Asksocfortress modular (#47)
* modular ask socfortress * docstrings * mkdocs * precommit
taylor_socfortress committed
Jul 17, 2023 at 21:10 UTC
8ab8c179be5b56f17014299c147d1d4147ddaf6b
5 files changed
+75
-27
backend/app/services/WazuhIndexer/alerts.py
+1
-1
@@ -4,7 +4,7 @@ from typing import Dict
4
from elasticsearch7 import Elasticsearch
5
from loguru import logger
6
7
-from app.services.ask_socfortress.univerval import AskSocfortressService
7
+from app.services.ask_socfortress.universal import AskSocfortressService
8
from app.services.WazuhIndexer.universal import UniversalService
9
10
backend/app/services/ask_socfortress/__init__.py
backend/app/services/ask_socfortress/universal.py
renamed
+68
-26
@@ -53,47 +53,69 @@ class AskSocfortressService:
53
else:
54
return None, None
55
56
- def invoke_asksocfortress(self, data: str) -> Dict[str, Any]:
56
+ def create_payload(self, data: str) -> Dict[str, Any]:
57
"""
58
- Invoke ASKSOCFortress API to enrich data via a POST request.
58
+ Creates the payload for the AskSOCFortress API request.
59
60
- Attributes:
60
+ Args:
61
data (str): The data to be enriched.
62
63
Returns:
64
- dict: A dictionary containing a success key indicating the success or failure of the connection
65
- and a message key containing further information about the connection result.
64
+ dict: The payload to be sent to the AskSOCFortress API.
65
"""
67
- headers = {
66
+ return {"rule_description": data}
67
+
68
+ def create_headers(self) -> Dict[str, str]:
69
+ """
70
+ Creates the headers for the AskSOCFortress API request.
71
+
72
+ Returns:
73
+ dict: The headers to be used for the AskSOCFortress API request.
74
+ """
75
+ return {
76
"Content-Type": "application/json",
77
"x-api-key": self.connector_api_key,
78
"module-version": "1.0",
79
}
72
- logger.info(f"Invoking AskSOCFortress API with data: {data}")
80
74
- payload = {"rule_description": data}
81
+ def make_request(self, payload: Dict[str, Any], headers: Dict[str, str]) -> requests.Response:
82
+ """
83
+ Makes the HTTP request to the AskSOCFortress API.
84
+
85
+ Args:
86
+ payload (dict): The payload to be sent to the AskSOCFortress API.
87
+ headers (dict): The headers to be used for the AskSOCFortress API request.
88
+
89
+ Returns:
90
+ requests.Response: The HTTP response from the AskSOCFortress API.
91
+ """
92
+ return requests.post(
93
+ self.connector_url,
94
+ data=json.dumps(payload),
95
+ headers=headers,
96
+ timeout=120,
97
+ )
98
+
99
+ def handle_response(self, response: requests.Response) -> Dict[str, Any]:
100
+ """
101
+ Handles the response from the AskSOCFortress API.
102
76
- timeout = 120
103
+ Args:
104
+ response (requests.Response): The HTTP response from the AskSOCFortress API.
105
106
+ Returns:
107
+ dict: A dictionary containing a success key indicating the success or failure of the connection,
108
+ a response key containing the response from the AskSOCFortress API (if successful), and
109
+ a message key containing further information about the connection result.
110
+ """
111
try:
79
- response = requests.post(
80
- self.connector_url,
81
- data=json.dumps(payload),
82
- headers=headers,
83
- timeout=timeout,
84
- )
112
response.raise_for_status()
86
- try:
87
- response_data = response.json()
88
- except ValueError:
89
- logger.error(f"Unable to decode response from AskSOCFortress API: {response.text}")
90
- raise
91
- else:
92
- return {
93
- "success": True,
94
- "response": response_data["message"],
95
- "message": "Successfully invoked AskSOCFortress API",
96
- }
113
+ response_data = response.json()
114
+ return {
115
+ "success": True,
116
+ "response": response_data["message"],
117
+ "message": "Successfully invoked AskSOCFortress API",
118
+ }
119
except requests.exceptions.HTTPError as e:
120
logger.error(f"Unable to invoke AskSOCFortress API: {e}")
121
return {
@@ -108,3 +130,23 @@ class AskSocfortressService:
130
"response": None,
131
"message": f"Unable to invoke AskSOCFortress API: {e}",
132
}
133
+
134
+ def invoke_asksocfortress(self, data: str) -> Dict[str, Any]:
135
+ """
136
+ Invokes the AskSOCFortress API to enrich data via a POST request.
137
+
138
+ The function creates the payload and headers, makes the HTTP request, and handles the response.
139
+
140
+ Args:
141
+ data (str): The data to be enriched.
142
+
143
+ Returns:
144
+ dict: A dictionary containing a success key indicating the success or failure of the connection,
145
+ a response key containing the response from the AskSOCFortress API (if successful), and
146
+ a message key containing further information about the connection result.
147
+ """
148
+ logger.info(f"Invoking AskSOCFortress API with data: {data}")
149
+ payload = self.create_payload(data)
150
+ headers = self.create_headers()
151
+ response = self.make_request(payload, headers)
152
+ return self.handle_response(response)
backend/docs/asksocfortress.md
new
+5
@@ -0,0 +1,5 @@
1
+## AskSOCFortress Overview
2
+
3
+### <span style="color:blue">AskSOCFortress Services</span>
4
+
5
+::: app.services.ask_socfortress.universal
backend/mkdocs.yml
+1
@@ -45,6 +45,7 @@ nav:
45
- InfluxDB: influxdb.md
46
- Healthcehcks: healthchecks.md
47
- SMTP: smtp.md
48
+ - ASK-SOCFortress: asksocfortress.md
49
50
markdown_extensions:
51
- pymdownx.highlight: