Create dfir_iris.py
taylor_socfortress committed
Jul 10, 2023 at 16:40 UTC
2912b171922ce013dd9fff61aa6a3b4ed2fa4517
1 file changed
+109
backend/app/routes/dfir_iris.py
new
+109
@@ -0,0 +1,109 @@
1
+from flask import Blueprint, jsonify, request
2
+from loguru import logger
3
+from app.models.connectors import Connector, WazuhManagerConnector
4
+
5
+from app.services.Graylog.messages import MessagesService
6
+from app.services.Graylog.metrics import MetricsService
7
+from app.services.Graylog.index import IndexService
8
+from app.services.Graylog.inputs import InputsService
9
+from app.services.DFIR_IRIS.cases import CasesService
10
+from app.services.DFIR_IRIS.notes import NotesService
11
+from app.services.DFIR_IRIS.assets import AssetsService
12
+from app.services.DFIR_IRIS.alerts import AlertsService
13
+
14
+bp = Blueprint("dfir_iris", __name__)
15
+
16
+
17
+@bp.route("/dfir_iris/cases", methods=["GET"])
18
+def get_cases():
19
+ """
20
+ Endpoint to collect cases from DFIR IRIS.
21
+
22
+ Returns:
23
+ json: A JSON response containing the list of all the messages.
24
+ """
25
+ service = CasesService()
26
+ cases = service.list_cases()
27
+ return cases
28
+
29
+@bp.route("/dfir_iris/cases/<case_id>", methods=["GET"])
30
+def get_case(case_id):
31
+ """
32
+ Endpoint to collect a specific case from DFIR IRIS.
33
+
34
+ Returns:
35
+ json: A JSON response containing the list of all the messages.
36
+ """
37
+ # Get the Case ID from the URL
38
+ service = CasesService()
39
+ case_id_exists = service.check_case_id(case_id=case_id)
40
+ if case_id_exists["success"] == False:
41
+ return case_id_exists
42
+ case = service.get_case(case_id=case_id)
43
+ return case
44
+
45
+@bp.route("/dfir_iris/cases/<case_id>/notes", methods=["GET"])
46
+def get_case_notes(case_id):
47
+ """
48
+ Endpoint to collect notes from a specific case from DFIR IRIS.
49
+
50
+ Returns:
51
+ json: A JSON response containing the list of all the messages.
52
+ """
53
+ # Get the Case ID from the URL
54
+ case_service = CasesService()
55
+ notes_service = NotesService()
56
+ search_term = "%"
57
+ case_id_exists = case_service.check_case_id(case_id=case_id)
58
+ if case_id_exists["success"] == False:
59
+ return case_id_exists
60
+ notes = notes_service.get_case_notes(search_term=search_term, cid=int(case_id))
61
+ return notes
62
+
63
+@bp.route("/dfir_iris/cases/<case_id>/note", methods=["POST"])
64
+def create_case_note(case_id):
65
+ """
66
+ Endpoint to create notes from a specific case from DFIR IRIS.
67
+
68
+ Returns:
69
+ json: A JSON response containing the list of all the messages.
70
+ """
71
+ # Get the Case ID from the URL
72
+ note_title = request.json["note_title"]
73
+ note_content = request.json["note_content"]
74
+ case_service = CasesService()
75
+ notes_service = NotesService()
76
+ case_id_exists = case_service.check_case_id(case_id=case_id)
77
+ if case_id_exists["success"] == False:
78
+ return case_id_exists
79
+ created_note = notes_service.create_case_note(cid=int(case_id), note_title=note_title, note_content=note_content)
80
+ return created_note
81
+
82
+@bp.route("/dfir_iris/cases/<case_id>/assets", methods=["GET"])
83
+def get_case_assets(case_id):
84
+ """
85
+ Endpoint to collect assets from a specific case from DFIR IRIS.
86
+
87
+ Returns:
88
+ json: A JSON response containing the list of all the messages.
89
+ """
90
+ asset_service = AssetsService()
91
+ case_service = CasesService()
92
+
93
+ case_id_exists = case_service.check_case_id(case_id=case_id)
94
+ if case_id_exists["success"] == False:
95
+ return case_id_exists
96
+ assets = asset_service.get_case_assets(cid=int(case_id))
97
+ return assets
98
+
99
+@bp.route("/dfir_iris/alerts", methods=["GET"])
100
+def get_alerts():
101
+ """
102
+ Endpoint to collect alerts from DFIR-IRIS
103
+
104
+ Returns:
105
+ json: A JSON response containing the list of all the messages.
106
+ """
107
+ service = AlertsService()
108
+ alerts = service.list_alerts()
109
+ return alerts