reverted back to before last_24_hours
Taylor committed
Jul 19, 2023 at 16:19 UTC
0b34516873d292632a905747c6d13c29bd5b4305
2 files changed
+3
-50
backend/app/routes/alerts.py
+1
-20
@@ -21,7 +21,7 @@ def get_alerts() -> jsonify:
21
containing all its associated data.
22
"""
23
service = AlertsService()
24
- alerts = service.collect_alerts(size=1000) # replace `collect_all_alerts` with `collect_alerts(size=1000)`
24
+ alerts = service.collect_alerts(size=10) # replace `collect_all_alerts` with `collect_alerts(size=1000)`
25
return jsonify(alerts)
26
27
@@ -42,25 +42,6 @@ def get_alerts_by_agent(agent_name: str) -> jsonify:
42
alerts = service.collect_alerts_by_agent_name(agent_name=agent_name)
43
return jsonify(alerts)
44
45
-
46
-@bp.route("/alerts/last_24_hours", methods=["GET"])
47
-def get_alerts_last_24_hours() -> jsonify:
48
- """
49
- Retrieves all alerts from all wazuh indices with the last 24 hours.
50
-
51
- This endpoint retrieves all available alerts from the AlertsService. It does this by creating an instance of
52
- the AlertsService class and calling its `collect_alerts_by_agent` method. The result is a list of all alerts currently
53
- available.
54
-
55
- Returns:
56
- jsonify: A JSON response containing a list of alerts. Each item in the list is a dictionary representing an alert,
57
- containing all its associated data.
58
- """
59
- service = AlertsService()
60
- alerts = service.collect_alerts_last_24_hours(size=1000)
61
- return jsonify(alerts)
62
-
63
-
45
@bp.route("/alerts/top_10", methods=["GET"])
46
def get_top_10_alerts() -> jsonify:
47
"""
backend/app/services/WazuhIndexer/alerts.py
+2
-30
@@ -254,7 +254,7 @@ class AlertsService:
254
"""
255
return {"message": message, "success": False}
256
257
- def _collect_alerts(self, index_name: str, size: int = None, query: Dict[str, object] = None) -> Dict[str, object]:
257
+ def _collect_alerts(self, index_name: str, size: int = None) -> Dict[str, object]:
258
"""
259
Elasticsearch query to get the most recent alerts where the `rule_level` is 12 or higher or the
260
`syslog_level` field is `ALERT` and return the results in descending order by the `timestamp_utc` field.
@@ -263,13 +263,12 @@ class AlertsService:
263
Args:
264
index_name (str): The name of the index to query.
265
size (int, optional): The maximum number of alerts to return. If None, all alerts are returned.
266
- query (Dict[str, object], optional): The Elasticsearch query to use. If None, the default query is used.
266
267
Returns:
268
Dict[str, object]: A dictionary containing success status and alerts or an error message.
269
"""
270
logger.info(f"Collecting alerts from {index_name}")
272
- query = query or self._build_query() # Use the provided query or the default query
271
+ query = self._build_query() # Use the provided query
272
try:
273
alerts = self.es.search(index=index_name, body=query, size=size)
274
alerts_list = [alert for alert in alerts["hits"]["hits"]]
@@ -328,33 +327,6 @@ class AlertsService:
327
"sort": [{"timestamp_utc": {"order": "desc"}}],
328
}
329
331
- def _build_query_last_24_hours(self) -> Dict[str, object]:
332
- """
333
- Builds the Elasticsearch query to get the most recent alerts where the `rule_level` is 12 or higher or
334
- the `syslog_level` field is `ALERT`, and the `timestamp_utc` is within the last 24 hours.
335
-
336
- Returns:
337
- Dict[str, object]: A dictionary representing the Elasticsearch query.
338
- """
339
- # Calculate the time 24 hours ago
340
- time_24_hours_ago = datetime.utcnow() - timedelta(hours=24)
341
-
342
- # Convert the time to the format used in the Elasticsearch index
343
- time_24_hours_ago = time_24_hours_ago.strftime("%Y-%m-%dT%H:%M:%S")
344
-
345
- return {
346
- "query": {
347
- "bool": {
348
- "must": [{"range": {"timestamp_utc": {"gte": time_24_hours_ago}}}],
349
- "should": [
350
- {"range": {"rule_level": {"gte": 12}}},
351
- {"match": {"syslog_level": "ALERT"}},
352
- ],
353
- },
354
- },
355
- "sort": [{"timestamp_utc": {"order": "desc"}}],
356
- }
357
-
330
def escalate_alert(self, alert_id: str, index: str) -> Dict[str, Any]:
331
"""
332
Escalates an alert by creating it in DFIR-IRIS