| 1 | from typing import List |
| 2 | from typing import Optional |
| 3 | |
| 4 | from sqlmodel import Field |
| 5 | from sqlmodel import Relationship |
| 6 | from sqlmodel import SQLModel |
| 7 | |
| 8 | |
| 9 | class Condition(SQLModel, table=True): |
| 10 | __tablename__ = "custom_alert_creation_condition" |
| 11 | id: int = Field(default=None, primary_key=True) |
| 12 | event_order_id: int = Field( |
| 13 | default=None, |
| 14 | foreign_key="custom_alert_creation_event_order.id", |
| 15 | ) |
| 16 | field_name: str = Field(max_length=1024) |
| 17 | field_value: str = Field(max_length=1024) |
| 18 | event_order: "EventOrder" = Relationship(back_populates="conditions") |
| 19 | |
| 20 | |
| 21 | class EventOrder(SQLModel, table=True): |
| 22 | __tablename__ = "custom_alert_creation_event_order" |
| 23 | id: int = Field(default=None, primary_key=True) |
| 24 | alert_creation_settings_id: int = Field( |
| 25 | default=None, |
| 26 | foreign_key="custom_alert_creation_settings.id", |
| 27 | ) |
| 28 | order_label: str = Field(max_length=255) |
| 29 | conditions: List["Condition"] = Relationship(back_populates="event_order") |
| 30 | alert_creation_settings: "AlertCreationSettings" = Relationship( |
| 31 | back_populates="event_orders", |
| 32 | ) |
| 33 | event_configs: List["AlertCreationEventConfig"] = Relationship( |
| 34 | back_populates="event_order", |
| 35 | ) |
| 36 | |
| 37 | |
| 38 | class AlertCreationSettings(SQLModel, table=True): |
| 39 | __tablename__ = "custom_alert_creation_settings" |
| 40 | id: Optional[int] = Field(primary_key=True) |
| 41 | customer_code: str = Field(max_length=50, nullable=False) |
| 42 | customer_name: str = Field(max_length=50, nullable=False) |
| 43 | excluded_wazuh_rules: Optional[str] = Field(max_length=1024) |
| 44 | excluded_suricata_rules: Optional[str] = Field(max_length=1024) |
| 45 | timefield: Optional[str] = Field(max_length=1024) |
| 46 | office365_organization_id: Optional[str] = Field(max_length=1024) |
| 47 | iris_customer_id: Optional[int] = Field() |
| 48 | iris_customer_name: Optional[str] = Field(max_length=1024) |
| 49 | iris_index: Optional[str] = Field(max_length=1024) |
| 50 | grafana_url: Optional[str] = Field(max_length=1024) |
| 51 | misp_url: Optional[str] = Field(max_length=1024) |
| 52 | opencti_url: Optional[str] = Field(max_length=1024) |
| 53 | custom_message: Optional[str] = Field(max_length=1024) |
| 54 | shuffle_endpoint: Optional[str] = Field(max_length=1024) |
| 55 | nvd_url: Optional[str] = Field( |
| 56 | default="https://services.nvd.nist.gov/rest/json/cves/2.0?cveId", |
| 57 | max_length=1024, |
| 58 | ) |
| 59 | event_orders: List[EventOrder] = Relationship( |
| 60 | back_populates="alert_creation_settings", |
| 61 | ) |
| 62 | |
| 63 | |
| 64 | class AlertCreationEventConfig(SQLModel, table=True): |
| 65 | __tablename__ = "custom_alert_creation_event_config" |
| 66 | id: Optional[int] = Field(default=None, primary_key=True) |
| 67 | event_order_id: Optional[int] = Field( |
| 68 | default=None, |
| 69 | foreign_key="custom_alert_creation_event_order.id", |
| 70 | ) |
| 71 | event_id: str = Field(max_length=255) |
| 72 | field: str = Field(max_length=1024) |
| 73 | value: str = Field(max_length=1024) |
| 74 | event_order: "EventOrder" = Relationship(back_populates="event_configs") |