collect alerts by provided agent_name (#55)
taylor_socfortress committed
Jul 19, 2023 at 10:48 UTC
4dd92d5c4fc27d0bd73c50b59e42d5f4b65ff870
3 files changed
+132
backend/app/routes/alerts.py
+18
@@ -25,6 +25,24 @@ def get_alerts() -> jsonify:
25
return jsonify(alerts)
26
27
28
+@bp.route("/alerts/<agent_name>", methods=["GET"])
29
+def get_alerts_by_agent(agent_name: str) -> jsonify:
30
+ """
31
+ Retrieves all alerts from the AlertsService by agent name.
32
+
33
+ This endpoint retrieves all available alerts from the AlertsService. It does this by creating an instance of
34
+ the AlertsService class and calling its `collect_alerts_by_agent` method. The result is a list of all alerts currently
35
+ available.
36
+
37
+ Returns:
38
+ jsonify: A JSON response containing a list of alerts. Each item in the list is a dictionary representing an alert,
39
+ containing all its associated data.
40
+ """
41
+ service = AlertsService()
42
+ alerts = service.collect_alerts_by_agent_name(agent_name=agent_name)
43
+ return jsonify(alerts)
44
+
45
+
46
@bp.route("/alerts/top_10", methods=["GET"])
47
def get_top_10_alerts() -> jsonify:
48
"""
backend/app/services/WazuhIndexer/alerts.py
+30
@@ -113,6 +113,36 @@ class AlertsService:
113
"total_alerts": len(alerts["alerts"]),
114
}
115
116
+ def collect_alerts_by_agent_name(self, agent_name: str) -> Dict[str, Any]:
117
+ """
118
+ Collects alerts associated with a given agent name.
119
+
120
+ Args:
121
+ agent_name (str): The agent name associated with the alerts.
122
+
123
+ Returns:
124
+ Dict[str, Any]: A dictionary containing success status, a message, and potentially the alerts associated with the agent.
125
+ """
126
+ indices_validation = self._collect_indices_and_validate()
127
+ if not indices_validation["success"]:
128
+ return indices_validation
129
+
130
+ alerts_by_agent_dict = {}
131
+ for index_name in indices_validation["indices"]:
132
+ alerts = self._collect_alerts(index_name=index_name, size=1000)
133
+ if alerts["success"]:
134
+ for alert in alerts["alerts"]:
135
+ if alert["_source"]["agent_name"] == agent_name:
136
+ alerts_by_agent_dict[alert["_id"]] = alert["_source"]
137
+
138
+ alerts_by_agent_list = [{"alert_id": alert_id, "alert": alert} for alert_id, alert in alerts_by_agent_dict.items()]
139
+
140
+ return {
141
+ "message": f"Successfully collected alerts associated with agent {agent_name}",
142
+ "success": True,
143
+ "alerts_by_agent": alerts_by_agent_list,
144
+ }
145
+
146
def collect_alerts_by_host(self) -> Dict[str, int]:
147
"""
148
Collects the number of alerts per host.
backend/app/static/swagger.json
+84
@@ -985,6 +985,90 @@
985
"tags": ["Wazuh-Indexer"]
986
}
987
},
988
+ "/alerts/{agent_name}": {
989
+ "get": {
990
+ "summary": "Get alerts from a specific agent",
991
+ "description": "Endpoint to get alerts from a specific agent.",
992
+ "parameters": [
993
+ {
994
+ "name": "agent_name",
995
+ "in": "path",
996
+ "description": "The name of the host to get alerts from.",
997
+ "required": true,
998
+ "type": "string"
999
+ }
1000
+ ],
1001
+ "responses": {
1002
+ "200": {
1003
+ "description": "Successful operation",
1004
+ "content": {
1005
+ "application/json": {
1006
+ "schema": {
1007
+ "type": "object",
1008
+ "properties": {
1009
+ "alerts": {
1010
+ "type": "array",
1011
+ "items": {
1012
+ "type": "object",
1013
+ "description": "Alert details"
1014
+ }
1015
+ }
1016
+ }
1017
+ }
1018
+ }
1019
+ }
1020
+ },
1021
+ "400": {
1022
+ "description": "Bad request",
1023
+ "content": {
1024
+ "application/json": {
1025
+ "schema": {
1026
+ "type": "object",
1027
+ "properties": {
1028
+ "message": {
1029
+ "type": "string"
1030
+ },
1031
+ "success": {
1032
+ "type": "boolean"
1033
+ }
1034
+ }
1035
+ }
1036
+ }
1037
+ }
1038
+ },
1039
+ "404": {
1040
+ "description": "Index not found",
1041
+ "content": {
1042
+ "application/json": {
1043
+ "schema": {
1044
+ "type": "object",
1045
+ "properties": {
1046
+ "message": {
1047
+ "type": "string"
1048
+ },
1049
+ "success": {
1050
+ "type": "boolean"
1051
+ }
1052
+ }
1053
+ }
1054
+ }
1055
+ }
1056
+ },
1057
+ "default": {
1058
+ "description": "Unexpected error",
1059
+ "content": {
1060
+ "application/json": {
1061
+ "schema": {
1062
+ "$ref": "#/components/schemas/Error"
1063
+ }
1064
+ }
1065
+ }
1066
+ }
1067
+ },
1068
+ "operationId": "getAlertsFromIndex",
1069
+ "tags": ["Wazuh-Indexer"]
1070
+ }
1071
+ },
1072
"/alerts/top_10": {
1073
"get": {
1074
"summary": "Get top 10 alerts",