Add Velociraptor header validation and update environment variable in incident alert (#439)
taylor_socfortress committed
Apr 11, 2025 at 16:15 UTC
50d7cafb64c87f3f593499801187b9c14f707465
2 files changed
+23
-1
.env.example
+1
@@ -1,6 +1,7 @@
1
# Leave this as is if connecting from a remote machine
2
SERVER_IP=0.0.0.0
3
GRAYLOG_API_HEADER_VALUE=ab73de7a-6f61-4dde-87cd-3af5175a7281
4
+VELOCIRAPTOR_API_HEADER_VALUE=ab73de7a-6f61-4dde-87cd-3af5175a7281
5
6
MYSQL_URL=copilot-mysql
7
# ! Avoid using special characters in the password ! #
backend/app/incidents/routes/incident_alert.py
+22
-1
@@ -1,5 +1,9 @@
1
+import os
2
+
3
from fastapi import APIRouter
4
from fastapi import Depends
5
+from fastapi import Header
6
+from fastapi import HTTPException
7
from fastapi import Security
8
from loguru import logger
9
from sqlalchemy.ext.asyncio import AsyncSession
@@ -33,6 +37,18 @@ from app.incidents.services.velo_sigma import create_velo_sigma_alert
37
incidents_alerts_router = APIRouter()
38
39
40
+# Function to validate the Velociraptor header
41
+async def verify_velociraptor_header(velociraptor: str = Header(None)):
42
+ """Verify that the request has the correct Velociraptor header."""
43
+ # Get the header value from environment variable or use "ab73de7a-6f61-4dde-87cd-3af5175a7281" as default
44
+ expected_header = os.getenv("VELOCIRAPTOR_API_HEADER_VALUE", "ab73de7a-6f61-4dde-87cd-3af5175a7281")
45
+
46
+ if velociraptor != expected_header:
47
+ logger.error("Invalid or missing Velociraptor header")
48
+ raise HTTPException(status_code=403, detail="Invalid or missing Velociraptor header")
49
+ return velociraptor
50
+
51
+
52
@incidents_alerts_router.get(
53
"/index/names",
54
response_model=IndexNamesResponse,
@@ -230,7 +246,12 @@ async def invoke_alert_threshold_graylog_route(
246
return CreateAlertResponse(success=True, message="Alert threshold Graylog invoked successfully", alert_id=alert_id)
247
248
233
-@incidents_alerts_router.post("/create/velo-sigma", response_model=VelociraptorSigmaAlertResponse)
249
+@incidents_alerts_router.post(
250
+ "/create/velo-sigma",
251
+ response_model=VelociraptorSigmaAlertResponse,
252
+ description="Creates an incident alert in CoPilot for a Velociraptor Sigma alert",
253
+ dependencies=[Depends(verify_velociraptor_header)],
254
+)
255
async def process_sigma_alert(alert: VelociraptorSigmaAlert, session: AsyncSession = Depends(get_db)) -> VelociraptorSigmaAlertResponse:
256
"""
257
This route receives a Velociraptor Sigma alert. You must have defined the Windows.Hayabusa.Monitoring