_index_skipped(index_name) and not index_name.__contains__("deflector") |
| 48 | So that users whom do not use `wazuh-` index naming convention can still receive alerts. |
| 49 | |
| 50 | Args: |
| 51 | index_name (str): The name of the index to check. |
| 52 | |
| 53 | Returns: |
| 54 | bool: True if the index is valid, False otherwise. |
| 55 | """ |
| 56 | # return index_name.startswith("wazuh") and not self.is_index_skipped(index_name) |
| 57 | # ! Modifying the return statement to return not self.is_index_skipped(index_name) and not index_name.__contains__("deflector") |
| 58 | # ! Using this so that users whom do not use `wazuh-` index naming convention can still receive alerts |
| 59 | return not self.is_index_skipped(index_name) and not index_name.__contains__("deflector") |