@cryptotaxi247 / CoPilot / commits / ccdb0530

Cleanup (#279)

* feat: Add alert title payload to handle_customer_notifications function * feat: Update branch name in Docker workflow The code changes update the branch name in the Docker workflow file from "incident-management" to "cleanup". This change ensures that the workflow is triggered only when changes are pushed to the "cleanup" branch. * feat: Add processed value for CustomerCodeKeys.CLUSTER_NODE in get_customer_code This commit adds a processed value for the CustomerCodeKeys.CLUSTER_NODE key in the get_customer_code function of incident_alert.py. The processed value is obtained by calling the get_processed_value method of the CustomerCodeKeys enum. This change ensures that the processed value is returned when the key is CLUSTER_NODE. Recent user commits: - Update branch name in Docker workflow - Add alert title payload to handle_customer_notifications function Recent repository commits: - feat: Update branch name in Docker workflow - feat: Add alert title payload to handle_customer_notifications function * feat: Remove unnecessary code for deleting DFIR-IRIS customer The code changes in the `decommission_wazuh_customer` function of `decommission.py` remove the unnecessary code for deleting the DFIR-IRIS customer. * feat: Add processed value for CustomerCodeKeys.CLUSTER_NODE in get_customer_code * try exception for if graylog index events is blocked for writing * cleanup unused connectors allow for `get_connector_attribute` function to use connector_name * add sigma api/types * update dependencies * add code highlighter component * improve badge component * update sigma types * add sigma components * add incident/sigma page * refactor code components * remove unused files * remove webhook notification when creating graylog alert * chore: Add order asc|desc parameter to list_alerts_endpoint * chore: Add order parameter to listing of alert filter endpoints * chore: Remove unused environment variables * update SOCFORTRESS_WAZUH_CONTENT_PACK * update wazuh content pack * chore: Add endpoint to fetch alerts for a specific agent * update incident/alerts lists page added sort * chore: Update agent routes to fetch cases by asset name * removed alerts by agents route * update index.html file * improve incident/cases api * update incident cases components * update agent cases tab * chore: Skip decommissioning if Wazuh Worker Provisioning connector is not verified * chore: Decommission HAProxy worker during customer decommissioning * test of disabling wazuh_monitoring_alert * disable wazuh_monitoring_alert in scheduler * chore: Remove DFIR-IRIS connector service * chore: Add logging for Wazuh Worker response and status code * chore: Refactor provision.py for better logging and error handling * update incident alerts list component * update agent alerts tab * update sigma api * refactor upload components * chore: Update agent vulnerabilities CSV export endpoint to include EPSS score * feat: Add endpoint to export agent sca results as CSV * updated all sigma rules components * update dependencies * fix CodeSource component * prettify * chore: Fix formatting issue in file collection parameters * chore: Update Docker image tags for backend and frontend * chore: Update branch name in Docker workflow * precommit fixes --------- Co-authored-by: Davide Di Modica <webmaster.ddm@gmail.com>

taylor_socfortress committed Sep 2, 2024 at 11:14 UTC ccdb0530dcbbca79ba582b5cd3edbb6df398b70f

117 files changed +3027 -17085

.env.example

+1 -12

@@ -8,6 +8,7 @@ MYSQL_PASSWORD=REPLACE_WITH_PASSWORD

9 # ! ALERT FORWARDING IP

10 # Set this to the IP of the host running CoPilot. This is used by Graylog to forward alerts to CoPilot

11 +# ! Not needed anymore since we are reading from the index now

12 # ! Ensure Graylog is able to reach this IP and port 5000

13 ALERT_FORWARDING_IP=0.0.0.0

@@ -29,9 +30,6 @@ SHUFFLE_URL=https://127.1.1.1

30 SHUFFLER_API_KEY=dummy

31 SHUFFLE_WORKFLOW_ID=dummy

32 -DFIR_IRIS_URL=https://127.1.1.1

33 -DFIR_IRIS_API_KEY=dummy

34 -

33 VELOCIRAPTOR_URL=https://127.1.1.1

34 VELOCIRAPTOR_API_KEY_PATH=dummy

@@ -42,15 +40,6 @@ INFLUXDB_URL=http://127.1.1.1

40 INFLUXDB_API_KEY=dummy

41 INFLUXDB_ORG_AND_BUCKET=dummy,dummy

45 -ASKSOCFORTRESS_URL=https://knowledge.socfortress.co

46 -ASKSOCFORTRESS_API_KEY=dummy

47 -

48 -SOCFORTRESSTHREATINTEL_URL=https://intel.socfortress.co/search

49 -SOCFORTRESSTHREATINTEL_API_KEY=dummy

50 -

51 -CORTEX_URL=http://127.1.1.1

52 -CORTEX_API_KEY=dummy

53 -

43 GRAFANA_URL=http://127.1.1.1

44 GRAFANA_USERNAME=dummy

45 GRAFANA_PASSWORD=dummy

.github/workflows/docker.yml

+15 -15

@@ -2,7 +2,7 @@ name: Docker

3 on:

4 push:

5 - branches: [incident-management]

5 + branches: [main]

7 jobs:

8 build-backend:

@@ -27,16 +27,16 @@ jobs:

27 with:

28 context: ./backend

29 push: true

30 - tags: ghcr.io/socfortress/copilot-backend:lab

30 + tags: ghcr.io/socfortress/copilot-backend:latest

31 build-args: |

32 COPILOT_API_KEY=${{ secrets.COPILOT_API_KEY }}

34 - # - name: Notify Discord

35 - # uses: appleboy/discord-action@v1.0.0

36 - # with:

37 - # webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }}

38 - # webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}

39 - # message: "Docker image for backend has been updated."

34 + - name: Notify Discord

35 + uses: appleboy/discord-action@v1.0.0

36 + with:

37 + webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }}

38 + webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}

39 + message: "Docker image for backend has been updated."

41 build-frontend:

42 runs-on: ubuntu-latest

@@ -60,11 +60,11 @@ jobs:

60 with:

61 context: ./frontend

62 push: true

63 - tags: ghcr.io/socfortress/copilot-frontend:lab

63 + tags: ghcr.io/socfortress/copilot-frontend:latest

65 - # - name: Notify Discord

66 - # uses: appleboy/discord-action@v1.0.0

67 - # with:

68 - # webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }}

69 - # webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}

70 - # message: "Docker image for frontend has been updated."

65 + - name: Notify Discord

66 + uses: appleboy/discord-action@v1.0.0

67 + with:

68 + webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }}

69 + webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}

70 + message: "Docker image for frontend has been updated."

backend/app/agents/dfir_iris/schema/cases.py deleted

-9

@@ -1,9 +0,0 @@

1 -from typing import List

2 -

3 -from pydantic import BaseModel

4 -

5 -

6 -class AssetCaseIDResponse(BaseModel):

7 - message: str

8 - success: bool

9 - case_ids: List[int]

backend/app/agents/dfir_iris/services/cases.py deleted

-71

@@ -1,71 +0,0 @@

1 -from typing import List

2 -

3 -from loguru import logger

4 -from sqlalchemy.ext.asyncio import AsyncSession

5 -

6 -from app.agents.dfir_iris.schema.cases import AssetCaseIDResponse

7 -from app.connectors.dfir_iris.services.assets import get_case_assets

8 -from app.connectors.dfir_iris.services.cases import get_all_cases

9 -

10 -

11 -async def collect_agent_soc_cases(

12 - agent_id: int,

13 - session: AsyncSession,

14 -) -> AssetCaseIDResponse:

15 - """

16 - Get all cases for the given agent ID.

17 -

18 - Args:

19 - agent_id (int): The ID of the agent to get cases for.

20 -

21 - Returns:

22 - AssetCaseIDResponse: An instance of AssetCaseIDResponse containing the cases for the given agent ID.

23 - """

24 - logger.info(f"Getting cases for agent: {agent_id}")

25 - all_cases = await get_all_cases(session=session)

26 - case_ids = await filter_cases_by_agent_id(all_cases, agent_id)

27 -

28 - logger.info(f"Found cases: {case_ids}")

29 - return AssetCaseIDResponse(

30 - case_ids=case_ids,

31 - success=True,

32 - message="Successfully retrieved cases for agent",

33 - )

34 -

35 -

36 -async def filter_cases_by_agent_id(cases, agent_id: int) -> List[int]:

37 - """

38 - Filters cases by the given agent ID and collects all associated case IDs.

39 -

40 - Args:

41 - cases: All available cases.

42 - agent_id (int): Agent ID to filter by.

43 -

44 - Returns:

45 - List[int]: List of case IDs associated with the given agent ID.

46 - """

47 - case_ids = []

48 - for case in cases.cases:

49 - if await is_agent_in_case(case.case_id, agent_id):

50 - case_ids.append(case.case_id)

51 - return case_ids

52 -

53 -

54 -async def is_agent_in_case(case_id: int, agent_id: int) -> bool:

55 - """

56 - Checks if a given agent ID is associated with a case.

57 -

58 - Args:

59 - case_id (int): The case ID to check.

60 - agent_id (int): The agent ID to check.

61 -

62 - Returns:

63 - bool: True if the agent is associated with the case, False otherwise.

64 - """

65 - logger.info(f"Getting assets for case: {case_id}")

66 - assets = await get_case_assets(case_id)

67 - for asset in assets.assets:

68 - if f"agent_id:{agent_id}" in asset.asset_tags:

69 - logger.info(f"Found case with agent: {agent_id} in case: {case_id}")

70 - return True

71 - return False

backend/app/agents/routes/agents.py

+160 -7

@@ -1,4 +1,6 @@

1 import asyncio

2 +import csv

3 +import io

5 # from fastapi import BackgroundTasks

6 from fastapi import APIRouter

@@ -6,13 +8,13 @@ from fastapi import Depends

8 from fastapi import HTTPException

9 from fastapi import Path

10 from fastapi import Security

11 +from fastapi.responses import StreamingResponse

12 from loguru import logger

13 from packaging import version

14 from sqlalchemy import delete

15 from sqlalchemy.ext.asyncio import AsyncSession

16 from sqlalchemy.future import select

15 -from app.agents.dfir_iris.services.cases import collect_agent_soc_cases

18 from app.agents.schema.agents import AgentModifyResponse

19 from app.agents.schema.agents import AgentsResponse

20 from app.agents.schema.agents import AgentWazuhUpgradeResponse

@@ -43,6 +45,10 @@ from app.db.db_session import get_db

45 # App specific imports

46 # from app.db.db_session import session

47 from app.db.universal_models import Agents

48 +from app.incidents.schema.db_operations import CaseOutResponse

49 +from app.incidents.services.db_operations import list_cases_by_asset_name

50 +from app.threat_intel.schema.epss import EpssThreatIntelRequest

51 +from app.threat_intel.services.epss import collect_epss_score

54 async def get_wazuh_manager_version() -> str:

@@ -460,6 +466,84 @@ async def get_agent_vulnerabilities(

466 return await collect_agent_vulnerabilities(agent_id, vulnerability_severity.value)

467

468

469 +@agents_router.get(

470 + "/{agent_id}/csv/vulnerabilities/{vulnerability_severity}",

471 + description="Get agent vulnerabilities as CSV",

472 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

473 +)

474 +async def get_agent_vulnerabilities_csv(agent_id: str, vulnerability_severity: VulnSeverity = Path(...)) -> StreamingResponse:

475 + """

476 + Fetches the vulnerabilities of a specific agent and returns them as a CSV file.

477 +

478 + Args:

479 + agent_id (str): The ID of the agent.

480 +

481 + Returns:

482 + StreamingResponse: The response containing the agent vulnerabilities in CSV format.

483 + """

484 + logger.info(f"Fetching agent {agent_id} vulnerabilities as CSV")

485 + wazuh_new = await check_wazuh_manager_version()

486 + if wazuh_new is True:

487 + logger.info("Wazuh Manager version is 4.8.0 or higher. Fetching vulnerabilities using new API")

488 + vulnerabilities = (

489 + await collect_agent_vulnerabilities_new(agent_id, vulnerability_severity=vulnerability_severity.value)

490 + ).vulnerabilities

491 + else:

492 + vulnerabilities = (

493 + await collect_agent_vulnerabilities(agent_id, vulnerability_severity=vulnerability_severity.value)

494 + ).vulnerabilities

495 + # Create a CSV file

496 + logger.info(f"Creating CSV file for agent {agent_id} with {len(vulnerabilities)} vulnerabilities")

497 + logger.info(f"Vulnerabilities: {vulnerabilities}")

498 + output = io.StringIO()

499 + writer = csv.writer(output)

500 + # Write the header

501 + writer.writerow(

502 + [

503 + "Severity",

504 + "Version",

505 + "Type",

506 + "Name",

507 + "External References",

508 + "Detection Time",

509 + "CVSS3 Score",

510 + "Published",

511 + "Architecture",

512 + "CVE",

513 + "Status",

514 + "Title",

515 + "EPSS Score",

516 + ],

517 + )

518 + # Write the rows

519 + for vulnerability in vulnerabilities:

520 + epss_score = await collect_epss_score(EpssThreatIntelRequest(cve=vulnerability.cve))

521 + writer.writerow(

522 + [

523 + vulnerability.severity,

524 + vulnerability.version,

525 + vulnerability.type,

526 + vulnerability.name,

527 + ", ".join(vulnerability.external_references) if vulnerability.external_references else "",

528 + vulnerability.detection_time,

529 + vulnerability.cvss3_score,

530 + vulnerability.published,

531 + vulnerability.architecture,

532 + vulnerability.cve,

533 + vulnerability.status,

534 + vulnerability.title,

535 + epss_score.data[0].epss if epss_score.data else "",

536 + ],

537 + )

538 + # Return the CSV file as a streaming response

539 + output.seek(0)

540 + return StreamingResponse(

541 + output, # Use the StringIO object directly

542 + media_type="text/csv",

543 + headers={"Content-Disposition": f"attachment; filename={agent_id}_vulnerabilities.csv"},

544 + )

545 +

546 +

547 @agents_router.get(

548 "/{agent_id}/sca",

549 response_model=WazuhAgentScaResponse,

@@ -501,12 +585,77 @@ async def get_agent_sca_policy_results(agent_id: str, policy_id: str) -> WazuhAg

585

586

587 @agents_router.get(

504 - "/{agent_id}/soc_cases",

505 - # response_model=SocCasesResponse,

506 - description="Get SOC cases for agent",

588 + "/{agent_id}/csv/sca/{policy_id}",

589 + description="Get agent sca results as CSV",

590 dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

591 )

509 -async def get_agent_soc_cases(agent_id: str, session: AsyncSession = Depends(get_db)):

592 +async def get_agent_sca_policy_results_csv(agent_id: str, policy_id: str) -> StreamingResponse:

593 + """

594 + Fetches the sca results of a specific agent and returns them as a CSV file.

595 +

596 + Args:

597 + agent_id (str): The ID of the agent.

598 +

599 + Returns:

600 + StreamingResponse: The response containing the agent sca in CSV format.

601 + """

602 + logger.info(f"Fetching agent {agent_id} sca policy results as CSV")

603 + sca_results = (await collect_agent_sca_policy_results(agent_id, policy_id)).sca_policy_results

604 + # Create a CSV file

605 + logger.info(f"Creating CSV file for agent {agent_id} with {len(sca_results)} sca policy results")

606 + output = io.StringIO()

607 + writer = csv.writer(output)

608 + # Write the header

609 + writer.writerow(

610 + [

611 + "Description",

612 + "Policy ID",

613 + "Reason",

614 + "Command",

615 + "Rationale",

616 + "Condition",

617 + "Title",

618 + "Result",

619 + "Remediation",

620 + "Compliance",

621 + "Rules",

622 + ],

623 + )

624 + # Write the rows

625 + for sca_result in sca_results:

626 + writer.writerow(

627 + [

628 + sca_result.description,

629 + sca_result.policy_id,

630 + sca_result.reason,

631 + sca_result.command,

632 + sca_result.rationale,

633 + sca_result.condition,

634 + sca_result.title,

635 + sca_result.result,

636 + sca_result.remediation,

637 + ", ".join([f"{compliance.key}: {compliance.value}" for compliance in sca_result.compliance])

638 + if sca_result.compliance

639 + else "",

640 + ", ".join([f"{rule.type}: {rule.rule}" for rule in sca_result.rules]) if sca_result.rules else "",

641 + ],

642 + )

643 + # Return the CSV file as a streaming response

644 + output.seek(0)

645 + return StreamingResponse(

646 + output, # Use the StringIO object directly

647 + media_type="text/csv",

648 + headers={"Content-Disposition": f"attachment; filename={agent_id}_sca_policy_results.csv"},

649 + )

650 +

651 +

652 +@agents_router.get(

653 + "/{agent_hostname}/cases",

654 + response_model=CaseOutResponse,

655 + description="Get cases for agent",

656 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

657 +)

658 +async def get_agent_soc_cases(agent_hostname: str, session: AsyncSession = Depends(get_db)):

659 """

660 Fetches the SOC cases of a specific agent.

661

@@ -516,8 +665,12 @@ async def get_agent_soc_cases(agent_id: str, session: AsyncSession = Depends(get

665 Returns:

666 SocCasesResponse: The response containing the agent SOC cases.

667 """

519 - logger.info(f"Fetching agent {agent_id} SOC cases")

520 - return await collect_agent_soc_cases(agent_id, session)

668 + logger.info(f"Fetching agent {agent_hostname} cases")

669 + return CaseOutResponse(

670 + cases=await list_cases_by_asset_name(asset_name=agent_hostname, db=session),

671 + success=True,

672 + message="Cases retrieved successfully",

673 + )

674

675

676 @agents_router.get(

backend/app/connectors/dfir_iris/routes/alerts.py deleted

-311

@@ -1,311 +0,0 @@

1 -from fastapi import APIRouter

2 -from fastapi import Depends

3 -from fastapi import HTTPException

4 -from fastapi import Security

5 -from loguru import logger

6 -from sqlalchemy.ext.asyncio import AsyncSession

7 -

8 -from app.auth.utils import AuthHandler

9 -from app.connectors.dfir_iris.schema.alerts import AlertAssetsResponse

10 -from app.connectors.dfir_iris.schema.alerts import AlertResponse

11 -from app.connectors.dfir_iris.schema.alerts import AlertsResponse

12 -from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse

13 -from app.connectors.dfir_iris.schema.alerts import CaseCreationResponse

14 -from app.connectors.dfir_iris.schema.alerts import DeleteAlertResponse

15 -from app.connectors.dfir_iris.schema.alerts import DeleteMultipleAlertsRequest

16 -from app.connectors.dfir_iris.schema.alerts import FilterAlertsRequest

17 -from app.connectors.dfir_iris.schema.alerts import IrisAsset

18 -from app.connectors.dfir_iris.services.alerts import bookmark_alert

19 -from app.connectors.dfir_iris.services.alerts import create_case

20 -from app.connectors.dfir_iris.services.alerts import delete_alert

21 -from app.connectors.dfir_iris.services.alerts import get_alert

22 -from app.connectors.dfir_iris.services.alerts import get_alerts

23 -from app.connectors.dfir_iris.services.alerts import get_bookmarked_alerts

24 -from app.connectors.dfir_iris.utils.universal import check_alert_exists

25 -from app.db.db_session import get_db

26 -

27 -# App specific imports

28 -

29 -

30 -async def verify_alert_exists(alert_id: str) -> str:

31 - """

32 - Verifies if an alert with the given ID exists.

33 -

34 - Args:

35 - alert_id (str): The ID of the alert to verify.

36 -

37 - Returns:

38 - str: The ID of the alert if it exists.

39 -

40 - Raises:

41 - HTTPException: If the alert does not exist.

42 - """

43 - logger.info(f"Verifying alert {alert_id} exists")

44 - if not await check_alert_exists(alert_id):

45 - raise HTTPException(status_code=400, detail=f"Alert {alert_id} does not exist.")

46 - return alert_id

47 -

48 -

49 -dfir_iris_alerts_router = APIRouter()

50 -

51 -

52 -@dfir_iris_alerts_router.get(

53 - "/bookmark",

54 - response_model=BookmarkedAlertsResponse,

55 - description="Get all bookmarked alerts",

56 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

57 -)

58 -async def get_all_bookmarked_alerts(

59 - session: AsyncSession = Depends(get_db),

60 -) -> BookmarkedAlertsResponse:

61 - """

62 - Fetches all bookmarked alerts.

63 -

64 - Returns:

65 - BookmarkedAlertsResponse: The response containing the bookmarked alerts.

66 - """

67 - logger.info("Fetching all bookmarked alerts")

68 - return await get_bookmarked_alerts(session=session)

69 -

70 -

71 -@dfir_iris_alerts_router.post(

72 - "",

73 - response_model=AlertsResponse,

74 - description="Get alerts from IRIS based on the provided filters",

75 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

76 -)

77 -async def get_alerts_filtered(

78 - request: FilterAlertsRequest,

79 - session: AsyncSession = Depends(get_db),

80 -) -> AlertsResponse:

81 - """

82 - Retrieve alerts from DFIR-IRIS based on the provided filters.

83 -

84 - Returns:

85 - AlertsResponse: The response containing all alerts.

86 - """

87 - logger.info("Fetching all alerts")

88 - logger.info(f"Request: {request}")

89 - return await get_alerts(request, session=session)

90 -

91 -

92 -@dfir_iris_alerts_router.get(

93 - "/{alert_id}",

94 - response_model=AlertResponse,

95 - description="Get an alert by ID",

96 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

97 -)

98 -async def get_alert_by_id(

99 - alert_id: str = Depends(verify_alert_exists),

100 - session: AsyncSession = Depends(get_db),

101 -) -> AlertResponse:

102 - """

103 - Retrieve an alert by its ID.

104 -

105 - Args:

106 - alert_id (str): The ID of the alert to retrieve.

107 -

108 - Returns:

109 - AlertResponse: The response containing the alert information.

110 - """

111 - logger.info(f"Fetching alert {alert_id}")

112 - return await get_alert(alert_id=alert_id, session=session)

113 -

114 -

115 -@dfir_iris_alerts_router.get(

116 - "/assets/{alert_id}",

117 - response_model=AlertAssetsResponse,

118 - description="Get all assets associated with an alert",

119 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

120 -)

121 -async def get_assets_by_alert_id(

122 - alert_id: str = Depends(verify_alert_exists),

123 - session: AsyncSession = Depends(get_db),

124 -) -> AlertAssetsResponse:

125 - """

126 - Retrieve the list of assets associated with an alert by its ID.

127 -

128 - Args:

129 - alert_id (str): The ID of the alert to retrieve.

130 -

131 - Returns:

132 - AlertResponse: The response containing the alert information.

133 - """

134 - logger.info(f"Fetching assets for alert {alert_id}")

135 - assets_data = (await get_alert(alert_id=alert_id, session=session)).alert["assets"]

136 - assets = [IrisAsset(**asset) for asset in assets_data] # Parse the assets data into Asset objects

137 - return AlertAssetsResponse(

138 - success=True,

139 - message="Successfully fetched assets",

140 - assets=assets,

141 - )

142 -

143 -

144 -@dfir_iris_alerts_router.get(

145 - "/alerts_by_user/{user_id}",

146 - response_model=AlertsResponse,

147 - description="Get all alerts assigned to a user",

148 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

149 -)

150 -async def get_all_alerts_assigned_to_user(user_id: int, session: AsyncSession = Depends(get_db)) -> AlertsResponse:

151 - """

152 - Fetches all alerts assigned to a specific user.

153 -

154 - Args:

155 - user_id (int): The ID of the user.

156 -

157 - Returns:

158 - AlertsResponse: The response containing the fetched alerts assigned to the user.

159 - """

160 - logger.info(f"Fetching all alerts assigned to user {user_id}")

161 - alerts = (

162 - await get_alerts(

163 - request=FilterAlertsRequest(alert_owner_id=user_id, per_page=1000),

164 - session=session,

165 - )

166 - ).alerts

167 - alerts_assigned_to_user = []

168 - for alert in alerts:

169 - if alert["alert_owner_id"] == user_id:

170 - alerts_assigned_to_user.append(alert)

171 -

172 - return AlertsResponse(

173 - success=True,

174 - message="Successfully fetched alerts assigned to user",

175 - alerts=alerts_assigned_to_user,

176 - )

177 -

178 -

179 -@dfir_iris_alerts_router.post(

180 - "/create_case/{alert_id}",

181 - response_model=CaseCreationResponse,

182 - description="Assign an alert to a user",

183 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

184 -)

185 -async def create_case_from_alert(

186 - alert_id: str = Depends(verify_alert_exists),

187 -) -> CaseCreationResponse:

188 - """

189 - Create a case from an alert.

190 -

191 - Args:

192 - alert_id (str): The ID of the alert to create a case from.

193 -

194 - Returns:

195 - CaseCreationResponse: The response containing the created case.

196 - """

197 - logger.info(f"Creating case from alert {alert_id}")

198 - return await create_case(alert_id)

199 -

200 -

201 -@dfir_iris_alerts_router.post(

202 - "/bookmark/{alert_id}",

203 - response_model=AlertResponse,

204 - description="Bookmark an alert",

205 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

206 -)

207 -async def bookmark_alert_route(

208 - alert_id: str = Depends(verify_alert_exists),

209 -) -> AlertResponse:

210 - """

211 - Bookmark an alert.

212 -

213 - Args:

214 - alert_id (str): The ID of the alert to be bookmarked.

215 -

216 - Returns:

217 - DeleteAlertResponse: The response containing the bookmarked alert.

218 - """

219 - logger.info(f"Bookmarking alert {alert_id}")

220 - return await bookmark_alert(alert_id, bookmarked=True)

221 -

222 -

223 -@dfir_iris_alerts_router.delete(

224 - "/bookmark/{alert_id}",

225 - response_model=AlertResponse,

226 - description="Unbookmark an alert",

227 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

228 -)

229 -async def unbookmark_alert_route(

230 - alert_id: str = Depends(verify_alert_exists),

231 -) -> AlertResponse:

232 - """

233 - Unbookmark an alert.

234 -

235 - Args:

236 - alert_id (str): The ID of the alert to unbookmark.

237 -

238 - Returns:

239 - AlertResponse: The response containing the unbookmarked alert.

240 - """

241 - logger.info(f"Unbookmarking alert {alert_id}")

242 - return await bookmark_alert(alert_id, bookmarked=False)

243 -

244 -

245 -@dfir_iris_alerts_router.post(

246 - "/delete_multiple",

247 - response_model=DeleteAlertResponse,

248 - description="Delete multiple alerts",

249 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

250 -)

251 -async def delete_multiple_alerts_route(

252 - request: DeleteMultipleAlertsRequest,

253 -) -> DeleteAlertResponse:

254 - """

255 - Delete multiple alerts.

256 -

257 - Args:

258 - request (DeleteMultipleAlertsRequest): The request containing the IDs of the alerts to delete.

259 -

260 - Returns:

261 - DeleteAlertResponse: The response containing the deleted alerts.

262 - """

263 - logger.info(f"Deleting alerts {request.alert_ids}")

264 - for alert_id in request.alert_ids:

265 - await verify_alert_exists(alert_id)

266 - await delete_alert(int(alert_id))

267 - return DeleteAlertResponse(success=True, message="Successfully deleted alerts.")

268 -

269 -

270 -@dfir_iris_alerts_router.delete(

271 - "/purge",

272 - response_model=DeleteAlertResponse,

273 - description="Delete all alerts",

274 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

275 -)

276 -async def purge_alerts_route(

277 - session: AsyncSession = Depends(get_db),

278 -) -> DeleteAlertResponse:

279 - """

280 - Delete all alerts.

281 -

282 - Returns:

283 - AlertResponse: The response containing the deleted alerts.

284 - """

285 - logger.info("Purging all alerts, up to 1000")

286 - alerts = (await get_alerts(request=FilterAlertsRequest(per_page=1000), session=session)).alerts

287 - for alert in alerts:

288 - await delete_alert(int(alert["alert_id"]))

289 - return DeleteAlertResponse(success=True, message="Successfully deleted alerts.")

290 -

291 -

292 -@dfir_iris_alerts_router.delete(

293 - "/{alert_id}",

294 - response_model=DeleteAlertResponse,

295 - description="Delete an alert",

296 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

297 -)

298 -async def delete_alert_route(

299 - alert_id: str = Depends(verify_alert_exists),

300 -) -> DeleteAlertResponse:

301 - """

302 - Delete an alert.

303 -

304 - Args:

305 - alert_id (str): The ID of the alert to delete.

306 -

307 - Returns:

308 - AlertResponse: The response containing the deleted alert.

309 - """

310 - logger.info(f"Deleting alert {alert_id}")

311 - return await delete_alert(int(alert_id))

backend/app/connectors/dfir_iris/routes/assets.py deleted

-55

@@ -1,55 +0,0 @@

1 -from fastapi import APIRouter

2 -from fastapi import Depends

3 -from fastapi import HTTPException

4 -from fastapi import Security

5 -from loguru import logger

6 -

7 -from app.auth.utils import AuthHandler

8 -from app.connectors.dfir_iris.schema.assets import AssetResponse

9 -from app.connectors.dfir_iris.services.assets import get_case_assets

10 -from app.connectors.dfir_iris.utils.universal import check_case_exists

11 -

12 -# App specific imports

13 -

14 -

15 -async def verify_case_exists(case_id: int) -> int:

16 - """

17 - Verify if a case exists based on the given case ID.

18 -

19 - Args:

20 - case_id (int): The ID of the case to verify.

21 -

22 - Returns:

23 - int: The verified case ID.

24 -

25 - Raises:

26 - HTTPException: If the case does not exist.

27 - """

28 - if not await check_case_exists(case_id):

29 - raise HTTPException(status_code=400, detail=f"Case {case_id} does not exist.")

30 - return case_id

31 -

32 -

33 -dfir_iris_assets_router = APIRouter()

34 -

35 -

36 -@dfir_iris_assets_router.get(

37 - "/{case_id}",

38 - response_model=AssetResponse,

39 - description="Get all assets for a case",

40 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

41 -)

42 -async def get_case_assets_route(

43 - case_id: int = Depends(verify_case_exists),

44 -) -> AssetResponse:

45 - """

46 - Retrieve all assets for a given case.

47 -

48 - Args:

49 - case_id (int): The ID of the case.

50 -

51 - Returns:

52 - AssetResponse: The response containing the assets for the case.

53 - """

54 - logger.info(f"Fetching assets for case {case_id}")

55 - return await get_case_assets(case_id)

backend/app/connectors/dfir_iris/routes/cases.py deleted

-222

@@ -1,222 +0,0 @@

1 -from datetime import timedelta

2 -

3 -from fastapi import APIRouter

4 -from fastapi import Depends

5 -from fastapi import HTTPException

6 -from fastapi import Security

7 -from loguru import logger

8 -from sqlalchemy.ext.asyncio import AsyncSession

9 -

10 -from app.auth.utils import AuthHandler

11 -from app.connectors.dfir_iris.schema.cases import CaseOlderThanBody

12 -from app.connectors.dfir_iris.schema.cases import CaseResponse

13 -from app.connectors.dfir_iris.schema.cases import CasesBreachedResponse

14 -from app.connectors.dfir_iris.schema.cases import ClosedCaseResponse

15 -from app.connectors.dfir_iris.schema.cases import PurgeCaseResponse

16 -from app.connectors.dfir_iris.schema.cases import ReopenedCaseResponse

17 -from app.connectors.dfir_iris.schema.cases import SingleCaseBody

18 -from app.connectors.dfir_iris.schema.cases import SingleCaseResponse

19 -from app.connectors.dfir_iris.schema.cases import TimeUnit

20 -from app.connectors.dfir_iris.services.cases import close_case

21 -from app.connectors.dfir_iris.services.cases import delete_single_case

22 -from app.connectors.dfir_iris.services.cases import get_all_cases

23 -from app.connectors.dfir_iris.services.cases import get_cases_older_than

24 -from app.connectors.dfir_iris.services.cases import get_single_case

25 -from app.connectors.dfir_iris.services.cases import purge_cases

26 -from app.connectors.dfir_iris.services.cases import reopen_case

27 -from app.connectors.dfir_iris.utils.universal import check_case_exists

28 -from app.db.db_session import get_db

29 -

30 -

31 -async def verify_case_exists(case_id: int) -> int:

32 - """

33 - Verify if a case exists based on the given case ID.

34 -

35 - Args:

36 - case_id (int): The ID of the case to verify.

37 -

38 - Returns:

39 - int: The verified case ID.

40 -

41 - Raises:

42 - HTTPException: If the case does not exist.

43 - """

44 - if not await check_case_exists(case_id):

45 - raise HTTPException(status_code=400, detail=f"Case {case_id} does not exist.")

46 - return case_id

47 -

48 -

49 -dfir_iris_cases_router = APIRouter()

50 -

51 -

52 -def get_timedelta(older_than: int, time_unit: TimeUnit) -> CaseOlderThanBody:

53 - """

54 - Calculate a timedelta based on the given older_than value and time_unit.

55 -

56 - Args:

57 - older_than (int): The value representing the duration.

58 - time_unit (TimeUnit): The unit of time (hours, days, weeks).

59 -

60 - Returns:

61 - CaseOlderThanBody: An instance of CaseOlderThanBody with the calculated timedelta.

62 -

63 - """

64 - delta = None

65 - if time_unit == TimeUnit.HOURS:

66 - delta = timedelta(hours=older_than)

67 - elif time_unit == TimeUnit.DAYS:

68 - delta = timedelta(days=older_than)

69 - elif time_unit == TimeUnit.WEEKS:

70 - delta = timedelta(weeks=older_than)

71 - return CaseOlderThanBody(older_than=delta, time_unit=time_unit)

72 -

73 -

74 -@dfir_iris_cases_router.get(

75 - "",

76 - response_model=CaseResponse,

77 - description="Get all cases",

78 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

79 -)

80 -async def get_cases_route(session: AsyncSession = Depends(get_db)) -> CaseResponse:

81 - """

82 - Get all cases.

83 -

84 - Returns:

85 - CaseResponse: The response containing all cases.

86 - """

87 - logger.info("Fetching all cases")

88 - return await get_all_cases(session=session)

89 -

90 -

91 -@dfir_iris_cases_router.post(

92 - "/older_than",

93 - response_model=CasesBreachedResponse,

94 - description="Get all cases older than a specified date",

95 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

96 -)

97 -async def get_cases_older_than_route(

98 - case_older_than_body: CaseOlderThanBody = Depends(get_timedelta),

99 -) -> CaseResponse:

100 - """

101 - Fetches all cases older than a specified date.

102 -

103 - Args:

104 - case_older_than_body (CaseOlderThanBody): The request body containing the date and time unit.

105 -

106 - Returns:

107 - CaseResponse: The response containing the cases older than the specified date.

108 - """

109 - logger.info(

110 - f"Fetching all cases older than {case_older_than_body.older_than} ({case_older_than_body.time_unit.value})",

111 - )

112 - return await get_cases_older_than(case_older_than_body)

113 -

114 -

115 -@dfir_iris_cases_router.delete(

116 - "/purge",

117 - response_model=PurgeCaseResponse,

118 - description="Purge all cases",

119 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

120 -)

121 -async def purge_cases_route() -> PurgeCaseResponse:

122 - """

123 - Purge all cases.

124 -

125 - Returns:

126 - PurgeCaseResponse: The response containing the purge status.

127 - """

128 - logger.info("Purging all cases")

129 - return await purge_cases()

130 -

131 -

132 -@dfir_iris_cases_router.delete(

133 - "/purge/{case_id}",

134 - response_model=PurgeCaseResponse,

135 - description="Purge a single case",

136 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

137 -)

138 -async def purge_single_case_route(

139 - case_id: int = Depends(verify_case_exists),

140 -) -> PurgeCaseResponse:

141 - """

142 - Purge a single case by its ID.

143 -

144 - Args:

145 - case_id (int): The ID of the case to purge.

146 -

147 - Returns:

148 - PurgeCaseResponse: The response containing the purge status.

149 - """

150 - logger.info(f"Purging case {case_id}")

151 - single_case_body = SingleCaseBody(case_id=case_id)

152 - return await delete_single_case(single_case_body.case_id)

153 -

154 -

155 -@dfir_iris_cases_router.get(

156 - "/{case_id}",

157 - response_model=SingleCaseResponse,

158 - description="Get a single case",

159 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

160 -)

161 -async def get_single_case_route(

162 - case_id: int = Depends(verify_case_exists),

163 - session: AsyncSession = Depends(get_db),

164 -) -> SingleCaseResponse:

165 - """

166 - Retrieve a single case by its ID.

167 -

168 - Args:

169 - case_id (int): The ID of the case to retrieve.

170 -

171 - Returns:

172 - SingleCaseResponse: The response containing the single case information.

173 - """

174 - logger.info(f"Fetching case {case_id}")

175 - single_case_body = SingleCaseBody(case_id=case_id)

176 - return await get_single_case(single_case_body.case_id, session=session)

177 -

178 -

179 -@dfir_iris_cases_router.put(

180 - "/close/{case_id}",

181 - response_model=ClosedCaseResponse,

182 - description="Close a single case",

183 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

184 -)

185 -async def close_single_case_route(

186 - case_id: int = Depends(verify_case_exists),

187 -) -> ClosedCaseResponse:

188 - """

189 - Close a single case by its ID.

190 -

191 - Args:

192 - case_id (int): The ID of the case to close.

193 -

194 - Returns:

195 - ClosedCaseResponse: The response containing the closed case information.

196 - """

197 - logger.info(f"Closing case {case_id}")

198 - single_case_body = SingleCaseBody(case_id=case_id)

199 - return await close_case(single_case_body.case_id)

200 -

201 -

202 -@dfir_iris_cases_router.put(

203 - "/open/{case_id}",

204 - response_model=ReopenedCaseResponse,

205 - description="Open a single case",

206 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

207 -)

208 -async def reopen_single_case_route(

209 - case_id: int = Depends(verify_case_exists),

210 -) -> ReopenedCaseResponse:

211 - """

212 - Open a single case by its ID.

213 -

214 - Args:

215 - case_id (int): The ID of the case to open.

216 -

217 - Returns:

218 - ReopenedCaseResponse: The response containing the opened case information.

219 - """

220 - logger.info(f"Opening case {case_id}")

221 - single_case_body = SingleCaseBody(case_id=case_id)

222 - return await reopen_case(single_case_body.case_id)

backend/app/connectors/dfir_iris/routes/notes.py deleted

-88

@@ -1,88 +0,0 @@

1 -from typing import Optional

2 -

3 -from fastapi import APIRouter

4 -from fastapi import Depends

5 -from fastapi import HTTPException

6 -from fastapi import Security

7 -from loguru import logger

8 -

9 -from app.auth.utils import AuthHandler

10 -from app.connectors.dfir_iris.schema.notes import NoteCreationBody

11 -from app.connectors.dfir_iris.schema.notes import NoteCreationResponse

12 -from app.connectors.dfir_iris.schema.notes import NotesResponse

13 -from app.connectors.dfir_iris.services.notes import create_case_note

14 -from app.connectors.dfir_iris.services.notes import get_case_notes

15 -from app.connectors.dfir_iris.utils.universal import check_case_exists

16 -

17 -

18 -async def verify_case_exists(case_id: int) -> int:

19 - """

20 - Verify if a case exists based on the given case ID.

21 -

22 - Args:

23 - case_id (int): The ID of the case to verify.

24 -

25 - Returns:

26 - int: The verified case ID.

27 -

28 - Raises:

29 - HTTPException: If the case does not exist.

30 - """

31 - if not await check_case_exists(case_id):

32 - raise HTTPException(status_code=400, detail=f"Case {case_id} does not exist.")

33 - return case_id

34 -

35 -

36 -dfir_iris_notes_router = APIRouter()

37 -

38 -

39 -@dfir_iris_notes_router.get(

40 - "/{case_id}",

41 - response_model=NotesResponse,

42 - description="Get all notes for a case",

43 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

44 -)

45 -async def get_case_notes_route(

46 - case_id: int = Depends(verify_case_exists),

47 - search_term: Optional[str] = "%",

48 -) -> NotesResponse:

49 - """

50 - Retrieve all notes for a specific case.

51 -

52 - Args:

53 - case_id (int): The ID of the case.

54 - search_term (str, optional): The search term to filter notes. Defaults to "%".

55 -

56 - Returns:

57 - NotesResponse: The response containing the notes for the case.

58 - """

59 - logger.info(f"Fetching notes for case {case_id}")

60 - return await get_case_notes(case_id, search_term)

61 -

62 -

63 -@dfir_iris_notes_router.post(

64 - "/{case_id}",

65 - response_model=NoteCreationResponse,

66 - description="Create a note for a case",

67 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

68 -)

69 -async def create_case_note_route(

70 - case_id: int,

71 - note_creation_body: NoteCreationBody,

72 -) -> NoteCreationResponse:

73 - """

74 - Create a note for a case.

75 -

76 - Args:

77 - case_id (int): The ID of the case.

78 - note_creation_body (NoteCreationBody): The body of the note creation request.

79 -

80 - Returns:

81 - NoteCreationResponse: The response containing the created note.

82 -

83 - Raises:

84 - CaseNotFoundError: If the case with the given ID does not exist.

85 - """

86 - verify_case_exists(case_id)

87 - logger.info(f"Creating a note for case {case_id}")

88 - return await create_case_note(case_id, note_creation_body)

backend/app/connectors/dfir_iris/routes/users.py deleted

-200

@@ -1,200 +0,0 @@

1 -from fastapi import APIRouter

2 -from fastapi import Depends

3 -from fastapi import HTTPException

4 -from fastapi import Security

5 -from loguru import logger

6 -

7 -from app.auth.utils import AuthHandler

8 -from app.connectors.dfir_iris.schema.alerts import AlertResponse

9 -from app.connectors.dfir_iris.schema.users import User

10 -from app.connectors.dfir_iris.schema.users import UserAddedToCustomerResponse

11 -from app.connectors.dfir_iris.schema.users import UserRemovedFromCustomerResponse

12 -from app.connectors.dfir_iris.schema.users import UsersResponse

13 -from app.connectors.dfir_iris.services.users import assign_user_to_alert

14 -from app.connectors.dfir_iris.services.users import delete_user_from_alert

15 -from app.connectors.dfir_iris.services.users import get_users

16 -from app.connectors.dfir_iris.utils.universal import add_user_to_customers

17 -from app.connectors.dfir_iris.utils.universal import check_alert_exists

18 -from app.connectors.dfir_iris.utils.universal import check_user_exists

19 -from app.connectors.dfir_iris.utils.universal import collect_all_customers

20 -

21 -

22 -def verify_user_exists(user_id: int) -> int:

23 - """

24 - Verify if a user exists based on the provided user ID.

25 -

26 - Args:

27 - user_id (int): The ID of the user to verify.

28 -

29 - Returns:

30 - int: The verified user ID.

31 -

32 - Raises:

33 - HTTPException: If the user does not exist.

34 - """

35 - if not check_user_exists(user_id):

36 - raise HTTPException(status_code=400, detail=f"User {user_id} does not exist.")

37 - return user_id

38 -

39 -

40 -async def verify_alert_exists(alert_id: str) -> str:

41 - """

42 - Verify if an alert exists based on the given alert ID.

43 -

44 - Args:

45 - alert_id (str): The ID of the alert to be verified.

46 -

47 - Returns:

48 - str: The verified alert ID.

49 -

50 - Raises:

51 - HTTPException: If the alert does not exist.

52 - """

53 - if not await check_alert_exists(alert_id):

54 - raise HTTPException(status_code=400, detail=f"Alert {alert_id} does not exist.")

55 - return alert_id

56 -

57 -

58 -dfir_iris_users_router = APIRouter()

59 -

60 -

61 -@dfir_iris_users_router.get(

62 - "",

63 - response_model=UsersResponse,

64 - description="Get all users",

65 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

66 -)

67 -async def get_all_users() -> UsersResponse:

68 - """

69 - Retrieves all users.

70 -

71 - Returns:

72 - UsersResponse: The response containing the list of users.

73 - """

74 - logger.info("Fetching all users")

75 - return await get_users()

76 -

77 -

78 -@dfir_iris_users_router.post(

79 - "/assign/{alert_id}/{user_id}",

80 - response_model=AlertResponse,

81 - description="Assign a user to an alert",

82 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

83 -)

84 -async def assign_user_to_alert_route(

85 - alert_id: str = Depends(verify_alert_exists),

86 - user_id: int = Depends(verify_user_exists),

87 -) -> User:

88 - """

89 - Assigns a user to an alert.

90 -

91 - Parameters:

92 - - alert_id (str): The ID of the alert.

93 - - user_id (int): The ID of the user.

94 -

95 - Returns:

96 - - User: The assigned user.

97 -

98 - Raises:

99 - - HTTPException: If the alert or user does not exist.

100 - """

101 - logger.info(f"Assigning user {user_id} to alert {alert_id}")

102 - return await assign_user_to_alert(alert_id, user_id)

103 -

104 -

105 -@dfir_iris_users_router.post(

106 - "/add/{user_id}",

107 - response_model=AlertResponse,

108 - description="Add a user to a list of customers",

109 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

110 -)

111 -async def add_user_to_customers_route(

112 - user_id: int,

113 -) -> UserAddedToCustomerResponse:

114 - """

115 - Add a user to a list of customers.

116 -

117 - Parameters:

118 - - customers (List[str]): The list of customer IDs.

119 - - user_id (int): The ID of the user.

120 -

121 - Returns:

122 - - AlertResponse: The response containing the added user.

123 -

124 - Raises:

125 - - HTTPException: If the customer or user does not exist.

126 - """

127 - customers = await collect_all_customers()

128 - customer_ids = [str(customer["customer_id"]) for customer in customers]

129 - logger.info(f"Customer IDs: {customer_ids}")

130 - logger.info(f"Adding user {user_id} to customers {customer_ids}")

131 - success = await add_user_to_customers(customer_ids, user_id)

132 - if success:

133 - return UserAddedToCustomerResponse(message=f"User {user_id} added to customers {customers}", success=True)

134 - else:

135 - raise HTTPException(status_code=400, detail=f"Failed to add user {user_id} to customers {customers}")

136 -

137 -

138 -@dfir_iris_users_router.delete(

139 - "/remove/{user_id}/{customer_id}",

140 - response_model=AlertResponse,

141 - description="Remove a user from a customer",

142 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

143 -)

144 -async def remove_user_from_customer_route(

145 - user_id: int,

146 - customer_id: str,

147 -) -> UserRemovedFromCustomerResponse:

148 - """

149 - Remove a user from a customer.

150 -

151 - Parameters:

152 - - customer_id (str): The ID of the customer.

153 - - user_id (int): The ID of the user.

154 -

155 - Returns:

156 - - AlertResponse: The response containing the removed user.

157 -

158 - Raises:

159 - - HTTPException: If the customer or user does not exist.

160 - """

161 - customers = await collect_all_customers()

162 - customer_ids = [str(customer["customer_id"]) for customer in customers]

163 - if customer_id in customer_ids:

164 - customer_ids.remove(customer_id)

165 - else:

166 - raise HTTPException(status_code=404, detail="Customer ID not found")

167 - logger.info(f"Customer IDs: {customer_ids}")

168 - logger.info(f"Removing user {user_id} from customers {customer_ids}")

169 - success = await add_user_to_customers(customer_ids, user_id)

170 - if success:

171 - return UserRemovedFromCustomerResponse(message=f"User {user_id} removed from customer {customer_id}", success=True)

172 - else:

173 - raise HTTPException(status_code=400, detail=f"Failed to remove user {user_id} from customer {customer_id}")

174 -

175 -

176 -@dfir_iris_users_router.delete(

177 - "/assign/{alert_id}/{user_id}",

178 - response_model=AlertResponse,

179 - description="Delete a user from an alert",

180 - dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],

181 -)

182 -async def delete_user_from_alert_route(

183 - alert_id: str = Depends(verify_alert_exists),

184 - user_id: int = Depends(verify_user_exists),

185 -) -> User:

186 - """

187 - Delete a user from an alert.

188 -

189 - Args:

190 - alert_id (str): The ID of the alert.

191 - user_id (int): The ID of the user.

192 -

193 - Returns:

194 - User: The deleted user.

195 -

196 - Raises:

197 - HTTPException: If the alert or user does not exist.

198 - """

199 - logger.info(f"Deleting user {user_id} from alert {alert_id}")

200 - return await delete_user_from_alert(alert_id, user_id)

backend/app/connectors/dfir_iris/schema/admin.py deleted

-37

@@ -1,37 +0,0 @@

1 -import uuid

2 -from datetime import datetime

3 -from typing import Dict

4 -from typing import List

5 -from typing import Optional

6 -

7 -from pydantic import UUID4

8 -from pydantic import BaseModel

9 -

10 -

11 -class CreateCustomerData(BaseModel):

12 - customer_id: int

13 - customer_sla: Optional[str] = None

14 - customer_name: str

15 - customer_description: Optional[str] = None

16 - creation_date: datetime

17 - custom_attributes: Dict

18 - last_update_date: datetime

19 - client_uuid: uuid.UUID

20 -

21 -

22 -class CreateCustomerResponse(BaseModel):

23 - success: bool

24 - data: CreateCustomerData

25 -

26 -

27 -class Customer(BaseModel):

28 - customer_name: str

29 - customer_id: int

30 - customer_uuid: UUID4

31 - customer_description: Optional[str] = None

32 - customer_sla: Optional[str] = None

33 -

34 -

35 -class ListCustomers(BaseModel):

36 - success: bool

37 - data: List[Customer]

backend/app/connectors/dfir_iris/schema/alerts.py deleted

-136

@@ -1,136 +0,0 @@

1 -from enum import Enum

2 -from typing import Any

3 -from typing import Dict

4 -from typing import List

5 -from typing import Optional

6 -

7 -from pydantic import BaseModel

8 -from pydantic import Field

9 -from pydantic import validator

10 -

11 -

12 -class AlertsResponse(BaseModel):

13 - alerts: Optional[List[Dict[str, Any]]] = Field(

14 - [],

15 - description="The alerts returned from the search.",

16 - )

17 - message: str

18 - success: bool

19 -

20 -

21 -class AlertResponse(BaseModel):

22 - alert: Optional[Dict[str, Any]] = Field(

23 - {},

24 - description="The alert returned from the search.",

25 - )

26 - message: str

27 - success: bool

28 -

29 -

30 -class BookmarkedAlertsResponse(BaseModel):

31 - bookmarked_alerts: Optional[List[Dict[str, Any]]] = Field(

32 - [],

33 - description="The alerts returned from the search.",

34 - )

35 - message: str

36 - success: bool

37 -

38 -

39 -class DeleteMultipleAlertsRequest(BaseModel):

40 - alert_ids: List[str] = Field([], description="The IDs of the alerts to delete.")

41 -

42 -

43 -class DeleteAlertResponse(BaseModel):

44 - message: str

45 - success: bool

46 -

47 -

48 -class SortOrder(Enum):

49 - desc = "desc"

50 - asc = "asc"

51 -

52 -

53 -class FilterAlertsRequest(BaseModel):

54 - per_page: int = Field(1000, description="The number of alerts to return per page.")

55 - page: int = Field(1, description="The page number to return.")

56 - sort: SortOrder = Field(

57 - SortOrder.desc,

58 - description="The sort order for the alerts.",

59 - )

60 - alert_title: Optional[str] = Field(None, description="The title of the alert.")

61 - alert_owner_id: Optional[int] = Field(

62 - None,

63 - description="The ID of the alert owner.",

64 - )

65 -

66 -

67 -class CaseModificationHistory(BaseModel):

68 - user: str

69 - user_id: int

70 - action: str

71 -

72 -

73 -class CaseData(BaseModel):

74 - owner_id: int

75 - case_soc_id: str

76 - status_id: int

77 - case_name: str

78 - custom_attributes: Optional[Any]

79 - open_date: str

80 - close_date: Optional[str]

81 - state_id: int

82 - case_description: str

83 - reviewer_id: Optional[int]

84 - closing_note: Optional[str]

85 - case_id: int

86 - modification_history: Dict[str, CaseModificationHistory]

87 - classification_id: Optional[int]

88 - review_status_id: Optional[int]

89 - user_id: int

90 - case_uuid: str

91 - case_customer: int

92 -

93 -

94 -class CaseCreationResponse(BaseModel):

95 - success: bool

96 - case: CaseData

97 - message: str

98 -

99 -

100 -class IrisAssetType(BaseModel):

101 - asset_id: int

102 - asset_icon_compromised: str

103 - asset_name: str

104 - asset_icon_not_compromised: str

105 - asset_description: str

106 -

107 -

108 -class IrisAsset(BaseModel):

109 - asset_name: str

110 - asset_description: str

111 - asset_type: IrisAssetType

112 - custom_attributes: Optional[str]

113 - asset_tags: str

114 - asset_compromise_status_id: Optional[int]

115 - date_update: Optional[str]

116 - asset_enrichment: Optional[str]

117 - case_id: Optional[int]

118 - user_id: Optional[int]

119 - asset_type_id: int

120 - asset_id: int

121 - asset_ip: str

122 - asset_domain: Optional[str]

123 - asset_uuid: str

124 - analysis_status_id: Optional[int]

125 - asset_info: Optional[str]

126 - date_added: Optional[str]

127 -

128 - @validator("asset_tags", pre=True)

129 - def remove_agent_id(cls, v):

130 - return v.replace("agent_id:", "") if v else v

131 -

132 -

133 -class AlertAssetsResponse(BaseModel):

134 - success: bool

135 - message: str

136 - assets: List[IrisAsset]

backend/app/connectors/dfir_iris/schema/assets.py deleted

-50

@@ -1,50 +0,0 @@

1 -from typing import List

2 -from typing import Optional

3 -

4 -from pydantic import BaseModel

5 -from pydantic import Field

6 -

7 -

8 -class AssetState(BaseModel):

9 - object_last_update: str

10 - object_state: int

11 -

12 -

13 -class AssetIocLink(BaseModel):

14 - ioc_id: int

15 - ioc_value: str

16 - asset_id: int

17 -

18 -

19 -class Asset(BaseModel):

20 - analysis_status: str

21 - analysis_status_id: int

22 - asset_compromise_status_id: Optional[int]

23 - asset_description: Optional[str] = Field(

24 - None,

25 - description="The description of the asset.",

26 - )

27 - asset_domain: Optional[str]

28 - asset_icon_compromised: str

29 - asset_icon_not_compromised: str

30 - asset_id: int

31 - asset_ip: Optional[str] = Field(None, description="The IP address of the asset.")

32 - asset_name: str

33 - asset_tags: Optional[str]

34 - asset_type: Optional[str]

35 - asset_type_id: int

36 - asset_uuid: str

37 - ioc_links: Optional[List[AssetIocLink]] = None

38 - link: List

39 -

40 -

41 -class AssetData(BaseModel):

42 - assets: List[Asset]

43 - state: AssetState

44 -

45 -

46 -class AssetResponse(BaseModel):

47 - assets: List[Asset]

48 - state: AssetState

49 - message: str

50 - success: bool

backend/app/connectors/dfir_iris/schema/cases.py deleted

-177

@@ -1,177 +0,0 @@

1 -from datetime import date

2 -from datetime import timedelta

3 -from enum import Enum

4 -from typing import Dict

5 -from typing import List

6 -from typing import Optional

7 -from typing import Union

8 -

9 -from pydantic import BaseModel

10 -from pydantic import Field

11 -

12 -

13 -class CaseModel(BaseModel):

14 - access_level: int

15 - case_close_date: str

16 - case_description: str

17 - case_id: int

18 - case_name: str

19 - case_open_date: str

20 - case_soc_id: str

21 - case_uuid: str

22 - classification: Optional[str]

23 - classification_id: Optional[int]

24 - client_name: str

25 - opened_by: str

26 - opened_by_user_id: int

27 - owner: str

28 - owner_id: int

29 - state_id: Optional[int] = Field(None, description="The ID of the state the case is in.")

30 - state_name: Optional[str] = Field(None, description="The name of the state the case is in.")

31 - customer_code: str

32 -

33 -

34 -class CaseResponse(BaseModel):

35 - cases: List[CaseModel]

36 - message: str

37 - success: bool

38 -

39 -

40 -class PurgeCaseResponse(BaseModel):

41 - message: str

42 - success: bool

43 -

44 -

45 -class ModificationHistoryItem(BaseModel):

46 - action: str

47 - user: str

48 - user_id: int

49 -

50 -

51 -class SingleCaseModel(BaseModel):

52 - case_description: str

53 - case_id: int

54 - case_name: str

55 - case_soc_id: str

56 - case_tags: Optional[str]

57 - case_uuid: str

58 - classification: Optional[Union[str, None]]

59 - classification_id: Optional[Union[int, None]]

60 - close_date: Optional[Union[str, None]]

61 - # custom_attributes: Optional[Union[str, None]] = Field(

62 - # None,

63 - # description="The custom attributes of the case.",

64 - # )

65 - custom_attributes: Optional[Dict[str, Union[str, None]]] = Field(

66 - None,

67 - description="The custom attributes of the case.",

68 - )

69 - customer_id: int

70 - customer_name: str

71 - initial_date: str

72 - modification_history: Dict[str, ModificationHistoryItem]

73 - open_by_user: str

74 - open_by_user_id: int

75 - open_date: str

76 - owner: str

77 - owner_id: int

78 - protagonists: List[str]

79 - reviewer: Optional[Union[str, None]]

80 - reviewer_id: Optional[Union[int, None]]

81 - state_id: int

82 - state_name: str

83 - status_id: int

84 - status_name: str

85 - customer_code: str

86 -

87 - def __init__(self, **data):

88 - if "custom_attributes" in data and not data["custom_attributes"]:

89 - data["custom_attributes"] = {"default_key": "no custom attributes found"} # Replace with your default entry

90 - super().__init__(**data)

91 -

92 -

93 -class SingleCaseBody(BaseModel):

94 - case_id: int

95 -

96 -

97 -class SingleCaseResponse(BaseModel):

98 - case: SingleCaseModel

99 - message: str

100 - success: bool

101 -

102 -

103 -class TimeUnit(str, Enum):

104 - HOURS = "hours"

105 - DAYS = "days"

106 - WEEKS = "weeks"

107 -

108 -

109 -class CaseOlderThanBody(BaseModel):

110 - older_than: timedelta = Field(..., description="Amount of time to filter cases by")

111 - time_unit: TimeUnit

112 -

113 -

114 -class CasesBreachedResponse(BaseModel):

115 - cases_breached: List[CaseModel]

116 - message: str

117 - success: bool

118 -

119 -

120 -class CaseModificationHistoryItem(BaseModel):

121 - user: str

122 - user_id: int

123 - action: str

124 -

125 -

126 -class CaseData(BaseModel):

127 - owner_id: int

128 - case_soc_id: str

129 - status_id: int

130 - case_name: str

131 - custom_attributes: Optional[str] = None

132 - open_date: date

133 - close_date: date

134 - state_id: int

135 - case_description: str

136 - reviewer_id: Optional[int] = None

137 - closing_note: Optional[str] = None

138 - case_id: int

139 - modification_history: Dict[str, CaseModificationHistoryItem]

140 - classification_id: Optional[int] = None

141 - review_status_id: Optional[int] = None

142 - user_id: int

143 - case_uuid: str

144 - case_customer: int

145 -

146 -

147 -class ClosedCaseResponse(BaseModel):

148 - success: bool

149 - case: CaseData

150 - message: str

151 -

152 -

153 -class ReopenedCaseData(BaseModel):

154 - owner_id: int

155 - case_soc_id: str

156 - status_id: int

157 - case_name: str

158 - custom_attributes: Optional[str] = None

159 - open_date: date

160 - close_date: Optional[date] = None

161 - state_id: int

162 - case_description: str

163 - reviewer_id: Optional[int] = None

164 - closing_note: Optional[str] = None

165 - case_id: int

166 - modification_history: Dict[str, CaseModificationHistoryItem]

167 - classification_id: Optional[int] = None

168 - review_status_id: Optional[int] = None

169 - user_id: int

170 - case_uuid: str

171 - case_customer: int

172 -

173 -

174 -class ReopenedCaseResponse(BaseModel):

175 - success: bool

176 - case: ReopenedCaseData

177 - message: str

backend/app/connectors/dfir_iris/schema/notes.py deleted

-80

@@ -1,80 +0,0 @@

1 -from typing import Dict

2 -from typing import List

3 -from typing import Optional

4 -

5 -from pydantic import BaseModel

6 -from pydantic import Field

7 -

8 -

9 -class Directory(BaseModel):

10 - id: int

11 - name: str

12 - parent_id: Optional[int]

13 - case_id: int

14 -

15 -

16 -class ModificationHistory(BaseModel):

17 - user: str

18 - user_id: int

19 - action: str

20 -

21 -

22 -class NoteDetails(BaseModel):

23 - directory: Directory

24 - note_id: int

25 - note_uuid: str

26 - note_title: str

27 - note_content: str

28 - note_user: int

29 - note_creationdate: str

30 - note_lastupdate: str

31 - note_case_id: int

32 - custom_attributes: Optional[Dict]

33 - directory_id: int

34 - modification_history: Dict[str, ModificationHistory]

35 - comments: List[str]

36 -

37 -

38 -class NoteDetailsResponse(BaseModel):

39 - note_details: NoteDetails

40 - message: str

41 - success: bool

42 -

43 -

44 -class NoteItem(BaseModel):

45 - note_details: NoteDetails

46 -

47 -

48 -class NotesResponse(BaseModel):

49 - notes: List[NoteItem]

50 - message: str

51 - success: bool

52 -

53 -

54 -class NotesQueryParams(BaseModel):

55 - case_id: int

56 - search_term: Optional[str] = Field(

57 - "%",

58 - description="Search term to filter notes by. Defaults to wildcard search (%).",

59 - )

60 -

61 -

62 -class NoteCreationBody(BaseModel):

63 - note_title: str = Field(..., description="Title of the note to be created.")

64 - note_content: str = Field(..., description="Content of the note to be created.")

65 -

66 -

67 -class NoteAttributes(BaseModel):

68 - custom_attributes: Dict[str, str] = Field(...)

69 - note_content: str = Field(...)

70 - note_creationdate: str = Field(...)

71 - note_id: int = Field(...)

72 - note_lastupdate: str = Field(...)

73 - note_title: str = Field(...)

74 - note_uuid: str = Field(...)

75 -

76 -

77 -class NoteCreationResponse(BaseModel):

78 - message: str = Field(...)

79 - note: NoteAttributes = Field(...)

80 - success: bool = Field(...)

backend/app/connectors/dfir_iris/schema/users.py deleted

-27

@@ -1,27 +0,0 @@

1 -from typing import List

2 -

3 -from pydantic import BaseModel

4 -

5 -

6 -class User(BaseModel):

7 - user_active: bool

8 - user_id: int

9 - user_login: str

10 - user_name: str

11 - user_uuid: str

12 -

13 -

14 -class UsersResponse(BaseModel):

15 - message: str

16 - success: bool

17 - users: List[User]

18 -

19 -

20 -class UserAddedToCustomerResponse(BaseModel):

21 - success: bool

22 - message: str

23 -

24 -

25 -class UserRemovedFromCustomerResponse(BaseModel):

26 - success: bool

27 - message: str

backend/app/connectors/dfir_iris/services/alerts.py deleted

-264

@@ -1,264 +0,0 @@

1 -from fastapi import HTTPException

2 -from loguru import logger

3 -from sqlalchemy.ext.asyncio import AsyncSession

4 -from sqlalchemy.future import select

5 -

6 -from app.connectors.dfir_iris.schema.alerts import AlertResponse

7 -from app.connectors.dfir_iris.schema.alerts import AlertsResponse

8 -from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse

9 -from app.connectors.dfir_iris.schema.alerts import CaseCreationResponse

10 -from app.connectors.dfir_iris.schema.alerts import DeleteAlertResponse

11 -from app.connectors.dfir_iris.schema.alerts import FilterAlertsRequest

12 -from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data

13 -from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert

14 -from app.integrations.alert_creation_settings.models.alert_creation_settings import (

15 - AlertCreationSettings,

16 -)

17 -

18 -

19 -async def get_customer_code(session: AsyncSession, customer_id: int) -> str:

20 - """

21 - Retrieves the customer code for a given customer ID.

22 -

23 - Args:

24 - session (AsyncSession): The database session.

25 - customer_id (int): The ID of the customer.

26 -

27 - Returns:

28 - The customer code for the given customer ID.

29 - """

30 - logger.info(f"Retrieving customer code for customer ID {customer_id}")

31 - try:

32 - alert_creation_settings = await session.execute(

33 - select(AlertCreationSettings).filter(

34 - AlertCreationSettings.iris_customer_id == customer_id,

35 - ),

36 - )

37 - alert_creation_settings = alert_creation_settings.scalars().first()

38 - if alert_creation_settings is None:

39 - return "Customer Not Found"

40 - return alert_creation_settings.customer_code

41 - except Exception as e:

42 - logger.error(

43 - f"Error retrieving customer code for customer ID {customer_id}: {e}",

44 - )

45 - return "Customer Not Found"

46 -

47 -

48 -async def get_alerts(

49 - request: FilterAlertsRequest,

50 - session: AsyncSession,

51 -) -> AlertsResponse:

52 - """

53 - Retrieves alerts from the DFIR-IRIS service.

54 -

55 - Args:

56 - request (FilterAlertsRequest): The request object containing filtering criteria.

57 -

58 - Returns:

59 - AlertsResponse: The response object containing the fetched alerts.

60 - """

61 - try:

62 - client, alert = await initialize_client_and_alert("DFIR-IRIS")

63 - params = construct_params(request)

64 - result = await fetch_and_validate_data(

65 - client,

66 - lambda: alert.filter_alerts(**params),

67 - )

68 - logger.info(

69 - f"Successfully fetched length {len(result['data']['alerts'])} alerts",

70 - )

71 - # Add the customer code to each alert

72 - for alert in result["data"]["alerts"]:

73 - customer_code = await get_customer_code(

74 - session,

75 - alert["customer"]["customer_id"],

76 - )

77 - alert["customer"]["customer_code"] = customer_code

78 - return AlertsResponse(

79 - success=True,

80 - message="Successfully fetched alerts",

81 - alerts=result["data"]["alerts"],

82 - )

83 - except Exception as e:

84 - logger.error(f"Error fetching alerts: {e}")

85 - raise HTTPException(status_code=500, detail=f"Error fetching alerts: {e}")

86 -

87 -

88 -def construct_params(request: FilterAlertsRequest) -> dict:

89 - """

90 - Constructs the parameters for the alert filtering request.

91 -

92 - Args:

93 - request (FilterAlertsRequest): The request object containing filtering criteria.

94 -

95 - Returns:

96 - dict: A dictionary of parameters for the alert filtering request.

97 - """

98 - params = {

99 - "page": request.page,

100 - "per_page": request.per_page,

101 - "sort": request.sort.value if request.sort else None,

102 - "alert_title": request.alert_title,

103 - # Add more parameters here as needed

104 - }

105 -

106 - # Remove parameters that have a value of None

107 - return {k: v for k, v in params.items() if v is not None}

108 -

109 -

110 -async def get_alert(alert_id: str, session: AsyncSession) -> AlertResponse:

111 - """

112 - Retrieves an alert by its ID.

113 -

114 - Args:

115 - alert_id (str): The ID of the alert to retrieve.

116 -

117 - Returns:

118 - AlertResponse: The response object containing the alert data.

119 -

120 - Raises:

121 - SomeException: If there is an error retrieving the alert.

122 - """

123 - client, alert = await initialize_client_and_alert("DFIR-IRIS")

124 - result = await fetch_and_validate_data(client, alert.get_alert, alert_id)

125 - # Add the customer code to the alert

126 - customer_code = await get_customer_code(

127 - session,

128 - result["data"]["customer"]["customer_id"],

129 - )

130 - result["data"]["customer"]["customer_code"] = customer_code

131 - return AlertResponse(

132 - success=True,

133 - message="Successfully fetched alert",

134 - alert=result["data"],

135 - )

136 -

137 -

138 -async def create_case(alert_id: str) -> CaseCreationResponse:

139 - """

140 - Creates a case for an alert.

141 -

142 - Args:

143 - alert_id (str): The ID of the alert to create a case for.

144 -

145 - Returns:

146 - CaseCreationResponse: The response object containing the success status, message, and created case data.

147 - """

148 - client, alert = await initialize_client_and_alert("DFIR-IRIS")

149 - # Get the alert

150 - alert_details = await fetch_and_validate_data(client, alert.get_alert, alert_id)

151 - params = construct_case_creation_params(alert_details["data"])

152 - logger.info(f"Creating case with params {params}")

153 - result = await fetch_and_validate_data(

154 - client,

155 - lambda: alert.escalate_alert(int(alert_id), **params),

156 - )

157 - logger.info(f"Successfully created case for alert: {result}")

158 - return CaseCreationResponse(

159 - success=True,

160 - message="Successfully created case for alert",

161 - case=result["data"],

162 - )

163 -

164 -

165 -def construct_case_creation_params(alert_details: dict) -> dict:

166 - """

167 - Constructs the parameters for the case creation request.

168 -

169 - Args:

170 - alert_details (dict): The alert details.

171 -

172 - Returns:

173 - dict: A dictionary of parameters for the case creation request.

174 - """

175 - params = {

176 - "case_title": alert_details["alert_title"],

177 - "case_tags": alert_details["alert_tags"],

178 - "escalation_note": "Case created from CoPilot",

179 - "iocs_import_list": [ioc["ioc_uuid"] for ioc in alert_details["iocs"]],

180 - "assets_import_list": [asset["asset_uuid"] for asset in alert_details["assets"]],

181 - }

182 -

183 - # Replace None values with the string "None"

184 - return {k: v if v is not None else "None" for k, v in params.items()}

185 -

186 -

187 -async def bookmark_alert(alert_id: str, bookmarked: bool) -> AlertResponse:

188 - """

189 - Bookmarks or removes bookmark from an alert.

190 -

191 - Args:

192 - alert_id (str): The ID of the alert.

193 - bookmarked (bool): Indicates whether to bookmark or remove bookmark from the alert.

194 -

195 - Returns:

196 - AlertResponse: The response containing the success status, message, and updated alert data.

197 - """

198 - client, alert = await initialize_client_and_alert("DFIR-IRIS")

199 - if bookmarked:

200 - result = await fetch_and_validate_data(

201 - client,

202 - alert.update_alert,

203 - alert_id,

204 - {"alert_tags": "bookmarked"},

205 - )

206 - return AlertResponse(

207 - success=True,

208 - message="Successfully bookmarked alert",

209 - alert=result["data"],

210 - )

211 - result = await fetch_and_validate_data(

212 - client,

213 - alert.update_alert,

214 - alert_id,

215 - {"alert_tags": ""},

216 - )

217 - return AlertResponse(

218 - success=True,

219 - message="Successfully removed bookmark from alert",

220 - alert=result["data"],

221 - )

222 -

223 -

224 -async def get_bookmarked_alerts(session: AsyncSession) -> BookmarkedAlertsResponse:

225 - """

226 - Retrieves the bookmarked alerts from the system.

227 -

228 - Returns:

229 - BookmarkedAlertsResponse: The response object containing the bookmarked alerts.

230 - """

231 - alerts = await get_alerts(

232 - request=FilterAlertsRequest(per_page=10000),

233 - session=session,

234 - )

235 - alerts = alerts.alerts

236 - bookmarked_alerts = []

237 - for alert in alerts:

238 - if alert["alert_tags"] is not None and "bookmarked" in alert["alert_tags"]:

239 - bookmarked_alerts.append(alert)

240 -

241 - return BookmarkedAlertsResponse(

242 - success=True,

243 - message="Successfully fetched bookmarked alerts",

244 - bookmarked_alerts=bookmarked_alerts,

245 - )

246 -

247 -

248 -async def delete_alert(alert_id: int) -> DeleteAlertResponse:

249 - """

250 - Deletes an alert.

251 -

252 - Args:

253 - alert_id (int): The ID of the alert to delete.

254 -

255 - Returns:

256 - DeleteAlertResponse: The response object containing the success status, message, and deleted alert.

257 - """

258 - client, alert = await initialize_client_and_alert("DFIR-IRIS")

259 - result = await fetch_and_validate_data(client, alert.delete_alert, alert_id)

260 - return DeleteAlertResponse(

261 - success=True,

262 - message="Successfully deleted alert",

263 - alert=result["data"],

264 - )

backend/app/connectors/dfir_iris/services/assets.py deleted

-36

@@ -1,36 +0,0 @@

1 -from fastapi import HTTPException

2 -

3 -from app.connectors.dfir_iris.schema.assets import Asset

4 -from app.connectors.dfir_iris.schema.assets import AssetResponse

5 -from app.connectors.dfir_iris.schema.assets import AssetState

6 -from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data

7 -from app.connectors.dfir_iris.utils.universal import initialize_client_and_case

8 -

9 -

10 -async def get_case_assets(case_id: int) -> AssetResponse:

11 - """

12 - Retrieves assets for a given case.

13 -

14 - Args:

15 - case_id (int): The ID of the case.

16 -

17 - Returns:

18 - AssetResponse: The response containing the fetched assets and their state.

19 - """

20 - client, case = await initialize_client_and_case("DFIR-IRIS")

21 - result = await fetch_and_validate_data(client, case.list_assets, case_id)

22 - try:

23 - asset_list = result["data"]["assets"]

24 - state_data = result["data"]["state"]

25 - except KeyError as e:

26 - raise HTTPException(

27 - status_code=500,

28 - detail=f"Failed to fetch assets for case {case_id}: {e}",

29 - )

30 -

31 - return AssetResponse(

32 - success=True,

33 - message="Successfully fetched assets for case",

34 - assets=[Asset(**asset) for asset in asset_list], # List[Asset]

35 - state=AssetState(**state_data), # AssetState

36 - )

backend/app/connectors/dfir_iris/services/cases.py deleted

-339

@@ -1,339 +0,0 @@

1 -from datetime import datetime

2 -from typing import Dict

3 -from typing import List

4 -

5 -from dfir_iris_client.case import Case

6 -from fastapi import HTTPException

7 -from loguru import logger

8 -from sqlalchemy.ext.asyncio import AsyncSession

9 -from sqlalchemy.future import select