provision.py · cryptotaxi247/CoPilot

Code Commits Issues Pulls Sessions CI/CD

main

py 3,514 lines 156 KB

Raw

1	from typing import Optional
2
3	from dotenv import load_dotenv
4	from fastapi import HTTPException
5	from loguru import logger
6
7	from app.connectors.graylog.routes.monitoring import get_all_event_notifications
8	from app.connectors.graylog.schema.management import UrlWhitelistEntryResponse
9	from app.connectors.graylog.schema.monitoring import GraylogEventNotificationsResponse
10	from app.connectors.graylog.services.collector import get_url_whitelist_entries
11	from app.connectors.graylog.utils.universal import send_post_request_create_entity
12	from app.connectors.graylog.utils.universal import send_put_request
13	from app.integrations.monitoring_alert.schema.provision import (
14	CustomMonitoringAlertProvisionModel,
15	)
16	from app.integrations.monitoring_alert.schema.provision import (
17	GraylogAlertProvisionConfig,
18	)
19	from app.integrations.monitoring_alert.schema.provision import (
20	GraylogAlertProvisionFieldSpecItem,
21	)
22	from app.integrations.monitoring_alert.schema.provision import (
23	GraylogAlertProvisionModel,
24	)
25	from app.integrations.monitoring_alert.schema.provision import (
26	GraylogAlertProvisionNotificationSettings,
27	)
28	from app.integrations.monitoring_alert.schema.provision import (
29	GraylogAlertProvisionProvider,
30	)
31	from app.integrations.monitoring_alert.schema.provision import (
32	GraylogAlertWebhookNotificationModel,
33	)
34	from app.integrations.monitoring_alert.schema.provision import (
35	GraylogUrlWhitelistEntries,
36	)
37	from app.integrations.monitoring_alert.schema.provision import (
38	GraylogUrlWhitelistEntryConfig,
39	)
40	from app.integrations.monitoring_alert.schema.provision import (
41	ProvisionMonitoringAlertRequest,
42	)
43	from app.integrations.monitoring_alert.schema.provision import (
44	ProvisionWazuhMonitoringAlertResponse,
45	)
46	from app.stack_provisioning.graylog.services.utils import get_graylog_version
47
48	load_dotenv()
49	import uuid
50
51
52	async def convert_seconds_to_milliseconds(seconds: int) -> int:
53	"""
54	Convert seconds to milliseconds.
55
56	Args:
57	seconds (int): The seconds to convert.
58
59	Returns:
60	int: The milliseconds.
61	"""
62	return seconds * 1000
63
64
65	async def generate_random_id() -> str:
66	"""
67	Generate a random id.
68
69	Returns:
70	str: The random id.
71	"""
72	return str(uuid.uuid4())
73
74
75	async def check_if_url_whitelist_entry_exists(url: str) -> bool:
76	"""
77	Check if the url whitelist entry exists.
78
79	Args:
80	url (str): The url to check.
81
82	Returns:
83	bool: True if the url whitelist entry exists, False otherwise.
84	"""
85	url_whitelist_entries_response = await get_url_whitelist_entries()
86	if not url_whitelist_entries_response.success:
87	raise HTTPException(
88	status_code=500,
89	detail="Failed to collect url whitelist entries",
90	)
91	url_whitelist_entries_response = UrlWhitelistEntryResponse(
92	**url_whitelist_entries_response.model_dump(),
93	)
94	logger.info(
95	f"Url whitelist entries collected: {url_whitelist_entries_response.url_whitelist_entries}",
96	)
97	if url in [url_whitelist_entry.value for url_whitelist_entry in url_whitelist_entries_response.url_whitelist_entries.entries]:
98	logger.info(f"Url whitelist entry {url} already exists")
99	return True
100	return False
101
102
103	async def get_notification_id(notification_title: str) -> Optional[str]:
104	"""
105	Get the notification id.
106
107	Args:
108	notification_title (str): The notification title.
109
110	Returns:
111	Optional[str]: The notification id if it exists, None otherwise.
112	"""
113	event_notifications_response = await get_all_event_notifications()
114	if not event_notifications_response.success:
115	raise HTTPException(
116	status_code=500,
117	detail="Failed to collect event notifications",
118	)
119	event_notifications_response = GraylogEventNotificationsResponse(
120	**event_notifications_response.model_dump(),
121	)
122	logger.info(
123	f"Event notifications collected: {event_notifications_response.event_notifications}",
124	)
125	for event_notification in event_notifications_response.event_notifications.notifications:
126	if event_notification.title == notification_title:
127	return event_notification.id
128	return None
129
130
131	async def build_url_whitelisted_entries(
132	whitelist_url_model: GraylogUrlWhitelistEntryConfig,
133	) -> GraylogUrlWhitelistEntries:
134	"""
135	Builds the URL Whitelisted Entries model.
136
137	Returns:
138	GraylogUrlWhitelistEntries: The URL Whitelisted Entries model.
139	"""
140	url_whitelist_entries_response = await get_url_whitelist_entries()
141	if not url_whitelist_entries_response.success:
142	raise HTTPException(
143	status_code=500,
144	detail="Failed to collect url whitelist entries",
145	)
146	url_whitelist_entries_response = UrlWhitelistEntryResponse(
147	**url_whitelist_entries_response.model_dump(),
148	)
149	logger.info(f"Url whitelist entries collected: {url_whitelist_entries_response}")
150	url_whitelist_entries = url_whitelist_entries_response.url_whitelist_entries.entries
151	url_whitelist_entries.append(whitelist_url_model)
152	return GraylogUrlWhitelistEntries(
153	entries=url_whitelist_entries,
154	disabled=False,
155	)
156
157
158	async def provision_webhook_url_whitelist(
159	whitelist_url_model: GraylogUrlWhitelistEntries,
160	) -> bool:
161	"""
162	Provisions a webhook URL for Graylog.
163
164	Args:
165	whitelist_url_model (GraylogUrlWhitelistEntryConfig): The webhook URL model.
166
167	Returns:
168	bool: True if the webhook URL was provisioned successfully, False otherwise.
169	"""
170	logger.info(f"Provisioning URL Whitelist: {whitelist_url_model.model_dump()}")
171	response = await send_put_request(
172	endpoint="/api/system/urlwhitelist",
173	data=whitelist_url_model.model_dump(),
174	)
175	logger.info(f"URL Whitelist provisioned: {response}")
176	if response["success"]:
177	return True
178	raise HTTPException(status_code=500, detail="Failed to provision URL Whitelist")
179
180
181	async def check_if_event_notification_exists(event_notification: str) -> bool:
182	"""
183	Check if the event notification exists.
184
185	Args:
186	event_notification (str): The event notification to check.
187
188	Returns:
189	bool: True if the event notification exists, False otherwise.
190	"""
191	event_notifications_response = await get_all_event_notifications()
192	if not event_notifications_response.success:
193	raise HTTPException(
194	status_code=500,
195	detail="Failed to collect event notifications",
196	)
197	event_notifications_response = GraylogEventNotificationsResponse(
198	**event_notifications_response.model_dump(),
199	)
200	logger.info(
201	f"Event notifications collected: {event_notifications_response.event_notifications}",
202	)
203	if event_notification in [
204	event_notification.title for event_notification in event_notifications_response.event_notifications.notifications
205	]:
206	return True
207	return False
208
209
210	async def provision_webhook(
211	webhook_model: GraylogAlertWebhookNotificationModel,
212	) -> Optional[str]:
213	"""
214	Provisions a webhook for Graylog alerts.
215
216	Args:
217	webhook_model (GraylogAlertWebhookNotificationModel): The webhook model.
218
219	Returns:
220	bool: True if the webhook was provisioned successfully, False otherwise.
221	"""
222	response = await send_post_request_create_entity(
223	endpoint="/api/events/notifications",
224	entity=webhook_model.model_dump(),
225	)
226	if response["success"]:
227	logger.info(f"response: {response}")
228	return response["data"]["id"]
229	raise HTTPException(status_code=500, detail="Failed to provision webhook")
230
231
232	async def provision_alert_definition(
233	alert_definition_model: GraylogAlertProvisionModel,
234	) -> bool:
235	"""
236	Provisions an alert definition for Graylog.
237
238	Args:
239	alert_definition_model (GraylogAlertProvisionModel): The alert definition model.
240
241	Returns:
242	bool: True if the alert definition was provisioned successfully, False otherwise.
243	"""
244	# If the graylog version is less than 5.2, remove the `event_limit` key from the config
245	graylog_version = await get_graylog_version()
246	logger.info(f"Graylog version: {graylog_version}")
247	if graylog_version < "5.2":
248	logger.info("Graylog version is less than 5.2. Removing event_limit from config")
249	if hasattr(alert_definition_model.config, "event_limit"):
250	delattr(alert_definition_model.config, "event_limit")
251
252	response = await send_post_request_create_entity(
253	endpoint="/api/events/definitions",
254	entity=alert_definition_model.model_dump(),
255	)
256	logger.info(f"Graylog alert definition provisioned response: {response}")
257	if response["success"]:
258	return True
259	raise HTTPException(status_code=500, detail="Failed to provision alert definition")
260
261
262	async def provision_wazuh_monitoring_alert(
263	request: ProvisionMonitoringAlertRequest,
264	) -> ProvisionWazuhMonitoringAlertResponse:
265	"""
266	Provisions Wazuh monitoring alerts.
267
268	Returns:
269	ProvisionWazuhMonitoringAlertResponse: The response indicating the success of provisioning the monitoring alerts.
270	"""
271	#
272	logger.info(
273	f"Invoking provision_wazuh_monitoring_alert with request: {request.model_dump()}",
274	)
275	# ! TODO Commenting out for now since the plan is to pull from gl-events ! #
276	# notification_exists = await check_if_event_notification_exists("SEND TO COPILOT")
277	# if not notification_exists:
278	# # ! Unfortunately Graylog does not support disabling SSL verification when sending webhooks
279	# # ! Therefore, we need to send to API port of Copilot over HTTP
280	# url_whitelisted = await check_if_url_whitelist_entry_exists(
281	# f"http://{os.getenv('ALERT_FORWARDING_IP')}:5000/api/monitoring_alert/create",
282	# )
283	# if not url_whitelisted:
284	# logger.info("Provisioning URL Whitelist")
285	# whitelisted_urls = await build_url_whitelisted_entries(
286	# whitelist_url_model=GraylogUrlWhitelistEntryConfig(
287	# id=await generate_random_id(),
288	# value=f"http://{os.getenv('ALERT_FORWARDING_IP')}:5000/api/monitoring_alert/create",
289	# title="SEND TO COPILOT",
290	# type="literal",
291	# ),
292	# )
293	# await provision_webhook_url_whitelist(whitelisted_urls)
294
295	# logger.info("Provisioning SEND TO COPILOT Webhook")
296	# notification_id = await provision_webhook(
297	# GraylogAlertWebhookNotificationModel(
298	# title="SEND TO COPILOT",
299	# description="Send alert to Copilot",
300	# config={
301	# "url": f"http://{os.getenv('ALERT_FORWARDING_IP')}:5000/api/monitoring_alert/create",
302	# "type": "http-notification-v1",
303	# },
304	# ),
305	# )
306	# notification_id = await get_notification_id("SEND TO COPILOT")
307	await provision_alert_definition(
308	GraylogAlertProvisionModel(
309	title="WAZUH SYSLOG LEVEL ALERT",
310	description="Alert on Wazuh syslog level equal to ALERT",
311	priority=2,
312	config=GraylogAlertProvisionConfig(
313	type="aggregation-v1",
314	query="syslog_level:ALERT AND syslog_type:wazuh AND NOT (rule_group1:office365 OR rule_group1:vulnerability-detector)",
315	query_parameters=[],
316	streams=[],
317	group_by=[],
318	series=[],
319	conditions={
320	"expression": None,
321	},
322	search_within_ms=await convert_seconds_to_milliseconds(
323	request.search_within_last,
324	),
325	execute_every_ms=await convert_seconds_to_milliseconds(
326	request.execute_every,
327	),
328	event_limit=1000,
329	),
330	field_spec={
331	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
332	data_type="string",
333	providers=[
334	GraylogAlertProvisionProvider(
335	type="template-v1",
336	template="${source._id}",
337	require_values=True,
338	),
339	],
340	),
341	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
342	data_type="string",
343	providers=[
344	GraylogAlertProvisionProvider(
345	type="template-v1",
346	template="${source.agent_labels_customer}",
347	require_values=True,
348	),
349	],
350	),
351	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
352	data_type="string",
353	providers=[
354	GraylogAlertProvisionProvider(
355	type="template-v1",
356	template="WAZUH",
357	require_values=True,
358	),
359	],
360	),
361	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
362	data_type="string",
363	providers=[
364	GraylogAlertProvisionProvider(
365	type="template-v1",
366	template="NONE",
367	require_values=True,
368	),
369	],
370	),
371	},
372	key_spec=[],
373	notification_settings=GraylogAlertProvisionNotificationSettings(
374	grace_period_ms=0,
375	backlog_size=None,
376	),
377	# notifications=[
378	# GraylogAlertProvisionNotification(
379	# notification_id=notification_id,
380	# ),
381	# ],
382	alert=True,
383	),
384	)
385
386	return ProvisionWazuhMonitoringAlertResponse(
387	success=True,
388	message="Wazuh monitoring alerts provisioned successfully",
389	)
390
391
392	async def provision_suricata_monitoring_alert(
393	request: ProvisionMonitoringAlertRequest,
394	) -> ProvisionWazuhMonitoringAlertResponse:
395	"""
396	Provisions Suricata monitoring alerts.
397
398	Returns:
399	ProvisionWazuhMonitoringAlertResponse: The response indicating the success of provisioning the monitoring alerts.
400	"""
401	#
402	logger.info(
403	f"Invoking provision_suricata_monitoring_alert with request: {request.model_dump()}",
404	)
405	await provision_alert_definition(
406	GraylogAlertProvisionModel(
407	title="SURICATA ALERT SEVERITY 1",
408	description="Alert on Suricata alerts",
409	priority=2,
410	config=GraylogAlertProvisionConfig(
411	type="aggregation-v1",
412	query="alert_severity:1 AND syslog_type:suricata",
413	query_parameters=[],
414	streams=[],
415	group_by=[],
416	series=[],
417	conditions={
418	"expression": None,
419	},
420	search_within_ms=await convert_seconds_to_milliseconds(
421	request.search_within_last,
422	),
423	execute_every_ms=await convert_seconds_to_milliseconds(
424	request.execute_every,
425	),
426	event_limit=1000,
427	),
428	field_spec={
429	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
430	data_type="string",
431	providers=[
432	GraylogAlertProvisionProvider(
433	type="template-v1",
434	template="${source._id}",
435	require_values=True,
436	),
437	],
438	),
439	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
440	data_type="string",
441	providers=[
442	GraylogAlertProvisionProvider(
443	type="template-v1",
444	template="${source.agent_labels_customer}",
445	require_values=True,
446	),
447	],
448	),
449	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
450	data_type="string",
451	providers=[
452	GraylogAlertProvisionProvider(
453	type="template-v1",
454	template="SURICATA",
455	require_values=True,
456	),
457	],
458	),
459	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
460	data_type="string",
461	providers=[
462	GraylogAlertProvisionProvider(
463	type="template-v1",
464	template="NONE",
465	require_values=True,
466	),
467	],
468	),
469	},
470	key_spec=[],
471	notification_settings=GraylogAlertProvisionNotificationSettings(
472	grace_period_ms=0,
473	backlog_size=None,
474	),
475	alert=True,
476	),
477	)
478
479	return ProvisionWazuhMonitoringAlertResponse(
480	success=True,
481	message="Suricata monitoring alerts provisioned successfully",
482	)
483
484
485	async def provision_office365_exchange_online_alert(
486	request: ProvisionMonitoringAlertRequest,
487	) -> ProvisionWazuhMonitoringAlertResponse:
488	"""
489	Provisions Office365 Exchange Online monitoring alerts.
490
491	Returns:
492	ProvisionWazuhMonitoringAlertResponse: The response indicating the success of provisioning the monitoring alerts.
493	"""
494	#
495	logger.info(
496	f"Invoking provision_office365_exchange_online_alert with request: {request.model_dump()}",
497	)
498	await provision_alert_definition(
499	GraylogAlertProvisionModel(
500	title="OFFICE365 EXCHANGE ONLINE",
501	description="Alert on Office365 Exchange Online alerts",
502	priority=2,
503	config=GraylogAlertProvisionConfig(
504	type="aggregation-v1",
505	query="syslog_level:ALERT AND data_office365_Subscription:Audit.Exchange",
506	query_parameters=[],
507	streams=[],
508	group_by=[],
509	series=[],
510	conditions={
511	"expression": None,
512	},
513	search_within_ms=await convert_seconds_to_milliseconds(
514	request.search_within_last,
515	),
516	execute_every_ms=await convert_seconds_to_milliseconds(
517	request.execute_every,
518	),
519	event_limit=1000,
520	),
521	field_spec={
522	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
523	data_type="string",
524	providers=[
525	GraylogAlertProvisionProvider(
526	type="template-v1",
527	template="${source._id}",
528	require_values=True,
529	),
530	],
531	),
532	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
533	data_type="string",
534	providers=[
535	GraylogAlertProvisionProvider(
536	type="template-v1",
537	template="${source.data_office365_OrganizationId}",
538	require_values=True,
539	),
540	],
541	),
542	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
543	data_type="string",
544	providers=[
545	GraylogAlertProvisionProvider(
546	type="template-v1",
547	template="OFFICE365_EXCHANGE_ONLINE",
548	require_values=True,
549	),
550	],
551	),
552	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
553	data_type="string",
554	providers=[
555	GraylogAlertProvisionProvider(
556	type="template-v1",
557	template="NONE",
558	require_values=True,
559	),
560	],
561	),
562	},
563	key_spec=[],
564	notification_settings=GraylogAlertProvisionNotificationSettings(
565	grace_period_ms=0,
566	backlog_size=None,
567	),
568	alert=True,
569	),
570	)
571
572	return ProvisionWazuhMonitoringAlertResponse(
573	success=True,
574	message="Office365 Exchange Online monitoring alerts provisioned successfully",
575	)
576
577
578	async def provision_office365_threat_intel_alert(
579	request: ProvisionMonitoringAlertRequest,
580	) -> ProvisionWazuhMonitoringAlertResponse:
581	"""
582	Provisions Office365 Threat Intel monitoring alerts.
583
584	Returns:
585	ProvisionWazuhMonitoringAlertResponse: The response indicating the success of provisioning the monitoring alerts.
586	"""
587	#
588	logger.info(
589	f"Invoking provision_office365_threat_intel_alert with request: {request.model_dump()}",
590	)
591	await provision_alert_definition(
592	GraylogAlertProvisionModel(
593	title="OFFICE365 THREAT INTEL",
594	description="Alert on Office365 Threat Intel alerts",
595	priority=2,
596	config=GraylogAlertProvisionConfig(
597	type="aggregation-v1",
598	query="syslog_level:ALERT AND data_office365_UserId:ThreatIntel AND NOT data_office365_DeliveryAction:Blocked",
599	query_parameters=[],
600	streams=[],
601	group_by=[],
602	series=[],
603	conditions={
604	"expression": None,
605	},
606	search_within_ms=await convert_seconds_to_milliseconds(
607	request.search_within_last,
608	),
609	execute_every_ms=await convert_seconds_to_milliseconds(
610	request.execute_every,
611	),
612	event_limit=1000,
613	),
614	field_spec={
615	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
616	data_type="string",
617	providers=[
618	GraylogAlertProvisionProvider(
619	type="template-v1",
620	template="${source._id}",
621	require_values=True,
622	),
623	],
624	),
625	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
626	data_type="string",
627	providers=[
628	GraylogAlertProvisionProvider(
629	type="template-v1",
630	template="${source.data_office365_OrganizationId}",
631	require_values=True,
632	),
633	],
634	),
635	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
636	data_type="string",
637	providers=[
638	GraylogAlertProvisionProvider(
639	type="template-v1",
640	template="OFFICE365_THREAT_INTEL",
641	require_values=True,
642	),
643	],
644	),
645	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
646	data_type="string",
647	providers=[
648	GraylogAlertProvisionProvider(
649	type="template-v1",
650	template="NONE",
651	require_values=True,
652	),
653	],
654	),
655	},
656	key_spec=[],
657	notification_settings=GraylogAlertProvisionNotificationSettings(
658	grace_period_ms=0,
659	backlog_size=None,
660	),
661	alert=True,
662	),
663	)
664
665	return ProvisionWazuhMonitoringAlertResponse(
666	success=True,
667	message="Office365 Threat Intel monitoring alerts provisioned successfully",
668	)
669
670
671	async def provision_crowdstrike_monitoring_alert(
672	request: ProvisionMonitoringAlertRequest,
673	) -> ProvisionWazuhMonitoringAlertResponse:
674	"""
675	Provisions Crowdstrike monitoring alerts.
676
677	Returns:
678	ProvisionWazuhMonitoringAlertResponse: The response indicating the success of provisioning the monitoring alerts.
679	"""
680	#
681	logger.info(
682	f"Invoking provision_crowdstrike_monitoring_alert with request: {request.model_dump()}",
683	)
684	await provision_alert_definition(
685	GraylogAlertProvisionModel(
686	title="CROWDSTRIKE ALERT",
687	description="Alert on Crowdstrike alerts",
688	priority=2,
689	config=GraylogAlertProvisionConfig(
690	type="aggregation-v1",
691	query="syslog_type:crowdstrike AND (syslog_level:Alert OR syslog_level:Warning)",
692	query_parameters=[],
693	streams=[],
694	group_by=[],
695	series=[],
696	conditions={
697	"expression": None,
698	},
699	search_within_ms=await convert_seconds_to_milliseconds(
700	request.search_within_last,
701	),
702	execute_every_ms=await convert_seconds_to_milliseconds(
703	request.execute_every,
704	),
705	event_limit=1000,
706	),
707	field_spec={
708	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
709	data_type="string",
710	providers=[
711	GraylogAlertProvisionProvider(
712	type="template-v1",
713	template="${source._id}",
714	require_values=True,
715	),
716	],
717	),
718	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
719	data_type="string",
720	providers=[
721	GraylogAlertProvisionProvider(
722	type="template-v1",
723	template="${source.syslog_customer}",
724	require_values=True,
725	),
726	],
727	),
728	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
729	data_type="string",
730	providers=[
731	GraylogAlertProvisionProvider(
732	type="template-v1",
733	template="CROWDSTRIKE",
734	require_values=True,
735	),
736	],
737	),
738	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
739	data_type="string",
740	providers=[
741	GraylogAlertProvisionProvider(
742	type="template-v1",
743	template="NONE",
744	require_values=True,
745	),
746	],
747	),
748	},
749	key_spec=[],
750	notification_settings=GraylogAlertProvisionNotificationSettings(
751	grace_period_ms=0,
752	backlog_size=None,
753	),
754	alert=True,
755	),
756	)
757
758	return ProvisionWazuhMonitoringAlertResponse(
759	success=True,
760	message="Crowdstrike monitoring alerts provisioned successfully",
761	)
762
763
764	async def provision_fortinet_system_monitoring_alert(
765	request: ProvisionMonitoringAlertRequest,
766	) -> ProvisionWazuhMonitoringAlertResponse:
767	"""
768	Provisions Fortinet system monitoring alerts.
769
770	Returns:
771	ProvisionWazuhMonitoringAlertResponse: The response indicating the success of provisioning the monitoring alerts.
772	"""
773	#
774	logger.info(
775	f"Invoking provision_fortinet_system_monitoring_alert with request: {request.model_dump()}",
776	)
777	await provision_alert_definition(
778	GraylogAlertProvisionModel(
779	title="FORTINET SYSTEM - CRITICAL EVENTS",
780	description="FORTINET SYSTEM - CRITICAL EVENTS",
781	priority=2,
782	config=GraylogAlertProvisionConfig(
783	type="aggregation-v1",
784	query="syslog_type:fortinet AND subtype:system AND level:critical",
785	query_parameters=[],
786	streams=[],
787	group_by=[],
788	series=[],
789	conditions={
790	"expression": None,
791	},
792	search_within_ms=await convert_seconds_to_milliseconds(
793	request.search_within_last,
794	),
795	execute_every_ms=await convert_seconds_to_milliseconds(
796	request.execute_every,
797	),
798	event_limit=1000,
799	),
800	field_spec={
801	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
802	data_type="string",
803	providers=[
804	GraylogAlertProvisionProvider(
805	type="template-v1",
806	template="${source._id}",
807	require_values=True,
808	),
809	],
810	),
811	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
812	data_type="string",
813	providers=[
814	GraylogAlertProvisionProvider(
815	type="template-v1",
816	template="${source.syslog_customer}",
817	require_values=True,
818	),
819	],
820	),
821	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
822	data_type="string",
823	providers=[
824	GraylogAlertProvisionProvider(
825	type="template-v1",
826	template="FORTINET",
827	require_values=True,
828	),
829	],
830	),
831	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
832	data_type="string",
833	providers=[
834	GraylogAlertProvisionProvider(
835	type="template-v1",
836	template="NONE",
837	require_values=True,
838	),
839	],
840	),
841	},
842	key_spec=[],
843	notification_settings=GraylogAlertProvisionNotificationSettings(
844	grace_period_ms=0,
845	backlog_size=None,
846	),
847	alert=True,
848	),
849	)
850
851	return ProvisionWazuhMonitoringAlertResponse(
852	success=True,
853	message="Fortinet system monitoring alerts provisioned successfully",
854	)
855
856
857	async def provision_fortinet_utm_monitoring_alert(
858	request: ProvisionMonitoringAlertRequest,
859	) -> ProvisionWazuhMonitoringAlertResponse:
860	"""
861	Provisions Fortinet UTM monitoring alerts.
862
863	Returns:
864	ProvisionWazuhMonitoringAlertResponse: The response indicating the success of provisioning the monitoring alerts.
865	"""
866	#
867	logger.info(
868	f"Invoking provision_fortinet_utm_monitoring_alert with request: {request.model_dump()}",
869	)
870	await provision_alert_definition(
871	GraylogAlertProvisionModel(
872	title="FORTINET UTM - HIGH SEVERITY EVENTS",
873	description="FORTINET UTM - HIGH SEVERITY EVENTS",
874	priority=2,
875	config=GraylogAlertProvisionConfig(
876	type="aggregation-v1",
877	query="syslog_type:fortinet AND type:utm AND (severity:high OR severity:critical) AND !action:dropped AND !action:clear_session",
878	query_parameters=[],
879	streams=[],
880	group_by=[],
881	series=[],
882	conditions={
883	"expression": None,
884	},
885	search_within_ms=await convert_seconds_to_milliseconds(
886	request.search_within_last,
887	),
888	execute_every_ms=await convert_seconds_to_milliseconds(
889	request.execute_every,
890	),
891	event_limit=1000,
892	),
893	field_spec={
894	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
895	data_type="string",
896	providers=[
897	GraylogAlertProvisionProvider(
898	type="template-v1",
899	template="${source._id}",
900	require_values=True,
901	),
902	],
903	),
904	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
905	data_type="string",
906	providers=[
907	GraylogAlertProvisionProvider(
908	type="template-v1",
909	template="${source.syslog_customer}",
910	require_values=True,
911	),
912	],
913	),
914	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
915	data_type="string",
916	providers=[
917	GraylogAlertProvisionProvider(
918	type="template-v1",
919	template="FORTINET",
920	require_values=True,
921	),
922	],
923	),
924	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
925	data_type="string",
926	providers=[
927	GraylogAlertProvisionProvider(
928	type="template-v1",
929	template="NONE",
930	require_values=True,
931	),
932	],
933	),
934	},
935	key_spec=[],
936	notification_settings=GraylogAlertProvisionNotificationSettings(
937	grace_period_ms=0,
938	backlog_size=None,
939	),
940	alert=True,
941	),
942	)
943
944	return ProvisionWazuhMonitoringAlertResponse(
945	success=True,
946	message="Fortinet UTM monitoring alerts provisioned successfully",
947	)
948
949
950	async def provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert(
951	request: ProvisionMonitoringAlertRequest,
952	) -> ProvisionWazuhMonitoringAlertResponse:
953	"""
954	Provisions Fortinet FortiWeb Path Traversal Vulnerability Exploitation Attempt monitoring alert.
955	"""
956	logger.info(
957	"Invoking provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert "
958	f"with request: {request.model_dump()}",
959	)
960	await provision_alert_definition(
961	GraylogAlertProvisionModel(
962	title="FORTINET - FORTIWEB PATH TRAVERSAL VULNERABILITY EXPLOITATION ATTEMPT",
963	description="FORTINET - FORTIWEB PATH TRAVERSAL VULNERABILITY EXPLOITATION ATTEMPT",
964	priority=2,
965	config=GraylogAlertProvisionConfig(
966	type="aggregation-v1",
967	query=r"syslog_type:fortinet AND httpmethod:POST AND !action:blocked AND !action:block AND !action:reset AND !action:drop AND !action:dropped AND (url:/\/system\/admin%3F/ OR url:/\/cgi\-bin\/fwbcgi/)",
968	query_parameters=[],
969	streams=[],
970	group_by=[],
971	series=[],
972	conditions={"expression": None},
973	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
974	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
975	event_limit=1000,
976	),
977	field_spec={
978	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
979	data_type="string",
980	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
981	),
982	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
983	data_type="string",
984	providers=[
985	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
986	],
987	),
988	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
989	data_type="string",
990	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
991	),
992	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
993	data_type="string",
994	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
995	),
996	},
997	key_spec=[],
998	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
999	alert=True,
1000	),
1001	)
1002	return ProvisionWazuhMonitoringAlertResponse(
1003	success=True,
1004	message="Fortinet FortiWeb path traversal vulnerability exploitation attempt monitoring alert provisioned successfully",
1005	)
1006
1007
1008	async def provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert(
1009	request: ProvisionMonitoringAlertRequest,
1010	) -> ProvisionWazuhMonitoringAlertResponse:
1011	"""
1012	Provisions Fortinet WIDS Wireless Valid Client Misassociation Detected monitoring alert.
1013	"""
1014	logger.info(
1015	"Invoking provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert "
1016	f"with request: {request.model_dump()}",
1017	)
1018	await provision_alert_definition(
1019	GraylogAlertProvisionModel(
1020	title="FORTINET - WIDS WIRELESS VALID CLIENT MISASSOCIATION DETECTED",
1021	description="FORTINET - WIDS WIRELESS VALID CLIENT MISASSOCIATION DETECTED",
1022	priority=2,
1023	config=GraylogAlertProvisionConfig(
1024	type="aggregation-v1",
1025	query='syslog_type:fortinet AND logdesc:"Wireless valid_client_misassoc detected"',
1026	query_parameters=[],
1027	streams=[],
1028	group_by=[],
1029	series=[],
1030	conditions={"expression": None},
1031	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1032	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1033	event_limit=1000,
1034	),
1035	field_spec={
1036	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1037	data_type="string",
1038	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1039	),
1040	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1041	data_type="string",
1042	providers=[
1043	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1044	],
1045	),
1046	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1047	data_type="string",
1048	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1049	),
1050	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1051	data_type="string",
1052	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1053	),
1054	},
1055	key_spec=[],
1056	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1057	alert=True,
1058	),
1059	)
1060	return ProvisionWazuhMonitoringAlertResponse(
1061	success=True,
1062	message="Fortinet WIDS wireless valid client misassociation detected monitoring alert provisioned successfully",
1063	)
1064
1065
1066	async def provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert(
1067	request: ProvisionMonitoringAlertRequest,
1068	) -> ProvisionWazuhMonitoringAlertResponse:
1069	"""
1070	Provisions Fortinet WIDS Wireless Management Flooding Detected monitoring alert.
1071	"""
1072	logger.info(
1073	"Invoking provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert " f"with request: {request.model_dump()}",
1074	)
1075	await provision_alert_definition(
1076	GraylogAlertProvisionModel(
1077	title="FORTINET - WIDS WIRELESS MANAGEMENT FLOODING DETECTED",
1078	description="FORTINET - WIDS WIRELESS MANAGEMENT FLOODING DETECTED",
1079	priority=2,
1080	config=GraylogAlertProvisionConfig(
1081	type="aggregation-v1",
1082	query='syslog_type:fortinet AND logdesc:"Wireless management flooding detected"',
1083	query_parameters=[],
1084	streams=[],
1085	group_by=[],
1086	series=[],
1087	conditions={"expression": None},
1088	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1089	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1090	event_limit=1000,
1091	),
1092	field_spec={
1093	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1094	data_type="string",
1095	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1096	),
1097	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1098	data_type="string",
1099	providers=[
1100	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1101	],
1102	),
1103	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1104	data_type="string",
1105	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1106	),
1107	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1108	data_type="string",
1109	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1110	),
1111	},
1112	key_spec=[],
1113	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1114	alert=True,
1115	),
1116	)
1117	return ProvisionWazuhMonitoringAlertResponse(
1118	success=True,
1119	message="Fortinet WIDS wireless management flooding detected monitoring alert provisioned successfully",
1120	)
1121
1122
1123	async def provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert(
1124	request: ProvisionMonitoringAlertRequest,
1125	) -> ProvisionWazuhMonitoringAlertResponse:
1126	"""
1127	Provisions Fortinet WIDS Wireless EAPOL Packet Flooding Detected monitoring alert.
1128	"""
1129	logger.info(
1130	"Invoking provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert "
1131	f"with request: {request.model_dump()}",
1132	)
1133	await provision_alert_definition(
1134	GraylogAlertProvisionModel(
1135	title="FORTINET - WIDS WIRELESS EAPOL PACKET FLOODING DETECTED",
1136	description="FORTINET - WIDS WIRELESS EAPOL PACKET FLOODING DETECTED",
1137	priority=2,
1138	config=GraylogAlertProvisionConfig(
1139	type="aggregation-v1",
1140	query='syslog_type:fortinet AND logdesc:"Wireless EAPOL packet flooding detected"',
1141	query_parameters=[],
1142	streams=[],
1143	group_by=[],
1144	series=[],
1145	conditions={"expression": None},
1146	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1147	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1148	event_limit=1000,
1149	),
1150	field_spec={
1151	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1152	data_type="string",
1153	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1154	),
1155	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1156	data_type="string",
1157	providers=[
1158	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1159	],
1160	),
1161	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1162	data_type="string",
1163	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1164	),
1165	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1166	data_type="string",
1167	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1168	),
1169	},
1170	key_spec=[],
1171	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1172	alert=True,
1173	),
1174	)
1175	return ProvisionWazuhMonitoringAlertResponse(
1176	success=True,
1177	message="Fortinet WIDS wireless EAPOL packet flooding detected monitoring alert provisioned successfully",
1178	)
1179
1180
1181	async def provision_fortinet_wids_rogue_access_point_detected_monitoring_alert(
1182	request: ProvisionMonitoringAlertRequest,
1183	) -> ProvisionWazuhMonitoringAlertResponse:
1184	"""
1185	Provisions Fortinet WIDS Rogue Access Point Detected monitoring alert.
1186	"""
1187	logger.info(
1188	"Invoking provision_fortinet_wids_rogue_access_point_detected_monitoring_alert " f"with request: {request.model_dump()}",
1189	)
1190	await provision_alert_definition(
1191	GraylogAlertProvisionModel(
1192	title="FORTINET - WIDS ROGUE ACCESS POINT DETECTED",
1193	description="FORTINET - WIDS ROGUE ACCESS POINT DETECTED",
1194	priority=2,
1195	config=GraylogAlertProvisionConfig(
1196	type="aggregation-v1",
1197	query='syslog_type:fortinet AND (logdesc:"Rogue AP detected" OR logdesc:"Rogue AP activity" OR logdesc:"Rogue AP on air" OR logdesc:"Fake AP on air" OR logdesc:"Fake AP detected" OR logdesc:"Offending AP on air" OR logdesc:"Offending AP detected")',
1198	query_parameters=[],
1199	streams=[],
1200	group_by=[],
1201	series=[],
1202	conditions={"expression": None},
1203	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1204	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1205	event_limit=1000,
1206	),
1207	field_spec={
1208	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1209	data_type="string",
1210	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1211	),
1212	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1213	data_type="string",
1214	providers=[
1215	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1216	],
1217	),
1218	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1219	data_type="string",
1220	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1221	),
1222	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1223	data_type="string",
1224	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1225	),
1226	},
1227	key_spec=[],
1228	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1229	alert=True,
1230	),
1231	)
1232	return ProvisionWazuhMonitoringAlertResponse(
1233	success=True,
1234	message="Fortinet WIDS rogue access point detected monitoring alert provisioned successfully",
1235	)
1236
1237
1238	async def provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert(
1239	request: ProvisionMonitoringAlertRequest,
1240	) -> ProvisionWazuhMonitoringAlertResponse:
1241	"""
1242	Provisions Fortinet WIDS Wireless Long Duration Attack Detected monitoring alert.
1243	"""
1244	logger.info(
1245	"Invoking provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert " f"with request: {request.model_dump()}",
1246	)
1247	await provision_alert_definition(
1248	GraylogAlertProvisionModel(
1249	title="FORTINET - WIDS WIRELESS LONG DURATION ATTACK DETECTED",
1250	description="FORTINET - WIDS WIRELESS LONG DURATION ATTACK DETECTED",
1251	priority=2,
1252	config=GraylogAlertProvisionConfig(
1253	type="aggregation-v1",
1254	query='syslog_type:fortinet AND logdesc:"Wireless long duration attack detected"',
1255	query_parameters=[],
1256	streams=[],
1257	group_by=[],
1258	series=[],
1259	conditions={"expression": None},
1260	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1261	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1262	event_limit=1000,
1263	),
1264	field_spec={
1265	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1266	data_type="string",
1267	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1268	),
1269	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1270	data_type="string",
1271	providers=[
1272	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1273	],
1274	),
1275	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1276	data_type="string",
1277	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1278	),
1279	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1280	data_type="string",
1281	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1282	),
1283	},
1284	key_spec=[],
1285	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1286	alert=True,
1287	),
1288	)
1289	return ProvisionWazuhMonitoringAlertResponse(
1290	success=True,
1291	message="Fortinet WIDS wireless long duration attack detected monitoring alert provisioned successfully",
1292	)
1293
1294
1295	async def provision_fortinet_firewall_virus_detected_monitoring_alert(
1296	request: ProvisionMonitoringAlertRequest,
1297	) -> ProvisionWazuhMonitoringAlertResponse:
1298	"""
1299	Provisions Fortinet Firewall Virus Detected monitoring alert.
1300	"""
1301	logger.info(
1302	"Invoking provision_fortinet_firewall_virus_detected_monitoring_alert " f"with request: {request.model_dump()}",
1303	)
1304	await provision_alert_definition(
1305	GraylogAlertProvisionModel(
1306	title="FORTINET - FIREWALL VIRUS DETECTED",
1307	description="FORTINET - FIREWALL VIRUS DETECTED",
1308	priority=2,
1309	config=GraylogAlertProvisionConfig(
1310	type="aggregation-v1",
1311	query='syslog_type:fortinet AND subtype:"virus" AND !action:"blocked"',
1312	query_parameters=[],
1313	streams=[],
1314	group_by=[],
1315	series=[],
1316	conditions={"expression": None},
1317	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1318	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1319	event_limit=1000,
1320	),
1321	field_spec={
1322	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1323	data_type="string",
1324	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1325	),
1326	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1327	data_type="string",
1328	providers=[
1329	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1330	],
1331	),
1332	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1333	data_type="string",
1334	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1335	),
1336	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1337	data_type="string",
1338	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1339	),
1340	},
1341	key_spec=[],
1342	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1343	alert=True,
1344	),
1345	)
1346	return ProvisionWazuhMonitoringAlertResponse(
1347	success=True,
1348	message="Fortinet firewall virus detected monitoring alert provisioned successfully",
1349	)
1350
1351
1352	async def provision_fortinet_wids_wireless_threat_detected_monitoring_alert(
1353	request: ProvisionMonitoringAlertRequest,
1354	) -> ProvisionWazuhMonitoringAlertResponse:
1355	"""
1356	Provisions Fortinet WIDS Wireless Threat Detected monitoring alert.
1357	"""
1358	logger.info(
1359	"Invoking provision_fortinet_wids_wireless_threat_detected_monitoring_alert " f"with request: {request.model_dump()}",
1360	)
1361	await provision_alert_definition(
1362	GraylogAlertProvisionModel(
1363	title="FORTINET - WIDS WIRELESS THREAT DETECTED",
1364	description="FORTINET - WIDS WIRELESS THREAT DETECTED",
1365	priority=2,
1366	config=GraylogAlertProvisionConfig(
1367	type="aggregation-v1",
1368	query='syslog_type:fortinet AND logdesc:"Wireless threat detected"',
1369	query_parameters=[],
1370	streams=[],
1371	group_by=[],
1372	series=[],
1373	conditions={"expression": None},
1374	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1375	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1376	event_limit=1000,
1377	),
1378	field_spec={
1379	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1380	data_type="string",
1381	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1382	),
1383	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1384	data_type="string",
1385	providers=[
1386	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1387	],
1388	),
1389	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1390	data_type="string",
1391	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1392	),
1393	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1394	data_type="string",
1395	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1396	),
1397	},
1398	key_spec=[],
1399	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1400	alert=True,
1401	),
1402	)
1403	return ProvisionWazuhMonitoringAlertResponse(
1404	success=True,
1405	message="Fortinet WIDS wireless threat detected monitoring alert provisioned successfully",
1406	)
1407
1408
1409	async def provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert(
1410	request: ProvisionMonitoringAlertRequest,
1411	) -> ProvisionWazuhMonitoringAlertResponse:
1412	"""
1413	Provisions Fortinet WIDS Wireless Invalid MAC OUI Detected monitoring alert.
1414	"""
1415	logger.info(
1416	"Invoking provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert " f"with request: {request.model_dump()}",
1417	)
1418	await provision_alert_definition(
1419	GraylogAlertProvisionModel(
1420	title="FORTINET - WIDS WIRELESS INVALID MAC OUI DETECTED",
1421	description="FORTINET - WIDS WIRELESS INVALID MAC OUI DETECTED",
1422	priority=2,
1423	config=GraylogAlertProvisionConfig(
1424	type="aggregation-v1",
1425	query='syslog_type:fortinet AND logdesc:"Wireless invalid MAC OUI detected"',
1426	query_parameters=[],
1427	streams=[],
1428	group_by=[],
1429	series=[],
1430	conditions={"expression": None},
1431	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1432	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1433	event_limit=1000,
1434	),
1435	field_spec={
1436	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1437	data_type="string",
1438	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1439	),
1440	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1441	data_type="string",
1442	providers=[
1443	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1444	],
1445	),
1446	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1447	data_type="string",
1448	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1449	),
1450	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1451	data_type="string",
1452	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1453	),
1454	},
1455	key_spec=[],
1456	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1457	alert=True,
1458	),
1459	)
1460	return ProvisionWazuhMonitoringAlertResponse(
1461	success=True,
1462	message="Fortinet WIDS wireless invalid MAC OUI detected monitoring alert provisioned successfully",
1463	)
1464
1465
1466	async def provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert(
1467	request: ProvisionMonitoringAlertRequest,
1468	) -> ProvisionWazuhMonitoringAlertResponse:
1469	"""
1470	Provisions Fortinet WIDS Wireless Asleap Attack Detected monitoring alert.
1471	"""
1472	logger.info(
1473	"Invoking provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert " f"with request: {request.model_dump()}",
1474	)
1475	await provision_alert_definition(
1476	GraylogAlertProvisionModel(
1477	title="FORTINET - WIDS WIRELESS ASLEAP ATTACK DETECTED",
1478	description="FORTINET - WIDS WIRELESS ASLEAP ATTACK DETECTED",
1479	priority=2,
1480	config=GraylogAlertProvisionConfig(
1481	type="aggregation-v1",
1482	query='syslog_type:fortinet AND logdesc:"Wireless Asleap attack detected"',
1483	query_parameters=[],
1484	streams=[],
1485	group_by=[],
1486	series=[],
1487	conditions={"expression": None},
1488	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1489	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1490	event_limit=1000,
1491	),
1492	field_spec={
1493	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1494	data_type="string",
1495	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1496	),
1497	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1498	data_type="string",
1499	providers=[
1500	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1501	],
1502	),
1503	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1504	data_type="string",
1505	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1506	),
1507	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1508	data_type="string",
1509	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1510	),
1511	},
1512	key_spec=[],
1513	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1514	alert=True,
1515	),
1516	)
1517	return ProvisionWazuhMonitoringAlertResponse(
1518	success=True,
1519	message="Fortinet WIDS wireless Asleap attack detected monitoring alert provisioned successfully",
1520	)
1521
1522
1523	async def provision_fortinet_ips_malicious_url_detected_monitoring_alert(
1524	request: ProvisionMonitoringAlertRequest,
1525	) -> ProvisionWazuhMonitoringAlertResponse:
1526	"""
1527	Provisions Fortinet IPS Malicious URL Detected monitoring alert.
1528	"""
1529	logger.info(
1530	"Invoking provision_fortinet_ips_malicious_url_detected_monitoring_alert " f"with request: {request.model_dump()}",
1531	)
1532	await provision_alert_definition(
1533	GraylogAlertProvisionModel(
1534	title="FORTINET - IPS MALICIOUS URL DETECTED",
1535	description="FORTINET - IPS MALICIOUS URL DETECTED",
1536	priority=2,
1537	config=GraylogAlertProvisionConfig(
1538	type="aggregation-v1",
1539	query='syslog_type:fortinet AND subtype:"ips" AND attack:"malicious-url" AND action:"detected"',
1540	query_parameters=[],
1541	streams=[],
1542	group_by=[],
1543	series=[],
1544	conditions={"expression": None},
1545	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1546	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1547	event_limit=1000,
1548	),
1549	field_spec={
1550	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1551	data_type="string",
1552	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1553	),
1554	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1555	data_type="string",
1556	providers=[
1557	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1558	],
1559	),
1560	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1561	data_type="string",
1562	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1563	),
1564	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1565	data_type="string",
1566	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1567	),
1568	},
1569	key_spec=[],
1570	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1571	alert=True,
1572	),
1573	)
1574	return ProvisionWazuhMonitoringAlertResponse(
1575	success=True,
1576	message="Fortinet IPS malicious URL detected monitoring alert provisioned successfully",
1577	)
1578
1579
1580	async def provision_fortinet_ips_botnet_activity_detected_monitoring_alert(
1581	request: ProvisionMonitoringAlertRequest,
1582	) -> ProvisionWazuhMonitoringAlertResponse:
1583	"""
1584	Provisions Fortinet IPS Botnet Activity Detected monitoring alert.
1585	"""
1586	logger.info(
1587	"Invoking provision_fortinet_ips_botnet_activity_detected_monitoring_alert " f"with request: {request.model_dump()}",
1588	)
1589	await provision_alert_definition(
1590	GraylogAlertProvisionModel(
1591	title="FORTINET - IPS BOTNET ACTIVITY DETECTED",
1592	description="FORTINET - IPS BOTNET ACTIVITY DETECTED",
1593	priority=2,
1594	config=GraylogAlertProvisionConfig(
1595	type="aggregation-v1",
1596	query='syslog_type:fortinet AND subtype:"ips" AND attack:"botnet" AND action:"detected"',
1597	query_parameters=[],
1598	streams=[],
1599	group_by=[],
1600	series=[],
1601	conditions={"expression": None},
1602	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1603	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1604	event_limit=1000,
1605	),
1606	field_spec={
1607	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1608	data_type="string",
1609	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1610	),
1611	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1612	data_type="string",
1613	providers=[
1614	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1615	],
1616	),
1617	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1618	data_type="string",
1619	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1620	),
1621	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1622	data_type="string",
1623	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1624	),
1625	},
1626	key_spec=[],
1627	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1628	alert=True,
1629	),
1630	)
1631	return ProvisionWazuhMonitoringAlertResponse(
1632	success=True,
1633	message="Fortinet IPS botnet activity detected monitoring alert provisioned successfully",
1634	)
1635
1636
1637	async def provision_fortinet_admin_user_created_from_public_ip_monitoring_alert(
1638	request: ProvisionMonitoringAlertRequest,
1639	) -> ProvisionWazuhMonitoringAlertResponse:
1640	"""
1641	Provisions Fortinet Admin User Created from Public IP monitoring alert.
1642	"""
1643	logger.info(
1644	"Invoking provision_fortinet_admin_user_created_from_public_ip_monitoring_alert " f"with request: {request.model_dump()}",
1645	)
1646	await provision_alert_definition(
1647	GraylogAlertProvisionModel(
1648	title="FORTINET - ADMIN USER CREATED FROM PUBLIC IP",
1649	description="FORTINET - ADMIN USER CREATED FROM PUBLIC IP",
1650	priority=2,
1651	config=GraylogAlertProvisionConfig(
1652	type="aggregation-v1",
1653	query='syslog_type:fortinet AND subtype:"system" AND logdesc:"Object attribute configured" AND action:"Add" AND cfgpath:"system.admin"',
1654	query_parameters=[],
1655	streams=[],
1656	group_by=[],
1657	series=[],
1658	conditions={"expression": None},
1659	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1660	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1661	event_limit=1000,
1662	),
1663	field_spec={
1664	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1665	data_type="string",
1666	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1667	),
1668	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1669	data_type="string",
1670	providers=[
1671	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1672	],
1673	),
1674	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1675	data_type="string",
1676	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1677	),
1678	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1679	data_type="string",
1680	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1681	),
1682	},
1683	key_spec=[],
1684	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1685	alert=True,
1686	),
1687	)
1688	return ProvisionWazuhMonitoringAlertResponse(
1689	success=True,
1690	message="Fortinet admin user created from public IP monitoring alert provisioned successfully",
1691	)
1692
1693
1694	async def provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert(
1695	request: ProvisionMonitoringAlertRequest,
1696	) -> ProvisionWazuhMonitoringAlertResponse:
1697	"""
1698	Provisions Fortinet Suspicious Config File Access from External Network monitoring alert.
1699	"""
1700	logger.info(
1701	"Invoking provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert "
1702	f"with request: {request.model_dump()}",
1703	)
1704	await provision_alert_definition(
1705	GraylogAlertProvisionModel(
1706	title="FORTINET - SUSPICIOUS CONFIG FILE ACCESS FROM EXTERNAL NETWORK",
1707	description="FORTINET - SUSPICIOUS CONFIG FILE ACCESS FROM EXTERNAL NETWORK",
1708	priority=2,
1709	config=GraylogAlertProvisionConfig(
1710	type="aggregation-v1",
1711	query='syslog_type:fortinet AND msg:"System config file has been downloaded" AND status:"success"',
1712	query_parameters=[],
1713	streams=[],
1714	group_by=[],
1715	series=[],
1716	conditions={"expression": None},
1717	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1718	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1719	event_limit=1000,
1720	),
1721	field_spec={
1722	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1723	data_type="string",
1724	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1725	),
1726	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1727	data_type="string",
1728	providers=[
1729	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1730	],
1731	),
1732	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1733	data_type="string",
1734	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1735	),
1736	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1737	data_type="string",
1738	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1739	),
1740	},
1741	key_spec=[],
1742	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1743	alert=True,
1744	),
1745	)
1746	return ProvisionWazuhMonitoringAlertResponse(
1747	success=True,
1748	message="Fortinet suspicious config file access from external network monitoring alert provisioned successfully",
1749	)
1750
1751
1752	async def provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert(
1753	request: ProvisionMonitoringAlertRequest,
1754	) -> ProvisionWazuhMonitoringAlertResponse:
1755	"""
1756	Provisions Fortinet WIDS Wireless Weak Encryption Detected monitoring alert.
1757	"""
1758	logger.info(
1759	"Invoking provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert " f"with request: {request.model_dump()}",
1760	)
1761	await provision_alert_definition(
1762	GraylogAlertProvisionModel(
1763	title="FORTINET - WIDS WIRELESS WEAK ENCRYPTION DETECTED",
1764	description="FORTINET - WIDS WIRELESS WEAK ENCRYPTION DETECTED",
1765	priority=2,
1766	config=GraylogAlertProvisionConfig(
1767	type="aggregation-v1",
1768	query='syslog_type:fortinet AND (logdesc:"Wireless risky_encryption detected" OR logdesc:"Wireless Weak WEP IV detected")',
1769	query_parameters=[],
1770	streams=[],
1771	group_by=[],
1772	series=[],
1773	conditions={"expression": None},
1774	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1775	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1776	event_limit=1000,
1777	),
1778	field_spec={
1779	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1780	data_type="string",
1781	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1782	),
1783	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1784	data_type="string",
1785	providers=[
1786	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1787	],
1788	),
1789	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1790	data_type="string",
1791	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1792	),
1793	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1794	data_type="string",
1795	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1796	),
1797	},
1798	key_spec=[],
1799	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1800	alert=True,
1801	),
1802	)
1803	return ProvisionWazuhMonitoringAlertResponse(
1804	success=True,
1805	message="Fortinet WIDS wireless weak encryption detected monitoring alert provisioned successfully",
1806	)
1807
1808
1809	async def provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert(
1810	request: ProvisionMonitoringAlertRequest,
1811	) -> ProvisionWazuhMonitoringAlertResponse:
1812	"""
1813	Provisions Fortinet Suspicious Super Admin Login Detected monitoring alert.
1814	"""
1815	logger.info(
1816	"Invoking provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert " f"with request: {request.model_dump()}",
1817	)
1818	await provision_alert_definition(
1819	GraylogAlertProvisionModel(
1820	title="FORTINET - SUSPICIOUS SUPER ADMIN LOGIN DETECTED",
1821	description="FORTINET - SUSPICIOUS SUPER ADMIN LOGIN DETECTED",
1822	priority=2,
1823	config=GraylogAlertProvisionConfig(
1824	type="aggregation-v1",
1825	query='syslog_type:fortinet AND subtype:"system" AND logdesc:"Admin login successful" AND profile:"super_admin" AND method:"jsconsole" AND status:"success" AND srcip_reserved_ip:false',
1826	query_parameters=[],
1827	streams=[],
1828	group_by=[],
1829	series=[],
1830	conditions={"expression": None},
1831	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1832	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1833	event_limit=1000,
1834	),
1835	field_spec={
1836	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1837	data_type="string",
1838	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
1839	),
1840	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1841	data_type="string",
1842	providers=[
1843	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
1844	],
1845	),
1846	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1847	data_type="string",
1848	providers=[GraylogAlertProvisionProvider(type="template-v1", template="FORTINET", require_values=True)],
1849	),
1850	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1851	data_type="string",
1852	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
1853	),
1854	},
1855	key_spec=[],
1856	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
1857	alert=True,
1858	),
1859	)
1860	return ProvisionWazuhMonitoringAlertResponse(
1861	success=True,
1862	message="Fortinet suspicious super admin login detected monitoring alert provisioned successfully",
1863	)
1864
1865
1866	# ! -- PaloAlto Monitoring Alerts -- ! #
1867	async def provision_paloalto_monitoring_alert(
1868	request: ProvisionMonitoringAlertRequest,
1869	) -> ProvisionWazuhMonitoringAlertResponse:
1870	"""
1871	Provisions Palo Alto monitoring alerts.
1872
1873	Returns:
1874	ProvisionWazuhMonitoringAlertResponse: The response indicating the success of provisioning the monitoring alerts.
1875	"""
1876	#
1877	logger.info(
1878	f"Invoking provision_paloalto_monitoring_alert with request: {request.model_dump()}",
1879	)
1880	await provision_alert_definition(
1881	GraylogAlertProvisionModel(
1882	title="PALO ALTO - HIGH SEVERITY EVENTS",
1883	description="PALO ALTO - HIGH SEVERITY EVENTS",
1884	priority=2,
1885	config=GraylogAlertProvisionConfig(
1886	type="aggregation-v1",
1887	query="syslog_type:palo_alto AND event_log_name:THREAT AND (vendor_alert_severity:high OR vendor_alert_severity:critical) AND !vendor_event_action:drop",
1888	query_parameters=[],
1889	streams=[],
1890	group_by=[],
1891	series=[],
1892	conditions={
1893	"expression": None,
1894	},
1895	search_within_ms=await convert_seconds_to_milliseconds(
1896	request.search_within_last,
1897	),
1898	execute_every_ms=await convert_seconds_to_milliseconds(
1899	request.execute_every,
1900	),
1901	event_limit=1000,
1902	),
1903	field_spec={
1904	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1905	data_type="string",
1906	providers=[
1907	GraylogAlertProvisionProvider(
1908	type="template-v1",
1909	template="${source._id}",
1910	require_values=True,
1911	),
1912	],
1913	),
1914	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
1915	data_type="string",
1916	providers=[
1917	GraylogAlertProvisionProvider(
1918	type="template-v1",
1919	template="${source.syslog_customer}",
1920	require_values=True,
1921	),
1922	],
1923	),
1924	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
1925	data_type="string",
1926	providers=[
1927	GraylogAlertProvisionProvider(
1928	type="template-v1",
1929	template="PALOALTO",
1930	require_values=True,
1931	),
1932	],
1933	),
1934	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1935	data_type="string",
1936	providers=[
1937	GraylogAlertProvisionProvider(
1938	type="template-v1",
1939	template="NONE",
1940	require_values=True,
1941	),
1942	],
1943	),
1944	},
1945	key_spec=[],
1946	notification_settings=GraylogAlertProvisionNotificationSettings(
1947	grace_period_ms=0,
1948	backlog_size=None,
1949	),
1950	alert=True,
1951	),
1952	)
1953
1954	return ProvisionWazuhMonitoringAlertResponse(
1955	success=True,
1956	message="Palo Alto monitoring alerts provisioned successfully",
1957	)
1958
1959
1960	async def provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert(
1961	request: ProvisionMonitoringAlertRequest,
1962	) -> ProvisionWazuhMonitoringAlertResponse:
1963	"""
1964	Provisions PaloAlto Firewall Traffic to Phishing URL Allowed monitoring alert.
1965	"""
1966	logger.info(
1967	"Invoking provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert " f"with request: {request.model_dump()}",
1968	)
1969	await provision_alert_definition(
1970	GraylogAlertProvisionModel(
1971	title="PALOALTO - FIREWALL TRAFFIC TO PHISHING URL ALLOWED",
1972	description=(
1973	"Detects when the Palo Alto Networks firewall does not block traffic to a URL known to be used in phishing "
1974	"attacks. "
1975	"An adversary can abuse this by directing victims to the phishing site, potentially stealing credentials, "
1976	"deploying malware, or conducting other malicious activities."
1977	),
1978	priority=2,
1979	config=GraylogAlertProvisionConfig(
1980	type="aggregation-v1",
1981	query=(
1982	"syslog_type:palo_alto_fw AND event_log_name:THREAT AND pan_log_subtype:url AND alert_category:phishing "
1983	"AND (event_severity:critical OR event_severity:high OR event_severity:medium) "
1984	"AND !vendor_event_action:deny AND !vendor_event_action:drop AND !vendor_event_action:reset AND !vendor_event_action:block"
1985	),
1986	query_parameters=[],
1987	streams=[],
1988	group_by=[],
1989	series=[],
1990	conditions={"expression": None},
1991	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
1992	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
1993	event_limit=1000,
1994	),
1995	field_spec={
1996	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
1997	data_type="string",
1998	providers=[
1999	GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True),
2000	],
2001	),
2002	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2003	data_type="string",
2004	providers=[
2005	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2006	],
2007	),
2008	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2009	data_type="string",
2010	providers=[
2011	GraylogAlertProvisionProvider(type="template-v1", template="PALOALTO", require_values=True),
2012	],
2013	),
2014	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2015	data_type="string",
2016	providers=[
2017	GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True),
2018	],
2019	),
2020	},
2021	key_spec=[],
2022	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2023	alert=True,
2024	),
2025	)
2026	return ProvisionWazuhMonitoringAlertResponse(
2027	success=True,
2028	message="PaloAlto firewall traffic to phishing URL allowed monitoring alert provisioned successfully",
2029	)
2030
2031
2032	async def provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert(
2033	request: ProvisionMonitoringAlertRequest,
2034	) -> ProvisionWazuhMonitoringAlertResponse:
2035	"""
2036	Provisions PaloAlto Firewall Traffic to Malicious URL Allowed monitoring alert.
2037	"""
2038	logger.info(
2039	"Invoking provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert " f"with request: {request.model_dump()}",
2040	)
2041	await provision_alert_definition(
2042	GraylogAlertProvisionModel(
2043	title="PALOALTO - FIREWALL TRAFFIC TO MALICIOUS URL ALLOWED",
2044	description=(
2045	"Detects when the Palo Alto Networks firewall does not block traffic to a URL associated with malware "
2046	"distribution or operation. "
2047	"This typically indicates a lapse in the firewall's threat intelligence or a misconfiguration. "
2048	"An adversary can abuse this by using the unblocked URL to download malware onto a target system, establish "
2049	"a command and control channel, or exfiltrate data."
2050	),
2051	priority=2,
2052	config=GraylogAlertProvisionConfig(
2053	type="aggregation-v1",
2054	query=(
2055	"syslog_type:palo_alto_fw AND event_log_name:THREAT AND pan_log_subtype:url AND alert_category:malware "
2056	"AND (event_severity:critical OR event_severity:high OR event_severity:medium) "
2057	"AND !vendor_event_action:deny AND !vendor_event_action:drop AND !vendor_event_action:reset AND !vendor_event_action:block"
2058	),
2059	query_parameters=[],
2060	streams=[],
2061	group_by=[],
2062	series=[],
2063	conditions={"expression": None},
2064	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2065	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2066	event_limit=1000,
2067	),
2068	field_spec={
2069	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2070	data_type="string",
2071	providers=[
2072	GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True),
2073	],
2074	),
2075	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2076	data_type="string",
2077	providers=[
2078	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2079	],
2080	),
2081	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2082	data_type="string",
2083	providers=[
2084	GraylogAlertProvisionProvider(type="template-v1", template="PALOALTO", require_values=True),
2085	],
2086	),
2087	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2088	data_type="string",
2089	providers=[
2090	GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True),
2091	],
2092	),
2093	},
2094	key_spec=[],
2095	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2096	alert=True,
2097	),
2098	)
2099	return ProvisionWazuhMonitoringAlertResponse(
2100	success=True,
2101	message="PaloAlto firewall traffic to malicious URL allowed monitoring alert provisioned successfully",
2102	)
2103
2104
2105	async def provision_paloalto_firewall_virus_allowed_monitoring_alert(
2106	request: ProvisionMonitoringAlertRequest,
2107	) -> ProvisionWazuhMonitoringAlertResponse:
2108	"""
2109	Provisions PaloAlto Firewall Virus Allowed monitoring alert.
2110	"""
2111	logger.info(
2112	"Invoking provision_paloalto_firewall_virus_allowed_monitoring_alert " f"with request: {request.model_dump()}",
2113	)
2114	await provision_alert_definition(
2115	GraylogAlertProvisionModel(
2116	title="PALOALTO - FIREWALL VIRUS ALLOWED",
2117	description=(
2118	"Detects active network communication associated with known malware that is being allowed by the Palo Alto "
2119	"Networks firewall. "
2120	"This may indicate an ongoing security threat, where malicious traffic is bypassing firewall protections, "
2121	"potentially leading to system compromise, data exfiltration, or further infiltration within the network."
2122	),
2123	priority=2,
2124	config=GraylogAlertProvisionConfig(
2125	type="aggregation-v1",
2126	query=(
2127	"syslog_type:palo_alto_fw AND event_log_name:THREAT AND pan_log_subtype:virus "
2128	"AND !vendor_event_action:deny AND !vendor_event_action:drop AND !vendor_event_action:reset AND !vendor_event_action:block"
2129	),
2130	query_parameters=[],
2131	streams=[],
2132	group_by=[],
2133	series=[],
2134	conditions={"expression": None},
2135	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2136	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2137	event_limit=1000,
2138	),
2139	field_spec={
2140	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2141	data_type="string",
2142	providers=[
2143	GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True),
2144	],
2145	),
2146	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2147	data_type="string",
2148	providers=[
2149	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2150	],
2151	),
2152	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2153	data_type="string",
2154	providers=[
2155	GraylogAlertProvisionProvider(type="template-v1", template="PALOALTO", require_values=True),
2156	],
2157	),
2158	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2159	data_type="string",
2160	providers=[
2161	GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True),
2162	],
2163	),
2164	},
2165	key_spec=[],
2166	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2167	alert=True,
2168	),
2169	)
2170	return ProvisionWazuhMonitoringAlertResponse(
2171	success=True,
2172	message="PaloAlto firewall virus allowed monitoring alert provisioned successfully",
2173	)
2174
2175
2176	async def provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert(
2177	request: ProvisionMonitoringAlertRequest,
2178	) -> ProvisionWazuhMonitoringAlertResponse:
2179	"""
2180	Provisions PaloAlto Firewall TOR Traffic Allowed monitoring alert.
2181	"""
2182	logger.info(
2183	"Invoking provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert " f"with request: {request.model_dump()}",
2184	)
2185	await provision_alert_definition(
2186	GraylogAlertProvisionModel(
2187	title="PALOALTO - FIREWALL TOR TRAFFIC ALLOWED",
2188	description=(
2189	"Detects allowed network traffic to the TOR network. Adversaries can use TOR to anonymize their network "
2190	"activity, bypass security controls, and evade detection while conducting malicious operations. "
2191	"This could lead to unauthorized access, data exfiltration, and compliance violations if deemed malicious."
2192	),
2193	priority=2,
2194	config=GraylogAlertProvisionConfig(
2195	type="aggregation-v1",
2196	query="syslog_type:palo_alto_fw AND event_log_name:TRAFFIC AND application_name:tor AND vendor_event_action:allow",
2197	query_parameters=[],
2198	streams=[],
2199	group_by=[],
2200	series=[],
2201	conditions={"expression": None},
2202	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2203	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2204	event_limit=1000,
2205	),
2206	field_spec={
2207	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2208	data_type="string",
2209	providers=[
2210	GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True),
2211	],
2212	),
2213	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2214	data_type="string",
2215	providers=[
2216	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2217	],
2218	),
2219	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2220	data_type="string",
2221	providers=[
2222	GraylogAlertProvisionProvider(type="template-v1", template="PALOALTO", require_values=True),
2223	],
2224	),
2225	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2226	data_type="string",
2227	providers=[
2228	GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True),
2229	],
2230	),
2231	},
2232	key_spec=[],
2233	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2234	alert=True,
2235	),
2236	)
2237	return ProvisionWazuhMonitoringAlertResponse(
2238	success=True,
2239	message="PaloAlto firewall TOR traffic allowed monitoring alert provisioned successfully",
2240	)
2241
2242
2243	async def provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert(
2244	request: ProvisionMonitoringAlertRequest,
2245	) -> ProvisionWazuhMonitoringAlertResponse:
2246	"""
2247	Provisions PaloAlto Firewall Medium Severity Correlation Event Detected monitoring alert.
2248	"""
2249	logger.info(
2250	"Invoking provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert "
2251	f"with request: {request.model_dump()}",
2252	)
2253	await provision_alert_definition(
2254	GraylogAlertProvisionModel(
2255	title="PALOALTO - FIREWALL MEDIUM SEVERITY CORRELATION EVENT DETECTED",
2256	description=(
2257	"Detects medium severity correlation events generated by Palo Alto Networks firewall's automated correlation "
2258	"engine. "
2259	"The correlation engine connects isolated network events and looks for patterns that indicate a more "
2260	"significant event. "
2261	"This helps identify suspicious traffic patterns and network anomalies which, when correlated, indicate with "
2262	"a high probability that a host on the network has been compromised."
2263	),
2264	priority=2,
2265	config=GraylogAlertProvisionConfig(
2266	type="aggregation-v1",
2267	query="syslog_type:palo_alto_fw AND event_log_name:CORRELATION AND vendor_alert_severity:medium",
2268	query_parameters=[],
2269	streams=[],
2270	group_by=[],
2271	series=[],
2272	conditions={"expression": None},
2273	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2274	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2275	event_limit=1000,
2276	),
2277	field_spec={
2278	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2279	data_type="string",
2280	providers=[
2281	GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True),
2282	],
2283	),
2284	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2285	data_type="string",
2286	providers=[
2287	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2288	],
2289	),
2290	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2291	data_type="string",
2292	providers=[
2293	GraylogAlertProvisionProvider(type="template-v1", template="PALOALTO", require_values=True),
2294	],
2295	),
2296	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2297	data_type="string",
2298	providers=[
2299	GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True),
2300	],
2301	),
2302	},
2303	key_spec=[],
2304	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2305	alert=True,
2306	),
2307	)
2308	return ProvisionWazuhMonitoringAlertResponse(
2309	success=True,
2310	message="PaloAlto firewall medium severity correlation event detected monitoring alert provisioned successfully",
2311	)
2312
2313
2314	# ! SentinelOne Monitoring Alerts -- ! #
2315	async def provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert(
2316	request: ProvisionMonitoringAlertRequest,
2317	) -> ProvisionWazuhMonitoringAlertResponse:
2318	"""
2319	Provisions SentinelOne: New Active Threat Malicious Detected.
2320	"""
2321	logger.info(
2322	"Invoking provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert " f"with request: {request.model_dump()}",
2323	)
2324	await provision_alert_definition(
2325	GraylogAlertProvisionModel(
2326	title="SENTINELONE - NEW ACTIVE THREAT MALICIOUS DETECTED",
2327	description="Threat with confidence level malicious detected",
2328	priority=3,
2329	config=GraylogAlertProvisionConfig(
2330	type="aggregation-v1",
2331	query="syslog_type:sentinelone AND cat:MALWARE AND threatConfidenceLevel:malicious",
2332	query_parameters=[],
2333	streams=[],
2334	group_by=[],
2335	series=[],
2336	conditions={"expression": None},
2337	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2338	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2339	event_limit=1000,
2340	),
2341	field_spec={
2342	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2343	data_type="string",
2344	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2345	),
2346	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2347	data_type="string",
2348	providers=[
2349	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2350	],
2351	),
2352	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2353	data_type="string",
2354	providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2355	),
2356	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2357	data_type="string",
2358	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2359	),
2360	},
2361	key_spec=[],
2362	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2363	alert=True,
2364	),
2365	)
2366	return ProvisionWazuhMonitoringAlertResponse(
2367	success=True,
2368	message="SentinelOne new active threat malicious detected monitoring alert provisioned successfully",
2369	)
2370
2371
2372	async def provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert(
2373	request: ProvisionMonitoringAlertRequest,
2374	) -> ProvisionWazuhMonitoringAlertResponse:
2375	"""
2376	Provisions SentinelOne: New Active Threat Suspicious Detected.
2377	"""
2378	logger.info(
2379	"Invoking provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert " f"with request: {request.model_dump()}",
2380	)
2381	await provision_alert_definition(
2382	GraylogAlertProvisionModel(
2383	title="SENTINELONE - NEW ACTIVE THREAT SUSPICIOUS DETECTED",
2384	description="Threat with confidence level suspicious detected",
2385	priority=2,
2386	config=GraylogAlertProvisionConfig(
2387	type="aggregation-v1",
2388	query="syslog_type:sentinelone AND cat:MALWARE AND threatConfidenceLevel:suspicious",
2389	query_parameters=[],
2390	streams=[],
2391	group_by=[],
2392	series=[],
2393	conditions={"expression": None},
2394	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2395	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2396	event_limit=1000,
2397	),
2398	field_spec={
2399	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2400	data_type="string",
2401	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2402	),
2403	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2404	data_type="string",
2405	providers=[
2406	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2407	],
2408	),
2409	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2410	data_type="string",
2411	providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2412	),
2413	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2414	data_type="string",
2415	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2416	),
2417	},
2418	key_spec=[],
2419	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2420	alert=True,
2421	),
2422	)
2423	return ProvisionWazuhMonitoringAlertResponse(
2424	success=True,
2425	message="SentinelOne new active threat suspicious detected monitoring alert provisioned successfully",
2426	)
2427
2428
2429	async def provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert(
2430	request: ProvisionMonitoringAlertRequest,
2431	) -> ProvisionWazuhMonitoringAlertResponse:
2432	"""
2433	Provisions SentinelOne: New Mitigation, Kill performed successfully.
2434	"""
2435	logger.info(
2436	"Invoking provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert "
2437	f"with request: {request.model_dump()}",
2438	)
2439	await provision_alert_definition(
2440	GraylogAlertProvisionModel(
2441	title="SENTINELONE - NEW MITIGATION KILL PERFORMED SUCCESSFULLY",
2442	description="Kill performed successfully",
2443	priority=2,
2444	config=GraylogAlertProvisionConfig(
2445	type="aggregation-v1",
2446	query='syslog_type:sentinelone AND cat:MITIGATION AND eventDesc:"Kill performed successfully"',
2447	query_parameters=[],
2448	streams=[],
2449	group_by=[],
2450	series=[],
2451	conditions={"expression": None},
2452	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2453	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2454	event_limit=1000,
2455	),
2456	field_spec={
2457	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2458	data_type="string",
2459	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2460	),
2461	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2462	data_type="string",
2463	providers=[
2464	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2465	],
2466	),
2467	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2468	data_type="string",
2469	providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2470	),
2471	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2472	data_type="string",
2473	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2474	),
2475	},
2476	key_spec=[],
2477	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2478	alert=True,
2479	),
2480	)
2481	return ProvisionWazuhMonitoringAlertResponse(
2482	success=True,
2483	message="SentinelOne mitigation kill performed successfully monitoring alert provisioned successfully",
2484	)
2485
2486
2487	async def provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert(
2488	request: ProvisionMonitoringAlertRequest,
2489	) -> ProvisionWazuhMonitoringAlertResponse:
2490	"""
2491	Provisions SentinelOne: New Mitigation, Quarantine performed successfully.
2492	"""
2493	logger.info(
2494	"Invoking provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert "
2495	f"with request: {request.model_dump()}",
2496	)
2497	await provision_alert_definition(
2498	GraylogAlertProvisionModel(
2499	title="SENTINELONE - NEW MITIGATION QUARANTINE PERFORMED SUCCESSFULLY",
2500	description="Quarantine performed successfully",
2501	priority=2,
2502	config=GraylogAlertProvisionConfig(
2503	type="aggregation-v1",
2504	query='syslog_type:sentinelone AND cat:MITIGATION AND eventDesc:"Quarantine performed successfully"',
2505	query_parameters=[],
2506	streams=[],
2507	group_by=[],
2508	series=[],
2509	conditions={"expression": None},
2510	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2511	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2512	event_limit=1000,
2513	),
2514	field_spec={
2515	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2516	data_type="string",
2517	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2518	),
2519	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2520	data_type="string",
2521	providers=[
2522	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2523	],
2524	),
2525	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2526	data_type="string",
2527	providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2528	),
2529	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2530	data_type="string",
2531	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2532	),
2533	},
2534	key_spec=[],
2535	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2536	alert=True,
2537	),
2538	)
2539	return ProvisionWazuhMonitoringAlertResponse(
2540	success=True,
2541	message="SentinelOne mitigation quarantine performed successfully monitoring alert provisioned successfully",
2542	)
2543
2544
2545	async def provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert(
2546	request: ProvisionMonitoringAlertRequest,
2547	) -> ProvisionWazuhMonitoringAlertResponse:
2548	"""
2549	Provisions SentinelOne: New Exclusion was added/modified by user.
2550	"""
2551	logger.info(
2552	"Invoking provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert "
2553	f"with request: {request.model_dump()}",
2554	)
2555	await provision_alert_definition(
2556	GraylogAlertProvisionModel(
2557	title="SENTINELONE - NEW EXCLUSION WAS ADDED OR MODIFIED BY USER",
2558	description="Exclusion was added/modified by user",
2559	priority=2,
2560	config=GraylogAlertProvisionConfig(
2561	type="aggregation-v1",
2562	query='syslog_type:sentinelone AND cat:WHITELISTBLACKLIST AND eventDesc:"Exclusion was added/modified by user"',
2563	query_parameters=[],
2564	streams=[],
2565	group_by=[],
2566	series=[],
2567	conditions={"expression": None},
2568	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2569	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2570	event_limit=1000,
2571	),
2572	field_spec={
2573	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2574	data_type="string",
2575	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2576	),
2577	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2578	data_type="string",
2579	providers=[
2580	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2581	],
2582	),
2583	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2584	data_type="string",
2585	providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2586	),
2587	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2588	data_type="string",
2589	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2590	),
2591	},
2592	key_spec=[],
2593	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2594	alert=True,
2595	),
2596	)
2597	return ProvisionWazuhMonitoringAlertResponse(
2598	success=True,
2599	message="SentinelOne exclusion added/modified by user monitoring alert provisioned successfully",
2600	)
2601
2602
2603	async def provision_sentinelone_new_path_exclusion_added_monitoring_alert(
2604	request: ProvisionMonitoringAlertRequest,
2605	) -> ProvisionWazuhMonitoringAlertResponse:
2606	"""
2607	Provisions SentinelOne: New Path Exclusion added.
2608	"""
2609	logger.info(
2610	"Invoking provision_sentinelone_new_path_exclusion_added_monitoring_alert " f"with request: {request.model_dump()}",
2611	)
2612	await provision_alert_definition(
2613	GraylogAlertProvisionModel(
2614	title="SENTINELONE - NEW PATH EXCLUSION ADDED",
2615	description="Path Exclusion added",
2616	priority=2,
2617	config=GraylogAlertProvisionConfig(
2618	type="aggregation-v1",
2619	query='syslog_type:sentinelone AND cat:WHITELISTBLACKLIST AND eventDesc:"Path Exclusion added"',
2620	query_parameters=[],
2621	streams=[],
2622	group_by=[],
2623	series=[],
2624	conditions={"expression": None},
2625	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2626	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2627	event_limit=1000,
2628	),
2629	field_spec={
2630	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2631	data_type="string",
2632	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2633	),
2634	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2635	data_type="string",
2636	providers=[
2637	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2638	],
2639	),
2640	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2641	data_type="string",
2642	providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2643	),
2644	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2645	data_type="string",
2646	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2647	),
2648	},
2649	key_spec=[],
2650	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2651	alert=True,
2652	),
2653	)
2654	return ProvisionWazuhMonitoringAlertResponse(
2655	success=True,
2656	message="SentinelOne path exclusion added monitoring alert provisioned successfully",
2657	)
2658
2659
2660	async def provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert(
2661	request: ProvisionMonitoringAlertRequest,
2662	) -> ProvisionWazuhMonitoringAlertResponse:
2663	"""
2664	Provisions SentinelOne: Analyst verdict changed to True Positive.
2665	"""
2666	logger.info(
2667	"Invoking provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert " f"with request: {request.model_dump()}",
2668	)
2669	await provision_alert_definition(
2670	GraylogAlertProvisionModel(
2671	title='SENTINELONE - ANALYST VERDICT CHANGED TO "TRUE POSITIVE"',
2672	description="A management user changed the analyst verdict to True positive.",
2673	priority=3,
2674	config=GraylogAlertProvisionConfig(
2675	type="aggregation-v1",
2676	query="syslog_type:sentinelone AND cat:THREATMANAGEMENT AND data_newAnalystVerdict:true_positive",
2677	query_parameters=[],
2678	streams=[],
2679	group_by=[],
2680	series=[],
2681	conditions={"expression": None},
2682	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2683	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2684	event_limit=1000,
2685	),
2686	field_spec={
2687	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2688	data_type="string",
2689	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2690	),
2691	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2692	data_type="string",
2693	providers=[
2694	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2695	],
2696	),
2697	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2698	data_type="string",
2699	providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2700	),
2701	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2702	data_type="string",
2703	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2704	),
2705	},
2706	key_spec=[],
2707	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2708	alert=True,
2709	),
2710	)
2711	return ProvisionWazuhMonitoringAlertResponse(
2712	success=True,
2713	message='SentinelOne analyst verdict changed to "True Positive" monitoring alert provisioned successfully',
2714	)
2715
2716
2717	async def provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert(
2718	request: ProvisionMonitoringAlertRequest,
2719	) -> ProvisionWazuhMonitoringAlertResponse:
2720	"""
2721	Provisions SentinelOne: Analyst verdict changed to False Positive.
2722	"""
2723	logger.info(
2724	"Invoking provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert "
2725	f"with request: {request.model_dump()}",
2726	)
2727	await provision_alert_definition(
2728	GraylogAlertProvisionModel(
2729	title='SENTINELONE - ANALYST VERDICT CHANGED TO "FALSE POSITIVE"',
2730	description="A management user changed the analyst verdict to False Positive.",
2731	priority=2,
2732	config=GraylogAlertProvisionConfig(
2733	type="aggregation-v1",
2734	query="syslog_type:sentinelone AND cat:THREATMANAGEMENT AND data_newAnalystVerdict:false_positive",
2735	query_parameters=[],
2736	streams=[],
2737	group_by=[],
2738	series=[],
2739	conditions={"expression": None},
2740	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2741	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2742	event_limit=1000,
2743	),
2744	field_spec={
2745	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2746	data_type="string",
2747	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2748	),
2749	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2750	data_type="string",
2751	providers=[
2752	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2753	],
2754	),
2755	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2756	data_type="string",
2757	providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2758	),
2759	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2760	data_type="string",
2761	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2762	),
2763	},
2764	key_spec=[],
2765	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2766	alert=True,
2767	),
2768	)
2769	return ProvisionWazuhMonitoringAlertResponse(
2770	success=True,
2771	message='SentinelOne analyst verdict changed to "False Positive" monitoring alert provisioned successfully',
2772	)
2773
2774
2775	# ! --- Mimecast Monitoring Alerts --- ! #
2776	async def provision_mimecast_compromised_site_url_accessed_monitoring_alert(
2777	request: ProvisionMonitoringAlertRequest,
2778	) -> ProvisionWazuhMonitoringAlertResponse:
2779	"""
2780	Provisions Mimecast Compromised Site URL Accessed monitoring alert.
2781	"""
2782	logger.info(
2783	"Invoking provision_mimecast_compromised_site_url_accessed_monitoring_alert " f"with request: {request.model_dump()}",
2784	)
2785	await provision_alert_definition(
2786	GraylogAlertProvisionModel(
2787	title="MIMECAST - COMPROMISED SITE URL ACCESSED",
2788	description="MIMECAST - COMPROMISED SITE URL ACCESSED",
2789	priority=3,
2790	config=GraylogAlertProvisionConfig(
2791	type="aggregation-v1",
2792	query='integration:mimecast AND (category:"Compromised" OR category:"Botnets" OR category:"Attacker Controlled Infrastructure") AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block" AND !adminOverride:"Hold" AND !adminOverride:"Block" AND !adminOverride:"Bounce"',
2793	query_parameters=[],
2794	streams=[],
2795	group_by=[],
2796	series=[],
2797	conditions={"expression": None},
2798	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2799	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2800	event_limit=1000,
2801	),
2802	field_spec={
2803	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2804	data_type="string",
2805	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2806	),
2807	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2808	data_type="string",
2809	providers=[
2810	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2811	],
2812	),
2813	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2814	data_type="string",
2815	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
2816	),
2817	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2818	data_type="string",
2819	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2820	),
2821	},
2822	key_spec=[],
2823	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2824	alert=True,
2825	),
2826	)
2827	return ProvisionWazuhMonitoringAlertResponse(
2828	success=True,
2829	message="Mimecast compromised site URL accessed monitoring alert provisioned successfully",
2830	)
2831
2832
2833	async def provision_mimecast_executable_file_attachment_delivered_monitoring_alert(
2834	request: ProvisionMonitoringAlertRequest,
2835	) -> ProvisionWazuhMonitoringAlertResponse:
2836	"""
2837	Provisions Mimecast Executable File Attachment Delivered monitoring alert.
2838	"""
2839	logger.info(
2840	"Invoking provision_mimecast_executable_file_attachment_delivered_monitoring_alert " f"with request: {request.model_dump()}",
2841	)
2842	await provision_alert_definition(
2843	GraylogAlertProvisionModel(
2844	title="MIMECAST - EXECUTABLE FILE ATTACHMENT DELIVERED",
2845	description="MIMECAST - EXECUTABLE FILE ATTACHMENT DELIVERED",
2846	priority=3,
2847	config=GraylogAlertProvisionConfig(
2848	type="aggregation-v1",
2849	query='integration:mimecast AND (Route:"Inbound" OR Dir:"Inbound" OR route:"inbound") AND (file_type:"application/x-dosexec" OR file_type:"application/x-msdownload" OR file_type:"application/x-executable" OR file_type:"application/vnd.microsoft.portable-executable") AND !actionTriggered:"Hold" AND !actionTriggered:"Block" AND !actionTriggered:"Bounce"',
2850	query_parameters=[],
2851	streams=[],
2852	group_by=[],
2853	series=[],
2854	conditions={"expression": None},
2855	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2856	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2857	event_limit=1000,
2858	),
2859	field_spec={
2860	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2861	data_type="string",
2862	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2863	),
2864	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2865	data_type="string",
2866	providers=[
2867	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2868	],
2869	),
2870	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2871	data_type="string",
2872	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
2873	),
2874	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2875	data_type="string",
2876	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2877	),
2878	},
2879	key_spec=[],
2880	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2881	alert=True,
2882	),
2883	)
2884	return ProvisionWazuhMonitoringAlertResponse(
2885	success=True,
2886	message="Mimecast executable file attachment delivered monitoring alert provisioned successfully",
2887	)
2888
2889
2890	async def provision_mimecast_malicious_email_attachment_delivered_monitoring_alert(
2891	request: ProvisionMonitoringAlertRequest,
2892	) -> ProvisionWazuhMonitoringAlertResponse:
2893	"""
2894	Provisions Mimecast Malicious Email Attachment Delivered monitoring alert.
2895	"""
2896	logger.info(
2897	"Invoking provision_mimecast_malicious_email_attachment_delivered_monitoring_alert " f"with request: {request.model_dump()}",
2898	)
2899	await provision_alert_definition(
2900	GraylogAlertProvisionModel(
2901	title="MIMECAST - MALICIOUS EMAIL ATTACHMENT DELIVERED",
2902	description="MIMECAST - MALICIOUS EMAIL ATTACHMENT DELIVERED",
2903	priority=3,
2904	config=GraylogAlertProvisionConfig(
2905	type="aggregation-v1",
2906	query='integration:mimecast AND scanResult:"malicious" AND (Route:"Inbound" OR Dir:"Inbound" OR route:"inbound") AND !actionTriggered:"Hold" AND !actionTriggered:"Block" AND !actionTriggered:"Bounce"',
2907	query_parameters=[],
2908	streams=[],
2909	group_by=[],
2910	series=[],
2911	conditions={"expression": None},
2912	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2913	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2914	event_limit=1000,
2915	),
2916	field_spec={
2917	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2918	data_type="string",
2919	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2920	),
2921	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2922	data_type="string",
2923	providers=[
2924	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2925	],
2926	),
2927	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2928	data_type="string",
2929	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
2930	),
2931	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2932	data_type="string",
2933	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2934	),
2935	},
2936	key_spec=[],
2937	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2938	alert=True,
2939	),
2940	)
2941	return ProvisionWazuhMonitoringAlertResponse(
2942	success=True,
2943	message="Mimecast malicious email attachment delivered monitoring alert provisioned successfully",
2944	)
2945
2946
2947	async def provision_mimecast_malicious_email_link_accessed_monitoring_alert(
2948	request: ProvisionMonitoringAlertRequest,
2949	) -> ProvisionWazuhMonitoringAlertResponse:
2950	"""
2951	Provisions Mimecast Malicious Email Link Accessed monitoring alert.
2952	"""
2953	logger.info(
2954	"Invoking provision_mimecast_malicious_email_link_accessed_monitoring_alert " f"with request: {request.model_dump()}",
2955	)
2956	await provision_alert_definition(
2957	GraylogAlertProvisionModel(
2958	title="MIMECAST - MALICIOUS EMAIL LINK ACCESSED",
2959	description="MIMECAST - MALICIOUS EMAIL LINK ACCESSED",
2960	priority=3,
2961	config=GraylogAlertProvisionConfig(
2962	type="aggregation-v1",
2963	query='integration:mimecast AND scanResult:"malicious" AND !action:"block"',
2964	query_parameters=[],
2965	streams=[],
2966	group_by=[],
2967	series=[],
2968	conditions={"expression": None},
2969	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2970	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2971	event_limit=1000,
2972	),
2973	field_spec={
2974	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2975	data_type="string",
2976	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2977	),
2978	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2979	data_type="string",
2980	providers=[
2981	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2982	],
2983	),
2984	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2985	data_type="string",
2986	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
2987	),
2988	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2989	data_type="string",
2990	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2991	),
2992	},
2993	key_spec=[],
2994	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2995	alert=True,
2996	),
2997	)
2998	return ProvisionWazuhMonitoringAlertResponse(
2999	success=True,
3000	message="Mimecast malicious email link accessed monitoring alert provisioned successfully",
3001	)
3002
3003
3004	async def provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert(
3005	request: ProvisionMonitoringAlertRequest,
3006	) -> ProvisionWazuhMonitoringAlertResponse:
3007	"""
3008	Provisions Mimecast P2P File Sharing URL Accessed monitoring alert.
3009	"""
3010	logger.info(
3011	"Invoking provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert " f"with request: {request.model_dump()}",
3012	)
3013	await provision_alert_definition(
3014	GraylogAlertProvisionModel(
3015	title="MIMECAST - P2P FILE SHARING URL ACCESSED",
3016	description="MIMECAST - P2P FILE SHARING URL ACCESSED",
3017	priority=3,
3018	config=GraylogAlertProvisionConfig(
3019	type="aggregation-v1",
3020	query='integration:mimecast AND category:"Peer-to-Peer" AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block" AND !adminOverride:"Hold" AND !adminOverride:"Block" AND !adminOverride:"Bounce"',
3021	query_parameters=[],
3022	streams=[],
3023	group_by=[],
3024	series=[],
3025	conditions={"expression": None},
3026	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3027	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3028	event_limit=1000,
3029	),
3030	field_spec={
3031	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3032	data_type="string",
3033	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3034	),
3035	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3036	data_type="string",
3037	providers=[
3038	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3039	],
3040	),
3041	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3042	data_type="string",
3043	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3044	),
3045	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3046	data_type="string",
3047	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3048	),
3049	},
3050	key_spec=[],
3051	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3052	alert=True,
3053	),
3054	)
3055	return ProvisionWazuhMonitoringAlertResponse(
3056	success=True,
3057	message="Mimecast P2P file sharing URL accessed monitoring alert provisioned successfully",
3058	)
3059
3060
3061	async def provision_mimecast_anonymizer_url_accessed_monitoring_alert(
3062	request: ProvisionMonitoringAlertRequest,
3063	) -> ProvisionWazuhMonitoringAlertResponse:
3064	"""
3065	Provisions Mimecast Anonymizer URL Accessed monitoring alert.
3066	"""
3067	logger.info(
3068	"Invoking provision_mimecast_anonymizer_url_accessed_monitoring_alert " f"with request: {request.model_dump()}",
3069	)
3070	await provision_alert_definition(
3071	GraylogAlertProvisionModel(
3072	title="MIMECAST - ANONYMIZER URL ACCESSED",
3073	description="MIMECAST - ANONYMIZER URL ACCESSED",
3074	priority=2,
3075	config=GraylogAlertProvisionConfig(
3076	type="aggregation-v1",
3077	query='integration:mimecast AND category:"Anonymizers" AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block" AND !adminOverride:"Hold" AND !adminOverride:"Block" AND !adminOverride:"Bounce"',
3078	query_parameters=[],
3079	streams=[],
3080	group_by=[],
3081	series=[],
3082	conditions={"expression": None},
3083	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3084	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3085	event_limit=1000,
3086	),
3087	field_spec={
3088	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3089	data_type="string",
3090	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3091	),
3092	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3093	data_type="string",
3094	providers=[
3095	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3096	],
3097	),
3098	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3099	data_type="string",
3100	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3101	),
3102	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3103	data_type="string",
3104	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3105	),
3106	},
3107	key_spec=[],
3108	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3109	alert=True,
3110	),
3111	)
3112	return ProvisionWazuhMonitoringAlertResponse(
3113	success=True,
3114	message="Mimecast anonymizer URL accessed monitoring alert provisioned successfully",
3115	)
3116
3117
3118	async def provision_mimecast_impersonation_email_delivered_monitoring_alert(
3119	request: ProvisionMonitoringAlertRequest,
3120	) -> ProvisionWazuhMonitoringAlertResponse:
3121	"""
3122	Provisions Mimecast Impersonation Email Delivered monitoring alert.
3123	"""
3124	logger.info(
3125	"Invoking provision_mimecast_impersonation_email_delivered_monitoring_alert " f"with request: {request.model_dump()}",
3126	)
3127	await provision_alert_definition(
3128	GraylogAlertProvisionModel(
3129	title="MIMECAST - IMPERSONATION EMAIL DELIVERED",
3130	description="MIMECAST - IMPERSONATION EMAIL DELIVERED",
3131	priority=2,
3132	config=GraylogAlertProvisionConfig(
3133	type="aggregation-v1",
3134	query='integration:mimecast AND taggedMalicious:true AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block"',
3135	query_parameters=[],
3136	streams=[],
3137	group_by=[],
3138	series=[],
3139	conditions={"expression": None},
3140	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3141	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3142	event_limit=1000,
3143	),
3144	field_spec={
3145	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3146	data_type="string",
3147	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3148	),
3149	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3150	data_type="string",
3151	providers=[
3152	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3153	],
3154	),
3155	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3156	data_type="string",
3157	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3158	),
3159	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3160	data_type="string",
3161	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3162	),
3163	},
3164	key_spec=[],
3165	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3166	alert=True,
3167	),
3168	)
3169	return ProvisionWazuhMonitoringAlertResponse(
3170	success=True,
3171	message="Mimecast impersonation email delivered monitoring alert provisioned successfully",
3172	)
3173
3174
3175	async def provision_mimecast_malicious_outbound_email_monitoring_alert(
3176	request: ProvisionMonitoringAlertRequest,
3177	) -> ProvisionWazuhMonitoringAlertResponse:
3178	"""
3179	Provisions Mimecast Malicious Outbound Email monitoring alert.
3180	"""
3181	logger.info(
3182	"Invoking provision_mimecast_malicious_outbound_email_monitoring_alert " f"with request: {request.model_dump()}",
3183	)
3184	await provision_alert_definition(
3185	GraylogAlertProvisionModel(
3186	title="MIMECAST - MALICIOUS OUTBOUND EMAIL",
3187	description="MIMECAST - MALICIOUS OUTBOUND EMAIL",
3188	priority=2,
3189	config=GraylogAlertProvisionConfig(
3190	type="aggregation-v1",
3191	query='integration:mimecast AND Dir:"Outbound" AND category:"Malware" AND scanResult:"malicious" AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block" AND !adminOverride:"Hold" AND !adminOverride:"Block" AND !adminOverride:"Bounce"',
3192	query_parameters=[],
3193	streams=[],
3194	group_by=[],
3195	series=[],
3196	conditions={"expression": None},
3197	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3198	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3199	event_limit=1000,
3200	),
3201	field_spec={
3202	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3203	data_type="string",
3204	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3205	),
3206	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3207	data_type="string",
3208	providers=[
3209	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3210	],
3211	),
3212	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3213	data_type="string",
3214	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3215	),
3216	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3217	data_type="string",
3218	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3219	),
3220	},
3221	key_spec=[],
3222	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3223	alert=True,
3224	),
3225	)
3226	return ProvisionWazuhMonitoringAlertResponse(
3227	success=True,
3228	message="Mimecast malicious outbound email monitoring alert provisioned successfully",
3229	)
3230
3231
3232	async def provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert(
3233	request: ProvisionMonitoringAlertRequest,
3234	) -> ProvisionWazuhMonitoringAlertResponse:
3235	"""
3236	Provisions Mimecast Malicious RTF Attachment Delivered monitoring alert.
3237	"""
3238	logger.info(
3239	"Invoking provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert " f"with request: {request.model_dump()}",
3240	)
3241	await provision_alert_definition(
3242	GraylogAlertProvisionModel(
3243	title="MIMECAST - MALICIOUS RTF ATTACHMENT DELIVERED",
3244	description="MIMECAST - MALICIOUS RTF ATTACHMENT DELIVERED",
3245	priority=2,
3246	config=GraylogAlertProvisionConfig(
3247	type="aggregation-v1",
3248	query='integration:mimecast AND scanResult:"malicious" AND fileName:/\\.rtf$/ AND !actionTriggered:"Hold" AND !actionTriggered:"Block" AND !actionTriggered:"Bounce"',
3249	query_parameters=[],
3250	streams=[],
3251	group_by=[],
3252	series=[],
3253	conditions={"expression": None},
3254	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3255	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3256	event_limit=1000,
3257	),
3258	field_spec={
3259	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3260	data_type="string",
3261	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3262	),
3263	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3264	data_type="string",
3265	providers=[
3266	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3267	],
3268	),
3269	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3270	data_type="string",
3271	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3272	),
3273	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3274	data_type="string",
3275	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3276	),
3277	},
3278	key_spec=[],
3279	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3280	alert=True,
3281	),
3282	)
3283	return ProvisionWazuhMonitoringAlertResponse(
3284	success=True,
3285	message="Mimecast malicious RTF attachment delivered monitoring alert provisioned successfully",
3286	)
3287
3288
3289	async def provision_mimecast_phishing_email_delivered_monitoring_alert(
3290	request: ProvisionMonitoringAlertRequest,
3291	) -> ProvisionWazuhMonitoringAlertResponse:
3292	"""
3293	Provisions Mimecast Phishing Email Delivered monitoring alert.
3294	"""
3295	logger.info(
3296	"Invoking provision_mimecast_phishing_email_delivered_monitoring_alert " f"with request: {request.model_dump()}",
3297	)
3298	await provision_alert_definition(
3299	GraylogAlertProvisionModel(
3300	title="MIMECAST - PHISHING EMAIL DELIVERED",
3301	description="MIMECAST - PHISHING EMAIL DELIVERED",
3302	priority=2,
3303	config=GraylogAlertProvisionConfig(
3304	type="aggregation-v1",
3305	query='integration:mimecast AND category:"Phishing & Fraud" AND (Route:"Inbound" OR Dir:"Inbound" OR route:"inbound") AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block"',
3306	query_parameters=[],
3307	streams=[],
3308	group_by=[],
3309	series=[],
3310	conditions={"expression": None},
3311	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3312	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3313	event_limit=1000,
3314	),
3315	field_spec={
3316	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3317	data_type="string",
3318	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3319	),
3320	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3321	data_type="string",
3322	providers=[
3323	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3324	],
3325	),
3326	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3327	data_type="string",
3328	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3329	),
3330	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3331	data_type="string",
3332	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3333	),
3334	},
3335	key_spec=[],
3336	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3337	alert=True,
3338	),
3339	)
3340	return ProvisionWazuhMonitoringAlertResponse(
3341	success=True,
3342	message="Mimecast phishing email delivered monitoring alert provisioned successfully",
3343	)
3344
3345
3346	async def provision_mimecast_source_code_file_in_email_attachment_monitoring_alert(
3347	request: ProvisionMonitoringAlertRequest,
3348	) -> ProvisionWazuhMonitoringAlertResponse:
3349	"""
3350	Provisions Mimecast Source Code File In Email Attachment monitoring alert.
3351	"""
3352	logger.info(
3353	"Invoking provision_mimecast_source_code_file_in_email_attachment_monitoring_alert " f"with request: {request.model_dump()}",
3354	)
3355	await provision_alert_definition(
3356	GraylogAlertProvisionModel(
3357	title="MIMECAST - SOURCE CODE FILE IN EMAIL ATTACHMENT",
3358	description="MIMECAST - SOURCE CODE FILE IN EMAIL ATTACHMENT",
3359	priority=2,
3360	config=GraylogAlertProvisionConfig(
3361	type="aggregation-v1",
3362	query="integration:mimecast AND (AttNames:/\\.py$/ OR AttNames:/\\.java$/ OR AttNames:/\\.c$/ OR AttNames:/\\.cs$/ OR AttNames:/\\.cpp$/ OR AttNames:/\\.jsp$/ OR AttNames:/\\.vba$/ OR AttNames:/\\.class$/)",
3363	query_parameters=[],
3364	streams=[],
3365	group_by=[],
3366	series=[],
3367	conditions={"expression": None},
3368	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3369	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3370	event_limit=1000,
3371	),
3372	field_spec={
3373	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3374	data_type="string",
3375	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3376	),
3377	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3378	data_type="string",
3379	providers=[
3380	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3381	],
3382	),
3383	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3384	data_type="string",
3385	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3386	),
3387	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3388	data_type="string",
3389	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3390	),
3391	},
3392	key_spec=[],
3393	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3394	alert=True,
3395	),
3396	)
3397	return ProvisionWazuhMonitoringAlertResponse(
3398	success=True,
3399	message="Mimecast source code file in email attachment monitoring alert provisioned successfully",
3400	)
3401
3402
3403	async def provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert(
3404	request: ProvisionMonitoringAlertRequest,
3405	) -> ProvisionWazuhMonitoringAlertResponse:
3406	"""
3407	Provisions Mimecast URL with Dangerous File Type Accessed monitoring alert.
3408	"""
3409	logger.info(
3410	"Invoking provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert " f"with request: {request.model_dump()}",
3411	)
3412	await provision_alert_definition(
3413	GraylogAlertProvisionModel(
3414	title="MIMECAST - URL WITH DANGEROUS FILE TYPE ACCESSED",
3415	description="MIMECAST - URL WITH DANGEROUS FILE TYPE ACCESSED",
3416	priority=2,
3417	config=GraylogAlertProvisionConfig(
3418	type="aggregation-v1",
3419	query='integration:mimecast AND category:"Dangerous file extension" AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block" AND !adminOverride:"Hold" AND !adminOverride:"Block" AND !adminOverride:"Bounce"',
3420	query_parameters=[],
3421	streams=[],
3422	group_by=[],
3423	series=[],
3424	conditions={"expression": None},
3425	search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3426	execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3427	event_limit=1000,
3428	),
3429	field_spec={
3430	"ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3431	data_type="string",
3432	providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3433	),
3434	"CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3435	data_type="string",
3436	providers=[
3437	GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3438	],
3439	),
3440	"ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3441	data_type="string",
3442	providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3443	),
3444	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3445	data_type="string",
3446	providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3447	),
3448	},
3449	key_spec=[],
3450	notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3451	alert=True,
3452	),
3453	)
3454	return ProvisionWazuhMonitoringAlertResponse(
3455	success=True,
3456	message="Mimecast URL with dangerous file type accessed monitoring alert provisioned successfully",
3457	)
3458
3459
3460	async def provision_custom_alert(request: CustomMonitoringAlertProvisionModel) -> ProvisionWazuhMonitoringAlertResponse:
3461	"""
3462	Provisions custom monitoring alerts.
3463
3464	Returns:
3465	ProvisionWazuhMonitoringAlertResponse: The response indicating the success of provisioning the monitoring alerts.
3466	"""
3467	#
3468	logger.info(
3469	f"Invoking provision_custom_alert with request: {request.model_dump()}",
3470	)
3471	await provision_alert_definition(
3472	GraylogAlertProvisionModel(
3473	title=request.alert_name,
3474	description=request.alert_description,
3475	priority=request.alert_priority.value,
3476	config=GraylogAlertProvisionConfig(
3477	type="aggregation-v1",
3478	query=f"{request.search_query}",
3479	query_parameters=[],
3480	streams=request.streams,
3481	group_by=[],
3482	series=[],
3483	conditions={
3484	"expression": None,
3485	},
3486	search_within_ms=request.search_within_ms,
3487	execute_every_ms=request.execute_every_ms,
3488	event_limit=1000,
3489	),
3490	field_spec={
3491	"COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3492	data_type="string",
3493	providers=[
3494	GraylogAlertProvisionProvider(
3495	type="template-v1",
3496	template="NONE",
3497	require_values=True,
3498	),
3499	],
3500	),
3501	},
3502	key_spec=[],
3503	notification_settings=GraylogAlertProvisionNotificationSettings(
3504	grace_period_ms=0,
3505	backlog_size=None,
3506	),
3507	alert=True,
3508	),
3509	)
3510
3511	return ProvisionWazuhMonitoringAlertResponse(
3512	success=True,
3513	message="Custom monitoring alerts provisioned successfully",
3514	)