precommit fixes
Taylor committed
Apr 21, 2024 at 08:57 UTC
9220d82a14131589ca5e92e8d47db4e227af2f5a
3 files changed
+9
-7
backend/app/connectors/wazuh_manager/routes/rules.py
+4
-4
@@ -9,11 +9,14 @@ from sqlalchemy.future import select
9
10
from app.auth.routes.auth import AuthHandler
11
from app.connectors.wazuh_manager.models.rules import DisabledRule
12
+
13
+# from app.connectors.wazuh_manager.schema.rules import RuleExclude
14
from app.connectors.wazuh_manager.schema.rules import AllDisabledRuleResponse
15
from app.connectors.wazuh_manager.schema.rules import RuleDisable
16
from app.connectors.wazuh_manager.schema.rules import RuleDisableResponse
17
from app.connectors.wazuh_manager.schema.rules import RuleEnable
18
from app.connectors.wazuh_manager.schema.rules import RuleEnableResponse
19
+from app.connectors.wazuh_manager.schema.rules import RuleExcludeResponse
20
21
# from app.connectors.wazuh_manager.schema.rules import RuleExclude
22
# from app.connectors.wazuh_manager.schema.rules import RuleExcludeResponse
@@ -23,9 +26,6 @@ from app.connectors.wazuh_manager.services.rules import enable_rule
26
# from app.connectors.wazuh_manager.services.rules import exclude_rule
27
from app.db.db_session import get_db
28
26
-# from app.connectors.wazuh_manager.schema.rules import RuleExclude
27
-from app.connectors.wazuh_manager.schema.rules import RuleExcludeResponse
28
-
29
# from app.connectors.wazuh_manager.services.rules import exclude_rule
30
31
@@ -164,7 +164,7 @@ async def enable_wazuh_rule(
164
async def exclude_wazuh_rule() -> RuleExcludeResponse:
165
raise HTTPException(status_code=501, detail="Feature not yet ready")
166
return RuleExcludeResponse(
167
- wazuh_rule="<group name=\"windows, sysmon, sysmon_event1, windows_sysmon_event1\">\n<rule id=\"100126\" level=\"1\">\n<if_sid>100125</if_sid>\n<field name=\"win.eventdata.user\">NT AUTHORITY\\\\SYSTEM</field>\n<field name=\"win.eventdata.originalFileName\">Wmiprvse.exe</field>\n<field name=\"win.eventdata.image\">C:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe</field>\n<field name=\"win.eventdata.parentCommandLine\">C:\\\\Windows\\\\system32\\\\svchost.exe -k DcomLaunch -p</field>\n<description>Exclusion rule for specific system processes and parent commands.</description>\n</rule>\n</group>",
167
+ wazuh_rule='<group name="windows, sysmon, sysmon_event1, windows_sysmon_event1">\n<rule id="100126" level="1">\n<if_sid>100125</if_sid>\n<field name="win.eventdata.user">NT AUTHORITY\\\\SYSTEM</field>\n<field name="win.eventdata.originalFileName">Wmiprvse.exe</field>\n<field name="win.eventdata.image">C:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe</field>\n<field name="win.eventdata.parentCommandLine">C:\\\\Windows\\\\system32\\\\svchost.exe -k DcomLaunch -p</field>\n<description>Exclusion rule for specific system processes and parent commands.</description>\n</rule>\n</group>',
168
explanation="This rule is designed to exclude specific system processes identified by their user, original filename, image path, and parent command line. It triggers based on the presence of these attributes, which are commonly associated with legitimate system activities as defined in the payload. The rule is set to level 1 as a basic exclusion without generating an alert. It inherits from a previous rule with ID 100125. The exclusion is based on matching the exact strings for the user, original file name, process image, and parent command line execution parameters.",
169
message="This is a test",
170
success=True,
backend/app/threat_intel/routes/socfortress.py
+4
-2
@@ -7,11 +7,12 @@ from sqlalchemy.ext.asyncio import AsyncSession
7
8
from app.auth.utils import AuthHandler
9
from app.db.db_session import get_db
10
+from app.middleware.license import get_license
11
+from app.middleware.license import is_feature_enabled
12
from app.threat_intel.schema.socfortress import IoCResponse
13
from app.threat_intel.schema.socfortress import SocfortressThreatIntelRequest
14
from app.threat_intel.services.socfortress import socfortress_threat_intel_lookup
15
from app.utils import get_connector_attribute
14
-from app.middleware.license import get_license, is_feature_enabled
16
17
# App specific imports
18
@@ -45,6 +46,7 @@ async def ensure_api_key_exists(session: AsyncSession = Depends(get_db)) -> bool
46
)
47
return True
48
49
+
50
@threat_intel_socfortress_router.post(
51
"/socfortress",
52
response_model=IoCResponse,
@@ -54,7 +56,7 @@ async def ensure_api_key_exists(session: AsyncSession = Depends(get_db)) -> bool
56
async def threat_intel_socfortress(
57
request: SocfortressThreatIntelRequest,
58
session: AsyncSession = Depends(get_db),
57
- #_key_exists: bool = Depends(ensure_api_key_exists),
59
+ # _key_exists: bool = Depends(ensure_api_key_exists),
60
):
61
"""
62
Endpoint for SocFortress Threat Intel.
frontend/package.json
+1
-1
@@ -124,4 +124,4 @@
124
"engines": {
125
"node": ">=18.0.0"
126
}
127
-}
\ No newline at end of file
127
+}