Reporting ioc (#330)
* add iocs to case report template * precommit fixes
taylor_socfortress committed
Nov 5, 2024 at 08:08 UTC
42b2859e8469b0b5f21bd6511bcbb25e2ca955a1
3 files changed
+12
-2
backend/app/incidents/routes/incident_report.py
+4
-2
@@ -17,6 +17,7 @@ from sqlmodel import select
17
from app.customers.routes.customers import get_customer
18
from app.db.db_session import get_db
19
from app.incidents.models import Alert
20
+from app.incidents.models import AlertToIoC
21
from app.incidents.models import AlertToTag
22
from app.incidents.models import Asset
23
from app.incidents.models import Case
@@ -92,8 +93,9 @@ async def fetch_case_by_id(session: AsyncSession, case_id: int) -> Case:
93
.selectinload(CaseAlertLink.alert)
94
.options(
95
selectinload(Alert.assets).selectinload(Asset.alert_context), # Load alert_context
95
- selectinload(Alert.tags).selectinload(AlertToTag.tag),
96
- selectinload(Alert.comments),
96
+ selectinload(Alert.tags).selectinload(AlertToTag.tag), # Load tags
97
+ selectinload(Alert.comments), # Load comments
98
+ selectinload(Alert.iocs).selectinload(AlertToIoC.ioc), # Load IoCs
99
),
100
),
101
)
backend/app/incidents/services/reports.py
+8
@@ -54,6 +54,14 @@ def create_case_context(case) -> Dict[str, Dict[str, str]]:
54
}
55
if alert.alert.assets
56
else None,
57
+ "iocs": [
58
+ {
59
+ "ioc_value": ioc.ioc.value,
60
+ "ioc_type": ioc.ioc.type,
61
+ "ioc_description": ioc.ioc.description,
62
+ }
63
+ for ioc in alert.alert.iocs
64
+ ],
65
}
66
for alert in case.alerts
67
],
backend/app/incidents/templates/case_report_jinja_template.docx
Binary files a/backend/app/incidents/templates/case_report_jinja_template.docx and b/backend/app/incidents/templates/case_report_jinja_template.docx differ