@cryptotaxi247 / CoPilot / commits / 9eeba144

583 add mimecast alerts (#584)

* Add Mimecast monitoring alerts provisioning functions and definitions * precommit-fixes * Bump version to 0.1.19

taylor_socfortress committed Jan 1, 2026 at 16:02 UTC 9eeba1440923b9ad8a0a3d5b64b3fce80f1eae25
5 files changed +856 -2
.flake8
+1 -1
@@ -1,6 +1,6 @@
1 [flake8]
2 #max-complexity = 18
3 -max-line-length = 270
3 +max-line-length = 400
4 #select = B,C,E,F,W,T4,B9
5 #ignore = E203, E266, E501, W503, F403, F401
6 ignore = E402, W503, E231, W605, E266, E712, E702, E713, E999, E272, E241, E221, E202
backend/app/integrations/monitoring_alert/routes/provision.py
+120
@@ -83,6 +83,42 @@ from app.integrations.monitoring_alert.services.provision import (
83 from app.integrations.monitoring_alert.services.provision import (
84 provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert,
85 )
86 +from app.integrations.monitoring_alert.services.provision import (
87 + provision_mimecast_anonymizer_url_accessed_monitoring_alert,
88 +)
89 +from app.integrations.monitoring_alert.services.provision import (
90 + provision_mimecast_compromised_site_url_accessed_monitoring_alert,
91 +)
92 +from app.integrations.monitoring_alert.services.provision import (
93 + provision_mimecast_executable_file_attachment_delivered_monitoring_alert,
94 +)
95 +from app.integrations.monitoring_alert.services.provision import (
96 + provision_mimecast_impersonation_email_delivered_monitoring_alert,
97 +)
98 +from app.integrations.monitoring_alert.services.provision import (
99 + provision_mimecast_malicious_email_attachment_delivered_monitoring_alert,
100 +)
101 +from app.integrations.monitoring_alert.services.provision import (
102 + provision_mimecast_malicious_email_link_accessed_monitoring_alert,
103 +)
104 +from app.integrations.monitoring_alert.services.provision import (
105 + provision_mimecast_malicious_outbound_email_monitoring_alert,
106 +)
107 +from app.integrations.monitoring_alert.services.provision import (
108 + provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert,
109 +)
110 +from app.integrations.monitoring_alert.services.provision import (
111 + provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert,
112 +)
113 +from app.integrations.monitoring_alert.services.provision import (
114 + provision_mimecast_phishing_email_delivered_monitoring_alert,
115 +)
116 +from app.integrations.monitoring_alert.services.provision import (
117 + provision_mimecast_source_code_file_in_email_attachment_monitoring_alert,
118 +)
119 +from app.integrations.monitoring_alert.services.provision import (
120 + provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert,
121 +)
122 from app.integrations.monitoring_alert.services.provision import (
123 provision_office365_exchange_online_alert,
124 )
@@ -466,6 +502,78 @@ async def invoke_provision_sentinelone_analyst_verdict_changed_to_false_positive
502 )
503
504
505 +async def invoke_provision_mimecast_compromised_site_url_accessed_monitoring_alert(
506 + request: ProvisionMonitoringAlertRequest,
507 +):
508 + await provision_mimecast_compromised_site_url_accessed_monitoring_alert(request)
509 +
510 +
511 +async def invoke_provision_mimecast_executable_file_attachment_delivered_monitoring_alert(
512 + request: ProvisionMonitoringAlertRequest,
513 +):
514 + await provision_mimecast_executable_file_attachment_delivered_monitoring_alert(request)
515 +
516 +
517 +async def invoke_provision_mimecast_malicious_email_attachment_delivered_monitoring_alert(
518 + request: ProvisionMonitoringAlertRequest,
519 +):
520 + await provision_mimecast_malicious_email_attachment_delivered_monitoring_alert(request)
521 +
522 +
523 +async def invoke_provision_mimecast_malicious_email_link_accessed_monitoring_alert(
524 + request: ProvisionMonitoringAlertRequest,
525 +):
526 + await provision_mimecast_malicious_email_link_accessed_monitoring_alert(request)
527 +
528 +
529 +async def invoke_provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert(
530 + request: ProvisionMonitoringAlertRequest,
531 +):
532 + await provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert(request)
533 +
534 +
535 +async def invoke_provision_mimecast_anonymizer_url_accessed_monitoring_alert(
536 + request: ProvisionMonitoringAlertRequest,
537 +):
538 + await provision_mimecast_anonymizer_url_accessed_monitoring_alert(request)
539 +
540 +
541 +async def invoke_provision_mimecast_impersonation_email_delivered_monitoring_alert(
542 + request: ProvisionMonitoringAlertRequest,
543 +):
544 + await provision_mimecast_impersonation_email_delivered_monitoring_alert(request)
545 +
546 +
547 +async def invoke_provision_mimecast_malicious_outbound_email_monitoring_alert(
548 + request: ProvisionMonitoringAlertRequest,
549 +):
550 + await provision_mimecast_malicious_outbound_email_monitoring_alert(request)
551 +
552 +
553 +async def invoke_provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert(
554 + request: ProvisionMonitoringAlertRequest,
555 +):
556 + await provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert(request)
557 +
558 +
559 +async def invoke_provision_mimecast_phishing_email_delivered_monitoring_alert(
560 + request: ProvisionMonitoringAlertRequest,
561 +):
562 + await provision_mimecast_phishing_email_delivered_monitoring_alert(request)
563 +
564 +
565 +async def invoke_provision_mimecast_source_code_file_in_email_attachment_monitoring_alert(
566 + request: ProvisionMonitoringAlertRequest,
567 +):
568 + await provision_mimecast_source_code_file_in_email_attachment_monitoring_alert(request)
569 +
570 +
571 +async def invoke_provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert(
572 + request: ProvisionMonitoringAlertRequest,
573 +):
574 + await provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert(request)
575 +
576 +
577 async def invoke_provision_custom_monitoring_alert(
578 request: CustomMonitoringAlertProvisionModel,
579 ):
@@ -512,6 +620,18 @@ PROVISION_FUNCTIONS = {
620 "SENTINELONE_NEW_PATH_EXCLUSION_ADDED": invoke_provision_sentinelone_new_path_exclusion_added_monitoring_alert,
621 "SENTINELONE_ANALYST_VERDICT_CHANGED_TO_TRUE_POSITIVE": invoke_provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert,
622 "SENTINELONE_ANALYST_VERDICT_CHANGED_TO_FALSE_POSITIVE": invoke_provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert,
623 + "MIMECAST_COMPROMISED_SITE_URL_ACCESSED": invoke_provision_mimecast_compromised_site_url_accessed_monitoring_alert,
624 + "MIMECAST_EXECUTABLE_FILE_ATTACHMENT_DELIVERED": invoke_provision_mimecast_executable_file_attachment_delivered_monitoring_alert,
625 + "MIMECAST_MALICIOUS_EMAIL_ATTACHMENT_DELIVERED": invoke_provision_mimecast_malicious_email_attachment_delivered_monitoring_alert,
626 + "MIMECAST_MALICIOUS_EMAIL_LINK_ACCESSED": invoke_provision_mimecast_malicious_email_link_accessed_monitoring_alert,
627 + "MIMECAST_P2P_FILE_SHARING_URL_ACCESSED": invoke_provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert,
628 + "MIMECAST_ANONYMIZER_URL_ACCESSED": invoke_provision_mimecast_anonymizer_url_accessed_monitoring_alert,
629 + "MIMECAST_IMPERSONATION_EMAIL_DELIVERED": invoke_provision_mimecast_impersonation_email_delivered_monitoring_alert,
630 + "MIMECAST_MALICIOUS_OUTBOUND_EMAIL": invoke_provision_mimecast_malicious_outbound_email_monitoring_alert,
631 + "MIMECAST_MALICIOUS_RTF_ATTACHMENT_DELIVERED": invoke_provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert,
632 + "MIMECAST_PHISHING_EMAIL_DELIVERED": invoke_provision_mimecast_phishing_email_delivered_monitoring_alert,
633 + "MIMECAST_SOURCE_CODE_FILE_IN_EMAIL_ATTACHMENT": invoke_provision_mimecast_source_code_file_in_email_attachment_monitoring_alert,
634 + "MIMECAST_URL_WITH_DANGEROUS_FILE_TYPE_ACCESSED": invoke_provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert,
635 "CUSTOM": invoke_provision_custom_monitoring_alert,
636 # Add more alert names and functions as needed
637 }
backend/app/integrations/monitoring_alert/schema/provision.py
+49
@@ -218,6 +218,55 @@ class AvailableMonitoringAlerts(str, Enum):
218 SENTINELONE_NEW_PATH_EXCLUSION_ADDED = "Path Exclusion added"
219 SENTINELONE_ANALYST_VERDICT_CHANGED_TO_TRUE_POSITIVE = 'A management user changed the analyst verdict to "True Positive".'
220 SENTINELONE_ANALYST_VERDICT_CHANGED_TO_FALSE_POSITIVE = 'A management user changed the analyst verdict to "False Positive".'
221 + # ! --- Mimecast alerts ---
222 + MIMECAST_COMPROMISED_SITE_URL_ACCESSED = (
223 + "Detects user clicks on compromised websites classified by Mimecast, which were delivered via email. "
224 + "Adversaries can exploit these links to direct users to malicious sites hosting malware, phishing pages, or spam content."
225 + )
226 + MIMECAST_EXECUTABLE_FILE_ATTACHMENT_DELIVERED = (
227 + "Detects emails containing executable file attachments that have been delivered to a user's mailbox, as identified by Mimecast. "
228 + "An adversary can abuse this delivery method to distribute malicious payloads, including malware, ransomware, or other executables designed to compromise the recipient's system."
229 + )
230 + MIMECAST_MALICIOUS_EMAIL_ATTACHMENT_DELIVERED = (
231 + "Detects emails containing malicious attachments identified by Mimecast that have been delivered to a user's mailbox. "
232 + "Attackers commonly use spearphishing emails with malicious attachments to compromise systems by tricking recipients into opening them."
233 + )
234 + MIMECAST_MALICIOUS_EMAIL_LINK_ACCESSED = (
235 + "Detects instances where users click on malicious URLs embedded in emails. "
236 + "These URLs may redirect to phishing sites, initiate malware downloads, or enable advanced threats, posing risks to user and organizational security."
237 + )
238 + MIMECAST_P2P_FILE_SHARING_URL_ACCESSED = (
239 + "Detects a user clicking on a peer-to-peer file sharing URL, as classified by Mimecast, that was delivered via email. "
240 + "Adversaries can abuse P2P file-sharing platforms to distribute malicious files, such as malware, ransomware, or unauthorized software, by embedding these links in phishing emails."
241 + )
242 + MIMECAST_ANONYMIZER_URL_ACCESSED = (
243 + "Detects user clicks on anonymizer URLs classified by Mimecast that arrived in an email. "
244 + "An adversary can abuse anonymizer services to mask their identity and hide the origin of malicious traffic, making it harder to trace their activities."
245 + )
246 + MIMECAST_IMPERSONATION_EMAIL_DELIVERED = (
247 + "Detects unblocked email messages flagged by Mimecast as potential impersonation attempts. "
248 + "These emails are strong indicators of Business Email Compromise (BEC), a sophisticated phishing tactic in which attackers impersonate trusted entities to deceive recipients."
249 + )
250 + MIMECAST_MALICIOUS_OUTBOUND_EMAIL = (
251 + "Detects outbound emails identified by Mimecast as malicious, including those containing phishing links, malware-laden attachments, or other suspicious content. "
252 + "Monitoring these events is crucial in identifying potential account compromises or unauthorized activities aimed at distributing threats to external recipients."
253 + )
254 + MIMECAST_MALICIOUS_RTF_ATTACHMENT_DELIVERED = (
255 + "Detects emails containing malicious rtf file attachments identified by Mimecast that have been delivered to a user's mailbox. "
256 + "Adversaries can abuse malicious RTF files to exploit vulnerabilities in applications that process these files, potentially executing arbitrary code or delivering malware."
257 + )
258 + MIMECAST_PHISHING_EMAIL_DELIVERED = (
259 + "Detects unblocked email messages flagged as phishing by Mimecast, indicating their successful delivery to recipients' mailboxes. "
260 + "Such emails may contain malicious attachments, URLs, or deceptive content."
261 + )
262 + MIMECAST_SOURCE_CODE_FILE_IN_EMAIL_ATTACHMENT = (
263 + "Detects the presence of source code files in email attachments by analyzing Mimecast email logs. "
264 + "This activity may indicate potential insider threats, as internal users could be attempting to exfiltrate sensitive or proprietary information."
265 + )
266 + MIMECAST_URL_WITH_DANGEROUS_FILE_TYPE_ACCESSED = (
267 + "Detects user clicks on URLs containing dangerous file types, as classified by Mimecast, that were delivered via email. "
268 + "Adversaries often use emails with embedded URLs linking to files with extensions commonly associated with malware, such as .exe, .bat, .js, or .msi."
269 + )
270
271
272 class AvailableMonitoringAlertsResponse(BaseModel):
backend/app/integrations/monitoring_alert/services/provision.py
+685
@@ -2768,6 +2768,691 @@ async def provision_sentinelone_analyst_verdict_changed_to_false_positive_monito
2768 )
2769
2770
2771 +# ! --- Mimecast Monitoring Alerts --- ! #
2772 +async def provision_mimecast_compromised_site_url_accessed_monitoring_alert(
2773 + request: ProvisionMonitoringAlertRequest,
2774 +) -> ProvisionWazuhMonitoringAlertResponse:
2775 + """
2776 + Provisions Mimecast Compromised Site URL Accessed monitoring alert.
2777 + """
2778 + logger.info(
2779 + "Invoking provision_mimecast_compromised_site_url_accessed_monitoring_alert " f"with request: {request.dict()}",
2780 + )
2781 + await provision_alert_definition(
2782 + GraylogAlertProvisionModel(
2783 + title="MIMECAST - COMPROMISED SITE URL ACCESSED",
2784 + description="MIMECAST - COMPROMISED SITE URL ACCESSED",
2785 + priority=3,
2786 + config=GraylogAlertProvisionConfig(
2787 + type="aggregation-v1",
2788 + query='integration:mimecast AND (category:"Compromised" OR category:"Botnets" OR category:"Attacker Controlled Infrastructure") AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block" AND !adminOverride:"Hold" AND !adminOverride:"Block" AND !adminOverride:"Bounce"',
2789 + query_parameters=[],
2790 + streams=[],
2791 + group_by=[],
2792 + series=[],
2793 + conditions={"expression": None},
2794 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2795 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2796 + event_limit=1000,
2797 + ),
2798 + field_spec={
2799 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2800 + data_type="string",
2801 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2802 + ),
2803 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2804 + data_type="string",
2805 + providers=[
2806 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2807 + ],
2808 + ),
2809 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2810 + data_type="string",
2811 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
2812 + ),
2813 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2814 + data_type="string",
2815 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2816 + ),
2817 + },
2818 + key_spec=[],
2819 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2820 + alert=True,
2821 + ),
2822 + )
2823 + return ProvisionWazuhMonitoringAlertResponse(
2824 + success=True,
2825 + message="Mimecast compromised site URL accessed monitoring alert provisioned successfully",
2826 + )
2827 +
2828 +
2829 +async def provision_mimecast_executable_file_attachment_delivered_monitoring_alert(
2830 + request: ProvisionMonitoringAlertRequest,
2831 +) -> ProvisionWazuhMonitoringAlertResponse:
2832 + """
2833 + Provisions Mimecast Executable File Attachment Delivered monitoring alert.
2834 + """
2835 + logger.info(
2836 + "Invoking provision_mimecast_executable_file_attachment_delivered_monitoring_alert " f"with request: {request.dict()}",
2837 + )
2838 + await provision_alert_definition(
2839 + GraylogAlertProvisionModel(
2840 + title="MIMECAST - EXECUTABLE FILE ATTACHMENT DELIVERED",
2841 + description="MIMECAST - EXECUTABLE FILE ATTACHMENT DELIVERED",
2842 + priority=3,
2843 + config=GraylogAlertProvisionConfig(
2844 + type="aggregation-v1",
2845 + query='integration:mimecast AND (Route:"Inbound" OR Dir:"Inbound" OR route:"inbound") AND (file_type:"application/x-dosexec" OR file_type:"application/x-msdownload" OR file_type:"application/x-executable" OR file_type:"application/vnd.microsoft.portable-executable") AND !actionTriggered:"Hold" AND !actionTriggered:"Block" AND !actionTriggered:"Bounce"',
2846 + query_parameters=[],
2847 + streams=[],
2848 + group_by=[],
2849 + series=[],
2850 + conditions={"expression": None},
2851 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2852 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2853 + event_limit=1000,
2854 + ),
2855 + field_spec={
2856 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2857 + data_type="string",
2858 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2859 + ),
2860 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2861 + data_type="string",
2862 + providers=[
2863 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2864 + ],
2865 + ),
2866 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2867 + data_type="string",
2868 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
2869 + ),
2870 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2871 + data_type="string",
2872 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2873 + ),
2874 + },
2875 + key_spec=[],
2876 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2877 + alert=True,
2878 + ),
2879 + )
2880 + return ProvisionWazuhMonitoringAlertResponse(
2881 + success=True,
2882 + message="Mimecast executable file attachment delivered monitoring alert provisioned successfully",
2883 + )
2884 +
2885 +
2886 +async def provision_mimecast_malicious_email_attachment_delivered_monitoring_alert(
2887 + request: ProvisionMonitoringAlertRequest,
2888 +) -> ProvisionWazuhMonitoringAlertResponse:
2889 + """
2890 + Provisions Mimecast Malicious Email Attachment Delivered monitoring alert.
2891 + """
2892 + logger.info(
2893 + "Invoking provision_mimecast_malicious_email_attachment_delivered_monitoring_alert " f"with request: {request.dict()}",
2894 + )
2895 + await provision_alert_definition(
2896 + GraylogAlertProvisionModel(
2897 + title="MIMECAST - MALICIOUS EMAIL ATTACHMENT DELIVERED",
2898 + description="MIMECAST - MALICIOUS EMAIL ATTACHMENT DELIVERED",
2899 + priority=3,
2900 + config=GraylogAlertProvisionConfig(
2901 + type="aggregation-v1",
2902 + query='integration:mimecast AND scanResult:"malicious" AND (Route:"Inbound" OR Dir:"Inbound" OR route:"inbound") AND !actionTriggered:"Hold" AND !actionTriggered:"Block" AND !actionTriggered:"Bounce"',
2903 + query_parameters=[],
2904 + streams=[],
2905 + group_by=[],
2906 + series=[],
2907 + conditions={"expression": None},
2908 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2909 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2910 + event_limit=1000,
2911 + ),
2912 + field_spec={
2913 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2914 + data_type="string",
2915 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2916 + ),
2917 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2918 + data_type="string",
2919 + providers=[
2920 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2921 + ],
2922 + ),
2923 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2924 + data_type="string",
2925 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
2926 + ),
2927 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2928 + data_type="string",
2929 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2930 + ),
2931 + },
2932 + key_spec=[],
2933 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2934 + alert=True,
2935 + ),
2936 + )
2937 + return ProvisionWazuhMonitoringAlertResponse(
2938 + success=True,
2939 + message="Mimecast malicious email attachment delivered monitoring alert provisioned successfully",
2940 + )
2941 +
2942 +
2943 +async def provision_mimecast_malicious_email_link_accessed_monitoring_alert(
2944 + request: ProvisionMonitoringAlertRequest,
2945 +) -> ProvisionWazuhMonitoringAlertResponse:
2946 + """
2947 + Provisions Mimecast Malicious Email Link Accessed monitoring alert.
2948 + """
2949 + logger.info(
2950 + "Invoking provision_mimecast_malicious_email_link_accessed_monitoring_alert " f"with request: {request.dict()}",
2951 + )
2952 + await provision_alert_definition(
2953 + GraylogAlertProvisionModel(
2954 + title="MIMECAST - MALICIOUS EMAIL LINK ACCESSED",
2955 + description="MIMECAST - MALICIOUS EMAIL LINK ACCESSED",
2956 + priority=3,
2957 + config=GraylogAlertProvisionConfig(
2958 + type="aggregation-v1",
2959 + query='integration:mimecast AND scanResult:"malicious" AND !action:"block"',
2960 + query_parameters=[],
2961 + streams=[],
2962 + group_by=[],
2963 + series=[],
2964 + conditions={"expression": None},
2965 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
2966 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
2967 + event_limit=1000,
2968 + ),
2969 + field_spec={
2970 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2971 + data_type="string",
2972 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
2973 + ),
2974 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
2975 + data_type="string",
2976 + providers=[
2977 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
2978 + ],
2979 + ),
2980 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
2981 + data_type="string",
2982 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
2983 + ),
2984 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
2985 + data_type="string",
2986 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
2987 + ),
2988 + },
2989 + key_spec=[],
2990 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
2991 + alert=True,
2992 + ),
2993 + )
2994 + return ProvisionWazuhMonitoringAlertResponse(
2995 + success=True,
2996 + message="Mimecast malicious email link accessed monitoring alert provisioned successfully",
2997 + )
2998 +
2999 +
3000 +async def provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert(
3001 + request: ProvisionMonitoringAlertRequest,
3002 +) -> ProvisionWazuhMonitoringAlertResponse:
3003 + """
3004 + Provisions Mimecast P2P File Sharing URL Accessed monitoring alert.
3005 + """
3006 + logger.info(
3007 + "Invoking provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert " f"with request: {request.dict()}",
3008 + )
3009 + await provision_alert_definition(
3010 + GraylogAlertProvisionModel(
3011 + title="MIMECAST - P2P FILE SHARING URL ACCESSED",
3012 + description="MIMECAST - P2P FILE SHARING URL ACCESSED",
3013 + priority=3,
3014 + config=GraylogAlertProvisionConfig(
3015 + type="aggregation-v1",
3016 + query='integration:mimecast AND category:"Peer-to-Peer" AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block" AND !adminOverride:"Hold" AND !adminOverride:"Block" AND !adminOverride:"Bounce"',
3017 + query_parameters=[],
3018 + streams=[],
3019 + group_by=[],
3020 + series=[],
3021 + conditions={"expression": None},
3022 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3023 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3024 + event_limit=1000,
3025 + ),
3026 + field_spec={
3027 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3028 + data_type="string",
3029 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3030 + ),
3031 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3032 + data_type="string",
3033 + providers=[
3034 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3035 + ],
3036 + ),
3037 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3038 + data_type="string",
3039 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3040 + ),
3041 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3042 + data_type="string",
3043 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3044 + ),
3045 + },
3046 + key_spec=[],
3047 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3048 + alert=True,
3049 + ),
3050 + )
3051 + return ProvisionWazuhMonitoringAlertResponse(
3052 + success=True,
3053 + message="Mimecast P2P file sharing URL accessed monitoring alert provisioned successfully",
3054 + )
3055 +
3056 +
3057 +async def provision_mimecast_anonymizer_url_accessed_monitoring_alert(
3058 + request: ProvisionMonitoringAlertRequest,
3059 +) -> ProvisionWazuhMonitoringAlertResponse:
3060 + """
3061 + Provisions Mimecast Anonymizer URL Accessed monitoring alert.
3062 + """
3063 + logger.info(
3064 + "Invoking provision_mimecast_anonymizer_url_accessed_monitoring_alert " f"with request: {request.dict()}",
3065 + )
3066 + await provision_alert_definition(
3067 + GraylogAlertProvisionModel(
3068 + title="MIMECAST - ANONYMIZER URL ACCESSED",
3069 + description="MIMECAST - ANONYMIZER URL ACCESSED",
3070 + priority=2,
3071 + config=GraylogAlertProvisionConfig(
3072 + type="aggregation-v1",
3073 + query='integration:mimecast AND category:"Anonymizers" AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block" AND !adminOverride:"Hold" AND !adminOverride:"Block" AND !adminOverride:"Bounce"',
3074 + query_parameters=[],
3075 + streams=[],
3076 + group_by=[],
3077 + series=[],
3078 + conditions={"expression": None},
3079 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3080 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3081 + event_limit=1000,
3082 + ),
3083 + field_spec={
3084 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3085 + data_type="string",
3086 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3087 + ),
3088 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3089 + data_type="string",
3090 + providers=[
3091 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3092 + ],
3093 + ),
3094 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3095 + data_type="string",
3096 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3097 + ),
3098 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3099 + data_type="string",
3100 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3101 + ),
3102 + },
3103 + key_spec=[],
3104 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3105 + alert=True,
3106 + ),
3107 + )
3108 + return ProvisionWazuhMonitoringAlertResponse(
3109 + success=True,
3110 + message="Mimecast anonymizer URL accessed monitoring alert provisioned successfully",
3111 + )
3112 +
3113 +
3114 +async def provision_mimecast_impersonation_email_delivered_monitoring_alert(
3115 + request: ProvisionMonitoringAlertRequest,
3116 +) -> ProvisionWazuhMonitoringAlertResponse:
3117 + """
3118 + Provisions Mimecast Impersonation Email Delivered monitoring alert.
3119 + """
3120 + logger.info(
3121 + "Invoking provision_mimecast_impersonation_email_delivered_monitoring_alert " f"with request: {request.dict()}",
3122 + )
3123 + await provision_alert_definition(
3124 + GraylogAlertProvisionModel(
3125 + title="MIMECAST - IMPERSONATION EMAIL DELIVERED",
3126 + description="MIMECAST - IMPERSONATION EMAIL DELIVERED",
3127 + priority=2,
3128 + config=GraylogAlertProvisionConfig(
3129 + type="aggregation-v1",
3130 + query='integration:mimecast AND taggedMalicious:true AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block"',
3131 + query_parameters=[],
3132 + streams=[],
3133 + group_by=[],
3134 + series=[],
3135 + conditions={"expression": None},
3136 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3137 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3138 + event_limit=1000,
3139 + ),
3140 + field_spec={
3141 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3142 + data_type="string",
3143 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3144 + ),
3145 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3146 + data_type="string",
3147 + providers=[
3148 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3149 + ],
3150 + ),
3151 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3152 + data_type="string",
3153 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3154 + ),
3155 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3156 + data_type="string",
3157 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3158 + ),
3159 + },
3160 + key_spec=[],
3161 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3162 + alert=True,
3163 + ),
3164 + )
3165 + return ProvisionWazuhMonitoringAlertResponse(
3166 + success=True,
3167 + message="Mimecast impersonation email delivered monitoring alert provisioned successfully",
3168 + )
3169 +
3170 +
3171 +async def provision_mimecast_malicious_outbound_email_monitoring_alert(
3172 + request: ProvisionMonitoringAlertRequest,
3173 +) -> ProvisionWazuhMonitoringAlertResponse:
3174 + """
3175 + Provisions Mimecast Malicious Outbound Email monitoring alert.
3176 + """
3177 + logger.info(
3178 + "Invoking provision_mimecast_malicious_outbound_email_monitoring_alert " f"with request: {request.dict()}",
3179 + )
3180 + await provision_alert_definition(
3181 + GraylogAlertProvisionModel(
3182 + title="MIMECAST - MALICIOUS OUTBOUND EMAIL",
3183 + description="MIMECAST - MALICIOUS OUTBOUND EMAIL",
3184 + priority=2,
3185 + config=GraylogAlertProvisionConfig(
3186 + type="aggregation-v1",
3187 + query='integration:mimecast AND Dir:"Outbound" AND category:"Malware" AND scanResult:"malicious" AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block" AND !adminOverride:"Hold" AND !adminOverride:"Block" AND !adminOverride:"Bounce"',
3188 + query_parameters=[],
3189 + streams=[],
3190 + group_by=[],
3191 + series=[],
3192 + conditions={"expression": None},
3193 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3194 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3195 + event_limit=1000,
3196 + ),
3197 + field_spec={
3198 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3199 + data_type="string",
3200 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3201 + ),
3202 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3203 + data_type="string",
3204 + providers=[
3205 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3206 + ],
3207 + ),
3208 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3209 + data_type="string",
3210 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3211 + ),
3212 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3213 + data_type="string",
3214 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3215 + ),
3216 + },
3217 + key_spec=[],
3218 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3219 + alert=True,
3220 + ),
3221 + )
3222 + return ProvisionWazuhMonitoringAlertResponse(
3223 + success=True,
3224 + message="Mimecast malicious outbound email monitoring alert provisioned successfully",
3225 + )
3226 +
3227 +
3228 +async def provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert(
3229 + request: ProvisionMonitoringAlertRequest,
3230 +) -> ProvisionWazuhMonitoringAlertResponse:
3231 + """
3232 + Provisions Mimecast Malicious RTF Attachment Delivered monitoring alert.
3233 + """
3234 + logger.info(
3235 + "Invoking provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert " f"with request: {request.dict()}",
3236 + )
3237 + await provision_alert_definition(
3238 + GraylogAlertProvisionModel(
3239 + title="MIMECAST - MALICIOUS RTF ATTACHMENT DELIVERED",
3240 + description="MIMECAST - MALICIOUS RTF ATTACHMENT DELIVERED",
3241 + priority=2,
3242 + config=GraylogAlertProvisionConfig(
3243 + type="aggregation-v1",
3244 + query='integration:mimecast AND scanResult:"malicious" AND fileName:/\\.rtf$/ AND !actionTriggered:"Hold" AND !actionTriggered:"Block" AND !actionTriggered:"Bounce"',
3245 + query_parameters=[],
3246 + streams=[],
3247 + group_by=[],
3248 + series=[],
3249 + conditions={"expression": None},
3250 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3251 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3252 + event_limit=1000,
3253 + ),
3254 + field_spec={
3255 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3256 + data_type="string",
3257 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3258 + ),
3259 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3260 + data_type="string",
3261 + providers=[
3262 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3263 + ],
3264 + ),
3265 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3266 + data_type="string",
3267 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3268 + ),
3269 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3270 + data_type="string",
3271 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3272 + ),
3273 + },
3274 + key_spec=[],
3275 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3276 + alert=True,
3277 + ),
3278 + )
3279 + return ProvisionWazuhMonitoringAlertResponse(
3280 + success=True,
3281 + message="Mimecast malicious RTF attachment delivered monitoring alert provisioned successfully",
3282 + )
3283 +
3284 +
3285 +async def provision_mimecast_phishing_email_delivered_monitoring_alert(
3286 + request: ProvisionMonitoringAlertRequest,
3287 +) -> ProvisionWazuhMonitoringAlertResponse:
3288 + """
3289 + Provisions Mimecast Phishing Email Delivered monitoring alert.
3290 + """
3291 + logger.info(
3292 + "Invoking provision_mimecast_phishing_email_delivered_monitoring_alert " f"with request: {request.dict()}",
3293 + )
3294 + await provision_alert_definition(
3295 + GraylogAlertProvisionModel(
3296 + title="MIMECAST - PHISHING EMAIL DELIVERED",
3297 + description="MIMECAST - PHISHING EMAIL DELIVERED",
3298 + priority=2,
3299 + config=GraylogAlertProvisionConfig(
3300 + type="aggregation-v1",
3301 + query='integration:mimecast AND category:"Phishing & Fraud" AND (Route:"Inbound" OR Dir:"Inbound" OR route:"inbound") AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block"',
3302 + query_parameters=[],
3303 + streams=[],
3304 + group_by=[],
3305 + series=[],
3306 + conditions={"expression": None},
3307 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3308 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3309 + event_limit=1000,
3310 + ),
3311 + field_spec={
3312 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3313 + data_type="string",
3314 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3315 + ),
3316 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3317 + data_type="string",
3318 + providers=[
3319 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3320 + ],
3321 + ),
3322 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3323 + data_type="string",
3324 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3325 + ),
3326 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3327 + data_type="string",
3328 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3329 + ),
3330 + },
3331 + key_spec=[],
3332 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3333 + alert=True,
3334 + ),
3335 + )
3336 + return ProvisionWazuhMonitoringAlertResponse(
3337 + success=True,
3338 + message="Mimecast phishing email delivered monitoring alert provisioned successfully",
3339 + )
3340 +
3341 +
3342 +async def provision_mimecast_source_code_file_in_email_attachment_monitoring_alert(
3343 + request: ProvisionMonitoringAlertRequest,
3344 +) -> ProvisionWazuhMonitoringAlertResponse:
3345 + """
3346 + Provisions Mimecast Source Code File In Email Attachment monitoring alert.
3347 + """
3348 + logger.info(
3349 + "Invoking provision_mimecast_source_code_file_in_email_attachment_monitoring_alert " f"with request: {request.dict()}",
3350 + )
3351 + await provision_alert_definition(
3352 + GraylogAlertProvisionModel(
3353 + title="MIMECAST - SOURCE CODE FILE IN EMAIL ATTACHMENT",
3354 + description="MIMECAST - SOURCE CODE FILE IN EMAIL ATTACHMENT",
3355 + priority=2,
3356 + config=GraylogAlertProvisionConfig(
3357 + type="aggregation-v1",
3358 + query="integration:mimecast AND (AttNames:/\\.py$/ OR AttNames:/\\.java$/ OR AttNames:/\\.c$/ OR AttNames:/\\.cs$/ OR AttNames:/\\.cpp$/ OR AttNames:/\\.jsp$/ OR AttNames:/\\.vba$/ OR AttNames:/\\.class$/)",
3359 + query_parameters=[],
3360 + streams=[],
3361 + group_by=[],
3362 + series=[],
3363 + conditions={"expression": None},
3364 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3365 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3366 + event_limit=1000,
3367 + ),
3368 + field_spec={
3369 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3370 + data_type="string",
3371 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3372 + ),
3373 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3374 + data_type="string",
3375 + providers=[
3376 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3377 + ],
3378 + ),
3379 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3380 + data_type="string",
3381 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3382 + ),
3383 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3384 + data_type="string",
3385 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3386 + ),
3387 + },
3388 + key_spec=[],
3389 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3390 + alert=True,
3391 + ),
3392 + )
3393 + return ProvisionWazuhMonitoringAlertResponse(
3394 + success=True,
3395 + message="Mimecast source code file in email attachment monitoring alert provisioned successfully",
3396 + )
3397 +
3398 +
3399 +async def provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert(
3400 + request: ProvisionMonitoringAlertRequest,
3401 +) -> ProvisionWazuhMonitoringAlertResponse:
3402 + """
3403 + Provisions Mimecast URL with Dangerous File Type Accessed monitoring alert.
3404 + """
3405 + logger.info(
3406 + "Invoking provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert " f"with request: {request.dict()}",
3407 + )
3408 + await provision_alert_definition(
3409 + GraylogAlertProvisionModel(
3410 + title="MIMECAST - URL WITH DANGEROUS FILE TYPE ACCESSED",
3411 + description="MIMECAST - URL WITH DANGEROUS FILE TYPE ACCESSED",
3412 + priority=2,
3413 + config=GraylogAlertProvisionConfig(
3414 + type="aggregation-v1",
3415 + query='integration:mimecast AND category:"Dangerous file extension" AND !action:"hold" AND !action:"block" AND !action:"bounce" AND !actions:"Hold" AND !actions:"Block" AND !adminOverride:"Hold" AND !adminOverride:"Block" AND !adminOverride:"Bounce"',
3416 + query_parameters=[],
3417 + streams=[],
3418 + group_by=[],
3419 + series=[],
3420 + conditions={"expression": None},
3421 + search_within_ms=await convert_seconds_to_milliseconds(request.search_within_last),
3422 + execute_every_ms=await convert_seconds_to_milliseconds(request.execute_every),
3423 + event_limit=1000,
3424 + ),
3425 + field_spec={
3426 + "ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3427 + data_type="string",
3428 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="${source._id}", require_values=True)],
3429 + ),
3430 + "CUSTOMER_CODE": GraylogAlertProvisionFieldSpecItem(
3431 + data_type="string",
3432 + providers=[
3433 + GraylogAlertProvisionProvider(type="template-v1", template="${source.syslog_customer}", require_values=True),
3434 + ],
3435 + ),
3436 + "ALERT_SOURCE": GraylogAlertProvisionFieldSpecItem(
3437 + data_type="string",
3438 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="MIMECAST", require_values=True)],
3439 + ),
3440 + "COPILOT_ALERT_ID": GraylogAlertProvisionFieldSpecItem(
3441 + data_type="string",
3442 + providers=[GraylogAlertProvisionProvider(type="template-v1", template="NONE", require_values=True)],
3443 + ),
3444 + },
3445 + key_spec=[],
3446 + notification_settings=GraylogAlertProvisionNotificationSettings(grace_period_ms=0, backlog_size=None),
3447 + alert=True,
3448 + ),
3449 + )
3450 + return ProvisionWazuhMonitoringAlertResponse(
3451 + success=True,
3452 + message="Mimecast URL with dangerous file type accessed monitoring alert provisioned successfully",
3453 + )
3454 +
3455 +
3456 async def provision_custom_alert(request: CustomMonitoringAlertProvisionModel) -> ProvisionWazuhMonitoringAlertResponse:
3457 """
3458 Provisions custom monitoring alerts.
backend/app/version/services/version.py
+1 -1
@@ -7,7 +7,7 @@ from loguru import logger
7 from packaging.version import Version
8
9 # Current version - update this with each release
10 -CURRENT_VERSION = "0.1.18"
10 +CURRENT_VERSION = "0.1.19"
11 VERSION_CHECK_URL = "https://api.github.com/repos/socfortress/CoPilot/releases/latest"
12
13