| 1 | from typing import List |
| 2 | |
| 3 | from fastapi import APIRouter |
| 4 | from fastapi import Depends |
| 5 | from fastapi import HTTPException |
| 6 | from fastapi import Security |
| 7 | from loguru import logger |
| 8 | from sqlalchemy.ext.asyncio import AsyncSession |
| 9 | from sqlalchemy.future import select |
| 10 | |
| 11 | from app.auth.routes.auth import AuthHandler |
| 12 | from app.connectors.graylog.routes.events import get_all_event_definitions |
| 13 | from app.connectors.graylog.schema.events import GraylogEventDefinitionsResponse |
| 14 | from app.connectors.graylog.services.streams import get_streams |
| 15 | from app.db.db_session import get_db |
| 16 | from app.db.universal_models import CustomersMeta |
| 17 | from app.integrations.monitoring_alert.schema.provision import AvailableMonitoringAlerts |
| 18 | from app.integrations.monitoring_alert.schema.provision import ( |
| 19 | AvailableMonitoringAlertsResponse, |
| 20 | ) |
| 21 | from app.integrations.monitoring_alert.schema.provision import ( |
| 22 | CustomMonitoringAlertProvisionModel, |
| 23 | ) |
| 24 | from app.integrations.monitoring_alert.schema.provision import ( |
| 25 | ProvisionMonitoringAlertRequest, |
| 26 | ) |
| 27 | from app.integrations.monitoring_alert.schema.provision import ( |
| 28 | ProvisionWazuhMonitoringAlertResponse, |
| 29 | ) |
| 30 | from app.integrations.monitoring_alert.services.provision import ( |
| 31 | provision_crowdstrike_monitoring_alert, |
| 32 | ) |
| 33 | from app.integrations.monitoring_alert.services.provision import provision_custom_alert |
| 34 | from app.integrations.monitoring_alert.services.provision import ( |
| 35 | provision_fortinet_admin_user_created_from_public_ip_monitoring_alert, |
| 36 | ) |
| 37 | from app.integrations.monitoring_alert.services.provision import ( |
| 38 | provision_fortinet_firewall_virus_detected_monitoring_alert, |
| 39 | ) |
| 40 | from app.integrations.monitoring_alert.services.provision import ( |
| 41 | provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert, |
| 42 | ) |
| 43 | from app.integrations.monitoring_alert.services.provision import ( |
| 44 | provision_fortinet_ips_botnet_activity_detected_monitoring_alert, |
| 45 | ) |
| 46 | from app.integrations.monitoring_alert.services.provision import ( |
| 47 | provision_fortinet_ips_malicious_url_detected_monitoring_alert, |
| 48 | ) |
| 49 | from app.integrations.monitoring_alert.services.provision import ( |
| 50 | provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert, |
| 51 | ) |
| 52 | from app.integrations.monitoring_alert.services.provision import ( |
| 53 | provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert, |
| 54 | ) |
| 55 | from app.integrations.monitoring_alert.services.provision import ( |
| 56 | provision_fortinet_system_monitoring_alert, |
| 57 | ) |
| 58 | from app.integrations.monitoring_alert.services.provision import ( |
| 59 | provision_fortinet_utm_monitoring_alert, |
| 60 | ) |
| 61 | from app.integrations.monitoring_alert.services.provision import ( |
| 62 | provision_fortinet_wids_rogue_access_point_detected_monitoring_alert, |
| 63 | ) |
| 64 | from app.integrations.monitoring_alert.services.provision import ( |
| 65 | provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert, |
| 66 | ) |
| 67 | from app.integrations.monitoring_alert.services.provision import ( |
| 68 | provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert, |
| 69 | ) |
| 70 | from app.integrations.monitoring_alert.services.provision import ( |
| 71 | provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert, |
| 72 | ) |
| 73 | from app.integrations.monitoring_alert.services.provision import ( |
| 74 | provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert, |
| 75 | ) |
| 76 | from app.integrations.monitoring_alert.services.provision import ( |
| 77 | provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert, |
| 78 | ) |
| 79 | from app.integrations.monitoring_alert.services.provision import ( |
| 80 | provision_fortinet_wids_wireless_threat_detected_monitoring_alert, |
| 81 | ) |
| 82 | from app.integrations.monitoring_alert.services.provision import ( |
| 83 | provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert, |
| 84 | ) |
| 85 | from app.integrations.monitoring_alert.services.provision import ( |
| 86 | provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert, |
| 87 | ) |
| 88 | from app.integrations.monitoring_alert.services.provision import ( |
| 89 | provision_mimecast_anonymizer_url_accessed_monitoring_alert, |
| 90 | ) |
| 91 | from app.integrations.monitoring_alert.services.provision import ( |
| 92 | provision_mimecast_compromised_site_url_accessed_monitoring_alert, |
| 93 | ) |
| 94 | from app.integrations.monitoring_alert.services.provision import ( |
| 95 | provision_mimecast_executable_file_attachment_delivered_monitoring_alert, |
| 96 | ) |
| 97 | from app.integrations.monitoring_alert.services.provision import ( |
| 98 | provision_mimecast_impersonation_email_delivered_monitoring_alert, |
| 99 | ) |
| 100 | from app.integrations.monitoring_alert.services.provision import ( |
| 101 | provision_mimecast_malicious_email_attachment_delivered_monitoring_alert, |
| 102 | ) |
| 103 | from app.integrations.monitoring_alert.services.provision import ( |
| 104 | provision_mimecast_malicious_email_link_accessed_monitoring_alert, |
| 105 | ) |
| 106 | from app.integrations.monitoring_alert.services.provision import ( |
| 107 | provision_mimecast_malicious_outbound_email_monitoring_alert, |
| 108 | ) |
| 109 | from app.integrations.monitoring_alert.services.provision import ( |
| 110 | provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert, |
| 111 | ) |
| 112 | from app.integrations.monitoring_alert.services.provision import ( |
| 113 | provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert, |
| 114 | ) |
| 115 | from app.integrations.monitoring_alert.services.provision import ( |
| 116 | provision_mimecast_phishing_email_delivered_monitoring_alert, |
| 117 | ) |
| 118 | from app.integrations.monitoring_alert.services.provision import ( |
| 119 | provision_mimecast_source_code_file_in_email_attachment_monitoring_alert, |
| 120 | ) |
| 121 | from app.integrations.monitoring_alert.services.provision import ( |
| 122 | provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert, |
| 123 | ) |
| 124 | from app.integrations.monitoring_alert.services.provision import ( |
| 125 | provision_office365_exchange_online_alert, |
| 126 | ) |
| 127 | from app.integrations.monitoring_alert.services.provision import ( |
| 128 | provision_office365_threat_intel_alert, |
| 129 | ) |
| 130 | from app.integrations.monitoring_alert.services.provision import ( |
| 131 | provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert, |
| 132 | ) |
| 133 | from app.integrations.monitoring_alert.services.provision import ( |
| 134 | provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert, |
| 135 | ) |
| 136 | from app.integrations.monitoring_alert.services.provision import ( |
| 137 | provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert, |
| 138 | ) |
| 139 | from app.integrations.monitoring_alert.services.provision import ( |
| 140 | provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert, |
| 141 | ) |
| 142 | from app.integrations.monitoring_alert.services.provision import ( |
| 143 | provision_paloalto_firewall_virus_allowed_monitoring_alert, |
| 144 | ) |
| 145 | from app.integrations.monitoring_alert.services.provision import ( |
| 146 | provision_paloalto_monitoring_alert, |
| 147 | ) |
| 148 | from app.integrations.monitoring_alert.services.provision import ( |
| 149 | provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert, |
| 150 | ) |
| 151 | from app.integrations.monitoring_alert.services.provision import ( |
| 152 | provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert, |
| 153 | ) |
| 154 | from app.integrations.monitoring_alert.services.provision import ( |
| 155 | provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert, |
| 156 | ) |
| 157 | from app.integrations.monitoring_alert.services.provision import ( |
| 158 | provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert, |
| 159 | ) |
| 160 | from app.integrations.monitoring_alert.services.provision import ( |
| 161 | provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert, |
| 162 | ) |
| 163 | from app.integrations.monitoring_alert.services.provision import ( |
| 164 | provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert, |
| 165 | ) |
| 166 | from app.integrations.monitoring_alert.services.provision import ( |
| 167 | provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert, |
| 168 | ) |
| 169 | from app.integrations.monitoring_alert.services.provision import ( |
| 170 | provision_sentinelone_new_path_exclusion_added_monitoring_alert, |
| 171 | ) |
| 172 | from app.integrations.monitoring_alert.services.provision import ( |
| 173 | provision_suricata_monitoring_alert, |
| 174 | ) |
| 175 | from app.integrations.monitoring_alert.services.provision import ( |
| 176 | provision_wazuh_monitoring_alert, |
| 177 | ) |
| 178 | from app.integrations.utils.event_shipper import event_shipper |
| 179 | from app.integrations.utils.schema import EventShipperPayload |
| 180 | |
| 181 | monitoring_alerts_provision_router = APIRouter() |
| 182 | |
| 183 | |
| 184 | async def get_customer_meta(customer_code: str, session: AsyncSession) -> CustomersMeta: |
| 185 | """ |
| 186 | Get the customer meta for the given customer_code. |
| 187 | |
| 188 | Args: |
| 189 | customer_code (str): The customer code. |
| 190 | session (AsyncSession): The database session. |
| 191 | |
| 192 | Returns: |
| 193 | CustomersMeta: The customer meta. |
| 194 | """ |
| 195 | logger.info(f"Getting customer meta for customer_code: {customer_code}") |
| 196 | |
| 197 | customer_meta = await session.execute( |
| 198 | select(CustomersMeta).where(CustomersMeta.customer_code == customer_code), |
| 199 | ) |
| 200 | customer_meta = customer_meta.scalars().first() |
| 201 | |
| 202 | if not customer_meta: |
| 203 | logger.info(f"Getting customer meta for customer_meta_office365_organization_id: {customer_code}") |
| 204 | customer_meta = await session.execute( |
| 205 | select(CustomersMeta).where(CustomersMeta.customer_meta_office365_organization_id == customer_code), |
| 206 | ) |
| 207 | customer_meta = customer_meta.scalars().first() |
| 208 | |
| 209 | if not customer_meta: |
| 210 | raise HTTPException(status_code=404, detail="Customer not found") |
| 211 | |
| 212 | return customer_meta |
| 213 | |
| 214 | |
| 215 | async def return_stream_ids(stream_names: List[str]) -> List[str]: |
| 216 | """ |
| 217 | Return the stream IDs for the given stream names. |
| 218 | |
| 219 | Args: |
| 220 | stream_names (List[str]): A list of stream names. |
| 221 | |
| 222 | Returns: |
| 223 | List[str]: A list of stream IDs. |
| 224 | """ |
| 225 | all_streams_response = await get_streams() |
| 226 | all_streams = all_streams_response.streams |
| 227 | stream_ids = [stream.id for stream in all_streams if stream.title in stream_names] |
| 228 | logger.info(f"Stream IDs collected: {stream_ids}") |
| 229 | return stream_ids |
| 230 | |
| 231 | |
| 232 | # Define your provision functions |
| 233 | async def invoke_provision_wazuh_monitoring_alert( |
| 234 | request: ProvisionMonitoringAlertRequest, |
| 235 | ): |
| 236 | # Provision the Wazuh monitoring alert |
| 237 | await provision_wazuh_monitoring_alert(request) |
| 238 | |
| 239 | |
| 240 | async def invoke_provision_suricata_monitoring_alert( |
| 241 | request: ProvisionMonitoringAlertRequest, |
| 242 | ): |
| 243 | # Provision the Suricata monitoring alert |
| 244 | await provision_suricata_monitoring_alert(request) |
| 245 | |
| 246 | |
| 247 | async def invoke_provision_office365_exchange_online_alert( |
| 248 | request: ProvisionMonitoringAlertRequest, |
| 249 | ): |
| 250 | # Provision the Office365 Exchange Online monitoring alert |
| 251 | await provision_office365_exchange_online_alert(request) |
| 252 | |
| 253 | |
| 254 | async def invoke_provision_office365_threat_intel_alert( |
| 255 | request: ProvisionMonitoringAlertRequest, |
| 256 | ): |
| 257 | # Provision the Office365 Threat Intel monitoring alert |
| 258 | await provision_office365_threat_intel_alert(request) |
| 259 | |
| 260 | |
| 261 | async def invoke_provision_crowdstrike_monitoring_alert( |
| 262 | request: ProvisionMonitoringAlertRequest, |
| 263 | ): |
| 264 | # Provision the CrowdStrike monitoring alert |
| 265 | await provision_crowdstrike_monitoring_alert(request) |
| 266 | |
| 267 | |
| 268 | async def invoke_provision_fortinet_system_monitoring_alert( |
| 269 | request: ProvisionMonitoringAlertRequest, |
| 270 | ): |
| 271 | # Provision the Fortinet System monitoring alert |
| 272 | await provision_fortinet_system_monitoring_alert(request) |
| 273 | |
| 274 | |
| 275 | async def invoke_provision_fortinet_utm_monitoring_alert( |
| 276 | request: ProvisionMonitoringAlertRequest, |
| 277 | ): |
| 278 | # Provision the Fortinet UTM monitoring alert |
| 279 | await provision_fortinet_utm_monitoring_alert(request) |
| 280 | |
| 281 | |
| 282 | async def invoke_provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert( |
| 283 | request: ProvisionMonitoringAlertRequest, |
| 284 | ): |
| 285 | await provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert( |
| 286 | request, |
| 287 | ) |
| 288 | |
| 289 | |
| 290 | async def invoke_provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert( |
| 291 | request: ProvisionMonitoringAlertRequest, |
| 292 | ): |
| 293 | await provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert( |
| 294 | request, |
| 295 | ) |
| 296 | |
| 297 | |
| 298 | async def invoke_provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert( |
| 299 | request: ProvisionMonitoringAlertRequest, |
| 300 | ): |
| 301 | await provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert( |
| 302 | request, |
| 303 | ) |
| 304 | |
| 305 | |
| 306 | async def invoke_provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert( |
| 307 | request: ProvisionMonitoringAlertRequest, |
| 308 | ): |
| 309 | await provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert( |
| 310 | request, |
| 311 | ) |
| 312 | |
| 313 | |
| 314 | async def invoke_provision_fortinet_wids_rogue_access_point_detected_monitoring_alert( |
| 315 | request: ProvisionMonitoringAlertRequest, |
| 316 | ): |
| 317 | await provision_fortinet_wids_rogue_access_point_detected_monitoring_alert( |
| 318 | request, |
| 319 | ) |
| 320 | |
| 321 | |
| 322 | async def invoke_provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert( |
| 323 | request: ProvisionMonitoringAlertRequest, |
| 324 | ): |
| 325 | await provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert( |
| 326 | request, |
| 327 | ) |
| 328 | |
| 329 | |
| 330 | async def invoke_provision_fortinet_firewall_virus_detected_monitoring_alert( |
| 331 | request: ProvisionMonitoringAlertRequest, |
| 332 | ): |
| 333 | await provision_fortinet_firewall_virus_detected_monitoring_alert(request) |
| 334 | |
| 335 | |
| 336 | async def invoke_provision_fortinet_wids_wireless_threat_detected_monitoring_alert( |
| 337 | request: ProvisionMonitoringAlertRequest, |
| 338 | ): |
| 339 | await provision_fortinet_wids_wireless_threat_detected_monitoring_alert(request) |
| 340 | |
| 341 | |
| 342 | async def invoke_provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert( |
| 343 | request: ProvisionMonitoringAlertRequest, |
| 344 | ): |
| 345 | await provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert( |
| 346 | request, |
| 347 | ) |
| 348 | |
| 349 | |
| 350 | async def invoke_provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert( |
| 351 | request: ProvisionMonitoringAlertRequest, |
| 352 | ): |
| 353 | await provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert( |
| 354 | request, |
| 355 | ) |
| 356 | |
| 357 | |
| 358 | async def invoke_provision_fortinet_ips_malicious_url_detected_monitoring_alert( |
| 359 | request: ProvisionMonitoringAlertRequest, |
| 360 | ): |
| 361 | await provision_fortinet_ips_malicious_url_detected_monitoring_alert(request) |
| 362 | |
| 363 | |
| 364 | async def invoke_provision_fortinet_ips_botnet_activity_detected_monitoring_alert( |
| 365 | request: ProvisionMonitoringAlertRequest, |
| 366 | ): |
| 367 | await provision_fortinet_ips_botnet_activity_detected_monitoring_alert(request) |
| 368 | |
| 369 | |
| 370 | async def invoke_provision_fortinet_admin_user_created_from_public_ip_monitoring_alert( |
| 371 | request: ProvisionMonitoringAlertRequest, |
| 372 | ): |
| 373 | await provision_fortinet_admin_user_created_from_public_ip_monitoring_alert(request) |
| 374 | |
| 375 | |
| 376 | async def invoke_provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert( |
| 377 | request: ProvisionMonitoringAlertRequest, |
| 378 | ): |
| 379 | await provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert( |
| 380 | request, |
| 381 | ) |
| 382 | |
| 383 | |
| 384 | async def invoke_provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert( |
| 385 | request: ProvisionMonitoringAlertRequest, |
| 386 | ): |
| 387 | await provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert( |
| 388 | request, |
| 389 | ) |
| 390 | |
| 391 | |
| 392 | async def invoke_provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert( |
| 393 | request: ProvisionMonitoringAlertRequest, |
| 394 | ): |
| 395 | await provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert( |
| 396 | request, |
| 397 | ) |
| 398 | |
| 399 | |
| 400 | async def invoke_provision_paloalto_monitoring_alert( |
| 401 | request: ProvisionMonitoringAlertRequest, |
| 402 | ): |
| 403 | # Provision the Palo Alto monitoring alert |
| 404 | await provision_paloalto_monitoring_alert(request) |
| 405 | |
| 406 | |
| 407 | async def invoke_provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert( |
| 408 | request: ProvisionMonitoringAlertRequest, |
| 409 | ): |
| 410 | await provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert( |
| 411 | request, |
| 412 | ) |
| 413 | |
| 414 | |
| 415 | async def invoke_provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert( |
| 416 | request: ProvisionMonitoringAlertRequest, |
| 417 | ): |
| 418 | await provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert( |
| 419 | request, |
| 420 | ) |
| 421 | |
| 422 | |
| 423 | async def invoke_provision_paloalto_firewall_virus_allowed_monitoring_alert( |
| 424 | request: ProvisionMonitoringAlertRequest, |
| 425 | ): |
| 426 | await provision_paloalto_firewall_virus_allowed_monitoring_alert(request) |
| 427 | |
| 428 | |
| 429 | async def invoke_provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert( |
| 430 | request: ProvisionMonitoringAlertRequest, |
| 431 | ): |
| 432 | await provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert(request) |
| 433 | |
| 434 | |
| 435 | async def invoke_provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert( |
| 436 | request: ProvisionMonitoringAlertRequest, |
| 437 | ): |
| 438 | await provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert( |
| 439 | request, |
| 440 | ) |
| 441 | |
| 442 | |
| 443 | async def invoke_provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert( |
| 444 | request: ProvisionMonitoringAlertRequest, |
| 445 | ): |
| 446 | await provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert( |
| 447 | request, |
| 448 | ) |
| 449 | |
| 450 | |
| 451 | async def invoke_provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert( |
| 452 | request: ProvisionMonitoringAlertRequest, |
| 453 | ): |
| 454 | await provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert( |
| 455 | request, |
| 456 | ) |
| 457 | |
| 458 | |
| 459 | async def invoke_provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert( |
| 460 | request: ProvisionMonitoringAlertRequest, |
| 461 | ): |
| 462 | await provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert( |
| 463 | request, |
| 464 | ) |
| 465 | |
| 466 | |
| 467 | async def invoke_provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert( |
| 468 | request: ProvisionMonitoringAlertRequest, |
| 469 | ): |
| 470 | await provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert( |
| 471 | request, |
| 472 | ) |
| 473 | |
| 474 | |
| 475 | async def invoke_provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert( |
| 476 | request: ProvisionMonitoringAlertRequest, |
| 477 | ): |
| 478 | await provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert( |
| 479 | request, |
| 480 | ) |
| 481 | |
| 482 | |
| 483 | async def invoke_provision_sentinelone_new_path_exclusion_added_monitoring_alert( |
| 484 | request: ProvisionMonitoringAlertRequest, |
| 485 | ): |
| 486 | await provision_sentinelone_new_path_exclusion_added_monitoring_alert( |
| 487 | request, |
| 488 | ) |
| 489 | |
| 490 | |
| 491 | async def invoke_provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert( |
| 492 | request: ProvisionMonitoringAlertRequest, |
| 493 | ): |
| 494 | await provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert( |
| 495 | request, |
| 496 | ) |
| 497 | |
| 498 | |
| 499 | async def invoke_provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert( |
| 500 | request: ProvisionMonitoringAlertRequest, |
| 501 | ): |
| 502 | await provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert( |
| 503 | request, |
| 504 | ) |
| 505 | |
| 506 | |
| 507 | async def invoke_provision_mimecast_compromised_site_url_accessed_monitoring_alert( |
| 508 | request: ProvisionMonitoringAlertRequest, |
| 509 | ): |
| 510 | await provision_mimecast_compromised_site_url_accessed_monitoring_alert(request) |
| 511 | |
| 512 | |
| 513 | async def invoke_provision_mimecast_executable_file_attachment_delivered_monitoring_alert( |
| 514 | request: ProvisionMonitoringAlertRequest, |
| 515 | ): |
| 516 | await provision_mimecast_executable_file_attachment_delivered_monitoring_alert(request) |
| 517 | |
| 518 | |
| 519 | async def invoke_provision_mimecast_malicious_email_attachment_delivered_monitoring_alert( |
| 520 | request: ProvisionMonitoringAlertRequest, |
| 521 | ): |
| 522 | await provision_mimecast_malicious_email_attachment_delivered_monitoring_alert(request) |
| 523 | |
| 524 | |
| 525 | async def invoke_provision_mimecast_malicious_email_link_accessed_monitoring_alert( |
| 526 | request: ProvisionMonitoringAlertRequest, |
| 527 | ): |
| 528 | await provision_mimecast_malicious_email_link_accessed_monitoring_alert(request) |
| 529 | |
| 530 | |
| 531 | async def invoke_provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert( |
| 532 | request: ProvisionMonitoringAlertRequest, |
| 533 | ): |
| 534 | await provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert(request) |
| 535 | |
| 536 | |
| 537 | async def invoke_provision_mimecast_anonymizer_url_accessed_monitoring_alert( |
| 538 | request: ProvisionMonitoringAlertRequest, |
| 539 | ): |
| 540 | await provision_mimecast_anonymizer_url_accessed_monitoring_alert(request) |
| 541 | |
| 542 | |
| 543 | async def invoke_provision_mimecast_impersonation_email_delivered_monitoring_alert( |
| 544 | request: ProvisionMonitoringAlertRequest, |
| 545 | ): |
| 546 | await provision_mimecast_impersonation_email_delivered_monitoring_alert(request) |
| 547 | |
| 548 | |
| 549 | async def invoke_provision_mimecast_malicious_outbound_email_monitoring_alert( |
| 550 | request: ProvisionMonitoringAlertRequest, |
| 551 | ): |
| 552 | await provision_mimecast_malicious_outbound_email_monitoring_alert(request) |
| 553 | |
| 554 | |
| 555 | async def invoke_provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert( |
| 556 | request: ProvisionMonitoringAlertRequest, |
| 557 | ): |
| 558 | await provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert(request) |
| 559 | |
| 560 | |
| 561 | async def invoke_provision_mimecast_phishing_email_delivered_monitoring_alert( |
| 562 | request: ProvisionMonitoringAlertRequest, |
| 563 | ): |
| 564 | await provision_mimecast_phishing_email_delivered_monitoring_alert(request) |
| 565 | |
| 566 | |
| 567 | async def invoke_provision_mimecast_source_code_file_in_email_attachment_monitoring_alert( |
| 568 | request: ProvisionMonitoringAlertRequest, |
| 569 | ): |
| 570 | await provision_mimecast_source_code_file_in_email_attachment_monitoring_alert(request) |
| 571 | |
| 572 | |
| 573 | async def invoke_provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert( |
| 574 | request: ProvisionMonitoringAlertRequest, |
| 575 | ): |
| 576 | await provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert(request) |
| 577 | |
| 578 | |
| 579 | async def invoke_provision_custom_monitoring_alert( |
| 580 | request: CustomMonitoringAlertProvisionModel, |
| 581 | ): |
| 582 | # Provision the custom monitoring alert |
| 583 | await provision_custom_alert(request) |
| 584 | |
| 585 | |
| 586 | # Create a dictionary that maps alert names to provision functions |
| 587 | PROVISION_FUNCTIONS = { |
| 588 | "WAZUH_SYSLOG_LEVEL_ALERT": invoke_provision_wazuh_monitoring_alert, |
| 589 | "SURICATA_ALERT_SEVERITY_1": invoke_provision_suricata_monitoring_alert, |
| 590 | "OFFICE365_EXCHANGE_ONLINE": invoke_provision_office365_exchange_online_alert, |
| 591 | "OFFICE365_THREAT_INTEL": invoke_provision_office365_threat_intel_alert, |
| 592 | "CROWDSTRIKE_ALERT": invoke_provision_crowdstrike_monitoring_alert, |
| 593 | "FORTINET_SYSTEM": invoke_provision_fortinet_system_monitoring_alert, |
| 594 | "FORTINET_UTM": invoke_provision_fortinet_utm_monitoring_alert, |
| 595 | "FORTINET_FORTIWEB_PATH_TRAVERSAL_VULNERABILITY_EXPLOITATION_ATTEMPT": invoke_provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert, |
| 596 | "FORTINET_WIDS_WIRELESS_VALID_CLIENT_MISASSOCIATION_DETECTED": invoke_provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert, |
| 597 | "FORTINET_WIDS_WIRELESS_MANAGEMENT_FLOODING_DETECTED": invoke_provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert, |
| 598 | "FORTINET_WIDS_WIRELESS_EAPOL_PACKET_FLOODING_DETECTED": invoke_provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert, |
| 599 | "FORTINET_WIDS_ROGUE_ACCESS_POINT_DETECTED": invoke_provision_fortinet_wids_rogue_access_point_detected_monitoring_alert, |
| 600 | "FORTINET_WIDS_WIRELESS_LONG_DURATION_ATTACK_DETECTED": invoke_provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert, |
| 601 | "FORTINET_FIREWALL_VIRUS_DETECTED": invoke_provision_fortinet_firewall_virus_detected_monitoring_alert, |
| 602 | "FORTINET_WIDS_WIRELESS_THREAT_DETECTED": invoke_provision_fortinet_wids_wireless_threat_detected_monitoring_alert, |
| 603 | "FORTINET_WIDS_WIRELESS_INVALID_MAC_OUI_DETECTED": invoke_provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert, |
| 604 | "FORTINET_WIDS_WIRELESS_ASLEAP_ATTACK_DETECTED": invoke_provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert, |
| 605 | "FORTINET_IPS_MALICIOUS_URL_DETECTED": invoke_provision_fortinet_ips_malicious_url_detected_monitoring_alert, |
| 606 | "FORTINET_IPS_BOTNET_ACTIVITY_DETECTED": invoke_provision_fortinet_ips_botnet_activity_detected_monitoring_alert, |
| 607 | "FORTINET_ADMIN_USER_CREATED_FROM_PUBLIC_IP": invoke_provision_fortinet_admin_user_created_from_public_ip_monitoring_alert, |
| 608 | "FORTINET_SUSPICIOUS_CONFIG_FILE_ACCESS_FROM_EXTERNAL_NETWORK": invoke_provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert, |
| 609 | "FORTINET_WIDS_WIRELESS_WEAK_ENCRYPTION_DETECTED": invoke_provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert, |
| 610 | "FORTINET_SUSPICIOUS_SUPER_ADMIN_LOGIN_DETECTED": invoke_provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert, |
| 611 | "PALOALTO_ALERT": invoke_provision_paloalto_monitoring_alert, |
| 612 | "PALOALTO_FIREWALL_TRAFFIC_TO_PHISHING_URL_ALLOWED": invoke_provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert, |
| 613 | "PALOALTO_FIREWALL_TRAFFIC_TO_MALICIOUS_URL_ALLOWED": invoke_provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert, |
| 614 | "PALOALTO_FIREWALL_VIRUS_ALLOWED": invoke_provision_paloalto_firewall_virus_allowed_monitoring_alert, |
| 615 | "PALOALTO_FIREWALL_TOR_TRAFFIC_ALLOWED": invoke_provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert, |
| 616 | "PALOALTO_FIREWALL_MEDIUM_SEVERITY_CORRELATION_EVENT_DETECTED": invoke_provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert, |
| 617 | "SENTINELONE_NEW_ACTIVE_THREAT_MALICIOUS_DETECTED": invoke_provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert, |
| 618 | "SENTINELONE_NEW_ACTIVE_THREAT_SUSPICIOUS_DETECTED": invoke_provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert, |
| 619 | "SENTINELONE_NEW_MITIGATION_KILL_PERFORMED_SUCCESSFULLY": invoke_provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert, |
| 620 | "SENTINELONE_NEW_MITIGATION_QUARANTINE_PERFORMED_SUCCESSFULLY": invoke_provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert, |
| 621 | "SENTINELONE_NEW_EXCLUSION_WAS_ADDED_OR_MODIFIED_BY_USER": invoke_provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert, |
| 622 | "SENTINELONE_NEW_PATH_EXCLUSION_ADDED": invoke_provision_sentinelone_new_path_exclusion_added_monitoring_alert, |
| 623 | "SENTINELONE_ANALYST_VERDICT_CHANGED_TO_TRUE_POSITIVE": invoke_provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert, |
| 624 | "SENTINELONE_ANALYST_VERDICT_CHANGED_TO_FALSE_POSITIVE": invoke_provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert, |
| 625 | "MIMECAST_COMPROMISED_SITE_URL_ACCESSED": invoke_provision_mimecast_compromised_site_url_accessed_monitoring_alert, |
| 626 | "MIMECAST_EXECUTABLE_FILE_ATTACHMENT_DELIVERED": invoke_provision_mimecast_executable_file_attachment_delivered_monitoring_alert, |
| 627 | "MIMECAST_MALICIOUS_EMAIL_ATTACHMENT_DELIVERED": invoke_provision_mimecast_malicious_email_attachment_delivered_monitoring_alert, |
| 628 | "MIMECAST_MALICIOUS_EMAIL_LINK_ACCESSED": invoke_provision_mimecast_malicious_email_link_accessed_monitoring_alert, |
| 629 | "MIMECAST_P2P_FILE_SHARING_URL_ACCESSED": invoke_provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert, |
| 630 | "MIMECAST_ANONYMIZER_URL_ACCESSED": invoke_provision_mimecast_anonymizer_url_accessed_monitoring_alert, |
| 631 | "MIMECAST_IMPERSONATION_EMAIL_DELIVERED": invoke_provision_mimecast_impersonation_email_delivered_monitoring_alert, |
| 632 | "MIMECAST_MALICIOUS_OUTBOUND_EMAIL": invoke_provision_mimecast_malicious_outbound_email_monitoring_alert, |
| 633 | "MIMECAST_MALICIOUS_RTF_ATTACHMENT_DELIVERED": invoke_provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert, |
| 634 | "MIMECAST_PHISHING_EMAIL_DELIVERED": invoke_provision_mimecast_phishing_email_delivered_monitoring_alert, |
| 635 | "MIMECAST_SOURCE_CODE_FILE_IN_EMAIL_ATTACHMENT": invoke_provision_mimecast_source_code_file_in_email_attachment_monitoring_alert, |
| 636 | "MIMECAST_URL_WITH_DANGEROUS_FILE_TYPE_ACCESSED": invoke_provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert, |
| 637 | "CUSTOM": invoke_provision_custom_monitoring_alert, |
| 638 | # Add more alert names and functions as needed |
| 639 | } |
| 640 | |
| 641 | |
| 642 | async def check_if_event_definition_exists(event_definition: str) -> bool: |
| 643 | """ |
| 644 | Check if the event definition exists. |
| 645 | |
| 646 | Args: |
| 647 | event_definition (str): The event definition to check. |
| 648 | |
| 649 | Returns: |
| 650 | bool: True if the event definition exists, False otherwise. |
| 651 | """ |
| 652 | event_definitions_response = await get_all_event_definitions() |
| 653 | if not event_definitions_response.success: |
| 654 | raise HTTPException( |
| 655 | status_code=500, |
| 656 | detail="Failed to collect event definitions", |
| 657 | ) |
| 658 | event_definitions_response = GraylogEventDefinitionsResponse( |
| 659 | **event_definitions_response.model_dump(), |
| 660 | ) |
| 661 | logger.info( |
| 662 | f"Event definitions collected: {event_definitions_response.event_definitions}", |
| 663 | ) |
| 664 | if event_definition in [event_definition.title for event_definition in event_definitions_response.event_definitions]: |
| 665 | raise HTTPException( |
| 666 | status_code=400, |
| 667 | detail=f"Event definition {event_definition} already exists", |
| 668 | ) |
| 669 | return False |
| 670 | |
| 671 | |
| 672 | @monitoring_alerts_provision_router.get( |
| 673 | "/available", |
| 674 | response_model=AvailableMonitoringAlertsResponse, |
| 675 | description="Get the available monitoring alerts.", |
| 676 | dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))], |
| 677 | ) |
| 678 | async def get_available_monitoring_alerts_route() -> AvailableMonitoringAlertsResponse: |
| 679 | """ |
| 680 | Get the available monitoring alerts. |
| 681 | """ |
| 682 | alerts = [{"name": alert.name.replace("_", " "), "value": alert.value} for alert in AvailableMonitoringAlerts] |
| 683 | return AvailableMonitoringAlertsResponse( |
| 684 | success=True, |
| 685 | message="Alerts retrieved successfully", |
| 686 | available_monitoring_alerts=alerts, |
| 687 | ) |
| 688 | |
| 689 | |
| 690 | @monitoring_alerts_provision_router.post( |
| 691 | "/provision", |
| 692 | response_model=ProvisionWazuhMonitoringAlertResponse, |
| 693 | description="Provisions monitoring alerts.", |
| 694 | dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))], |
| 695 | ) |
| 696 | async def provision_monitoring_alert_route( |
| 697 | request: ProvisionMonitoringAlertRequest, |
| 698 | ) -> ProvisionWazuhMonitoringAlertResponse: |
| 699 | await check_if_event_definition_exists(request.alert_name.replace("_", " ")) |
| 700 | |
| 701 | # Look up the provision function based on request.alert_name |
| 702 | provision_function = PROVISION_FUNCTIONS.get(request.alert_name) |
| 703 | |
| 704 | if provision_function is None: |
| 705 | raise HTTPException( |
| 706 | status_code=400, |
| 707 | detail=f"No provision function found for alert name {request.alert_name}", |
| 708 | ) |
| 709 | |
| 710 | # Invoke the provision function |
| 711 | await provision_function(request) |
| 712 | |
| 713 | return ProvisionWazuhMonitoringAlertResponse(success=True, message=f"Monitoring alert {request.alert_name} provisioned successfully.") |
| 714 | |
| 715 | |
| 716 | @monitoring_alerts_provision_router.post( |
| 717 | "/provision/custom", |
| 718 | response_model=ProvisionWazuhMonitoringAlertResponse, |
| 719 | description="Provisions custom monitoring alerts.", |
| 720 | dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))], |
| 721 | ) |
| 722 | async def provision_custom_monitoring_alert_route( |
| 723 | request: CustomMonitoringAlertProvisionModel, |
| 724 | session: AsyncSession = Depends(get_db), |
| 725 | ) -> ProvisionWazuhMonitoringAlertResponse: |
| 726 | await check_if_event_definition_exists(request.alert_name.replace("_", " ")) |
| 727 | # ! This is commented out because it is not used in the code. Will revisit later ! # |
| 728 | # customer_code = next((field.value for field in request.custom_fields if field.name == "CUSTOMER_CODE"), None) |
| 729 | # await get_customer_meta(customer_code=customer_code, session=session) |
| 730 | # Look up the provision function based on request.alert_name |
| 731 | provision_function = PROVISION_FUNCTIONS.get("CUSTOM") |
| 732 | |
| 733 | logger.info(f"Provisioning custom alert {request}") |
| 734 | |
| 735 | if provision_function is None: |
| 736 | raise HTTPException( |
| 737 | status_code=400, |
| 738 | detail=f"No provision function found for alert name {request.alert_name}", |
| 739 | ) |
| 740 | |
| 741 | # Invoke the provision function |
| 742 | await provision_function(request) |
| 743 | |
| 744 | return ProvisionWazuhMonitoringAlertResponse(success=True, message=f"Monitoring alert {request.alert_name} provisioned successfully.") |
| 745 | |
| 746 | |
| 747 | @monitoring_alerts_provision_router.post( |
| 748 | "/provision/testing", |
| 749 | response_model=ProvisionWazuhMonitoringAlertResponse, |
| 750 | description="Used for testing purposes. To test, upload a JSON document.", |
| 751 | dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))], |
| 752 | ) |
| 753 | async def provision_monitoring_alert_testing_route( |
| 754 | request: dict, |
| 755 | ) -> ProvisionWazuhMonitoringAlertResponse: |
| 756 | """ |
| 757 | Used for testing purposes. |
| 758 | """ |
| 759 | message = EventShipperPayload( |
| 760 | customer_code="00002", |
| 761 | integration="testing", |
| 762 | version="1.0", |
| 763 | **request, |
| 764 | ) |
| 765 | await event_shipper(message) |
| 766 | return ProvisionWazuhMonitoringAlertResponse( |
| 767 | success=True, |
| 768 | message="Event sent to log shipper successfully.", |
| 769 | ) |