| 1 | import type { FlaskBaseResponse } from "@/types/flask.d" |
| 2 | import type { |
| 3 | AiAnalysisResponse, |
| 4 | AiVelociraptorArtifactRecommendationResponse, |
| 5 | AiWazuhExclusionRuleResponse, |
| 6 | EpssScore, |
| 7 | EvaluationData, |
| 8 | MCPQueryResponse, |
| 9 | ThreatIntelResponse, |
| 10 | VirusTotalAnalysis, |
| 11 | VirusTotalFileCheckResponse, |
| 12 | VirusTotalResponse |
| 13 | } from "@/types/threatIntel.d" |
| 14 | import { HttpClient } from "../httpClient" |
| 15 | |
| 16 | export default { |
| 17 | create(iocValue: string) { |
| 18 | const body = { |
| 19 | ioc_value: iocValue |
| 20 | } |
| 21 | return HttpClient.post<FlaskBaseResponse & { data: ThreatIntelResponse }>(`/threat_intel/socfortress`, body) |
| 22 | }, |
| 23 | processNameEvaluation(processName: string) { |
| 24 | const body = { |
| 25 | process_name: processName |
| 26 | } |
| 27 | return HttpClient.post<(FlaskBaseResponse & { data: EvaluationData }) | MCPQueryResponse>( |
| 28 | `/threat_intel/process_name`, |
| 29 | body |
| 30 | ) |
| 31 | }, |
| 32 | epssScore(cve: string) { |
| 33 | const body = { |
| 34 | cve |
| 35 | } |
| 36 | return HttpClient.post<FlaskBaseResponse & { data: EpssScore[]; the_epss_model: string }>( |
| 37 | `/threat_intel/epss`, |
| 38 | body |
| 39 | ) |
| 40 | }, |
| 41 | aiAlertAnalysis({ indexId, indexName, alertId }: { indexId: string; indexName: string; alertId: number }) { |
| 42 | return HttpClient.post<FlaskBaseResponse & AiAnalysisResponse>(`/threat_intel/ai/analyze-alert`, { |
| 43 | index_name: indexName, |
| 44 | index_id: indexId, |
| 45 | alert_id: alertId |
| 46 | }) |
| 47 | }, |
| 48 | aiWazuhExclusionRule({ indexId, indexName, alertId }: { indexId: string; indexName: string; alertId: number }) { |
| 49 | return HttpClient.post<FlaskBaseResponse & AiWazuhExclusionRuleResponse>( |
| 50 | `/threat_intel/ai/wazuh-exclusion-rule`, |
| 51 | { |
| 52 | index_name: indexName, |
| 53 | index_id: indexId, |
| 54 | alert_id: alertId |
| 55 | } |
| 56 | ) |
| 57 | }, |
| 58 | aiVelociraptorArtifactRecommendation({ |
| 59 | indexId, |
| 60 | indexName, |
| 61 | agentId, |
| 62 | alertId |
| 63 | }: { |
| 64 | indexId: string |
| 65 | indexName: string |
| 66 | agentId: string |
| 67 | alertId: number |
| 68 | }) { |
| 69 | return HttpClient.post<FlaskBaseResponse & AiVelociraptorArtifactRecommendationResponse>( |
| 70 | `/threat_intel/ai/velociraptor-artifact-recommendation`, |
| 71 | { |
| 72 | index_name: indexName, |
| 73 | index_id: indexId, |
| 74 | agent_id: agentId, |
| 75 | alert_id: alertId |
| 76 | } |
| 77 | ) |
| 78 | }, |
| 79 | virusTotalEnrichment(iocValue: string) { |
| 80 | return HttpClient.post<FlaskBaseResponse & VirusTotalResponse>(`/threat_intel/virustotal`, { |
| 81 | ioc_value: iocValue |
| 82 | }) |
| 83 | }, |
| 84 | virusTotalFileCheck(file: File, password?: string) { |
| 85 | const form = new FormData() |
| 86 | form.append("file", new Blob([file], { type: file.type }), file.name) |
| 87 | |
| 88 | if (password) { |
| 89 | form.append("password", password) |
| 90 | } |
| 91 | |
| 92 | return HttpClient.post<FlaskBaseResponse & { data: VirusTotalFileCheckResponse }>( |
| 93 | `/threat_intel/virustotal/file/submit`, |
| 94 | form |
| 95 | ) |
| 96 | }, |
| 97 | virusTotalAnalysis(id: string, signal?: AbortSignal) { |
| 98 | return HttpClient.get<FlaskBaseResponse & { data: VirusTotalAnalysis }>( |
| 99 | `/threat_intel/virustotal/analysis/${id}`, |
| 100 | signal ? { signal } : {} |
| 101 | ) |
| 102 | } |
| 103 | } |