@cryptotaxi247 / CoPilot / commits / 583fd92d

dfir-iris mkdocs

Taylor committed Jul 11, 2023 at 17:35 UTC 583fd92d421e8bdeba433ad9dc822e32e0072d6a

3 files changed +458 -17

backend/docs/dfiriris.md

+131

@@ -2,9 +2,56 @@

3 ### <span style="color:blue">Cases Model</span>

5 +# cases.py

6 +

7 +The `cases.py` file is a Python script that defines a `Case` class and a `CaseSchema` class. The file uses SQLAlchemy, a Python SQL toolkit and Object-Relational Mapping (ORM) library, to map the `Case` class to a relational database table.

8 +

9 +## Class `Case`

10 +

11 +The `Case` class models a 'case' in a database table. It has four fields:

12 +

13 +- `id` (type: Integer): Primary key of the table.

14 +- `case_id` (type: Integer): A unique identifier for the case.

15 +- `case_name` (type: String): The name of the case.

16 +- `agents` (type: String): A comma-separated string of agents associated with the case.

17 +

18 +This class also has an `__init__` method for initializing a new instance of the class and an `__repr__` method that returns a string representation of a `Case` instance.

19 +

20 +## Class `CaseSchema`

21 +

22 +The `CaseSchema` class is a marshmallow Schema for serializing and deserializing instances of the `Case` class. The `Meta` inner class inside `CaseSchema` defines the fields to be serialized/deserialized, which are `id`, `case_id`, `case_name`, and `agents`.

23 +

24 +This script also defines `case_schema` and `cases_schema` as instances of the `CaseSchema` class, with `cases_schema` set up to serialize/deserialize many `Case` instances at once.

25 +

26 ::: app.models.cases

27 <br>

29 +### <span style="color:green">DFIR-IRIS Routes</span>

30 +

31 +# dfir_iris.py

32 +

33 +This file, named `dfir_iris.py`, is a Flask module that sets up several HTTP endpoints related to the handling of case and alert data from a service named DFIR IRIS. The endpoints allow for retrieval and creation of case-related information and alert data.

34 +

35 +Here is a detailed summary of the module:

36 +

37 +1. The module begins by importing necessary libraries and services.

38 +

39 +2. A Flask Blueprint named `dfir_iris` is created to register the routes.

40 +

41 +3. A GET endpoint at `/dfir_iris/cases` is defined with the function `get_cases()`. This function retrieves all cases from the DFIR IRIS service and returns them.

42 +

43 +4. Another GET endpoint is set up at `/dfir_iris/cases/<case_id>`, which is handled by the `get_case(case_id: str)` function. This function retrieves a specific case from the DFIR IRIS service using the provided case ID.

44 +

45 +5. The function `get_case_notes(case_id: int)` handles GET requests at the `/dfir_iris/cases/<case_id>/notes` endpoint. It retrieves the notes associated with a specific case from the DFIR IRIS service.

46 +

47 +6. A POST endpoint at `/dfir_iris/cases/<case_id>/note` is handled by `create_case_note(case_id: str)`. This function creates a new note for a specific case in the DFIR IRIS service.

48 +

49 +7. The function `get_case_assets(case_id: str)` manages GET requests at the `/dfir_iris/cases/<case_id>/assets` endpoint. It retrieves the assets related to a specific case from the DFIR IRIS service.

50 +

51 +8. Lastly, a GET endpoint at `/dfir_iris/alerts` is handled by the `get_alerts()` function. This function retrieves all alerts from the DFIR IRIS service.

52 +

53 +Each of the functions uses a service class (like `CasesService`, `NotesService`, `AssetsService`, or `AlertsService`) to handle the interactions with the DFIR IRIS service. The data returned by these functions is sent as a JSON response to the client.

54 +

55 ### <span style="color:green">Cases Routes</span>

57 ::: app.routes.dfir_iris.get_cases

@@ -29,21 +76,105 @@

77 ### <span style="color:red">Alerts Services</span>

79 +# alerts.py Code Analysis

80 +

81 +This file, named `alerts.py`, is a Python script that defines a class `AlertsService`. This class is responsible for pulling alerts from a service named DFIR-IRIS.

82 +

83 +## Import Statements

84 +

85 +The code begins by importing necessary modules:

86 +

87 +- `requests` for sending HTTP requests.

88 +- `loguru` for logging.

89 +- `UniversalService` from `app.services.DFIR_IRIS.universal`.

90 +

91 +## Class `AlertsService`

92 +

93 +This class appears to encapsulate all the necessary operations to pull alerts from DFIR-IRIS.

94 +

95 +### Initialization

96 +

97 +In the `__init__` method, an instance of `UniversalService` is created, and a session with DFIR-IRIS is initiated.

98 +

99 +### Method `list_alerts`

100 +

101 +This method seems to retrieve a list of all alerts from DFIR-IRIS. If the session to DFIR-IRIS is not active, it returns an error message. If the session is active, it uses the instance of `Alert` to fetch alerts from DFIR-IRIS.

102 +

103 +## Overall

104 +

105 +This file is part of a larger application, and its role is to interact with DFIR-IRIS to manage and retrieve alerts.

106 +

107 ::: app.services.DFIR_IRIS.alerts

108 <br>

109

110 ### <span style="color:red">Cases Services</span>

111

112 +# cases.py

113 +

114 +This Python module, `cases.py`, is a component of a larger application designed to interface with a tool named DFIR-IRIS. It includes a single class, `CasesService`, which is responsible for interacting with DFIR-IRIS to retrieve case information.

115 +

116 +## CasesService class

117 +

118 +The `CasesService` class has the following methods:

119 +

120 +### `__init__` method

121 +

122 +This method initializes the `CasesService` class. It creates an instance of `UniversalService` and attempts to establish a session with DFIR-IRIS. If the session creation fails, it logs the failure message and sets `self.iris_session` to `None`.

123 +

124 +### `list_cases` method

125 +

126 +This method fetches a list of all cases from DFIR-IRIS. If a session has not been established successfully, it returns a failure message. If a session is available, it uses the `Case` class from the `dfir_iris_client.case` module to retrieve a list of cases. If the case retrieval process fails, it logs an error and returns a failure status. If the case retrieval is successful, it returns a dictionary containing a success status, a success message, and the retrieved case data.

127 +

128 ::: app.services.DFIR_IRIS.cases

129 <br>

130

131 ### <span style="color:red">Assets Services</span>

132

133 +# assets.py

134 +

135 +The `assets.py` script contains the `AssetsService` class, which provides the logic for pulling case assets from DFIR-IRIS. It creates a DFIR-IRIS session upon initialization and uses it to fetch case assets.

136 +

137 +## Class Initialization

138 +

139 +The class is initialized by creating a `UniversalService` object for DFIR-IRIS and establishing a session. If the session creation is unsuccessful, an error is logged, and the `iris_session` attribute is set to None.

140 +

141 +## Method: get_case_assets

142 +

143 +The `get_case_assets` method retrieves the assets of a specific case from DFIR-IRIS. If the `iris_session` attribute is None (indicating that the session creation was unsuccessful), this method returns a dictionary with `"success"` set to `False`. Otherwise, it attempts to fetch and parse the assets data for the case specified by the `cid` parameter.

144 +

145 +The return value is a dictionary containing the success status, a message, and potentially the fetched assets. The `"success"` key is a boolean indicating whether the operation was successful. The `"message"` key is a string providing details about the operation. If `"success"` is `True`, the dictionary also contains the `"data"` key with the fetched assets.

146 +

147 ::: app.services.DFIR_IRIS.assets

148 <br>

149

150 ### <span style="color:red">Notes Services</span>

151

152 +# notes.py

153 +

154 +The `notes.py` file defines a `NotesService` class that encapsulates the logic for interacting with case notes from DFIR-IRIS. Here is a detailed breakdown of the file:

155 +

156 +## Class: NotesService

157 +

158 +The `NotesService` class is designed to manage case notes from DFIR-IRIS. This includes operations like retrieving and creating case notes. The class utilizes a session with DFIR-IRIS to execute these operations.

159 +

160 +### Initializer

161 +

162 +The class initializer (`__init__`) creates an instance of `UniversalService` for "DFIR-IRIS" and attempts to establish a session with DFIR-IRIS. If the session cannot be established, it logs an error message and sets the `iris_session` attribute to `None`.

163 +

164 +### Method: get_case_notes

165 +

166 +This method retrieves the notes of a specific case from DFIR-IRIS. It takes two parameters: `search_term` and `cid` (the ID of the case to retrieve notes for). The method checks if the `iris_session` is `None` (indicating unsuccessful session creation), and if so, returns a dictionary indicating failure. Otherwise, it fetches and parses the notes data for the specified case.

167 +

168 +### Method: \_get_case_note_details

169 +

170 +This private method retrieves the details of a specific note of a case from DFIR-IRIS. It takes two parameters: `note_id` and `cid` (the ID of the note and the ID of the case respectively). Similar to `get_case_notes`, this method checks if the `iris_session` is `None` and returns a dictionary indicating failure if so. If the session exists, it fetches and parses the note data for the specified note and case.

171 +

172 +### Method: create_case_note

173 +

174 +This method creates a note for a specific case in DFIR-IRIS. It takes three parameters: `cid` (the ID of the case), `note_title` (the title of the note to create), and `note_content` (the content of the note to create). Like the other methods, it checks if the `iris_session` is `None` and returns a dictionary indicating failure if so. If the session exists, it attempts to create a note with the specified title and content for the specified case.

175 +

176 +This file serves as a core component in managing case notes in DFIR-IRIS, providing functionalities to fetch, parse, and create notes. It demonstrates a good encapsulation of related operations into a dedicated service class, thereby promoting code organization and maintainability.

177 +

178 ::: app.services.DFIR_IRIS.notes

179 <br>

180

backend/site/dfiriris/index.html

+327 -17

@@ -418,13 +418,35 @@

418 </li>

419

420 <li class="md-nav__item">

421 + <a href="#casespy" class="md-nav__link">

422 + cases.py

423 + </a>

424 +

425 + <nav class="md-nav" aria-label="cases.py">

426 + <ul class="md-nav__list">

427 +

428 + <li class="md-nav__item">

429 + <a href="#class-case" class="md-nav__link">

430 + Class Case

431 + </a>

432 +

433 +</li>

434 +

435 + <li class="md-nav__item">

436 + <a href="#class-caseschema" class="md-nav__link">

437 + Class CaseSchema

438 + </a>

439 +

440 +</li>

441 +

442 + <li class="md-nav__item">

443 <a href="#app.models.cases" class="md-nav__link">

444 app.models.cases

445 </a>

446

447 </li>

448

427 - <li class="md-nav__item">

449 + <li class="md-nav__item">

450 <a href="#app.models.cases.Case" class="md-nav__link">

451 Case

452 </a>

@@ -451,7 +473,7 @@

473

474 </li>

475

454 - <li class="md-nav__item">

476 + <li class="md-nav__item">

477 <a href="#app.models.cases.CaseSchema" class="md-nav__link">

478 CaseSchema

479 </a>

@@ -467,8 +489,8 @@

489 </li>

490

491 <li class="md-nav__item">

470 - <a href="#cases-routes" class="md-nav__link">

471 - Cases Routes

492 + <a href="#dfir-iris-routes" class="md-nav__link">

493 + DFIR-IRIS Routes

494 </a>

495

496 </li>

@@ -476,16 +498,36 @@

498 </ul>

499 </nav>

500

501 +</li>

502 +

503 + </ul>

504 + </nav>

505 +

506 </li>

507

508 <li class="md-nav__item">

509 + <a href="#dfir_irispy" class="md-nav__link">

510 + dfir_iris.py

511 + </a>

512 +

513 + <nav class="md-nav" aria-label="dfir_iris.py">

514 + <ul class="md-nav__list">

515 +

516 + <li class="md-nav__item">

517 + <a href="#cases-routes" class="md-nav__link">

518 + Cases Routes

519 + </a>

520 +

521 +</li>

522 +

523 + <li class="md-nav__item">

524 <a href="#app.routes.dfir_iris.get_cases" class="md-nav__link">

525 app.routes.dfir_iris.get_cases

526 </a>

527

528 </li>

529

488 - <li class="md-nav__item">

530 + <li class="md-nav__item">

531 <a href="#app.routes.dfir_iris.get_case" class="md-nav__link">

532 app.routes.dfir_iris.get_case

533 </a>

@@ -505,14 +547,14 @@

547

548 </li>

549

508 - <li class="md-nav__item">

550 + <li class="md-nav__item">

551 <a href="#app.routes.dfir_iris.get_case_notes" class="md-nav__link">

552 app.routes.dfir_iris.get_case_notes

553 </a>

554

555 </li>

556

515 - <li class="md-nav__item">

557 + <li class="md-nav__item">

558 <a href="#app.routes.dfir_iris.create_case_note" class="md-nav__link">

559 app.routes.dfir_iris.create_case_note

560 </a>

@@ -532,7 +574,7 @@

574

575 </li>

576

535 - <li class="md-nav__item">

577 + <li class="md-nav__item">

578 <a href="#app.routes.dfir_iris.get_case_assets" class="md-nav__link">

579 app.routes.dfir_iris.get_case_assets

580 </a>

@@ -552,7 +594,7 @@

594

595 </li>

596

555 - <li class="md-nav__item">

597 + <li class="md-nav__item">

598 <a href="#app.routes.dfir_iris.get_alerts" class="md-nav__link">

599 app.routes.dfir_iris.get_alerts

600 </a>

@@ -570,16 +612,70 @@

612 </ul>

613 </nav>

614

615 +</li>

616 +

617 + </ul>

618 + </nav>

619 +

620 </li>

621

622 <li class="md-nav__item">

623 + <a href="#alertspy-code-analysis" class="md-nav__link">

624 + alerts.py Code Analysis

625 + </a>

626 +

627 + <nav class="md-nav" aria-label="alerts.py Code Analysis">

628 + <ul class="md-nav__list">

629 +

630 + <li class="md-nav__item">

631 + <a href="#import-statements" class="md-nav__link">

632 + Import Statements

633 + </a>

634 +

635 +</li>

636 +

637 + <li class="md-nav__item">

638 + <a href="#class-alertsservice" class="md-nav__link">

639 + Class AlertsService

640 + </a>

641 +

642 + <nav class="md-nav" aria-label="Class AlertsService">

643 + <ul class="md-nav__list">

644 +

645 + <li class="md-nav__item">

646 + <a href="#initialization" class="md-nav__link">

647 + Initialization

648 + </a>

649 +

650 +</li>

651 +

652 + <li class="md-nav__item">

653 + <a href="#method-list_alerts" class="md-nav__link">

654 + Method list_alerts

655 + </a>

656 +

657 +</li>

658 +

659 + </ul>

660 + </nav>

661 +

662 +</li>

663 +

664 + <li class="md-nav__item">

665 + <a href="#overall" class="md-nav__link">

666 + Overall

667 + </a>

668 +

669 +</li>

670 +

671 + <li class="md-nav__item">

672 <a href="#app.services.DFIR_IRIS.alerts" class="md-nav__link">

673 app.services.DFIR_IRIS.alerts

674 </a>

675

676 </li>

677

582 - <li class="md-nav__item">

678 + <li class="md-nav__item">

679 <a href="#app.services.DFIR_IRIS.alerts.AlertsService" class="md-nav__link">

680 AlertsService

681 </a>

@@ -611,16 +707,56 @@

707 </ul>

708 </nav>

709

710 +</li>

711 +

712 + </ul>

713 + </nav>

714 +

715 </li>

716

717 <li class="md-nav__item">

718 + <a href="#casespy_1" class="md-nav__link">

719 + cases.py

720 + </a>

721 +

722 + <nav class="md-nav" aria-label="cases.py">

723 + <ul class="md-nav__list">

724 +

725 + <li class="md-nav__item">

726 + <a href="#casesservice-class" class="md-nav__link">

727 + CasesService class

728 + </a>

729 +

730 + <nav class="md-nav" aria-label="CasesService class">

731 + <ul class="md-nav__list">

732 +

733 + <li class="md-nav__item">

734 + <a href="#__init__-method" class="md-nav__link">

735 + __init__ method

736 + </a>

737 +

738 +</li>

739 +

740 + <li class="md-nav__item">

741 + <a href="#list_cases-method" class="md-nav__link">

742 + list_cases method

743 + </a>

744 +

745 +</li>

746 +

747 + </ul>

748 + </nav>

749 +

750 +</li>

751 +

752 + <li class="md-nav__item">

753 <a href="#app.services.DFIR_IRIS.cases" class="md-nav__link">

754 app.services.DFIR_IRIS.cases

755 </a>

756

757 </li>

758

623 - <li class="md-nav__item">

759 + <li class="md-nav__item">

760 <a href="#app.services.DFIR_IRIS.cases.CasesService" class="md-nav__link">

761 CasesService

762 </a>

@@ -659,16 +795,43 @@

795 </ul>

796 </nav>

797

798 +</li>

799 +

800 + </ul>

801 + </nav>

802 +

803 </li>

804

805 <li class="md-nav__item">

806 + <a href="#assetspy" class="md-nav__link">

807 + assets.py

808 + </a>

809 +

810 + <nav class="md-nav" aria-label="assets.py">

811 + <ul class="md-nav__list">

812 +

813 + <li class="md-nav__item">

814 + <a href="#class-initialization" class="md-nav__link">

815 + Class Initialization

816 + </a>

817 +

818 +</li>

819 +

820 + <li class="md-nav__item">

821 + <a href="#method-get_case_assets" class="md-nav__link">

822 + Method: get_case_assets

823 + </a>

824 +

825 +</li>

826 +

827 + <li class="md-nav__item">

828 <a href="#app.services.DFIR_IRIS.assets" class="md-nav__link">

829 app.services.DFIR_IRIS.assets

830 </a>

831

832 </li>

833

671 - <li class="md-nav__item">

834 + <li class="md-nav__item">

835 <a href="#app.services.DFIR_IRIS.assets.AssetsService" class="md-nav__link">

836 AssetsService

837 </a>

@@ -700,16 +863,70 @@

863 </ul>

864 </nav>

865

866 +</li>

867 +

868 + </ul>

869 + </nav>

870 +

871 </li>

872

873 <li class="md-nav__item">

874 + <a href="#notespy" class="md-nav__link">

875 + notes.py

876 + </a>

877 +

878 + <nav class="md-nav" aria-label="notes.py">

879 + <ul class="md-nav__list">

880 +

881 + <li class="md-nav__item">

882 + <a href="#class-notesservice" class="md-nav__link">

883 + Class: NotesService

884 + </a>

885 +

886 + <nav class="md-nav" aria-label="Class: NotesService">

887 + <ul class="md-nav__list">

888 +

889 + <li class="md-nav__item">

890 + <a href="#initializer" class="md-nav__link">

891 + Initializer

892 + </a>

893 +

894 +</li>

895 +

896 + <li class="md-nav__item">

897 + <a href="#method-get_case_notes" class="md-nav__link">

898 + Method: get_case_notes

899 + </a>

900 +

901 +</li>

902 +

903 + <li class="md-nav__item">

904 + <a href="#method-_get_case_note_details" class="md-nav__link">

905 + Method: _get_case_note_details

906 + </a>

907 +

908 +</li>

909 +

910 + <li class="md-nav__item">

911 + <a href="#method-create_case_note" class="md-nav__link">

912 + Method: create_case_note

913 + </a>

914 +

915 +</li>

916 +

917 + </ul>

918 + </nav>

919 +

920 +</li>

921 +

922 + <li class="md-nav__item">

923 <a href="#app.services.DFIR_IRIS.notes" class="md-nav__link">

924 app.services.DFIR_IRIS.notes

925 </a>

926

927 </li>

928

712 - <li class="md-nav__item">

929 + <li class="md-nav__item">

930 <a href="#app.services.DFIR_IRIS.notes.NotesService" class="md-nav__link">

931 NotesService

932 </a>

@@ -750,14 +967,14 @@

967

968 </li>

969

753 - <li class="md-nav__item">

970 + <li class="md-nav__item">

971 <a href="#app.services.DFIR_IRIS.universal" class="md-nav__link">

972 app.services.DFIR_IRIS.universal

973 </a>

974

975 </li>

976

760 - <li class="md-nav__item">

977 + <li class="md-nav__item">

978 <a href="#app.services.DFIR_IRIS.universal.UniversalService" class="md-nav__link">

979 UniversalService

980 </a>

@@ -796,6 +1013,11 @@

1013 </ul>

1014 </nav>

1015

1016 +</li>

1017 +

1018 + </ul>

1019 + </nav>

1020 +

1021 </li>

1022

1023 </ul>

@@ -881,10 +1103,22 @@

1103

1104

1105

884 - <h1>Dfir-Iris</h1>

885 -

1106 <h2 id="dfir-iris-overview">Dfir-Iris Overview</h2>

1107 <h3 id="cases-model"><span style="color:blue">Cases Model</span></h3>

1108 +<h1 id="casespy">cases.py</h1>

1109 +<p>The <code>cases.py</code> file is a Python script that defines a <code>Case</code> class and a <code>CaseSchema</code> class. The file uses SQLAlchemy, a Python SQL toolkit and Object-Relational Mapping (ORM) library, to map the <code>Case</code> class to a relational database table.</p>

1110 +<h2 id="class-case">Class <code>Case</code></h2>

1111 +<p>The <code>Case</code> class models a 'case' in a database table. It has four fields:</p>

1112 +<ul>

1113 +<li><code>id</code> (type: Integer): Primary key of the table.</li>

1114 +<li><code>case_id</code> (type: Integer): A unique identifier for the case.</li>

1115 +<li><code>case_name</code> (type: String): The name of the case.</li>

1116 +<li><code>agents</code> (type: String): A comma-separated string of agents associated with the case.</li>

1117 +</ul>

1118 +<p>This class also has an <code>__init__</code> method for initializing a new instance of the class and an <code>__repr__</code> method that returns a string representation of a <code>Case</code> instance.</p>

1119 +<h2 id="class-caseschema">Class <code>CaseSchema</code></h2>

1120 +<p>The <code>CaseSchema</code> class is a marshmallow Schema for serializing and deserializing instances of the <code>Case</code> class. The <code>Meta</code> inner class inside <code>CaseSchema</code> defines the fields to be serialized/deserialized, which are <code>id</code>, <code>case_id</code>, <code>case_name</code>, and <code>agents</code>.</p>

1121 +<p>This script also defines <code>case_schema</code> and <code>cases_schema</code> as instances of the <code>CaseSchema</code> class, with <code>cases_schema</code> set up to serialize/deserialize many <code>Case</code> instances at once.</p>

1122

1123

1124 <div class="doc doc-object doc-module">

@@ -1236,6 +1470,37 @@ This class inherits from SQLAlchemy's Model class.</p>

1470 </div>

1471

1472 </div><p><br></p>

1473 +<h3 id="dfir-iris-routes"><span style="color:green">DFIR-IRIS Routes</span></h3>

1474 +<h1 id="dfir_irispy">dfir_iris.py</h1>

1475 +<p>This file, named <code>dfir_iris.py</code>, is a Flask module that sets up several HTTP endpoints related to the handling of case and alert data from a service named DFIR IRIS. The endpoints allow for retrieval and creation of case-related information and alert data.</p>

1476 +<p>Here is a detailed summary of the module:</p>

1477 +<ol>

1478 +<li>

1479 +<p>The module begins by importing necessary libraries and services.</p>

1480 +</li>

1481 +<li>

1482 +<p>A Flask Blueprint named <code>dfir_iris</code> is created to register the routes.</p>

1483 +</li>

1484 +<li>

1485 +<p>A GET endpoint at <code>/dfir_iris/cases</code> is defined with the function <code>get_cases()</code>. This function retrieves all cases from the DFIR IRIS service and returns them.</p>

1486 +</li>

1487 +<li>

1488 +<p>Another GET endpoint is set up at <code>/dfir_iris/cases/<case_id></code>, which is handled by the <code>get_case(case_id: str)</code> function. This function retrieves a specific case from the DFIR IRIS service using the provided case ID.</p>

1489 +</li>

1490 +<li>

1491 +<p>The function <code>get_case_notes(case_id: int)</code> handles GET requests at the <code>/dfir_iris/cases/<case_id>/notes</code> endpoint. It retrieves the notes associated with a specific case from the DFIR IRIS service.</p>

1492 +</li>

1493 +<li>

1494 +<p>A POST endpoint at <code>/dfir_iris/cases/<case_id>/note</code> is handled by <code>create_case_note(case_id: str)</code>. This function creates a new note for a specific case in the DFIR IRIS service.</p>

1495 +</li>

1496 +<li>

1497 +<p>The function <code>get_case_assets(case_id: str)</code> manages GET requests at the <code>/dfir_iris/cases/<case_id>/assets</code> endpoint. It retrieves the assets related to a specific case from the DFIR IRIS service.</p>

1498 +</li>

1499 +<li>

1500 +<p>Lastly, a GET endpoint at <code>/dfir_iris/alerts</code> is handled by the <code>get_alerts()</code> function. This function retrieves all alerts from the DFIR IRIS service.</p>

1501 +</li>

1502 +</ol>

1503 +<p>Each of the functions uses a service class (like <code>CasesService</code>, <code>NotesService</code>, <code>AssetsService</code>, or <code>AlertsService</code>) to handle the interactions with the DFIR IRIS service. The data returned by these functions is sent as a JSON response to the client.</p>

1504 <h3 id="cases-routes"><span style="color:green">Cases Routes</span></h3>

1505

1506

@@ -1741,6 +2006,23 @@ This class inherits from SQLAlchemy's Model class.</p>

2006

2007 </div><p><br></p>

2008 <h3 id="alerts-services"><span style="color:red">Alerts Services</span></h3>

2009 +<h1 id="alertspy-code-analysis">alerts.py Code Analysis</h1>

2010 +<p>This file, named <code>alerts.py</code>, is a Python script that defines a class <code>AlertsService</code>. This class is responsible for pulling alerts from a service named DFIR-IRIS.</p>

2011 +<h2 id="import-statements">Import Statements</h2>

2012 +<p>The code begins by importing necessary modules:</p>

2013 +<ul>

2014 +<li><code>requests</code> for sending HTTP requests.</li>

2015 +<li><code>loguru</code> for logging.</li>

2016 +<li><code>UniversalService</code> from <code>app.services.DFIR_IRIS.universal</code>.</li>

2017 +</ul>

2018 +<h2 id="class-alertsservice">Class <code>AlertsService</code></h2>

2019 +<p>This class appears to encapsulate all the necessary operations to pull alerts from DFIR-IRIS.</p>

2020 +<h3 id="initialization">Initialization</h3>

2021 +<p>In the <code>__init__</code> method, an instance of <code>UniversalService</code> is created, and a session with DFIR-IRIS is initiated.</p>

2022 +<h3 id="method-list_alerts">Method <code>list_alerts</code></h3>

2023 +<p>This method seems to retrieve a list of all alerts from DFIR-IRIS. If the session to DFIR-IRIS is not active, it returns an error message. If the session is active, it uses the instance of <code>Alert</code> to fetch alerts from DFIR-IRIS.</p>

2024 +<h2 id="overall">Overall</h2>

2025 +<p>This file is part of a larger application, and its role is to interact with DFIR-IRIS to manage and retrieve alerts.</p>

2026

2027

2028 <div class="doc doc-object doc-module">

@@ -2118,6 +2400,14 @@ parse the alerts data.</p>

2400

2401 </div><p><br></p>

2402 <h3 id="cases-services"><span style="color:red">Cases Services</span></h3>

2403 +<h1 id="casespy_1">cases.py</h1>

2404 +<p>This Python module, <code>cases.py</code>, is a component of a larger application designed to interface with a tool named DFIR-IRIS. It includes a single class, <code>CasesService</code>, which is responsible for interacting with DFIR-IRIS to retrieve case information.</p>

2405 +<h2 id="casesservice-class">CasesService class</h2>

2406 +<p>The <code>CasesService</code> class has the following methods:</p>

2407 +<h3 id="__init__-method"><code>__init__</code> method</h3>

2408 +<p>This method initializes the <code>CasesService</code> class. It creates an instance of <code>UniversalService</code> and attempts to establish a session with DFIR-IRIS. If the session creation fails, it logs the failure message and sets <code>self.iris_session</code> to <code>None</code>.</p>

2409 +<h3 id="list_cases-method"><code>list_cases</code> method</h3>

2410 +<p>This method fetches a list of all cases from DFIR-IRIS. If a session has not been established successfully, it returns a failure message. If a session is available, it uses the <code>Case</code> class from the <code>dfir_iris_client.case</code> module to retrieve a list of cases. If the case retrieval process fails, it logs an error and returns a failure status. If the case retrieval is successful, it returns a dictionary containing a success status, a success message, and the retrieved case data.</p>

2411

2412

2413 <div class="doc doc-object doc-module">

@@ -2634,6 +2924,13 @@ parse the alerts data.</p>

2924

2925 </div><p><br></p>

2926 <h3 id="assets-services"><span style="color:red">Assets Services</span></h3>

2927 +<h1 id="assetspy">assets.py</h1>

2928 +<p>The <code>assets.py</code> script contains the <code>AssetsService</code> class, which provides the logic for pulling case assets from DFIR-IRIS. It creates a DFIR-IRIS session upon initialization and uses it to fetch case assets.</p>

2929 +<h2 id="class-initialization">Class Initialization</h2>

2930 +<p>The class is initialized by creating a <code>UniversalService</code> object for DFIR-IRIS and establishing a session. If the session creation is unsuccessful, an error is logged, and the <code>iris_session</code> attribute is set to None.</p>

2931 +<h2 id="method-get_case_assets">Method: get_case_assets</h2>

2932 +<p>The <code>get_case_assets</code> method retrieves the assets of a specific case from DFIR-IRIS. If the <code>iris_session</code> attribute is None (indicating that the session creation was unsuccessful), this method returns a dictionary with <code>"success"</code> set to <code>False</code>. Otherwise, it attempts to fetch and parse the assets data for the case specified by the <code>cid</code> parameter.</p>

2933 +<p>The return value is a dictionary containing the success status, a message, and potentially the fetched assets. The <code>"success"</code> key is a boolean indicating whether the operation was successful. The <code>"message"</code> key is a string providing details about the operation. If <code>"success"</code> is <code>True</code>, the dictionary also contains the <code>"data"</code> key with the fetched assets.</p>

2934

2935

2936 <div class="doc doc-object doc-module">

@@ -3043,6 +3340,19 @@ it attempts to fetch and parse the assets data for the case specified by the <co

3340

3341 </div><p><br></p>

3342 <h3 id="notes-services"><span style="color:red">Notes Services</span></h3>

3343 +<h1 id="notespy">notes.py</h1>

3344 +<p>The <code>notes.py</code> file defines a <code>NotesService</code> class that encapsulates the logic for interacting with case notes from DFIR-IRIS. Here is a detailed breakdown of the file:</p>

3345 +<h2 id="class-notesservice">Class: NotesService</h2>

3346 +<p>The <code>NotesService</code> class is designed to manage case notes from DFIR-IRIS. This includes operations like retrieving and creating case notes. The class utilizes a session with DFIR-IRIS to execute these operations.</p>

3347 +<h3 id="initializer">Initializer</h3>

3348 +<p>The class initializer (<code>__init__</code>) creates an instance of <code>UniversalService</code> for "DFIR-IRIS" and attempts to establish a session with DFIR-IRIS. If the session cannot be established, it logs an error message and sets the <code>iris_session</code> attribute to <code>None</code>.</p>

3349 +<h3 id="method-get_case_notes">Method: get_case_notes</h3>

3350 +<p>This method retrieves the notes of a specific case from DFIR-IRIS. It takes two parameters: <code>search_term</code> and <code>cid</code> (the ID of the case to retrieve notes for). The method checks if the <code>iris_session</code> is <code>None</code> (indicating unsuccessful session creation), and if so, returns a dictionary indicating failure. Otherwise, it fetches and parses the notes data for the specified case.</p>

3351 +<h3 id="method-_get_case_note_details">Method: _get_case_note_details</h3>

3352 +<p>This private method retrieves the details of a specific note of a case from DFIR-IRIS. It takes two parameters: <code>note_id</code> and <code>cid</code> (the ID of the note and the ID of the case respectively). Similar to <code>get_case_notes</code>, this method checks if the <code>iris_session</code> is <code>None</code> and returns a dictionary indicating failure if so. If the session exists, it fetches and parses the note data for the specified note and case.</p>

3353 +<h3 id="method-create_case_note">Method: create_case_note</h3>

3354 +<p>This method creates a note for a specific case in DFIR-IRIS. It takes three parameters: <code>cid</code> (the ID of the case), <code>note_title</code> (the title of the note to create), and <code>note_content</code> (the content of the note to create). Like the other methods, it checks if the <code>iris_session</code> is <code>None</code> and returns a dictionary indicating failure if so. If the session exists, it attempts to create a note with the specified title and content for the specified case.</p>

3355 +<p>This file serves as a core component in managing case notes in DFIR-IRIS, providing functionalities to fetch, parse, and create notes. It demonstrates a good encapsulation of related operations into a dedicated service class, thereby promoting code organization and maintainability.</p>

3356

3357

3358 <div class="doc doc-object doc-module">

backend/site/sitemap.xml.gz

Binary files a/backend/site/sitemap.xml.gz and b/backend/site/sitemap.xml.gz differ