bookmark alerts
Taylor committed
Jul 19, 2023 at 13:20 UTC
c9e98f7886fee56c227e07b8edb245b39a598c88
3 files changed
+270
backend/app/routes/dfir_iris.py
+45
@@ -106,6 +106,51 @@ def get_alerts():
106
return alerts
107
108
109
+@bp.route("/dfir_iris/alerts/bookmark/<alert_id>", methods=["POST"])
110
+def bookmark_alert(alert_id: str):
111
+ """
112
+ Handle POST requests at the "/alerts/<alert_id>/bookmark" endpoint. Bookmark an alert in DFIR IRIS.
113
+
114
+ Args:
115
+ alert_id (str): The ID of the alert to bookmark.
116
+
117
+ Returns:
118
+ Response: A Flask Response object carrying a JSON representation of the result of the bookmark operation.
119
+ """
120
+ service = IRISAlertsService()
121
+ bookmarked_alert = service.bookmark_alert(alert_id=alert_id)
122
+ return bookmarked_alert
123
+
124
+
125
+@bp.route("/dfir_iris/alerts/unbookmark/<alert_id>", methods=["POST"])
126
+def unbookmark_alert(alert_id: str):
127
+ """
128
+ Handle POST requests at the "/alerts/<alert_id>/unbookmark" endpoint. Unbookmark an alert in DFIR IRIS.
129
+
130
+ Args:
131
+ alert_id (str): The ID of the alert to unbookmark.
132
+
133
+ Returns:
134
+ Response: A Flask Response object carrying a JSON representation of the result of the unbookmark operation.
135
+ """
136
+ service = IRISAlertsService()
137
+ unbookmarked_alert = service.unbookmark_alert(alert_id=alert_id)
138
+ return unbookmarked_alert
139
+
140
+
141
+@bp.route("/dfir_iris/alerts/bookmarked", methods=["GET"])
142
+def get_bookmarked_alerts():
143
+ """
144
+ Handle GET requests at the "/alerts/bookmarked" endpoint. Retrieve all bookmarked alerts from DFIR IRIS.
145
+
146
+ Returns:
147
+ Response: A Flask Response object carrying a JSON representation of the list of bookmarked alerts.
148
+ """
149
+ service = IRISAlertsService()
150
+ alerts = service.list_bookmarked_alerts()
151
+ return alerts
152
+
153
+
154
@bp.route("/dfir_iris/users", methods=["GET"])
155
def get_users():
156
"""
backend/app/services/DFIR_IRIS/alerts.py
+92
@@ -102,6 +102,98 @@ class IRISAlertsService:
102
"results": result["data"],
103
}
104
105
+ def bookmark_alert(self, alert_id: str) -> Dict[str, Any]:
106
+ """
107
+ Bookmark an alert in DFIR-IRIS.
108
+
109
+ Parameters
110
+ ----------
111
+ alert_id : str
112
+ The ID of the alert to bookmark.
113
+
114
+ Returns
115
+ -------
116
+ Dict[str, Any]
117
+ The result of the bookmark operation. Contains information on whether the bookmark operation was successful,
118
+ an associated message, and the resulting data.
119
+ """
120
+ alert = Alert(session=self.iris_session)
121
+ result = self.universal_service.fetch_and_parse_data(
122
+ self.iris_session,
123
+ alert.update_alert,
124
+ alert_id,
125
+ {"alert_tags": "bookmarked"},
126
+ )
127
+
128
+ if not result["success"]:
129
+ return {
130
+ "success": False,
131
+ "message": "Failed to bookmark alert in DFIR-IRIS",
132
+ }
133
+
134
+ return {
135
+ "success": True,
136
+ "message": "Successfully bookmarked alert in DFIR-IRIS",
137
+ "results": result["data"],
138
+ }
139
+
140
+ def unbookmark_alert(self, alert_id: str) -> Dict[str, Any]:
141
+ """
142
+ Unbookmark an alert in DFIR-IRIS.
143
+
144
+ Parameters
145
+ ----------
146
+ alert_id : str
147
+ The ID of the alert to unbookmark.
148
+
149
+ Returns
150
+ -------
151
+ Dict[str, Any]
152
+ The result of the unbookmark operation. Contains information on whether the unbookmark operation was successful,
153
+ an associated message, and the resulting data.
154
+ """
155
+ alert = Alert(session=self.iris_session)
156
+ result = self.universal_service.fetch_and_parse_data(
157
+ self.iris_session,
158
+ alert.update_alert,
159
+ alert_id,
160
+ {"alert_tags": ""},
161
+ )
162
+
163
+ if not result["success"]:
164
+ return {
165
+ "success": False,
166
+ "message": "Failed to unbookmark alert in DFIR-IRIS",
167
+ }
168
+
169
+ return {
170
+ "success": True,
171
+ "message": "Successfully unbookmarked alert in DFIR-IRIS",
172
+ "results": result["data"],
173
+ }
174
+
175
+ def list_bookmarked_alerts(self) -> Dict[str, Any]:
176
+ """
177
+ List all bookmarked alerts from DFIR-IRIS.
178
+
179
+ Returns
180
+ -------
181
+ Dict[str, Any]
182
+ The result of the bookmarked alerts listing. Contains information on whether the listing was successful,
183
+ an associated message, and the resulting data.
184
+ """
185
+ alerts = self.list_alerts()["results"]["alerts"]
186
+ # Loop thorugh the alerts and collect ones where `alert_tags` contains `bookmarked`
187
+ bookmarked_alerts = []
188
+ for alert in alerts:
189
+ if alert["alert_tags"] is not None and "bookmarked" in alert["alert_tags"]:
190
+ bookmarked_alerts.append(alert)
191
+ return {
192
+ "success": True,
193
+ "message": "Successfully collected bookmarked alerts from DFIR-IRIS",
194
+ "bookmarked_alerts": bookmarked_alerts,
195
+ }
196
+
197
def create_alert_general(self, alert_data: Dict[str, Any], alert_id: str, index: str) -> Dict[str, Any]:
198
"""
199
Create an alert within DFIR-IRIS with the provided data.
backend/app/static/swagger.json
+133
@@ -2448,6 +2448,139 @@
2448
"tags": ["DFIR Iris"]
2449
}
2450
},
2451
+ "/dfir_iris/alerts/bookmark/{alert_id}": {
2452
+ "post": {
2453
+ "summary": "Assign a bookmark to an alert which adds it as an alert tag",
2454
+ "description": "Assign a bookmark to an alert which adds it as an alert tag.",
2455
+ "parameters": [
2456
+ {
2457
+ "name": "alert_id",
2458
+ "in": "path",
2459
+ "description": "ID of the alert to bookmark.",
2460
+ "required": true,
2461
+ "schema": {
2462
+ "type": "string"
2463
+ }
2464
+ }
2465
+ ],
2466
+ "responses": {
2467
+ "200": {
2468
+ "description": "Successful operation",
2469
+ "content": {
2470
+ "application/json": {
2471
+ "schema": {
2472
+ "type": "object",
2473
+ "properties": {
2474
+ "output": {
2475
+ "type": "string",
2476
+ "description": "The output of the command."
2477
+ }
2478
+ }
2479
+ }
2480
+ }
2481
+ }
2482
+ },
2483
+ "default": {
2484
+ "description": "Unexpected error",
2485
+ "content": {
2486
+ "application/json": {
2487
+ "schema": {
2488
+ "$ref": "#/components/schemas/Error"
2489
+ }
2490
+ }
2491
+ }
2492
+ }
2493
+ },
2494
+ "operationId": "assignUserToAlert",
2495
+ "tags": ["DFIR Iris"]
2496
+ }
2497
+ },
2498
+ "/dfir_iris/alerts/unbookmark/{alert_id}": {
2499
+ "post": {
2500
+ "summary": "Unbookmark an alert",
2501
+ "description": "Unbookmark an alert.",
2502
+ "parameters": [
2503
+ {
2504
+ "name": "alert_id",
2505
+ "in": "path",
2506
+ "description": "ID of the alert to unbookmark.",
2507
+ "required": true,
2508
+ "schema": {
2509
+ "type": "string"
2510
+ }
2511
+ }
2512
+ ],
2513
+ "responses": {
2514
+ "200": {
2515
+ "description": "Successful operation",
2516
+ "content": {
2517
+ "application/json": {
2518
+ "schema": {
2519
+ "type": "object",
2520
+ "properties": {
2521
+ "output": {
2522
+ "type": "string",
2523
+ "description": "The output of the command."
2524
+ }
2525
+ }
2526
+ }
2527
+ }
2528
+ }
2529
+ },
2530
+ "default": {
2531
+ "description": "Unexpected error",
2532
+ "content": {
2533
+ "application/json": {
2534
+ "schema": {
2535
+ "$ref": "#/components/schemas/Error"
2536
+ }
2537
+ }
2538
+ }
2539
+ }
2540
+ },
2541
+ "operationId": "unbookmarkAlert",
2542
+ "tags": ["DFIR Iris"]
2543
+ }
2544
+ },
2545
+ "/dfir_iris/alerts/bookmarked": {
2546
+ "get": {
2547
+ "summary": "Get all bookmarked alerts",
2548
+ "description": "Endpoint to get all bookmarked alerts.",
2549
+ "responses": {
2550
+ "200": {
2551
+ "description": "Successful operation",
2552
+ "content": {
2553
+ "application/json": {
2554
+ "schema": {
2555
+ "type": "object",
2556
+ "properties": {
2557
+ "alerts": {
2558
+ "type": "array",
2559
+ "items": {
2560
+ "type": "object",
2561
+ "description": "Alert details"
2562
+ }
2563
+ }
2564
+ }
2565
+ }
2566
+ }
2567
+ }
2568
+ },
2569
+ "default": {
2570
+ "description": "Unexpected error",
2571
+ "content": {
2572
+ "application/json": {
2573
+ "schema": {
2574
+ "$ref": "#/components/schemas/Error"
2575
+ }
2576
+ }
2577
+ }
2578
+ }
2579
+ },
2580
+ "operationId": "getAllBookmarkedAlerts",
2581
+ "tags": ["DFIR Iris"]
2582
+ }
2583
+ },
2584
"/dfir_iris/users": {
2585
"get": {
2586
"summary": "Get all users",