Create alerts.py
taylor_socfortress committed
Jul 10, 2023 at 16:42 UTC
1f7da095318cdf85d44aab8270a39c7b81c0c5c6
1 file changed
+45
backend/app/services/DFIR_IRIS/alerts.py
new
+45
@@ -0,0 +1,45 @@
1
+from typing import Dict
2
+import requests
3
+from loguru import logger
4
+from app.services.DFIR_IRIS.universal import UniversalService
5
+from dfir_iris_client.helper.utils import assert_api_resp
6
+from dfir_iris_client.helper.utils import get_data_from_resp
7
+from dfir_iris_client.alert import Alert
8
+
9
+
10
+class AlertsService:
11
+ """
12
+ A service class that encapsulates the logic for pulling alerts from DFIR-IRIS.
13
+ """
14
+
15
+ def __init__(self):
16
+ self.universal_service = UniversalService("DFIR-IRIS")
17
+ session_result = self.universal_service.create_session()
18
+
19
+ if not session_result['success']:
20
+ logger.error(session_result['message'])
21
+ self.iris_session = None
22
+ else:
23
+ self.iris_session = session_result['session']
24
+
25
+ def list_alerts(self) -> Dict[str, object]:
26
+ """
27
+ Lists all alerts from DFIR-IRIS
28
+
29
+ Returns:
30
+ dict: A dictionary containing the success status, a message and potentially the cases.
31
+ """
32
+ if self.iris_session is None:
33
+ return {
34
+ "success": False,
35
+ "message": "DFIR-IRIS session was not successfully created.",
36
+ }
37
+
38
+ logger.info("Collecting cases from DFIR-IRIS")
39
+ alert = Alert(session=self.iris_session)
40
+ result = self.universal_service.fetch_and_parse_data(self.iris_session, alert.filter_alerts)
41
+
42
+ if not result["success"]:
43
+ return {"success": False, "message": "Failed to collect cases from DFIR-IRIS"}
44
+
45
+ return {"success": True, "message": "Successfully collected cases from DFIR-IRIS", "results": result["data"]}