89
detail="Failed to collect url whitelist entries",
90
)
91
url_whitelist_entries_response = UrlWhitelistEntryResponse(
92
- **url_whitelist_entries_response.dict(),
92
+ **url_whitelist_entries_response.model_dump(),
93
)
94
logger.info(
95
f"Url whitelist entries collected: {url_whitelist_entries_response.url_whitelist_entries}",
117
detail="Failed to collect event notifications",
118
)
119
event_notifications_response = GraylogEventNotificationsResponse(
120
- **event_notifications_response.dict(),
120
+ **event_notifications_response.model_dump(),
121
)
122
logger.info(
123
f"Event notifications collected: {event_notifications_response.event_notifications}",
144
detail="Failed to collect url whitelist entries",
145
)
146
url_whitelist_entries_response = UrlWhitelistEntryResponse(
147
- **url_whitelist_entries_response.dict(),
147
+ **url_whitelist_entries_response.model_dump(),
148
)
149
logger.info(f"Url whitelist entries collected: {url_whitelist_entries_response}")
150
url_whitelist_entries = url_whitelist_entries_response.url_whitelist_entries.entries
167
Returns:
168
bool: True if the webhook URL was provisioned successfully, False otherwise.
169
"""
170
- logger.info(f"Provisioning URL Whitelist: {whitelist_url_model.dict()}")
170
+ logger.info(f"Provisioning URL Whitelist: {whitelist_url_model.model_dump()}")
171
response = await send_put_request(
172
endpoint="/api/system/urlwhitelist",
173
- data=whitelist_url_model.dict(),
173
+ data=whitelist_url_model.model_dump(),
174
)
175
logger.info(f"URL Whitelist provisioned: {response}")
176
if response["success"]:
195
detail="Failed to collect event notifications",
196
)
197
event_notifications_response = GraylogEventNotificationsResponse(
198
- **event_notifications_response.dict(),
198
+ **event_notifications_response.model_dump(),
199
)
200
logger.info(
201
f"Event notifications collected: {event_notifications_response.event_notifications}",
221
"""
222
response = await send_post_request(
223
endpoint="/api/events/notifications",
224
- data=webhook_model.dict(),
224
+ data=webhook_model.model_dump(),
225
)
226
if response["success"]:
227
logger.info(f"response: {response}")
251
252
response = await send_post_request(
253
endpoint="/api/events/definitions",
254
- data=alert_definition_model.dict(),
254
+ data=alert_definition_model.model_dump(),
255
)
256
logger.info(f"Graylog alert definition provisioned response: {response}")
257
if response["success"]:
270
"""
271
#
272
logger.info(
273
- f"Invoking provision_wazuh_monitoring_alert with request: {request.dict()}",
273
+ f"Invoking provision_wazuh_monitoring_alert with request: {request.model_dump()}",
274
)
275
# ! TODO Commenting out for now since the plan is to pull from gl-events ! #
276
# notification_exists = await check_if_event_notification_exists("SEND TO COPILOT")
400
"""
401
#
402
logger.info(
403
- f"Invoking provision_suricata_monitoring_alert with request: {request.dict()}",
403
+ f"Invoking provision_suricata_monitoring_alert with request: {request.model_dump()}",
404
)
405
await provision_alert_definition(
406
GraylogAlertProvisionModel(
493
"""
494
#
495
logger.info(
496
- f"Invoking provision_office365_exchange_online_alert with request: {request.dict()}",
496
+ f"Invoking provision_office365_exchange_online_alert with request: {request.model_dump()}",
497
)
498
await provision_alert_definition(
499
GraylogAlertProvisionModel(
586
"""
587
#
588
logger.info(
589
- f"Invoking provision_office365_threat_intel_alert with request: {request.dict()}",
589
+ f"Invoking provision_office365_threat_intel_alert with request: {request.model_dump()}",
590
)
591
await provision_alert_definition(
592
GraylogAlertProvisionModel(
679
"""
680
#
681
logger.info(
682
- f"Invoking provision_crowdstrike_monitoring_alert with request: {request.dict()}",
682
+ f"Invoking provision_crowdstrike_monitoring_alert with request: {request.model_dump()}",
683
)
684
await provision_alert_definition(
685
GraylogAlertProvisionModel(
772
"""
773
#
774
logger.info(
775
- f"Invoking provision_fortinet_system_monitoring_alert with request: {request.dict()}",
775
+ f"Invoking provision_fortinet_system_monitoring_alert with request: {request.model_dump()}",
776
)
777
await provision_alert_definition(
778
GraylogAlertProvisionModel(
865
"""
866
#
867
logger.info(
868
- f"Invoking provision_fortinet_utm_monitoring_alert with request: {request.dict()}",
868
+ f"Invoking provision_fortinet_utm_monitoring_alert with request: {request.model_dump()}",
869
)
870
await provision_alert_definition(
871
GraylogAlertProvisionModel(
955
"""
956
logger.info(
957
"Invoking provision_fortinet_fortiweb_path_traversal_vulnerability_exploitation_attempt_monitoring_alert "
958
- f"with request: {request.dict()}",
958
+ f"with request: {request.model_dump()}",
959
)
960
await provision_alert_definition(
961
GraylogAlertProvisionModel(
1013
"""
1014
logger.info(
1015
"Invoking provision_fortinet_wids_wireless_valid_client_misassociation_detected_monitoring_alert "
1016
- f"with request: {request.dict()}",
1016
+ f"with request: {request.model_dump()}",
1017
)
1018
await provision_alert_definition(
1019
GraylogAlertProvisionModel(
1070
Provisions Fortinet WIDS Wireless Management Flooding Detected monitoring alert.
1071
"""
1072
logger.info(
1073
- "Invoking provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert " f"with request: {request.dict()}",
1073
+ "Invoking provision_fortinet_wids_wireless_management_flooding_detected_monitoring_alert " f"with request: {request.model_dump()}",
1074
)
1075
await provision_alert_definition(
1076
GraylogAlertProvisionModel(
1127
Provisions Fortinet WIDS Wireless EAPOL Packet Flooding Detected monitoring alert.
1128
"""
1129
logger.info(
1130
- "Invoking provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert " f"with request: {request.dict()}",
1130
+ "Invoking provision_fortinet_wids_wireless_eapol_packet_flooding_detected_monitoring_alert " f"with request: {request.model_dump()}",
1131
)
1132
await provision_alert_definition(
1133
GraylogAlertProvisionModel(
1184
Provisions Fortinet WIDS Rogue Access Point Detected monitoring alert.
1185
"""
1186
logger.info(
1187
- "Invoking provision_fortinet_wids_rogue_access_point_detected_monitoring_alert " f"with request: {request.dict()}",
1187
+ "Invoking provision_fortinet_wids_rogue_access_point_detected_monitoring_alert " f"with request: {request.model_dump()}",
1188
)
1189
await provision_alert_definition(
1190
GraylogAlertProvisionModel(
1241
Provisions Fortinet WIDS Wireless Long Duration Attack Detected monitoring alert.
1242
"""
1243
logger.info(
1244
- "Invoking provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert " f"with request: {request.dict()}",
1244
+ "Invoking provision_fortinet_wids_wireless_long_duration_attack_detected_monitoring_alert " f"with request: {request.model_dump()}",
1245
)
1246
await provision_alert_definition(
1247
GraylogAlertProvisionModel(
1298
Provisions Fortinet Firewall Virus Detected monitoring alert.
1299
"""
1300
logger.info(
1301
- "Invoking provision_fortinet_firewall_virus_detected_monitoring_alert " f"with request: {request.dict()}",
1301
+ "Invoking provision_fortinet_firewall_virus_detected_monitoring_alert " f"with request: {request.model_dump()}",
1302
)
1303
await provision_alert_definition(
1304
GraylogAlertProvisionModel(
1355
Provisions Fortinet WIDS Wireless Threat Detected monitoring alert.
1356
"""
1357
logger.info(
1358
- "Invoking provision_fortinet_wids_wireless_threat_detected_monitoring_alert " f"with request: {request.dict()}",
1358
+ "Invoking provision_fortinet_wids_wireless_threat_detected_monitoring_alert " f"with request: {request.model_dump()}",
1359
)
1360
await provision_alert_definition(
1361
GraylogAlertProvisionModel(
1412
Provisions Fortinet WIDS Wireless Invalid MAC OUI Detected monitoring alert.
1413
"""
1414
logger.info(
1415
- "Invoking provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert " f"with request: {request.dict()}",
1415
+ "Invoking provision_fortinet_wids_wireless_invalid_mac_oui_detected_monitoring_alert " f"with request: {request.model_dump()}",
1416
)
1417
await provision_alert_definition(
1418
GraylogAlertProvisionModel(
1469
Provisions Fortinet WIDS Wireless Asleap Attack Detected monitoring alert.
1470
"""
1471
logger.info(
1472
- "Invoking provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert " f"with request: {request.dict()}",
1472
+ "Invoking provision_fortinet_wids_wireless_asleap_attack_detected_monitoring_alert " f"with request: {request.model_dump()}",
1473
)
1474
await provision_alert_definition(
1475
GraylogAlertProvisionModel(
1526
Provisions Fortinet IPS Malicious URL Detected monitoring alert.
1527
"""
1528
logger.info(
1529
- "Invoking provision_fortinet_ips_malicious_url_detected_monitoring_alert " f"with request: {request.dict()}",
1529
+ "Invoking provision_fortinet_ips_malicious_url_detected_monitoring_alert " f"with request: {request.model_dump()}",
1530
)
1531
await provision_alert_definition(
1532
GraylogAlertProvisionModel(
1583
Provisions Fortinet IPS Botnet Activity Detected monitoring alert.
1584
"""
1585
logger.info(
1586
- "Invoking provision_fortinet_ips_botnet_activity_detected_monitoring_alert " f"with request: {request.dict()}",
1586
+ "Invoking provision_fortinet_ips_botnet_activity_detected_monitoring_alert " f"with request: {request.model_dump()}",
1587
)
1588
await provision_alert_definition(
1589
GraylogAlertProvisionModel(
1640
Provisions Fortinet Admin User Created from Public IP monitoring alert.
1641
"""
1642
logger.info(
1643
- "Invoking provision_fortinet_admin_user_created_from_public_ip_monitoring_alert " f"with request: {request.dict()}",
1643
+ "Invoking provision_fortinet_admin_user_created_from_public_ip_monitoring_alert " f"with request: {request.model_dump()}",
1644
)
1645
await provision_alert_definition(
1646
GraylogAlertProvisionModel(
1698
"""
1699
logger.info(
1700
"Invoking provision_fortinet_suspicious_config_file_access_from_external_network_monitoring_alert "
1701
- f"with request: {request.dict()}",
1701
+ f"with request: {request.model_dump()}",
1702
)
1703
await provision_alert_definition(
1704
GraylogAlertProvisionModel(
1755
Provisions Fortinet WIDS Wireless Weak Encryption Detected monitoring alert.
1756
"""
1757
logger.info(
1758
- "Invoking provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert " f"with request: {request.dict()}",
1758
+ "Invoking provision_fortinet_wids_wireless_weak_encryption_detected_monitoring_alert " f"with request: {request.model_dump()}",
1759
)
1760
await provision_alert_definition(
1761
GraylogAlertProvisionModel(
1812
Provisions Fortinet Suspicious Super Admin Login Detected monitoring alert.
1813
"""
1814
logger.info(
1815
- "Invoking provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert " f"with request: {request.dict()}",
1815
+ "Invoking provision_fortinet_suspicious_super_admin_login_detected_monitoring_alert " f"with request: {request.model_dump()}",
1816
)
1817
await provision_alert_definition(
1818
GraylogAlertProvisionModel(
1874
"""
1875
#
1876
logger.info(
1877
- f"Invoking provision_paloalto_monitoring_alert with request: {request.dict()}",
1877
+ f"Invoking provision_paloalto_monitoring_alert with request: {request.model_dump()}",
1878
)
1879
await provision_alert_definition(
1880
GraylogAlertProvisionModel(
1963
Provisions PaloAlto Firewall Traffic to Phishing URL Allowed monitoring alert.
1964
"""
1965
logger.info(
1966
- "Invoking provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert " f"with request: {request.dict()}",
1966
+ "Invoking provision_paloalto_firewall_traffic_to_phishing_url_allowed_monitoring_alert " f"with request: {request.model_dump()}",
1967
)
1968
await provision_alert_definition(
1969
GraylogAlertProvisionModel(
2035
Provisions PaloAlto Firewall Traffic to Malicious URL Allowed monitoring alert.
2036
"""
2037
logger.info(
2038
- "Invoking provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert " f"with request: {request.dict()}",
2038
+ "Invoking provision_paloalto_firewall_traffic_to_malicious_url_allowed_monitoring_alert " f"with request: {request.model_dump()}",
2039
)
2040
await provision_alert_definition(
2041
GraylogAlertProvisionModel(
2108
Provisions PaloAlto Firewall Virus Allowed monitoring alert.
2109
"""
2110
logger.info(
2111
- "Invoking provision_paloalto_firewall_virus_allowed_monitoring_alert " f"with request: {request.dict()}",
2111
+ "Invoking provision_paloalto_firewall_virus_allowed_monitoring_alert " f"with request: {request.model_dump()}",
2112
)
2113
await provision_alert_definition(
2114
GraylogAlertProvisionModel(
2179
Provisions PaloAlto Firewall TOR Traffic Allowed monitoring alert.
2180
"""
2181
logger.info(
2182
- "Invoking provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert " f"with request: {request.dict()}",
2182
+ "Invoking provision_paloalto_firewall_tor_traffic_allowed_monitoring_alert " f"with request: {request.model_dump()}",
2183
)
2184
await provision_alert_definition(
2185
GraylogAlertProvisionModel(
2247
"""
2248
logger.info(
2249
"Invoking provision_paloalto_firewall_medium_severity_correlation_event_detected_monitoring_alert "
2250
- f"with request: {request.dict()}",
2250
+ f"with request: {request.model_dump()}",
2251
)
2252
await provision_alert_definition(
2253
GraylogAlertProvisionModel(
2318
Provisions SentinelOne: New Active Threat Malicious Detected.
2319
"""
2320
logger.info(
2321
- "Invoking provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert " f"with request: {request.dict()}",
2321
+ "Invoking provision_sentinelone_new_active_threat_malicious_detected_monitoring_alert " f"with request: {request.model_dump()}",
2322
)
2323
await provision_alert_definition(
2324
GraylogAlertProvisionModel(
2375
Provisions SentinelOne: New Active Threat Suspicious Detected.
2376
"""
2377
logger.info(
2378
- "Invoking provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert " f"with request: {request.dict()}",
2378
+ "Invoking provision_sentinelone_new_active_threat_suspicious_detected_monitoring_alert " f"with request: {request.model_dump()}",
2379
)
2380
await provision_alert_definition(
2381
GraylogAlertProvisionModel(
2432
Provisions SentinelOne: New Mitigation, Kill performed successfully.
2433
"""
2434
logger.info(
2435
- "Invoking provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert " f"with request: {request.dict()}",
2435
+ "Invoking provision_sentinelone_new_mitigation_kill_performed_successfully_monitoring_alert " f"with request: {request.model_dump()}",
2436
)
2437
await provision_alert_definition(
2438
GraylogAlertProvisionModel(
2490
"""
2491
logger.info(
2492
"Invoking provision_sentinelone_new_mitigation_quarantine_performed_successfully_monitoring_alert "
2493
- f"with request: {request.dict()}",
2493
+ f"with request: {request.model_dump()}",
2494
)
2495
await provision_alert_definition(
2496
GraylogAlertProvisionModel(
2547
Provisions SentinelOne: New Exclusion was added/modified by user.
2548
"""
2549
logger.info(
2550
- "Invoking provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert " f"with request: {request.dict()}",
2550
+ "Invoking provision_sentinelone_new_exclusion_was_added_or_modified_by_user_monitoring_alert " f"with request: {request.model_dump()}",
2551
)
2552
await provision_alert_definition(
2553
GraylogAlertProvisionModel(
2604
Provisions SentinelOne: New Path Exclusion added.
2605
"""
2606
logger.info(
2607
- "Invoking provision_sentinelone_new_path_exclusion_added_monitoring_alert " f"with request: {request.dict()}",
2607
+ "Invoking provision_sentinelone_new_path_exclusion_added_monitoring_alert " f"with request: {request.model_dump()}",
2608
)
2609
await provision_alert_definition(
2610
GraylogAlertProvisionModel(
2661
Provisions SentinelOne: Analyst verdict changed to True Positive.
2662
"""
2663
logger.info(
2664
- "Invoking provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert " f"with request: {request.dict()}",
2664
+ "Invoking provision_sentinelone_analyst_verdict_changed_to_true_positive_monitoring_alert " f"with request: {request.model_dump()}",
2665
)
2666
await provision_alert_definition(
2667
GraylogAlertProvisionModel(
2718
Provisions SentinelOne: Analyst verdict changed to False Positive.
2719
"""
2720
logger.info(
2721
- "Invoking provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert " f"with request: {request.dict()}",
2721
+ "Invoking provision_sentinelone_analyst_verdict_changed_to_false_positive_monitoring_alert " f"with request: {request.model_dump()}",
2722
)
2723
await provision_alert_definition(
2724
GraylogAlertProvisionModel(
2776
Provisions Mimecast Compromised Site URL Accessed monitoring alert.
2777
"""
2778
logger.info(
2779
- "Invoking provision_mimecast_compromised_site_url_accessed_monitoring_alert " f"with request: {request.dict()}",
2779
+ "Invoking provision_mimecast_compromised_site_url_accessed_monitoring_alert " f"with request: {request.model_dump()}",
2780
)
2781
await provision_alert_definition(
2782
GraylogAlertProvisionModel(
2833
Provisions Mimecast Executable File Attachment Delivered monitoring alert.
2834
"""
2835
logger.info(
2836
- "Invoking provision_mimecast_executable_file_attachment_delivered_monitoring_alert " f"with request: {request.dict()}",
2836
+ "Invoking provision_mimecast_executable_file_attachment_delivered_monitoring_alert " f"with request: {request.model_dump()}",
2837
)
2838
await provision_alert_definition(
2839
GraylogAlertProvisionModel(
2890
Provisions Mimecast Malicious Email Attachment Delivered monitoring alert.
2891
"""
2892
logger.info(
2893
- "Invoking provision_mimecast_malicious_email_attachment_delivered_monitoring_alert " f"with request: {request.dict()}",
2893
+ "Invoking provision_mimecast_malicious_email_attachment_delivered_monitoring_alert " f"with request: {request.model_dump()}",
2894
)
2895
await provision_alert_definition(
2896
GraylogAlertProvisionModel(
2947
Provisions Mimecast Malicious Email Link Accessed monitoring alert.
2948
"""
2949
logger.info(
2950
- "Invoking provision_mimecast_malicious_email_link_accessed_monitoring_alert " f"with request: {request.dict()}",
2950
+ "Invoking provision_mimecast_malicious_email_link_accessed_monitoring_alert " f"with request: {request.model_dump()}",
2951
)
2952
await provision_alert_definition(
2953
GraylogAlertProvisionModel(
3004
Provisions Mimecast P2P File Sharing URL Accessed monitoring alert.
3005
"""
3006
logger.info(
3007
- "Invoking provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert " f"with request: {request.dict()}",
3007
+ "Invoking provision_mimecast_p2p_file_sharing_url_accessed_monitoring_alert " f"with request: {request.model_dump()}",
3008
)
3009
await provision_alert_definition(
3010
GraylogAlertProvisionModel(
3061
Provisions Mimecast Anonymizer URL Accessed monitoring alert.
3062
"""
3063
logger.info(
3064
- "Invoking provision_mimecast_anonymizer_url_accessed_monitoring_alert " f"with request: {request.dict()}",
3064
+ "Invoking provision_mimecast_anonymizer_url_accessed_monitoring_alert " f"with request: {request.model_dump()}",
3065
)
3066
await provision_alert_definition(
3067
GraylogAlertProvisionModel(
3118
Provisions Mimecast Impersonation Email Delivered monitoring alert.
3119
"""
3120
logger.info(
3121
- "Invoking provision_mimecast_impersonation_email_delivered_monitoring_alert " f"with request: {request.dict()}",
3121
+ "Invoking provision_mimecast_impersonation_email_delivered_monitoring_alert " f"with request: {request.model_dump()}",
3122
)
3123
await provision_alert_definition(
3124
GraylogAlertProvisionModel(
3175
Provisions Mimecast Malicious Outbound Email monitoring alert.
3176
"""
3177
logger.info(
3178
- "Invoking provision_mimecast_malicious_outbound_email_monitoring_alert " f"with request: {request.dict()}",
3178
+ "Invoking provision_mimecast_malicious_outbound_email_monitoring_alert " f"with request: {request.model_dump()}",
3179
)
3180
await provision_alert_definition(
3181
GraylogAlertProvisionModel(
3232
Provisions Mimecast Malicious RTF Attachment Delivered monitoring alert.
3233
"""
3234
logger.info(
3235
- "Invoking provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert " f"with request: {request.dict()}",
3235
+ "Invoking provision_mimecast_malicious_rtf_attachment_delivered_monitoring_alert " f"with request: {request.model_dump()}",
3236
)
3237
await provision_alert_definition(
3238
GraylogAlertProvisionModel(
3289
Provisions Mimecast Phishing Email Delivered monitoring alert.
3290
"""
3291
logger.info(
3292
- "Invoking provision_mimecast_phishing_email_delivered_monitoring_alert " f"with request: {request.dict()}",
3292
+ "Invoking provision_mimecast_phishing_email_delivered_monitoring_alert " f"with request: {request.model_dump()}",
3293
)
3294
await provision_alert_definition(
3295
GraylogAlertProvisionModel(
3346
Provisions Mimecast Source Code File In Email Attachment monitoring alert.
3347
"""
3348
logger.info(
3349
- "Invoking provision_mimecast_source_code_file_in_email_attachment_monitoring_alert " f"with request: {request.dict()}",
3349
+ "Invoking provision_mimecast_source_code_file_in_email_attachment_monitoring_alert " f"with request: {request.model_dump()}",
3350
)
3351
await provision_alert_definition(
3352
GraylogAlertProvisionModel(
3403
Provisions Mimecast URL with Dangerous File Type Accessed monitoring alert.
3404
"""
3405
logger.info(
3406
- "Invoking provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert " f"with request: {request.dict()}",
3406
+ "Invoking provision_mimecast_url_with_dangerous_file_type_accessed_monitoring_alert " f"with request: {request.model_dump()}",
3407
)
3408
await provision_alert_definition(
3409
GraylogAlertProvisionModel(
3462
"""
3463
#
3464
logger.info(
3465
- f"Invoking provision_custom_alert with request: {request.dict()}",
3465
+ f"Invoking provision_custom_alert with request: {request.model_dump()}",
3466
)
3467
await provision_alert_definition(
3468
GraylogAlertProvisionModel(