| 1 | from loguru import logger |
| 2 | from sqlalchemy import and_ |
| 3 | from sqlalchemy import update |
| 4 | from sqlalchemy.ext.asyncio import AsyncSession |
| 5 | |
| 6 | from app.integrations.models.customer_integration_settings import CustomerIntegrations |
| 7 | from app.integrations.socfortress_mdr.schema.provision import ( |
| 8 | ProvisionSOCFortressMDRResponse, |
| 9 | ) |
| 10 | |
| 11 | INTEGRATION_NAME = "SOCFortress MDR" |
| 12 | |
| 13 | |
| 14 | async def update_customer_integration_table( |
| 15 | customer_code: str, |
| 16 | session: AsyncSession, |
| 17 | ) -> None: |
| 18 | """ |
| 19 | Set `deployed = True` on the customer's "SOCFortress MDR" integration row. |
| 20 | |
| 21 | Args: |
| 22 | customer_code (str): The customer code. |
| 23 | session (AsyncSession): The async database session. |
| 24 | """ |
| 25 | logger.info(f"Marking SOCFortress MDR integration deployed for customer {customer_code}") |
| 26 | await session.execute( |
| 27 | update(CustomerIntegrations) |
| 28 | .where( |
| 29 | and_( |
| 30 | CustomerIntegrations.customer_code == customer_code, |
| 31 | CustomerIntegrations.integration_service_name == INTEGRATION_NAME, |
| 32 | ), |
| 33 | ) |
| 34 | .values(deployed=True), |
| 35 | ) |
| 36 | await session.commit() |
| 37 | |
| 38 | |
| 39 | async def provision_socfortress_mdr( |
| 40 | customer_code: str, |
| 41 | collector_uuid: str, |
| 42 | session: AsyncSession, |
| 43 | ) -> ProvisionSOCFortressMDRResponse: |
| 44 | """ |
| 45 | Provision the SOCFortress MDR integration for a customer. |
| 46 | |
| 47 | Unlike most integrations there is no Graylog/Grafana infrastructure to stand |
| 48 | up here — the MDR server and the customer's collector already exist. The MDR |
| 49 | server pulls alerts on demand via the collector. Provisioning therefore just |
| 50 | records the COLLECTOR_UUID (already validated by the route) and marks the |
| 51 | integration deployed so alert forwarding is enabled for this customer. |
| 52 | |
| 53 | Args: |
| 54 | customer_code (str): The customer code. |
| 55 | collector_uuid (str): The MDR collector UUID for this customer. |
| 56 | session (AsyncSession): The async database session. |
| 57 | |
| 58 | Returns: |
| 59 | ProvisionSOCFortressMDRResponse |
| 60 | """ |
| 61 | logger.info( |
| 62 | f"Provisioning SOCFortress MDR integration for customer {customer_code} " f"(collector {collector_uuid})", |
| 63 | ) |
| 64 | await update_customer_integration_table(customer_code, session) |
| 65 | return ProvisionSOCFortressMDRResponse( |
| 66 | success=True, |
| 67 | message="SOCFortress MDR integration provisioned successfully.", |
| 68 | ) |