571 sentinelone rules (#572)
* feat: add SentinelOne monitoring alerts provisioning functions * feat: add new SentinelOne monitoring alert provisioning functions * chore: update CURRENT_VERSION to 0.1.14
taylor_socfortress committed
Dec 19, 2025 at 09:42 UTC
108427b54428d4fb0c24056ef603090e6dcd6511
4 files changed
+564
-1
backend/app/integrations/monitoring_alert/routes/provision.py
+96
@@ -107,6 +107,30 @@ from app.integrations.monitoring_alert.services.provision import (
107
from app.integrations.monitoring_alert.services.provision import (
108
provision_paloalto_monitoring_alert,
109
)
110
+from app.integrations.monitoring_alert.services.provision import (
111
+ provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert,
112
+)
113
+from app.integrations.monitoring_alert.services.provision import (
114
+ provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert,
115
+)
116
+from app.integrations.monitoring_alert.services.provision import (
117
+ provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert,
118
+)
119
+from app.integrations.monitoring_alert.services.provision import (
120
+ provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert,
121
+)
122
+from app.integrations.monitoring_alert.services.provision import (
123
+ provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert,
124
+)
125
+from app.integrations.monitoring_alert.services.provision import (
126
+ provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert,
127
+)
128
+from app.integrations.monitoring_alert.services.provision import (
129
+ provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert,
130
+)
131
+from app.integrations.monitoring_alert.services.provision import (
132
+ provision_sentinelone_new_path_exclusion_added_monitoring_alert,
133
+)
134
from app.integrations.monitoring_alert.services.provision import (
135
provision_suricata_monitoring_alert,
136
)
@@ -378,6 +402,70 @@ async def invoke_provision_paloalto_firewall_medium_severity_correlation_event_d
402
)
403
404
405
+async def invoke_provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert(
406
+ request: ProvisionMonitoringAlertRequest,
407
+):
408
+ await provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert(
409
+ request,
410
+ )
411
+
412
+
413
+async def invoke_provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert(
414
+ request: ProvisionMonitoringAlertRequest,
415
+):
416
+ await provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert(
417
+ request,
418
+ )
419
+
420
+
421
+async def invoke_provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert(
422
+ request: ProvisionMonitoringAlertRequest,
423
+):
424
+ await provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert(
425
+ request,
426
+ )
427
+
428
+
429
+async def invoke_provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert(
430
+ request: ProvisionMonitoringAlertRequest,
431
+):
432
+ await provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert(
433
+ request,
434
+ )
435
+
436
+
437
+async def invoke_provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert(
438
+ request: ProvisionMonitoringAlertRequest,
439
+):
440
+ await provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert(
441
+ request,
442
+ )
443
+
444
+
445
+async def invoke_provision_sentinelone_new_path_exclusion_added_monitoring_alert(
446
+ request: ProvisionMonitoringAlertRequest,
447
+):
448
+ await provision_sentinelone_new_path_exclusion_added_monitoring_alert(
449
+ request,
450
+ )
451
+
452
+
453
+async def invoke_provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert(
454
+ request: ProvisionMonitoringAlertRequest,
455
+):
456
+ await provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert(
457
+ request,
458
+ )
459
+
460
+
461
+async def invoke_provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert(
462
+ request: ProvisionMonitoringAlertRequest,
463
+):
464
+ await provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert(
465
+ request,
466
+ )
467
+
468
+
469
async def invoke_provision_custom_monitoring_alert(
470
request: CustomMonitoringAlertProvisionModel,
471
):
@@ -416,6 +504,14 @@ PROVISION_FUNCTIONS = {
504
"PALOALTO_FIREWALL_VIRUS_ALLOWED": invoke_provision_paloalto_firewall_virus_allowed_monitoring_alert,
505
"PALOALTO_FIREWALL_TOR_TRAFFIC_ALLOWED": invoke_provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert,
506
"PALOALTO_FIREWALL_MEDIUM_SEVERITY_CORRELATION_EVENT_DETECTED": invoke_provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert,
507
+ "SENTINELONE_NEW_ACTIVE_THREAT_MALICIOUS_DETECTED": invoke_provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert,
508
+ "SENTINELONE_NEW_ACTIVE_THREAT_SUSPICIOUS_DETECTED": invoke_provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert,
509
+ "SENTINELONE_NEW_MITIGATION_KILL_PERFORMED_SUCCESSFULLY": invoke_provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert,
510
+ "SENTINELONE_NEW_MITIGATION_QUARANTINE_PERFORMED_SUCCESSFULLY": invoke_provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert,
511
+ "SENTINELONE_NEW_EXCLUSION_WAS_ADDED_OR_MODIFIED_BY_USER": invoke_provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert,
512
+ "SENTINELONE_NEW_PATH_EXCLUSION_ADDED": invoke_provision_sentinelone_new_path_exclusion_added_monitoring_alert,
513
+ "SENTINELONE_ANALYST_VERDICT_CHANGED_TO_TRUE_POSITIVE": invoke_provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert,
514
+ "SENTINELONE_ANALYST_VERDICT_CHANGED_TO_FALSE_POSITIVE": invoke_provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert,
515
"CUSTOM": invoke_provision_custom_monitoring_alert,
516
# Add more alert names and functions as needed
517
}
backend/app/integrations/monitoring_alert/schema/provision.py
+9
@@ -209,6 +209,15 @@ class AvailableMonitoringAlerts(str, Enum):
209
"This helps identify suspicious traffic patterns and network anomalies which, when correlated, indicate with "
210
"a high probability that a host on the network has been compromised."
211
)
212
+ # ! --- SentinelOne alerts ---
213
+ SENTINELONE_NEW_ACTIVE_THREAT_MALICIOUS_DETECTED = "Threat with confidence level malicious detected"
214
+ SENTINELONE_NEW_ACTIVE_THREAT_SUSPICIOUS_DETECTED = "Threat with confidence level suspicious detected"
215
+ SENTINELONE_NEW_MITIGATION_KILL_PERFORMED_SUCCESSFULLY = "Kill performed successfully"
216
+ SENTINELONE_NEW_MITIGATION_QUARANTINE_PERFORMED_SUCCESSFULLY = "Quarantine performed successfully"
217
+ SENTINELONE_NEW_EXCLUSION_WAS_ADDED_OR_MODIFIED_BY_USER = "Exclusion was added/modified by user"
218
+ SENTINELONE_NEW_PATH_EXCLUSION_ADDED = "Path Exclusion added"
219
+ SENTINELONE_ANALYST_VERDICT_CHANGED_TO_TRUE_POSITIVE = 'A management user changed the analyst verdict to "True Positive".'
220
+ SENTINELONE_ANALYST_VERDICT_CHANGED_TO_FALSE_POSITIVE = 'A management user changed the analyst verdict to "False Positive".'
221
222
223
class AvailableMonitoringAlertsResponse(BaseModel):
backend/app/integrations/monitoring_alert/services/provision.py
+458
@@ -2310,6 +2310,464 @@ async def provision_paloalto_firewall_medium_severity_correlation_event_detected
2310
)
2311
2312
2313
+# ! SentinelOne Monitoring Alerts -- ! #
2314
+async def provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert(
2315
+ request: ProvisionMonitoringAlertRequest,
2316
+) -> ProvisionWazuhMonitoringAlertResponse:
2317
+ """
2318
+ Provisions SentinelOne: New Active Threat Malicious Detected.
2319
+ """
2320
+ logger.info(
2321
+ "Invoking provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert " f"with request: {request.dict()}",
2322
+ )
2323
+ await provision_alert_definition(
2324
+ GraylogAlertProvisionModel(
2325
+ title="SENTINELONE - NEW ACTIVE THREAT MALICIOUS DETECTED",
2326
+ description="Threat with confidence level malicious detected",
2327
+ priority=3,
2328
+ config=GraylogAlertProvisionConfig(
2329
+ type="aggregation-v1",
2330
+ query="syslog_type:sentinelone AND cat:MALWARE AND threatConfidenceLevel:malicious",
2331
+ query_parameters=[],
2332
+ streams=[],
2333
+ group_by=[],
2334
+ series=[],
2335
+ conditions={"expression": None},
2336
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2337
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2338
+ event_limit=1000,
2339
+ ),
2340
+ field_spec={
2341
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2342
+ data_type="string",
2343
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2344
+ ),
2345
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2346
+ data_type="string",
2347
+ providers=[
2348
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2349
+ ],
2350
+ ),
2351
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2352
+ data_type="string",
2353
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2354
+ ),
2355
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2356
+ data_type="string",
2357
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2358
+ ),
2359
+ },
2360
+ key_spec=[],
2361
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2362
+ alert=True,
2363
+ ),
2364
+ )
2365
+ return ProvisionWazuhMonitoringAlertResponse(
2366
+ success=True,
2367
+ message="SentinelOne new active threat malicious detected monitoring alert provisioned successfully",
2368
+ )
2369
+
2370
+
2371
+async def provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert(
2372
+ request: ProvisionMonitoringAlertRequest,
2373
+) -> ProvisionWazuhMonitoringAlertResponse:
2374
+ """
2375
+ Provisions SentinelOne: New Active Threat Suspicious Detected.
2376
+ """
2377
+ logger.info(
2378
+ "Invoking provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert " f"with request: {request.dict()}",
2379
+ )
2380
+ await provision_alert_definition(
2381
+ GraylogAlertProvisionModel(
2382
+ title="SENTINELONE - NEW ACTIVE THREAT SUSPICIOUS DETECTED",
2383
+ description="Threat with confidence level suspicious detected",
2384
+ priority=2,
2385
+ config=GraylogAlertProvisionConfig(
2386
+ type="aggregation-v1",
2387
+ query="syslog_type:sentinelone AND cat:MALWARE AND threatConfidenceLevel:suspicious",
2388
+ query_parameters=[],
2389
+ streams=[],
2390
+ group_by=[],
2391
+ series=[],
2392
+ conditions={"expression": None},
2393
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2394
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2395
+ event_limit=1000,
2396
+ ),
2397
+ field_spec={
2398
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2399
+ data_type="string",
2400
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2401
+ ),
2402
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2403
+ data_type="string",
2404
+ providers=[
2405
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2406
+ ],
2407
+ ),
2408
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2409
+ data_type="string",
2410
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2411
+ ),
2412
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2413
+ data_type="string",
2414
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2415
+ ),
2416
+ },
2417
+ key_spec=[],
2418
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2419
+ alert=True,
2420
+ ),
2421
+ )
2422
+ return ProvisionWazuhMonitoringAlertResponse(
2423
+ success=True,
2424
+ message="SentinelOne new active threat suspicious detected monitoring alert provisioned successfully",
2425
+ )
2426
+
2427
+
2428
+async def provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert(
2429
+ request: ProvisionMonitoringAlertRequest,
2430
+) -> ProvisionWazuhMonitoringAlertResponse:
2431
+ """
2432
+ Provisions SentinelOne: New Mitigation, Kill performed successfully.
2433
+ """
2434
+ logger.info(
2435
+ "Invoking provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert " f"with request: {request.dict()}",
2436
+ )
2437
+ await provision_alert_definition(
2438
+ GraylogAlertProvisionModel(
2439
+ title="SENTINELONE - NEW MITIGATION KILL PERFORMED SUCCESSFULLY",
2440
+ description="Kill performed successfully",
2441
+ priority=2,
2442
+ config=GraylogAlertProvisionConfig(
2443
+ type="aggregation-v1",
2444
+ query='syslog_type:sentinelone AND cat:MITIGATION AND eventDesc:"Kill performed successfully"',
2445
+ query_parameters=[],
2446
+ streams=[],
2447
+ group_by=[],
2448
+ series=[],
2449
+ conditions={"expression": None},
2450
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2451
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2452
+ event_limit=1000,
2453
+ ),
2454
+ field_spec={
2455
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2456
+ data_type="string",
2457
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2458
+ ),
2459
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2460
+ data_type="string",
2461
+ providers=[
2462
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2463
+ ],
2464
+ ),
2465
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2466
+ data_type="string",
2467
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2468
+ ),
2469
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2470
+ data_type="string",
2471
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2472
+ ),
2473
+ },
2474
+ key_spec=[],
2475
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2476
+ alert=True,
2477
+ ),
2478
+ )
2479
+ return ProvisionWazuhMonitoringAlertResponse(
2480
+ success=True,
2481
+ message="SentinelOne mitigation kill performed successfully monitoring alert provisioned successfully",
2482
+ )
2483
+
2484
+
2485
+async def provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert(
2486
+ request: ProvisionMonitoringAlertRequest,
2487
+) -> ProvisionWazuhMonitoringAlertResponse:
2488
+ """
2489
+ Provisions SentinelOne: New Mitigation, Quarantine performed successfully.
2490
+ """
2491
+ logger.info(
2492
+ "Invoking provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert "
2493
+ f"with request: {request.dict()}",
2494
+ )
2495
+ await provision_alert_definition(
2496
+ GraylogAlertProvisionModel(
2497
+ title="SENTINELONE - NEW MITIGATION QUARANTINE PERFORMED SUCCESSFULLY",
2498
+ description="Quarantine performed successfully",
2499
+ priority=2,
2500
+ config=GraylogAlertProvisionConfig(
2501
+ type="aggregation-v1",
2502
+ query='syslog_type:sentinelone AND cat:MITIGATION AND eventDesc:"Quarantine performed successfully"',
2503
+ query_parameters=[],
2504
+ streams=[],
2505
+ group_by=[],
2506
+ series=[],
2507
+ conditions={"expression": None},
2508
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2509
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2510
+ event_limit=1000,
2511
+ ),
2512
+ field_spec={
2513
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2514
+ data_type="string",
2515
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2516
+ ),
2517
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2518
+ data_type="string",
2519
+ providers=[
2520
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2521
+ ],
2522
+ ),
2523
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2524
+ data_type="string",
2525
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2526
+ ),
2527
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2528
+ data_type="string",
2529
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2530
+ ),
2531
+ },
2532
+ key_spec=[],
2533
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2534
+ alert=True,
2535
+ ),
2536
+ )
2537
+ return ProvisionWazuhMonitoringAlertResponse(
2538
+ success=True,
2539
+ message="SentinelOne mitigation quarantine performed successfully monitoring alert provisioned successfully",
2540
+ )
2541
+
2542
+
2543
+async def provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert(
2544
+ request: ProvisionMonitoringAlertRequest,
2545
+) -> ProvisionWazuhMonitoringAlertResponse:
2546
+ """
2547
+ Provisions SentinelOne: New Exclusion was added/modified by user.
2548
+ """
2549
+ logger.info(
2550
+ "Invoking provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert " f"with request: {request.dict()}",
2551
+ )
2552
+ await provision_alert_definition(
2553
+ GraylogAlertProvisionModel(
2554
+ title="SENTINELONE - NEW EXCLUSION WAS ADDED OR MODIFIED BY USER",
2555
+ description="Exclusion was added/modified by user",
2556
+ priority=2,
2557
+ config=GraylogAlertProvisionConfig(
2558
+ type="aggregation-v1",
2559
+ query='syslog_type:sentinelone AND cat:WHITELISTBLACKLIST AND eventDesc:"Exclusion was added/modified by user"',
2560
+ query_parameters=[],
2561
+ streams=[],
2562
+ group_by=[],
2563
+ series=[],
2564
+ conditions={"expression": None},
2565
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2566
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2567
+ event_limit=1000,
2568
+ ),
2569
+ field_spec={
2570
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2571
+ data_type="string",
2572
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2573
+ ),
2574
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2575
+ data_type="string",
2576
+ providers=[
2577
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2578
+ ],
2579
+ ),
2580
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2581
+ data_type="string",
2582
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2583
+ ),
2584
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2585
+ data_type="string",
2586
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2587
+ ),
2588
+ },
2589
+ key_spec=[],
2590
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2591
+ alert=True,
2592
+ ),
2593
+ )
2594
+ return ProvisionWazuhMonitoringAlertResponse(
2595
+ success=True,
2596
+ message="SentinelOne exclusion added/modified by user monitoring alert provisioned successfully",
2597
+ )
2598
+
2599
+
2600
+async def provision_sentinelone_new_path_exclusion_added_monitoring_alert(
2601
+ request: ProvisionMonitoringAlertRequest,
2602
+) -> ProvisionWazuhMonitoringAlertResponse:
2603
+ """
2604
+ Provisions SentinelOne: New Path Exclusion added.
2605
+ """
2606
+ logger.info(
2607
+ "Invoking provision_sentinelone_new_path_exclusion_added_monitoring_alert " f"with request: {request.dict()}",
2608
+ )
2609
+ await provision_alert_definition(
2610
+ GraylogAlertProvisionModel(
2611
+ title="SENTINELONE - NEW PATH EXCLUSION ADDED",
2612
+ description="Path Exclusion added",
2613
+ priority=2,
2614
+ config=GraylogAlertProvisionConfig(
2615
+ type="aggregation-v1",
2616
+ query='syslog_type:sentinelone AND cat:WHITELISTBLACKLIST AND eventDesc:"Path Exclusion added"',
2617
+ query_parameters=[],
2618
+ streams=[],
2619
+ group_by=[],
2620
+ series=[],
2621
+ conditions={"expression": None},
2622
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2623
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2624
+ event_limit=1000,
2625
+ ),
2626
+ field_spec={
2627
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2628
+ data_type="string",
2629
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2630
+ ),
2631
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2632
+ data_type="string",
2633
+ providers=[
2634
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2635
+ ],
2636
+ ),
2637
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2638
+ data_type="string",
2639
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2640
+ ),
2641
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2642
+ data_type="string",
2643
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2644
+ ),
2645
+ },
2646
+ key_spec=[],
2647
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2648
+ alert=True,
2649
+ ),
2650
+ )
2651
+ return ProvisionWazuhMonitoringAlertResponse(
2652
+ success=True,
2653
+ message="SentinelOne path exclusion added monitoring alert provisioned successfully",
2654
+ )
2655
+
2656
+
2657
+async def provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert(
2658
+ request: ProvisionMonitoringAlertRequest,
2659
+) -> ProvisionWazuhMonitoringAlertResponse:
2660
+ """
2661
+ Provisions SentinelOne: Analyst verdict changed to True Positive.
2662
+ """
2663
+ logger.info(
2664
+ "Invoking provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert " f"with request: {request.dict()}",
2665
+ )
2666
+ await provision_alert_definition(
2667
+ GraylogAlertProvisionModel(
2668
+ title='SENTINELONE - ANALYST VERDICT CHANGED TO "TRUE POSITIVE"',
2669
+ description="A management user changed the analyst verdict to True positive.",
2670
+ priority=3,
2671
+ config=GraylogAlertProvisionConfig(
2672
+ type="aggregation-v1",
2673
+ query="syslog_type:sentinelone AND cat:THREATMANAGEMENT AND data_newAnalystVerdict:true_positive",
2674
+ query_parameters=[],
2675
+ streams=[],
2676
+ group_by=[],
2677
+ series=[],
2678
+ conditions={"expression": None},
2679
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2680
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2681
+ event_limit=1000,
2682
+ ),
2683
+ field_spec={
2684
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2685
+ data_type="string",
2686
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2687
+ ),
2688
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2689
+ data_type="string",
2690
+ providers=[
2691
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2692
+ ],
2693
+ ),
2694
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2695
+ data_type="string",
2696
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2697
+ ),
2698
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2699
+ data_type="string",
2700
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2701
+ ),
2702
+ },
2703
+ key_spec=[],
2704
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2705
+ alert=True,
2706
+ ),
2707
+ )
2708
+ return ProvisionWazuhMonitoringAlertResponse(
2709
+ success=True,
2710
+ message='SentinelOne analyst verdict changed to "True Positive" monitoring alert provisioned successfully',
2711
+ )
2712
+
2713
+
2714
+async def provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert(
2715
+ request: ProvisionMonitoringAlertRequest,
2716
+) -> ProvisionWazuhMonitoringAlertResponse:
2717
+ """
2718
+ Provisions SentinelOne: Analyst verdict changed to False Positive.
2719
+ """
2720
+ logger.info(
2721
+ "Invoking provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert " f"with request: {request.dict()}",
2722
+ )
2723
+ await provision_alert_definition(
2724
+ GraylogAlertProvisionModel(
2725
+ title='SENTINELONE - ANALYST VERDICT CHANGED TO "FALSE POSITIVE"',
2726
+ description="A management user changed the analyst verdict to False Positive.",
2727
+ priority=2,
2728
+ config=GraylogAlertProvisionConfig(
2729
+ type="aggregation-v1",
2730
+ query="syslog_type:sentinelone AND cat:THREATMANAGEMENT AND data_newAnalystVerdict:false_positive",
2731
+ query_parameters=[],
2732
+ streams=[],
2733
+ group_by=[],
2734
+ series=[],
2735
+ conditions={"expression": None},
2736
+ search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2737
+ execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2738
+ event_limit=1000,
2739
+ ),
2740
+ field_spec={
2741
+ "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2742
+ data_type="string",
2743
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2744
+ ),
2745
+ "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2746
+ data_type="string",
2747
+ providers=[
2748
+ GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2749
+ ],
2750
+ ),
2751
+ "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2752
+ data_type="string",
2753
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="SENTINELONE", require_values=True)],
2754
+ ),
2755
+ "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2756
+ data_type="string",
2757
+ providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2758
+ ),
2759
+ },
2760
+ key_spec=[],
2761
+ notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2762
+ alert=True,
2763
+ ),
2764
+ )
2765
+ return ProvisionWazuhMonitoringAlertResponse(
2766
+ success=True,
2767
+ message='SentinelOne analyst verdict changed to "False Positive" monitoring alert provisioned successfully',
2768
+ )
2769
+
2770
+
2771
async def provision_custom_alert(request: CustomMonitoringAlertProvisionModel) -> ProvisionWazuhMonitoringAlertResponse:
2772
"""
2773
Provisions custom monitoring alerts.
backend/app/version/services/version.py
+1
-1
@@ -7,7 +7,7 @@ from loguru import logger
7
from packaging.version import Version
8
9
# Current version - update this with each release
10
-CURRENT_VERSION = "0.1.13"
10
+CURRENT_VERSION = "0.1.14"
11
VERSION_CHECK_URL = "https://api.github.com/repos/socfortress/CoPilot/releases/latest"
12
13