| 1 | from fastapi import APIRouter |
| 2 | from fastapi import Depends |
| 3 | from fastapi import Security |
| 4 | from loguru import logger |
| 5 | from sqlalchemy.ext.asyncio import AsyncSession |
| 6 | |
| 7 | from app.auth.routes.auth import AuthHandler |
| 8 | from app.db.db_session import get_db |
| 9 | from app.integrations.modules.schema.carbonblack import CarbonBlackAuthKeys |
| 10 | from app.integrations.modules.schema.carbonblack import CollectCarbonBlack |
| 11 | from app.integrations.modules.schema.carbonblack import InvokeCarbonBlackRequest |
| 12 | from app.integrations.modules.schema.carbonblack import InvokeCarbonBlackResponse |
| 13 | from app.integrations.modules.services.carbonblack import ( |
| 14 | post_to_copilot_carbonblack_module, |
| 15 | ) |
| 16 | from app.integrations.routes import find_customer_integration |
| 17 | from app.integrations.utils.utils import extract_auth_keys |
| 18 | from app.integrations.utils.utils import get_customer_integration_response |
| 19 | from app.middleware.license import get_license |
| 20 | from app.utils import get_connector_attribute |
| 21 | |
| 22 | module_carbonblack_router = APIRouter() |
| 23 | |
| 24 | |
| 25 | async def get_carbonblack_auth_keys(customer_integration) -> CarbonBlackAuthKeys: |
| 26 | """ |
| 27 | Extract the Huntress authentication keys from the CustomerIntegration. |
| 28 | |
| 29 | Args: |
| 30 | customer_integration (CustomerIntegration): The CustomerIntegration containing the |
| 31 | Huntress authentication keys. |
| 32 | |
| 33 | Returns: |
| 34 | CarbonBlackAuthKeys: The extracted Huntress authentication keys. |
| 35 | """ |
| 36 | carbonblack_auth_keys = extract_auth_keys( |
| 37 | customer_integration, |
| 38 | service_name="CarbonBlack", |
| 39 | ) |
| 40 | logger.info(f"carbonblack_auth_keys: {carbonblack_auth_keys}") |
| 41 | |
| 42 | return CarbonBlackAuthKeys( |
| 43 | carbonblack_api_url=carbonblack_auth_keys["API_URL"], |
| 44 | carbonblack_api_key=carbonblack_auth_keys["API_KEY"], |
| 45 | carbonblack_api_id=carbonblack_auth_keys["API_ID"], |
| 46 | carbonblack_org_key=carbonblack_auth_keys["ORGANIZATION_KEY"], |
| 47 | ) |
| 48 | |
| 49 | |
| 50 | async def get_collect_carbonblack_data(carbonblack_request, session, auth_keys): |
| 51 | return CollectCarbonBlack( |
| 52 | integration="carbonblack", |
| 53 | customer_code=carbonblack_request.customer_code, |
| 54 | graylog_host=await get_connector_attribute( |
| 55 | connector_name="Event Shipper", |
| 56 | column_name="connector_url", |
| 57 | session=session, |
| 58 | ), |
| 59 | graylog_port=await get_connector_attribute( |
| 60 | connector_name="Event Shipper", |
| 61 | column_name="connector_extra_data", |
| 62 | session=session, |
| 63 | ), |
| 64 | carbonblack_api_url=auth_keys.carbonblack_api_url, |
| 65 | carbonblack_api_key=auth_keys.carbonblack_api_key, |
| 66 | carbonblack_api_id=auth_keys.carbonblack_api_id, |
| 67 | carbonblack_org_key=auth_keys.carbonblack_org_key, |
| 68 | time_range=getattr(auth_keys, "time_range", "-15m"), |
| 69 | ) |
| 70 | |
| 71 | |
| 72 | @module_carbonblack_router.post( |
| 73 | "", |
| 74 | response_model=InvokeCarbonBlackResponse, |
| 75 | description="Invoke the CarbonBlack module.", |
| 76 | dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))], |
| 77 | ) |
| 78 | async def collect_carbonblack_route(carbonblack_request: InvokeCarbonBlackRequest, session: AsyncSession = Depends(get_db)): |
| 79 | """Pull down CarbonBlack Events.""" |
| 80 | try: |
| 81 | customer_integration_response = await get_customer_integration_response( |
| 82 | carbonblack_request.customer_code, |
| 83 | session, |
| 84 | ) |
| 85 | |
| 86 | customer_integration = await find_customer_integration( |
| 87 | carbonblack_request.customer_code, |
| 88 | carbonblack_request.integration_name, |
| 89 | customer_integration_response, |
| 90 | ) |
| 91 | |
| 92 | auth_keys = await get_carbonblack_auth_keys(customer_integration) |
| 93 | |
| 94 | collect_carbonblack_data = await get_collect_carbonblack_data(carbonblack_request, session, auth_keys) |
| 95 | |
| 96 | license = await get_license(session) |
| 97 | |
| 98 | await post_to_copilot_carbonblack_module(data=collect_carbonblack_data, license_key=license.license_key) |
| 99 | |
| 100 | except Exception as e: |
| 101 | logger.error(f"Error during DB session: {str(e)}") |
| 102 | return InvokeCarbonBlackResponse(success=False, message=str(e)) |
| 103 | |
| 104 | return InvokeCarbonBlackResponse(success=True, message="CarbonBlack Events collected successfully.") |