@cryptotaxi247 / CoPilot / commits / dc5fda1b

Fetch assets within iris alert (#162)

* Add endpoint to fetch assets by alert ID * Update CaseModel state_id and state_name fields * Add stack provisioning router * Update rotate_empty_index_set field to be optional * send sap siem to shuffle endpoint * Add command to retrieve admin password * some precommit fixes * Refactor provision_wazuh_content_pack route in Graylog * Add function to load content pack JSON file * Add insert_content_pack function to Graylog content_packs service * wazuh content pack change * Fix bug in login functionality * Update Wazuh Content Pack name * Add logging for POST request response and implement content pack installation and graylog system checking to ensure graylog version supports the content pack * add active-response readme * active response testing * Add windows firewall active response * Refactor firewall script and add block_ip function * precommit fixes * Update Windows Firewall script to include IP unblocking * Add wait_for_complete parameter to provision_wazuh_content_pack_route() * Add firewall.spec to .gitignore * Update active response command and add IP blocking action * full path for netsh * Fix Windows firewall script and update README.md * Update Wazuh configuration in readme * Update action to unblock IP and add agents list parameter * add active response markdowns * Add InvokeActiveResponseRequest model and update provision_wazuh_content_pack_route * precommit fixes * Refactor active response validation and alert creation * precommit fixes * precommit fixes * README updates * updated dependencies * updated vite config * Handle exception when creating customer in provision_wazuh_customer * readme install python * add to windows_firewall ar logging * updated npm scripts * updated assets types * updated soc assets apis * added soc alert assets component * updated soc asset description * ready for prod build * precommit fixes --------- Co-authored-by: Davide Di Modica <webmaster.ddm@gmail.com>

taylor_socfortress committed Feb 20, 2024 at 07:57 UTC dc5fda1b7bd58974162822e6de8faf8c5ca36ba7
41 files changed +5996 -229
.gitignore
+1
@@ -52,3 +52,4 @@ backend/file-store/api.config.yaml
52 unplugin.components.d.ts
53 package-lock.json
54 *.checkpoint
55 +firewall.spec
.vscode/settings.json
+8 -1
@@ -1,15 +1,22 @@
1 {
2 "cSpell.words": [
3 "ajoelp",
4 + "apexchart",
5 "colord",
6 + "datejs",
7 + "datetimesec",
8 "echarts",
9 + "Healthcheck",
10 + "majesticons",
11 "mimecast",
12 "picocolors",
13 "redoc",
14 "rushstack",
15 + "sparkline",
16 "taze",
17 "uvicorn",
18 "venv",
13 - "Wazuh"
19 + "Wazuh",
20 + "xaxis"
21 ]
22 }
README.md
+3
@@ -72,6 +72,9 @@ mkdir data
72
73 # Run Copilot
74 docker compose up -d
75 +
76 +# Once Copilot has started up you can retrieve the admin password by running the following command (Only accessible the first time Copilot is started up)
77 +docker logs "$(docker ps --filter ancestor=ghcr.io/socfortress/copilot-backend:latest --format "{{.ID}}")" 2>&1 | grep "Admin user password"
78 ```
79
80 Copilot shall be available on the host interface, port 443, protocol HTTPS - `https://<your_instance_ip>`.
backend/app/active_response/README.md new
+67
@@ -0,0 +1,67 @@
1 +Windows custom active response configuration
2 +
3 +You can implement the custom Python script on Windows endpoints using two methods. The first method converts Python scripts to executable applications, while the second method uses a Windows Batch launcher to run the Python script.
4 +
5 +Both methods require Python installed on the Windows endpoint. Use the following steps below to install Python on the Windows endpoint.
6 +
7 +#. Download Python executable installer from the `official Python website <https://www.python.org/downloads/windows/>`\_\_.
8 +#. Run the Python installer once downloaded. Check the following boxes when prompted and start the installation:
9 +
10 +- **Use admin privileges when installing py.exe**.
11 +- **Add python.exe to PATH**. This places the interpreter in the execution path.
12 +
13 +Or you can use the following PowerShell command to install Python:
14 +
15 +```
16 +Invoke-WebRequest -Uri "https://www.python.org/ftp/python/3.11.0/python-3.11.0-amd64.exe" -OutFile "$env:TEMP\python-3.11.0-amd64.exe"; Start-Process -FilePath "$env:TEMP\python-3.11.0-amd64.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1" -Wait -NoNewWindow
17 +```
18 +
19 +Method 1: Convert the Python script to an executable application
20 +""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
21 +
22 +#. Open an administrator PowerShell terminal and use `pip` to install `pyinstaller`:
23 +
24 + > pip install pyinstaller
25 + > pyinstaller --version
26 +
27 +#. Run the following command using PowerShell with administrator privileges to create the executable file:
28 +
29 +❗ - Make sure to point to the Wazuh DLLs
30 +
31 +```powershell
32 +pyinstaller --log-level DEBUG --add-data "C:\Program Files (x86)\ossec-agent\libwazuhext.dll;." --add-data "C:\Program Files (x86)\ossec-agent\libwinpthread-1.dll;." --add-data "C:\Program Files (x86)\ossec-agent\libwazuhshared.dll;." -F <PATH_TO_CUSTOM-AR.PY>
33 +```
34 +
35 +You can find the created `custom-ar.exe` executable in the `C:\Users\<USER>\dist\` directory.
36 +
37 +#. Copy the `custom-ar.exe` executable file to `C:\Program Files (x86)\ossec-agent\active-response\bin\` directory on the monitored endpoint.
38 +#. Restart the Wazuh agent using PowerShell with administrator privileges to apply the changes:
39 +
40 +.. code-block:: console
41 +
42 + > Restart-Service -Name wazuh
43 +
44 +#. On the Wazuh server, add the `<command>` and `<active-response>` blocks below to the `/var/ossec/etc/ossec.conf` configuration file. This uses the `custom-ar.exe` executable for Windows endpoints.
45 +
46 +```xml
47 +<command>
48 + <name>windows_firewall</name>
49 + <executable>windows_firewall.exe</executable>
50 + <timeout_allowed>no</timeout_allowed>
51 + </command>
52 +
53 + <active-response>
54 + <disabled>no</disabled>
55 + <command>windows_firewall</command>
56 + <location>local</location>
57 + <timeout>60</timeout>
58 + </active-response>
59 +```
60 +
61 +#. Restart the Wazuh manager to apply the changes:
62 +
63 +```console
64 +systemctl restart wazuh-manager
65 +```
66 +
67 +With this configuration, Wazuh runs an executable instead of a Python script when triggering an active response on a Windows endpoint.
backend/app/active_response/routes/active_response.py new
+118
@@ -0,0 +1,118 @@
1 +import json
2 +from pathlib import Path
3 +
4 +import aiofiles
5 +from fastapi import APIRouter
6 +from fastapi import HTTPException
7 +from fastapi import Security
8 +from fastapi.responses import JSONResponse
9 +from loguru import logger
10 +
11 +from app.active_response.schema.active_response import ActiveResponse
12 +from app.active_response.schema.active_response import ActiveResponseDetails
13 +from app.active_response.schema.active_response import ActiveResponsesSupported
14 +from app.active_response.schema.active_response import ActiveResponsesSupportedResponse
15 +from app.active_response.schema.active_response import InvokeActiveResponseRequest
16 +from app.active_response.schema.active_response import InvokeActiveResponseResponse
17 +from app.auth.utils import AuthHandler
18 +from app.connectors.wazuh_manager.utils.universal import send_put_request
19 +
20 +active_response_router = APIRouter()
21 +
22 +
23 +async def verify_active_response_name(active_response_name: str) -> None:
24 + """
25 + Verify the active response name
26 + """
27 + active_response_name = active_response_name.upper()
28 + if active_response_name not in ActiveResponsesSupported.__members__:
29 + raise HTTPException(status_code=404, detail="Active Response not found")
30 +
31 +
32 +def get_markdown_content_path(directory: str, filename: str) -> str:
33 + """
34 + Get the path to the markdown content
35 + """
36 + current_directory = Path(__file__).parent.parent
37 + return str(current_directory / f"scripts/{directory}/{filename}")
38 +
39 +
40 +async def read_markdown_file(file_path: str) -> str:
41 + """
42 + Read the content of a markdown file
43 + """
44 + async with aiofiles.open(file_path, "r") as file:
45 + return await file.read()
46 +
47 +
48 +@active_response_router.get(
49 + "/describe/{active_response_name}",
50 + response_model=ActiveResponse,
51 + description="Get the details of a specific active response",
52 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
53 +)
54 +async def get_active_response_details_route(active_response_name: str) -> ActiveResponse:
55 + """
56 + Get the details of a specific active response
57 + """
58 + await verify_active_response_name(active_response_name)
59 + directory = active_response_name.split("_")[0].lower()
60 + file_path = get_markdown_content_path(directory, f"{active_response_name}.md")
61 + logger.info(f"Reading markdown file: {file_path}")
62 + response = ActiveResponseDetails(
63 + name=active_response_name,
64 + description=ActiveResponsesSupported[active_response_name.upper()].value,
65 + markdown_content=await read_markdown_file(file_path),
66 + )
67 + return JSONResponse(content=response.dict())
68 +
69 +
70 +@active_response_router.get(
71 + "/supported",
72 + response_model=ActiveResponsesSupportedResponse,
73 + description="Get the list of supported active responses",
74 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
75 +)
76 +async def get_supported_active_responses_route() -> ActiveResponsesSupportedResponse:
77 + """
78 + Get the list of supported active responses
79 + """
80 + return ActiveResponsesSupportedResponse(
81 + supported_active_responses=[
82 + ActiveResponse(name=active_response.name, description=active_response.value) for active_response in ActiveResponsesSupported
83 + ],
84 + success=True,
85 + message="Supported Active Responses retrieved successfully",
86 + )
87 +
88 +
89 +@active_response_router.post(
90 + "/invoke",
91 + response_model=InvokeActiveResponseResponse,
92 + description="Invoke an active response",
93 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
94 +)
95 +async def invoke_active_response_route(
96 + request: InvokeActiveResponseRequest,
97 +) -> InvokeActiveResponseResponse:
98 + """
99 + Invoke an active response.
100 +
101 + Args:
102 + request (InvokeActiveResponseRequest): The request object containing the command, custom, arguments, and alert.
103 +
104 + Returns:
105 + InvokeActiveResponseResponse: The response object indicating the success or failure of the active response invocation.
106 + """
107 + logger.info("Invoking Wazuh Active Response...")
108 + # Append '0' to the command - This is required for Wazuh Active Response
109 + request.command = f"{request.command.value}0"
110 + # Create a dictionary with the request data
111 + data_dict = {"command": request.command, "custom": request.custom, "arguments": request.arguments, "alert": request.alert}
112 + await send_put_request(
113 + endpoint=request.endpoint,
114 + data=json.dumps(data_dict),
115 + params=request.params,
116 + )
117 +
118 + return InvokeActiveResponseResponse(success=True, message="Wazuh Active Response invoked successfully")
backend/app/active_response/schema/active_response.py new
+107
@@ -0,0 +1,107 @@
1 +from enum import Enum
2 +from typing import Any
3 +from typing import Dict
4 +from typing import List
5 +
6 +from fastapi import HTTPException
7 +from pydantic import BaseModel
8 +from pydantic import Field
9 +from pydantic import root_validator
10 +
11 +
12 +class ActiveResponsesSupported(Enum):
13 + WINDOWS_FIREWALL = "Block or unblock any outbound traffic to the defined IP address via the Windows Firewall"
14 + # Add more active responses here as needed
15 +
16 +
17 +class ActiveResponse(BaseModel):
18 + name: str
19 + description: str
20 +
21 +
22 +class ActiveResponsesSupportedResponse(BaseModel):
23 + supported_active_responses: List[ActiveResponse]
24 + success: bool
25 + message: str
26 +
27 +
28 +class ActiveResponseDetails(BaseModel):
29 + name: str
30 + description: str
31 + markdown_content: str
32 +
33 + class Config:
34 + json_encoders = {str: lambda v: v.encode("utf-8", "ignore").decode("utf-8")}
35 +
36 +
37 +# ! Invoke Active Response ! #
38 +class AlertAction(str, Enum):
39 + unblock = "unblock"
40 + block = "block"
41 +
42 +
43 +class BaseModelWithEnum(BaseModel):
44 + class Config:
45 + use_enum_values = True
46 +
47 +
48 +class WindowsFirewallAlert(BaseModelWithEnum):
49 + action: AlertAction
50 + ip: str
51 +
52 +
53 +class LinuxFirewallAlert(BaseModelWithEnum):
54 + action: AlertAction
55 + ip: str
56 +
57 +
58 +class ActiveResponseCommand(str, Enum):
59 + windows_firewall = "windows_firewall"
60 + linux_firewall = "linux_firewall"
61 +
62 + @classmethod
63 + def _missing_(cls, value):
64 + for member in cls:
65 + if member.name == value:
66 + return member
67 +
68 + for active_response in ActiveResponsesSupported:
69 + if active_response.name.lower() == value.lower():
70 + return cls[f"{value}0"]
71 +
72 + raise HTTPException(
73 + status_code=400,
74 + detail=f"Invalid command: {value}, must be one of {', '.join([member.name for member in cls])}",
75 + )
76 +
77 +
78 +class ParamsModel(BaseModel):
79 + wait_for_complete: bool
80 + agents_list: List[str]
81 +
82 +
83 +class InvokeActiveResponseRequest(BaseModel):
84 + endpoint: str = Field("active-response", const=True)
85 + arguments: list[str] = Field(default_factory=list)
86 + command: ActiveResponseCommand
87 + custom: bool = Field(True, const=True)
88 + alert: Dict[str, Any]
89 + params: ParamsModel
90 +
91 + @root_validator(pre=True)
92 + def create_alert(cls, values):
93 + command = values.get("command")
94 + alert = values.get("alert")
95 + if command == ActiveResponseCommand.windows_firewall:
96 + values["alert"] = WindowsFirewallAlert(**alert)
97 + elif command == ActiveResponseCommand.linux_firewall:
98 + values["alert"] = LinuxFirewallAlert(**alert)
99 + else:
100 + raise HTTPException(status_code=400, detail="Invalid command for alert")
101 +
102 + return values
103 +
104 +
105 +class InvokeActiveResponseResponse(BaseModel):
106 + success: bool
107 + message: str
backend/app/active_response/scripts/template.py new
+167
@@ -0,0 +1,167 @@
1 +#!/usr/bin/python3
2 +# Copyright (C) 2015-2022, Wazuh Inc.
3 +# All rights reserved.
4 +
5 +# This program is free software; you can redistribute it
6 +# and/or modify it under the terms of the GNU General Public
7 +# License (version 2) as published by the FSF - Free Software
8 +# Foundation.
9 +
10 +import datetime
11 +import json
12 +import os
13 +import sys
14 +from pathlib import PurePosixPath
15 +from pathlib import PureWindowsPath
16 +
17 +if os.name == "nt":
18 + LOG_FILE = "C:\\Program Files (x86)\\ossec-agent\\active-response\\active-responses.log"
19 +else:
20 + LOG_FILE = "/var/ossec/logs/active-responses.log"
21 +
22 +ADD_COMMAND = 0
23 +DELETE_COMMAND = 1
24 +CONTINUE_COMMAND = 2
25 +ABORT_COMMAND = 3
26 +
27 +OS_SUCCESS = 0
28 +OS_INVALID = -1
29 +
30 +
31 +class message:
32 + def __init__(self):
33 + self.alert = ""
34 + self.command = 0
35 +
36 +
37 +def write_debug_file(ar_name, msg):
38 + with open(LOG_FILE, mode="a") as log_file:
39 + ar_name_posix = str(PurePosixPath(PureWindowsPath(ar_name[ar_name.find("active-response") :])))
40 + log_file.write(str(datetime.datetime.now().strftime("%Y/%m/%d %H:%M:%S")) + " " + ar_name_posix + ": " + msg + "\n")
41 +
42 +
43 +def setup_and_check_message(argv):
44 + # get alert from stdin
45 + input_str = ""
46 + for line in sys.stdin:
47 + input_str = line
48 + break
49 +
50 + write_debug_file(argv[0], input_str)
51 +
52 + try:
53 + data = json.loads(input_str)
54 + except ValueError:
55 + write_debug_file(argv[0], "Decoding JSON has failed, invalid input format")
56 + message.command = OS_INVALID
57 + return message
58 +
59 + message.alert = data
60 +
61 + command = data.get("command")
62 +
63 + if command == "add":
64 + message.command = ADD_COMMAND
65 + elif command == "delete":
66 + message.command = DELETE_COMMAND
67 + else:
68 + message.command = OS_INVALID
69 + write_debug_file(argv[0], "Not valid command: " + command)
70 +
71 + return message
72 +
73 +
74 +def send_keys_and_check_message(argv, keys):
75 + # build and send message with keys
76 + keys_msg = json.dumps(
77 + {"version": 1, "origin": {"name": argv[0], "module": "active-response"}, "command": "check_keys", "parameters": {"keys": keys}},
78 + )
79 +
80 + write_debug_file(argv[0], keys_msg)
81 +
82 + print(keys_msg)
83 + sys.stdout.flush()
84 +
85 + # read the response of previous message
86 + input_str = ""
87 + while True:
88 + line = sys.stdin.readline()
89 + if line:
90 + input_str = line
91 + break
92 +
93 + write_debug_file(argv[0], input_str)
94 +
95 + try:
96 + data = json.loads(input_str)
97 + except ValueError:
98 + write_debug_file(argv[0], "Decoding JSON has failed, invalid input format")
99 + return message
100 +
101 + action = data.get("command")
102 +
103 + if "continue" == action:
104 + ret = CONTINUE_COMMAND
105 + elif "abort" == action:
106 + ret = ABORT_COMMAND
107 + else:
108 + ret = OS_INVALID
109 + write_debug_file(argv[0], "Invalid value of 'command'")
110 +
111 + return ret
112 +
113 +
114 +def main(argv):
115 + write_debug_file(argv[0], "Started")
116 +
117 + # validate json and get command
118 + msg = setup_and_check_message(argv)
119 +
120 + if msg.command < 0:
121 + sys.exit(OS_INVALID)
122 +
123 + if msg.command == ADD_COMMAND:
124 + """Start Custom Key
125 + At this point, it is necessary to select the keys from the alert and add them into the keys array.
126 + """
127 +
128 + alert = msg.alert["parameters"]["alert"]
129 + keys = [alert["rule"]["id"]]
130 +
131 + """ End Custom Key """
132 +
133 + action = send_keys_and_check_message(argv, keys)
134 +
135 + # if necessary, abort execution
136 + if action != CONTINUE_COMMAND:
137 + if action == ABORT_COMMAND:
138 + write_debug_file(argv[0], "Aborted")
139 + sys.exit(OS_SUCCESS)
140 + else:
141 + write_debug_file(argv[0], "Invalid command")
142 + sys.exit(OS_INVALID)
143 +
144 + """ Start Custom Action Add """
145 +
146 + with open("ar-test-result.txt", mode="a") as test_file:
147 + test_file.write("Active response triggered by rule ID: <" + str(keys) + ">\n")
148 +
149 + """ End Custom Action Add """
150 +
151 + elif msg.command == DELETE_COMMAND:
152 + """Start Custom Action Delete"""
153 +
154 + os.remove("ar-test-result.txt")
155 +
156 + """ End Custom Action Delete """
157 +
158 + else:
159 + write_debug_file(argv[0], "Invalid command")
160 +
161 + write_debug_file(argv[0], "Ended")
162 +
163 + sys.exit(OS_SUCCESS)
164 +
165 +
166 +if __name__ == "__main__":
167 + main(sys.argv)
backend/app/active_response/scripts/windows/windows_firewall.md new
+48
@@ -0,0 +1,48 @@
1 +# Windows Firewall
2 +
3 +## Description
4 +
5 +Wazuh Active Response capable of creating a new rule in the Windows Firewall to block or unblock traffic to a specific IP address.
6 +
7 +### Requirements
8 +
9 +- Python 3.11 or later installed on the Windows agent.
10 +- `windows_firewall.exe` - The executable file that will be used to create the rule in the Windows Firewall. Provided by SOCFortress at `https://repo.socfortress.co/repository/socfortress/active-response/windows_firewall.exe`.
11 +
12 +- Must be placed in the `C:\Program Files (x86)\ossec-agent\active-response\bin` directory on the Windows agent.
13 +
14 +### Download Python 3.11
15 +
16 +```powershell
17 +Invoke-WebRequest -Uri "https://www.python.org/ftp/python/3.11.0/python-3.11.0-amd64.exe" -OutFile "$env:TEMP\python-3.11.0-amd64.exe"; Start-Process -FilePath "$env:TEMP\python-3.11.0-amd64.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1" -Wait -NoNewWindow
18 +```
19 +
20 +### Download Script Via PowerShell
21 +
22 +```powershell
23 +Invoke-WebRequest -Uri "https://repo.socfortress.co/repository/socfortress/active-response/windows_firewall.exe" -OutFile "C:\Program Files (x86)\ossec-agent\active-response\bin\windows_firewall.exe"
24 +```
25 +
26 +## Wazuh Manager Configuration
27 +
28 +The following configuration must be added to the `ossec.conf` file on the Wazuh manager.
29 +
30 +```xml
31 +<command>
32 + <name>windows_firewall</name>
33 + <executable>windows_firewall.exe</executable>
34 + <timeout_allowed>no</timeout_allowed>
35 + </command>
36 +
37 + <active-response>
38 + <disabled>no</disabled>
39 + <command>windows_firewall</command>
40 + <location>local</location>
41 + <timeout>60</timeout>
42 + </active-response>
43 +```
44 +
45 +```bash
46 +# Restart the Wazuh manager to apply the changes
47 +systemctl restart wazuh-manager
48 +```
backend/app/active_response/scripts/windows/windows_firewall.py new
+140
@@ -0,0 +1,140 @@
1 +#!/usr/bin/python3
2 +# Copyright (C) 2024, SOCFortress LLP.
3 +# All rights reserved.
4 +
5 +# This program is free software; you can redistribute it
6 +# and/or modify it under the terms of the GNU General Public
7 +# License (version 2) as published by the FSF - Free Software
8 +# Foundation.
9 +
10 +import datetime
11 +import ipaddress
12 +import json
13 +import os
14 +import subprocess
15 +import sys
16 +
17 +LOG_FILE = (
18 + "C:\\Program Files (x86)\\ossec-agent\\active-response\\active-responses.log"
19 + if os.name == "nt"
20 + else "/var/ossec/logs/active-responses.log"
21 +)
22 +
23 +COMMANDS = {"add": 0, "delete": 1, "continue": 2, "abort": 3}
24 +
25 +OS_SUCCESS = 0
26 +OS_INVALID = -1
27 +
28 +
29 +class Message:
30 + def __init__(self, alert="", command=0):
31 + self.alert = alert
32 + self.command = command
33 +
34 +
35 +def write_debug_file(ar_name, msg):
36 + """Writes a debug message to the log file."""
37 + with open(LOG_FILE, mode="a") as log_file:
38 + log_msg = {
39 + "timestamp": datetime.datetime.now().strftime("%Y/%m/%d %H:%M:%S"),
40 + "active_response": "windows_firewall",
41 + "message": json.loads(msg) if isinstance(msg, str) and msg.strip().startswith("{") else msg,
42 + }
43 + log_file.write(json.dumps(log_msg) + "\n")
44 +
45 +
46 +def setup_and_check_message(argv):
47 + """Reads and validates the input message."""
48 + input_str = next(sys.stdin, "")
49 + write_debug_file(argv[0], input_str)
50 + try:
51 + data = json.loads(input_str)
52 + except ValueError:
53 + write_debug_file(argv[0], "Decoding JSON has failed, invalid input format")
54 + return Message(command=OS_INVALID)
55 + command = COMMANDS.get(data.get("command"), OS_INVALID)
56 + if command == OS_INVALID:
57 + write_debug_file(argv[0], "Not valid command: " + data.get("command"))
58 + return Message(alert=data, command=command)
59 +
60 +
61 +def is_valid_ipv4(ip):
62 + """Checks if an IP address is valid and not private."""
63 + try:
64 + ip_obj = ipaddress.IPv4Address(ip)
65 + return ip_obj.is_global
66 + except ipaddress.AddressValueError:
67 + return False
68 +
69 +
70 +def block_ip(ip):
71 + """Blocks an IP address on the Windows Firewall."""
72 + try:
73 + subprocess.run(
74 + [
75 + r"C:\Windows\System32\netsh",
76 + "advfirewall",
77 + "firewall",
78 + "add",
79 + "rule",
80 + f"name=SOCFortress Block Outbound {ip}",
81 + "dir=out",
82 + "action=block",
83 + f"remoteip={ip}",
84 + ],
85 + check=True,
86 + )
87 + return f"Blocked IP {ip} on Windows Firewall"
88 + except subprocess.CalledProcessError as e:
89 + return f"Failed to block IP {ip} on Windows Firewall: {e}"
90 +
91 +
92 +def remove_ip(ip):
93 + """Removes a blocked IP address from the Windows Firewall."""
94 + try:
95 + subprocess.run(
96 + [r"C:\Windows\System32\netsh", "advfirewall", "firewall", "delete", "rule", f"name=SOCFortress Block Outbound {ip}"],
97 + check=True,
98 + )
99 + return f"Removed blocked IP {ip} from Windows Firewall"
100 + except subprocess.CalledProcessError as e:
101 + return f"Failed to remove blocked IP {ip} from Windows Firewall: {e}"
102 +
103 +
104 +def extract_alert_info(msg, argv):
105 + """Extracts the action and IP from the alert message."""
106 + try:
107 + alert = msg.alert["parameters"]["alert"]
108 + action = alert["action"]
109 + ip = alert["ip"]
110 + except KeyError as e:
111 + write_debug_file(argv[0], f"Missing key in alert message: {str(e)}")
112 + sys.exit(OS_INVALID)
113 + return action, ip
114 +
115 +
116 +def main(argv):
117 + write_debug_file(argv[0], {"status": "Started"})
118 + msg = setup_and_check_message(argv)
119 + if msg.command < 0:
120 + sys.exit(OS_INVALID)
121 + if msg.command == COMMANDS["add"]:
122 + action, ip = extract_alert_info(msg, argv)
123 + if not is_valid_ipv4(ip):
124 + write_debug_file(argv[0], {"status": "failed", "message": f"Invalid IP address {ip}"})
125 + sys.exit(OS_INVALID)
126 + if action == "block":
127 + write_debug_file(argv[0], block_ip(ip))
128 + if action == "unblock":
129 + write_debug_file(argv[0], remove_ip(ip))
130 + elif msg.command == COMMANDS["delete"]:
131 + # Optionally, include logic here to remove the firewall rule if necessary
132 + pass
133 + else:
134 + write_debug_file(argv[0], "Invalid command")
135 + write_debug_file(argv[0], "Ended")
136 + sys.exit(OS_SUCCESS)
137 +
138 +
139 +if __name__ == "__main__":
140 + main(sys.argv)
backend/app/connectors/dfir_iris/routes/alerts.py
+31
@@ -6,6 +6,7 @@ from loguru import logger
6 from sqlalchemy.ext.asyncio import AsyncSession
7
8 from app.auth.utils import AuthHandler
9 +from app.connectors.dfir_iris.schema.alerts import AlertAssetsResponse
10 from app.connectors.dfir_iris.schema.alerts import AlertResponse
11 from app.connectors.dfir_iris.schema.alerts import AlertsResponse
12 from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse
@@ -13,6 +14,7 @@ from app.connectors.dfir_iris.schema.alerts import CaseCreationResponse
14 from app.connectors.dfir_iris.schema.alerts import DeleteAlertResponse
15 from app.connectors.dfir_iris.schema.alerts import DeleteMultipleAlertsRequest
16 from app.connectors.dfir_iris.schema.alerts import FilterAlertsRequest
17 +from app.connectors.dfir_iris.schema.alerts import IrisAsset
18 from app.connectors.dfir_iris.services.alerts import bookmark_alert
19 from app.connectors.dfir_iris.services.alerts import create_case
20 from app.connectors.dfir_iris.services.alerts import delete_alert
@@ -110,6 +112,35 @@ async def get_alert_by_id(
112 return await get_alert(alert_id=alert_id, session=session)
113
114
115 +@dfir_iris_alerts_router.get(
116 + "/assets/{alert_id}",
117 + response_model=AlertAssetsResponse,
118 + description="Get all assets associated with an alert",
119 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
120 +)
121 +async def get_assets_by_alert_id(
122 + alert_id: str = Depends(verify_alert_exists),
123 + session: AsyncSession = Depends(get_db),
124 +) -> AlertAssetsResponse:
125 + """
126 + Retrieve the list of assets associated with an alert by its ID.
127 +
128 + Args:
129 + alert_id (str): The ID of the alert to retrieve.
130 +
131 + Returns:
132 + AlertResponse: The response containing the alert information.
133 + """
134 + logger.info(f"Fetching assets for alert {alert_id}")
135 + assets_data = (await get_alert(alert_id=alert_id, session=session)).alert["assets"]
136 + assets = [IrisAsset(**asset) for asset in assets_data] # Parse the assets data into Asset objects
137 + return AlertAssetsResponse(
138 + success=True,
139 + message="Successfully fetched assets",
140 + assets=assets,
141 + )
142 +
143 +
144 @dfir_iris_alerts_router.get(
145 "/alerts_by_user/{user_id}",
146 response_model=AlertsResponse,
backend/app/connectors/dfir_iris/schema/alerts.py
+40
@@ -6,6 +6,7 @@ from typing import Optional
6
7 from pydantic import BaseModel
8 from pydantic import Field
9 +from pydantic import validator
10
11
12 class AlertsResponse(BaseModel):
@@ -94,3 +95,42 @@ class CaseCreationResponse(BaseModel):
95 success: bool
96 case: CaseData
97 message: str
98 +
99 +
100 +class IrisAssetType(BaseModel):
101 + asset_id: int
102 + asset_icon_compromised: str
103 + asset_name: str
104 + asset_icon_not_compromised: str
105 + asset_description: str
106 +
107 +
108 +class IrisAsset(BaseModel):
109 + asset_name: str
110 + asset_description: str
111 + asset_type: IrisAssetType
112 + custom_attributes: Optional[str]
113 + asset_tags: str
114 + asset_compromise_status_id: Optional[int]
115 + date_update: Optional[str]
116 + asset_enrichment: Optional[str]
117 + case_id: Optional[int]
118 + user_id: Optional[int]
119 + asset_type_id: int
120 + asset_id: int
121 + asset_ip: str
122 + asset_domain: Optional[str]
123 + asset_uuid: str
124 + analysis_status_id: Optional[int]
125 + asset_info: Optional[str]
126 + date_added: Optional[str]
127 +
128 + @validator("asset_tags", pre=True)
129 + def remove_agent_id(cls, v):
130 + return v.replace("agent_id:", "") if v else v
131 +
132 +
133 +class AlertAssetsResponse(BaseModel):
134 + success: bool
135 + message: str
136 + assets: List[IrisAsset]
backend/app/connectors/dfir_iris/schema/cases.py
+2 -2
@@ -26,8 +26,8 @@ class CaseModel(BaseModel):
26 opened_by_user_id: int
27 owner: str
28 owner_id: int
29 - state_id: int
30 - state_name: str
29 + state_id: Optional[int] = Field(None, description="The ID of the state the case is in.")
30 + state_name: Optional[str] = Field(None, description="The name of the state the case is in.")
31 customer_code: str
32
33
backend/app/connectors/graylog/schema/content_packs.py new
+88
@@ -0,0 +1,88 @@
1 +from typing import Any
2 +from typing import Dict
3 +from typing import List
4 +from typing import Optional
5 +
6 +from pydantic import BaseModel
7 +from pydantic import Extra
8 +from pydantic import Field
9 +
10 +
11 +class Configuration(BaseModel):
12 + api_url: Optional[str] = Field(None, alias="@value")
13 + http_connect_timeout: Optional[int] = Field(None, alias="@value")
14 + http_read_timeout: Optional[int] = Field(None, alias="@value")
15 + http_user_agent: Optional[str] = Field(None, alias="@value")
16 + http_write_timeout: Optional[int] = Field(None, alias="@value")
17 + indicator: Optional[str] = Field(None, alias="@value")
18 + type: Optional[str] = Field(None, alias="@value")
19 + # Add other fields as needed
20 +
21 + class Config:
22 + extra = Extra.allow # This line allows for additional fields that are not defined in the model.
23 +
24 +
25 +class Data(BaseModel):
26 + configuration: Optional[Configuration]
27 + description: Optional[str] = Field(None, alias="@value")
28 + name: Optional[str] = Field(None, alias="@value")
29 + title: Optional[str] = Field(None, alias="@value")
30 + # Define other fields as per your JSON structure
31 +
32 + class Config:
33 + extra = Extra.allow # This line allows for additional fields that are not defined in the model.
34 +
35 +
36 +class Type(BaseModel):
37 + name: str
38 + version: str
39 +
40 + class Config:
41 + extra = Extra.allow # This line allows for additional fields that are not defined in the model.
42 +
43 +
44 +class Constraint(BaseModel):
45 + type: str
46 + version: str
47 + # Additional fields based on constraints data
48 +
49 + class Config:
50 + extra = Extra.allow # This line allows for additional fields that are not defined in the model.
51 +
52 +
53 +class Entity(BaseModel):
54 + id: str
55 + type: Type
56 + v: str
57 + data: Data
58 + constraints: List[Constraint]
59 +
60 + class Config:
61 + extra = Extra.allow # This line allows for additional fields that are not defined in the model.
62 +
63 +
64 +class ContentPack(BaseModel):
65 + id: str
66 + rev: int
67 + v: str
68 + name: str
69 + summary: str
70 + description: str
71 + vendor: str
72 + url: str
73 + created_at: str
74 + server_version: str
75 + parameters: List
76 + entities: List[Entity]
77 +
78 + class Config:
79 + extra = Extra.allow # This line allows for additional fields that are not defined in the model.
80 +
81 +
82 +class ContentPackList(BaseModel):
83 + total: int
84 + content_packs: List[ContentPack]
85 + content_packs_metadata: Optional[Dict[str, Any]]
86 +
87 + class Config:
88 + extra = Extra.allow # This line allows for additional fields that are not defined in the model.
backend/app/connectors/graylog/schema/management.py
+16
@@ -1,3 +1,4 @@
1 +from datetime import datetime
2 from typing import List
3
4 from pydantic import BaseModel
@@ -64,3 +65,18 @@ class UrlWhitelistEntryResponse(BaseModel):
65 success: bool
66 message: str
67 url_whitelist_entries: UrlWhitelistEntries
68 +
69 +
70 +class GraylogServerInfo(BaseModel):
71 + facility: str
72 + codename: str
73 + node_id: str
74 + cluster_id: str
75 + version: str
76 + started_at: datetime
77 + hostname: str
78 + lifecycle: str
79 + lb_status: str
80 + timezone: str
81 + operating_system: str
82 + is_processing: bool
backend/app/connectors/graylog/services/content_packs.py new
+111
@@ -0,0 +1,111 @@
1 +from typing import List
2 +
3 +from fastapi import HTTPException
4 +from loguru import logger
5 +from pydantic import parse_obj_as
6 +
7 +from app.connectors.graylog.schema.content_packs import ContentPack
8 +from app.connectors.graylog.schema.content_packs import ContentPackList
9 +from app.connectors.graylog.utils.universal import send_get_request
10 +from app.connectors.graylog.utils.universal import send_post_request
11 +
12 +
13 +async def get_content_packs() -> List[ContentPack]:
14 + """Get content packs from Graylog.
15 +
16 + Returns:
17 + List[ContentPack]: The list of collected content packs.
18 +
19 + Raises:
20 + HTTPException: If there is an error collecting the content packs.
21 + """
22 + logger.info("Getting content packs from Graylog")
23 + try:
24 + content_packs_collected = await send_get_request(
25 + endpoint="/api/system/content_packs",
26 + )
27 + if content_packs_collected.get("success"):
28 + logger.info("Content packs collected successfully")
29 + content_packs_list = parse_obj_as(ContentPackList, content_packs_collected.get("data"))
30 + return content_packs_list.content_packs
31 + else:
32 + raise HTTPException(status_code=500, detail="Content packs collection unsuccessful")
33 + except KeyError as e:
34 + error_msg = f"Failed to collect content packs key: {e}"
35 + logger.error(error_msg)
36 + raise HTTPException(status_code=500, detail=error_msg)
37 + except Exception as e:
38 + error_msg = f"Failed to collect content packs: {e}"
39 + logger.error(error_msg)
40 + raise HTTPException(status_code=500, detail=error_msg)
41 +
42 +
43 +async def insert_content_pack(content_pack: ContentPack) -> bool:
44 + """Insert a content pack into Graylog.
45 +
46 + Args:
47 + content_pack (ContentPack): The content pack to insert.
48 +
49 + Returns:
50 + bool: True if the content pack was inserted successfully, False if it was not.
51 +
52 + Raises:
53 + HTTPException: If there is an error inserting the content pack.
54 + """
55 + logger.info(f"Inserting content pack {content_pack} into Graylog")
56 + try:
57 + content_pack_inserted = await send_post_request(
58 + endpoint="/api/system/content_packs",
59 + data=content_pack,
60 + )
61 + logger.info(f"Content pack inserted: {content_pack_inserted}")
62 + if content_pack_inserted["success"] is True:
63 + logger.info("Content pack inserted successfully")
64 + return True
65 + else:
66 + raise HTTPException(status_code=500, detail="Content pack insertion unsuccessful")
67 + except KeyError as e:
68 + error_msg = f"Failed to insert content pack key: {e}"
69 + logger.error(error_msg)
70 + raise HTTPException(status_code=500, detail=error_msg)
71 + except Exception as e:
72 + error_msg = f"Failed to insert content pack: {e}"
73 + logger.error(error_msg)
74 + raise HTTPException(status_code=500, detail=error_msg)
75 +
76 +
77 +async def install_content_pack(content_pack_id: str, revision: int) -> bool:
78 + """Install a content pack in Graylog.
79 +
80 + Args:
81 + content_pack_id (str): The ID of the content pack to install.
82 + revision (int): The revision of the content pack to install.
83 +
84 + Returns:
85 + bool: True if the content pack was installed successfully, False if it was not.
86 +
87 + Raises:
88 + HTTPException: If there is an error installing the content pack.
89 + """
90 + logger.info(f"Installing content pack {content_pack_id} in Graylog")
91 + try:
92 + content_pack_installed = await send_post_request(
93 + endpoint=f"/api/system/content_packs/{content_pack_id}/{revision}/installations",
94 + data={
95 + "comment": "Installed by SOCFortress CoPilot",
96 + },
97 + )
98 + logger.info(f"Content pack installed: {content_pack_installed}")
99 + if content_pack_installed["success"] is True:
100 + logger.info("Content pack installed successfully")
101 + return True
102 + else:
103 + raise HTTPException(status_code=500, detail="Content pack installation unsuccessful")
104 + except KeyError as e:
105 + error_msg = f"Failed to install content pack key: {e}"
106 + logger.error(error_msg)
107 + raise HTTPException(status_code=500, detail=error_msg)
108 + except Exception as e:
109 + error_msg = f"Failed to install content pack: {e}"
110 + logger.error(error_msg)
111 + raise HTTPException(status_code=500, detail=error_msg)
backend/app/connectors/graylog/services/management.py
+13
@@ -2,6 +2,7 @@ from loguru import logger
2
3 from app.connectors.graylog.schema.management import DeletedIndexBody
4 from app.connectors.graylog.schema.management import DeletedIndexResponse
5 +from app.connectors.graylog.schema.management import GraylogServerInfo
6 from app.connectors.graylog.schema.management import StartInputBody
7 from app.connectors.graylog.schema.management import StartInputResponse
8 from app.connectors.graylog.schema.management import StartStreamBody
@@ -12,10 +13,22 @@ from app.connectors.graylog.schema.management import StopStreamBody
13 from app.connectors.graylog.schema.management import StopStreamResponse
14 from app.connectors.graylog.services.collector import get_index_names
15 from app.connectors.graylog.utils.universal import send_delete_request
16 +from app.connectors.graylog.utils.universal import send_get_request
17 from app.connectors.graylog.utils.universal import send_post_request
18 from app.connectors.graylog.utils.universal import send_put_request
19
20
21 +async def get_system_info() -> GraylogServerInfo:
22 + """Get system information from Graylog.
23 +
24 + Returns:
25 + GraylogServerInfo: The system information from Graylog.
26 + """
27 + logger.info("Getting system information from Graylog")
28 + response = await send_get_request(endpoint="/api/system")
29 + return GraylogServerInfo(**response["data"])
30 +
31 +
32 async def delete_index(index_name: DeletedIndexBody) -> DeletedIndexResponse:
33 """Delete an index from Graylog.
34
backend/app/connectors/graylog/utils/universal.py
+15 -5
@@ -159,6 +159,9 @@ async def send_post_request(
159 json=data,
160 verify=False,
161 )
162 + logger.info(
163 + f"Response from POST request: {response.status_code} {response.text}",
164 + )
165
166 if response.status_code == 200:
167 return {
@@ -173,11 +176,18 @@ async def send_post_request(
176 "message": "Successfully completed request with no content",
177 }
178 elif response.status_code == 201:
176 - return {
177 - "data": response.json(),
178 - "success": True,
179 - "message": "Successfully created data",
180 - }
179 + try:
180 + return {
181 + "data": response.json(),
182 + "success": True,
183 + "message": "Successfully created data",
184 + }
185 + except ValueError:
186 + return {
187 + "data": None,
188 + "success": True,
189 + "message": "Successfully created data, but no data returned",
190 + }
191 else:
192 raise HTTPException(
193 status_code=500,
backend/app/connectors/wazuh_manager/utils/universal.py
+2
@@ -254,6 +254,8 @@ async def send_put_request(
254 if attributes is None:
255 logger.error("No Wazuh Manager connector found in the database")
256 return None
257 + # Add the default `Content-Type` header to the request
258 + wazuh_manager_client["Content-Type"] = "application/json"
259 # Add the `Content-Type` header to the request if the data is XML
260 if xml_data:
261 wazuh_manager_client["Content-Type"] = "application/xml"
backend/app/customer_provisioning/schema/graylog.py
+1 -1
@@ -65,7 +65,7 @@ class RotationStrategyConfig(BaseModel):
65 type: str
66 rotation_period: str = Field(..., alias="rotation_period")
67 max_rotation_period: Optional[str] = Field(None, alias="max_rotation_period")
68 - rotate_empty_index_set: bool = Field(..., alias="rotate_empty_index_set")
68 + rotate_empty_index_set: Optional[bool] = Field(None, alias="rotate_empty_index_set")
69
70
71 class RetentionStrategyConfig(BaseModel):
backend/app/customer_provisioning/services/provision.py
+4 -1
@@ -89,7 +89,10 @@ async def provision_wazuh_customer(
89 ),
90 )
91
92 - provision_meta_data["iris_customer_id"] = (await create_customer(request.customer_name)).data.customer_id
92 + try:
93 + provision_meta_data["iris_customer_id"] = (await create_customer(request.customer_name)).data.customer_id
94 + except Exception:
95 + provision_meta_data["iris_customer_id"] = 2
96
97 customer_provision_meta = CustomerProvisionMeta(**provision_meta_data)
98 customer_meta = await update_customer_meta_table(
backend/app/integrations/sap_siem/services/sap_siem_multiple_logins.py
+14
@@ -18,6 +18,8 @@ from app.integrations.sap_siem.schema.sap_siem import InvokeSAPSiemResponse
18 from app.integrations.sap_siem.schema.sap_siem import IrisCasePayload
19 from app.integrations.sap_siem.schema.sap_siem import SapSiemWazuhIndexerResponse
20 from app.integrations.sap_siem.schema.sap_siem import SuspiciousLogin
21 +from app.integrations.utils.alerts import send_to_shuffle
22 +from app.integrations.utils.schema import ShufflePayload
23 from app.utils import get_customer_alert_settings
24
25 # Global set to keep track of IPs that have already been checked
@@ -49,6 +51,18 @@ async def handle_common_suspicious_login_tasks(
51 user_activity = await collect_user_activity(suspicious_login)
52 await handle_user_activity(user_activity, unique_instances, case.data.case_id)
53 await mark_as_checked(suspicious_login)
54 + alert_source_link = (await get_customer_alert_settings(suspicious_login.customer_code, session=session)).shuffle_endpoint
55 + await send_to_shuffle(
56 + ShufflePayload(
57 + alert_id=case.data.case_id,
58 + customer=suspicious_login.customer_code,
59 + customer_code=suspicious_login.customer_code,
60 + alert_source_link=f"{alert_source_link}/case?cid={case.data.case_id}",
61 + rule_description=f"{case.data.case_name}",
62 + hostname=suspicious_login.ip,
63 + ),
64 + session=session,
65 + )
66
67
68 async def handle_suspicious_login_multiple(suspicious_login, unique_instances, case_ids, session: AsyncSession):
backend/app/integrations/sap_siem/services/sap_siem_suspicious_logins.py
+14
@@ -13,6 +13,8 @@ from app.integrations.sap_siem.schema.sap_siem import InvokeSAPSiemResponse
13 from app.integrations.sap_siem.schema.sap_siem import IrisCasePayload
14 from app.integrations.sap_siem.schema.sap_siem import SapSiemWazuhIndexerResponse
15 from app.integrations.sap_siem.schema.sap_siem import SuspiciousLogin
16 +from app.integrations.utils.alerts import send_to_shuffle
17 +from app.integrations.utils.schema import ShufflePayload
18 from app.utils import get_customer_alert_settings
19
20 # global set to keep track of checked IPs
@@ -203,6 +205,18 @@ async def handle_common_suspicious_login_tasks(
205 logger.info(f"User Activity: {user_activity}")
206 await handle_user_activity(user_activity, unique_instances, case.data.case_id)
207 await mark_as_checked(suspicious_login)
208 + alert_source_link = (await get_customer_alert_settings(suspicious_login.customer_code, session=session)).shuffle_endpoint
209 + await send_to_shuffle(
210 + ShufflePayload(
211 + alert_id=case.data.case_id,
212 + customer=suspicious_login.customer_code,
213 + customer_code=suspicious_login.customer_code,
214 + alert_source_link=f"{alert_source_link}/case?cid={case.data.case_id}",
215 + rule_description=f"{case.data.case_name}",
216 + hostname=suspicious_login.ip,
217 + ),
218 + session=session,
219 + )
220
221
222 async def handle_suspicious_login(suspicious_login, unique_instances, case_ids, session: AsyncSession):
backend/app/routers/active_response.py new
+13
@@ -0,0 +1,13 @@
1 +from fastapi import APIRouter
2 +
3 +from app.active_response.routes.active_response import active_response_router
4 +
5 +# Instantiate the APIRouter
6 +router = APIRouter()
7 +
8 +# Include the Stack Provisioning related routes
9 +router.include_router(
10 + active_response_router,
11 + prefix="/active_response",
12 + tags=["Active Response"],
13 +)
backend/app/routers/stack_provisioning.py new
+15
@@ -0,0 +1,15 @@
1 +from fastapi import APIRouter
2 +
3 +from app.stack_provisioning.graylog.routes.provision import (
4 + stack_provisioning_graylog_router,
5 +)
6 +
7 +# Instantiate the APIRouter
8 +router = APIRouter()
9 +
10 +# Include the Stack Provisioning related routes
11 +router.include_router(
12 + stack_provisioning_graylog_router,
13 + prefix="/stack_provisioning",
14 + tags=["Stack Provisioning"],
15 +)
backend/app/stack_provisioning/graylog/routes/provision.py new
+100
@@ -0,0 +1,100 @@
1 +from fastapi import APIRouter
2 +from fastapi import Depends
3 +from fastapi import HTTPException
4 +from fastapi import Security
5 +from loguru import logger
6 +from sqlalchemy.ext.asyncio import AsyncSession
7 +
8 +from app.auth.utils import AuthHandler
9 +from app.connectors.graylog.services.content_packs import get_content_packs
10 +from app.connectors.graylog.services.management import get_system_info
11 +from app.db.db_session import get_db
12 +from app.stack_provisioning.graylog.schema.provision import ProvisionGraylogResponse
13 +from app.stack_provisioning.graylog.services.provision import (
14 + provision_wazuh_content_pack,
15 +)
16 +
17 +stack_provisioning_graylog_router = APIRouter()
18 +
19 +
20 +async def get_graylog_version() -> str:
21 + """
22 + Get the version of the Graylog instance.
23 +
24 + Returns:
25 + str: The version of the Graylog instance.
26 + """
27 + system_info = await get_system_info()
28 + return system_info.version
29 +
30 +
31 +async def system_version_check(compatible_version: str) -> bool:
32 + """
33 + Check if the Graylog version is compatible with the content pack.
34 +
35 + Args:
36 + compatible_version (str): The version of the Graylog instance.
37 +
38 + Returns:
39 + bool: True if the version is compatible, False if it is not.
40 + """
41 + system_version = await get_graylog_version()
42 + logger.info(f"Graylog System version: {system_version}")
43 +
44 + # Split the version strings at the '+' character and compare the parts before the '+'
45 + system_version = system_version.split("+")[0]
46 + compatible_version = compatible_version.split("+")[0]
47 +
48 + # Split these parts at the '.' character and convert them to integers
49 + system_version_parts = list(map(int, system_version.split(".")))
50 + compatible_version_parts = list(map(int, compatible_version.split(".")))
51 +
52 + if system_version_parts >= compatible_version_parts:
53 + return True
54 + else:
55 + raise HTTPException(
56 + status_code=400,
57 + detail=f"Graylog version {system_version} is not compatible with the content pack",
58 + )
59 +
60 +
61 +async def does_content_pack_exist(content_pack_name: str) -> bool:
62 + """
63 + Check if the content pack exists in the list of content packs.
64 +
65 + Args:
66 + content_pack_name (str): The name of the content pack to check.
67 +
68 + Returns:
69 + bool: True if the content pack exists, False if it does not.
70 + """
71 + content_packs = await get_content_packs()
72 + for content_pack in content_packs:
73 + logger.info(f"Checking content pack {content_pack.name}")
74 + if content_pack.name == content_pack_name:
75 + logger.info(f"Content pack {content_pack_name} exists")
76 + raise HTTPException(
77 + status_code=400,
78 + detail=f"Content pack {content_pack_name} already exists",
79 + )
80 + logger.info(f"Content pack {content_pack_name} does not exist")
81 + return False
82 +
83 +
84 +@stack_provisioning_graylog_router.post(
85 + "/graylog/wazuh",
86 + response_model=ProvisionGraylogResponse,
87 + description="Provision the Wazuh Content Pack in the Graylog instance",
88 + dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
89 +)
90 +async def provision_wazuh_content_pack_route(
91 + session: AsyncSession = Depends(get_db),
92 +) -> ProvisionGraylogResponse:
93 + """
94 + Provision the Wazuh Content Pack in the Graylog instance
95 + """
96 + logger.info("Provisioning Wazuh Content Pack...")
97 + await system_version_check(compatible_version="5.0.13+083613e")
98 + await does_content_pack_exist("SOCFORTRESS_WAZUH_CONTENT_PACK")
99 + await provision_wazuh_content_pack(session)
100 + return ProvisionGraylogResponse(success=True, message="Wazuh Content Pack provisioned successfully")
backend/app/stack_provisioning/graylog/schema/provision.py new
+15
@@ -0,0 +1,15 @@
1 +from pydantic import BaseModel
2 +from pydantic import Field
3 +
4 +
5 +class ProvisionGraylogResponse(BaseModel):
6 + success: bool = Field(
7 + ...,
8 + example=True,
9 + description="Success of the Graylog provisioning",
10 + )
11 + message: str = Field(
12 + ...,
13 + example="Graylog provisioned successfully",
14 + description="Message from the Graylog provisioning",
15 + )
backend/app/stack_provisioning/graylog/services/provision.py new
+68
@@ -0,0 +1,68 @@
1 +import json
2 +from pathlib import Path
3 +
4 +from fastapi import HTTPException
5 +from loguru import logger
6 +from sqlalchemy.ext.asyncio import AsyncSession
7 +
8 +from app.connectors.graylog.schema.content_packs import ContentPack
9 +from app.connectors.graylog.services.content_packs import insert_content_pack
10 +from app.connectors.graylog.services.content_packs import install_content_pack
11 +from app.stack_provisioning.graylog.schema.provision import ProvisionGraylogResponse
12 +
13 +
14 +def get_content_pack_path(file_name: str) -> Path:
15 + """
16 + Returns the path to the dashboard JSON file.
17 +
18 + Parameters:
19 + - dashboard_info (tuple): A tuple containing the folder name and file name of the dashboard.
20 +
21 + Returns:
22 + - Path: The path to the dashboard JSON file.
23 + """
24 + current_file = Path(__file__) # Path to the current file
25 + base_dir = current_file.parent.parent # Move up two levels to the 'grafana' directory
26 + return base_dir / "templates" / file_name
27 +
28 +
29 +def load_content_pack_json(file_name: str) -> dict:
30 + """
31 + Load the JSON data of a dashboard from a file and replace the 'uid' value with the provided datasource UID.
32 +
33 + Args:
34 + dashboard_info (tuple): Information about the dashboard (e.g., file name, directory).
35 + datasource_uid (str): The UID of the datasource to replace in the dashboard JSON.
36 +
37 + Returns:
38 + dict: The loaded dashboard data with the replaced 'uid' value.
39 +
40 + Raises:
41 + FileNotFoundError: If the dashboard JSON file is not found.
42 + HTTPException: If there is an error decoding the JSON from the file.
43 + """
44 + file_path = get_content_pack_path(file_name)
45 + try:
46 + with open(file_path, "r") as file:
47 + content_pack_data = json.load(file)
48 +
49 + return ContentPack(**content_pack_data).dict()
50 +
51 + except FileNotFoundError:
52 + logger.error(f"Content pack JSON file not found at {file_path}")
53 + raise HTTPException(status_code=404, detail="Content pack JSON file not found")
54 +
55 +
56 +async def provision_wazuh_content_pack(
57 + session: AsyncSession,
58 +) -> ProvisionGraylogResponse:
59 + """
60 + Provision the Wazuh Content Pack in the Graylog instance
61 + """
62 + logger.info("Provisioning Wazuh Content Pack...")
63 + content_pack = load_content_pack_json("wazuh_content_pack.json")
64 + logger.info("Inserting Wazuh Content Pack...")
65 + await insert_content_pack(content_pack)
66 + # ! Content Pack ID is found in the `wazuh_content_pack.json` file
67 + await install_content_pack(content_pack_id="261577fe-d9a2-4141-af74-635f085eee54", revision=1)
68 + return ProvisionGraylogResponse(success=True, message="Wazuh Content Pack provisioned successfully")
backend/app/stack_provisioning/graylog/templates/wazuh_content_pack.json new
+4138
@@ -0,0 +1,4138 @@
1 +{
2 + "id": "261577fe-d9a2-4141-af74-635f085eee54",
3 + "rev": 1,
4 + "v": "1",
5 + "name": "SOCFORTRESS_WAZUH_CONTENT_PACK",
6 + "summary": "Content Pack for Wazuh",
7 + "description": "",
8 + "vendor": "SOCFortress - info@socfortress.co",
9 + "url": "https://github.com/socfortress/CoPilot/tree/main/backend/app/stack_provisioning/graylog/templates/wazuh_content_pack.json",
10 + "created_at": "2024-02-17T15:43:29.597Z",
11 + "server_version": "5.0.13+083613e",
12 + "parameters": [],
13 + "entities": [
14 + {
15 + "id": "4fbce4a8-897e-4c2f-8030-8fa884c34fd8",
16 + "type": {
17 + "name": "input",
18 + "version": "1"
19 + },
20 + "v": "1",
21 + "data": {
22 + "title": {
23 + "@type": "string",
24 + "@value": "WAZUH EVENTS FLUENT BIT - TCP"
25 + },
26 + "configuration": {
27 + "tls_key_file": {
28 + "@type": "string",
29 + "@value": "soc-syslog-manager"
30 + },
31 + "port": {
32 + "@type": "integer",
33 + "@value": 5555
34 + },
35 + "tls_enable": {
36 + "@type": "boolean",
37 + "@value": false
38 + },
39 + "use_null_delimiter": {
40 + "@type": "boolean",
41 + "@value": false
42 + },
43 + "recv_buffer_size": {
44 + "@type": "integer",
45 + "@value": 1048576
46 + },
47 + "tcp_keepalive": {
48 + "@type": "boolean",
49 + "@value": false
50 + },
51 + "tls_client_auth_cert_file": {
52 + "@type": "string",
53 + "@value": ""
54 + },
55 + "bind_address": {
56 + "@type": "string",
57 + "@value": "0.0.0.0"
58 + },
59 + "tls_cert_file": {
60 + "@type": "string",
61 + "@value": ""
62 + },
63 + "max_message_size": {
64 + "@type": "integer",
65 + "@value": 2097152
66 + },
67 + "tls_client_auth": {
68 + "@type": "string",
69 + "@value": "disabled"
70 + },
71 + "number_worker_threads": {
72 + "@type": "integer",
73 + "@value": 8
74 + },
75 + "tls_key_password": {
76 + "@type": "string",
77 + "@value": "na)R]Q`7q9>qxjqLdn-T[=sX"
78 + }
79 + },
80 + "static_fields": {
81 + "syslog_type": {
82 + "@type": "string",
83 + "@value": "wazuh"
84 + }
85 + },
86 + "type": {
87 + "@type": "string",
88 + "@value": "org.graylog2.inputs.raw.tcp.RawTCPInput"
89 + },
90 + "global": {
91 + "@type": "boolean",
92 + "@value": false
93 + },
94 + "extractors": [
95 + {
96 + "target_field": {
97 + "@type": "string",
98 + "@value": ""
99 + },
100 + "condition_value": {
101 + "@type": "string",
102 + "@value": ""
103 + },
104 + "order": {
105 + "@type": "integer",
106 + "@value": 0
107 + },
108 + "converters": [],
109 + "configuration": {
110 + "list_separator": {
111 + "@type": "string",
112 + "@value": ", "
113 + },
114 + "kv_separator": {
115 + "@type": "string",
116 + "@value": ":"
117 + },
118 + "key_prefix": {
119 + "@type": "string",
120 + "@value": ""
121 + },
122 + "key_separator": {
123 + "@type": "string",
124 + "@value": "_"
125 + },
126 + "replace_key_whitespace": {
127 + "@type": "boolean",
128 + "@value": false
129 + },
130 + "key_whitespace_replacement": {
131 + "@type": "string",
132 + "@value": "_"
133 + }
134 + },
135 + "source_field": {
136 + "@type": "string",
137 + "@value": "message"
138 + },
139 + "title": {
140 + "@type": "string",
141 + "@value": "FLUENTD - JSON EXTRACTOR"
142 + },
143 + "type": {
144 + "@type": "string",
145 + "@value": "JSON"
146 + },
147 + "cursor_strategy": {
148 + "@type": "string",
149 + "@value": "COPY"
150 + },
151 + "condition_type": {
152 + "@type": "string",
153 + "@value": "NONE"
154 + }
155 + },
156 + {
157 + "target_field": {
158 + "@type": "string",
159 + "@value": "hash_sha256"
160 + },
161 + "condition_value": {
162 + "@type": "string",
163 + "@value": "SHA256"
164 + },
165 + "order": {
166 + "@type": "integer",
167 + "@value": 10
168 + },
169 + "converters": [],
170 + "configuration": {
171 + "index": {
172 + "@type": "integer",
173 + "@value": 3
174 + },
175 + "split_by": {
176 + "@type": "string",
177 + "@value": ","
178 + }
179 + },
180 + "source_field": {
181 + "@type": "string",
182 + "@value": "data_win_eventdata_hashes"
183 + },
184 + "title": {
185 + "@type": "string",
186 + "@value": "FILE HASHES 1 - SHA256"
187 + },
188 + "type": {
189 + "@type": "string",
190 + "@value": "SPLIT_AND_INDEX"
191 + },
192 + "cursor_strategy": {
193 + "@type": "string",
194 + "@value": "COPY"
195 + },
196 + "condition_type": {
197 + "@type": "string",
198 + "@value": "STRING"
199 + }
200 + },
201 + {
202 + "target_field": {
203 + "@type": "string",
204 + "@value": "sha256"
205 + },
206 + "condition_value": {
207 + "@type": "string",
208 + "@value": "SHA256"
209 + },
210 + "order": {
211 + "@type": "integer",
212 + "@value": 12
213 + },
214 + "converters": [],
215 + "configuration": {
216 + "index": {
217 + "@type": "integer",
218 + "@value": 2
219 + },
220 + "split_by": {
221 + "@type": "string",
222 + "@value": "="
223 + }
224 + },
225 + "source_field": {
226 + "@type": "string",
227 + "@value": "hash_sha256"
228 + },
229 + "title": {
230 + "@type": "string",
231 + "@value": "SHA256 FILE HASH EXTRACTOR"
232 + },
233 + "type": {
234 + "@type": "string",
235 + "@value": "SPLIT_AND_INDEX"
236 + },
237 + "cursor_strategy": {
238 + "@type": "string",
239 + "@value": "COPY"
240 + },
241 + "condition_type": {
242 + "@type": "string",
243 + "@value": "STRING"
244 + }
245 + },
246 + {
247 + "target_field": {
248 + "@type": "string",
249 + "@value": "hash_sha256"
250 + },
251 + "condition_value": {
252 + "@type": "string",
253 + "@value": "SHA256"
254 + },
255 + "order": {
256 + "@type": "integer",
257 + "@value": 11
258 + },
259 + "converters": [],
260 + "configuration": {
261 + "index": {
262 + "@type": "integer",
263 + "@value": 3
264 + },
265 + "split_by": {
266 + "@type": "string",
267 + "@value": ","
268 + }
269 + },
270 + "source_field": {
271 + "@type": "string",
272 + "@value": "data_win_eventdata_hash"
273 + },
274 + "title": {
275 + "@type": "string",
276 + "@value": "FILE HASHES 2 - SHA256"
277 + },
278 + "type": {
279 + "@type": "string",
280 + "@value": "SPLIT_AND_INDEX"
281 + },
282 + "cursor_strategy": {
283 + "@type": "string",
284 + "@value": "COPY"
285 + },
286 + "condition_type": {
287 + "@type": "string",
288 + "@value": "STRING"
289 + }
290 + },
291 + {
292 + "target_field": {
293 + "@type": "string",
294 + "@value": "rule_group3"
295 + },
296 + "condition_value": {
297 + "@type": "string",
298 + "@value": ""
299 + },
300 + "order": {
301 + "@type": "integer",
302 + "@value": 7
303 + },
304 + "converters": [],
305 + "configuration": {
306 + "index": {
307 + "@type": "integer",
308 + "@value": 3
309 + },
310 + "split_by": {
311 + "@type": "string",
312 + "@value": ","
313 + }
314 + },
315 + "source_field": {
316 + "@type": "string",
317 + "@value": "rule_groups"
318 + },
319 + "title": {
320 + "@type": "string",
321 + "@value": "WAZUH RULE GROUPS SPLIT 3"
322 + },
323 + "type": {
324 + "@type": "string",
325 + "@value": "SPLIT_AND_INDEX"
326 + },
327 + "cursor_strategy": {
328 + "@type": "string",
329 + "@value": "COPY"
330 + },
331 + "condition_type": {
332 + "@type": "string",
333 + "@value": "NONE"
334 + }
335 + },
336 + {
337 + "target_field": {
338 + "@type": "string",
339 + "@value": "rule_group2"
340 + },
341 + "condition_value": {
342 + "@type": "string",
343 + "@value": ""
344 + },
345 + "order": {
346 + "@type": "integer",
347 + "@value": 6
348 + },
349 + "converters": [],
350 + "configuration": {
351 + "index": {
352 + "@type": "integer",
353 + "@value": 2
354 + },
355 + "split_by": {
356 + "@type": "string",
357 + "@value": ","
358 + }
359 + },
360 + "source_field": {
361 + "@type": "string",
362 + "@value": "rule_groups"
363 + },
364 + "title": {
365 + "@type": "string",
366 + "@value": "WAZUH RULE GROUPS SPLIT 2"
367 + },
368 + "type": {
369 + "@type": "string",
370 + "@value": "SPLIT_AND_INDEX"
371 + },
372 + "cursor_strategy": {
373 + "@type": "string",
374 + "@value": "COPY"
375 + },
376 + "condition_type": {
377 + "@type": "string",
378 + "@value": "NONE"
379 + }
380 + },
381 + {
382 + "target_field": {
383 + "@type": "string",
384 + "@value": "rule_group1"
385 + },
386 + "condition_value": {
387 + "@type": "string",
388 + "@value": ""
389 + },
390 + "order": {
391 + "@type": "integer",
392 + "@value": 5
393 + },
394 + "converters": [],
395 + "configuration": {
396 + "index": {
397 + "@type": "integer",
398 + "@value": 1
399 + },
400 + "split_by": {
401 + "@type": "string",
402 + "@value": ","
403 + }
404 + },
405 + "source_field": {
406 + "@type": "string",
407 + "@value": "rule_groups"
408 + },
409 + "title": {
410 + "@type": "string",
411 + "@value": "WAZUH RULE GROUPS SPLIT"
412 + },
413 + "type": {
414 + "@type": "string",
415 + "@value": "SPLIT_AND_INDEX"
416 + },
417 + "cursor_strategy": {
418 + "@type": "string",
419 + "@value": "COPY"
420 + },
421 + "condition_type": {
422 + "@type": "string",
423 + "@value": "NONE"
424 + }
425 + },
426 + {
427 + "target_field": {
428 + "@type": "string",
429 + "@value": "powershell_host_version"
430 + },
431 + "condition_value": {
432 + "@type": "string",
433 + "@value": ""
434 + },
435 + "order": {
436 + "@type": "integer",
437 + "@value": 2
438 + },
439 + "converters": [],
440 + "configuration": {
441 + "regex_value": {
442 + "@type": "string",
443 + "@value": "HostVersion=(\\d+.\\d+.\\d+.\\d+)"
444 + }
445 + },
446 + "source_field": {
447 + "@type": "string",
448 + "@value": "data_win_eventdata_data"
449 + },
450 + "title": {
451 + "@type": "string",
452 + "@value": "Powershell Host Version"
453 + },
454 + "type": {
455 + "@type": "string",
456 + "@value": "REGEX"
457 + },
458 + "cursor_strategy": {
459 + "@type": "string",
460 + "@value": "COPY"
461 + },
462 + "condition_type": {
463 + "@type": "string",
464 + "@value": "NONE"
465 + }
466 + },
467 + {
468 + "target_field": {
469 + "@type": "string",
470 + "@value": "data_win_eventdata_rv_json"
471 + },
472 + "condition_value": {
473 + "@type": "string",
474 + "@value": ""
475 + },
476 + "order": {
477 + "@type": "integer",
478 + "@value": 8
479 + },
480 + "converters": [],
481 + "configuration": {
482 + "regex": {
483 + "@type": "string",
484 + "@value": "\\\\\\\""
485 + },
486 + "replacement": {
487 + "@type": "string",
488 + "@value": "\\\""
489 + },
490 + "replace_all": {
491 + "@type": "boolean",
492 + "@value": true
493 + }
494 + },
495 + "source_field": {
496 + "@type": "string",
497 + "@value": "data_win_eventdata_rv"
498 + },
499 + "title": {
500 + "@type": "string",
501 + "@value": "EXTRACT JSON FROM F-SECURE MESSAGE"
502 + },
503 + "type": {
504 + "@type": "string",
505 + "@value": "REGEX_REPLACE"
506 + },
507 + "cursor_strategy": {
508 + "@type": "string",
509 + "@value": "CUT"
510 + },
511 + "condition_type": {
512 + "@type": "string",
513 + "@value": "NONE"
514 + }
515 + },
516 + {
517 + "target_field": {
518 + "@type": "string",
519 + "@value": ""
520 + },
521 + "condition_value": {
522 + "@type": "string",
523 + "@value": ""
524 + },
525 + "order": {
526 + "@type": "integer",
527 + "@value": 13
528 + },
529 + "converters": [],
530 + "configuration": {
531 + "list_separator": {
532 + "@type": "string",
533 + "@value": ", "
534 + },
535 + "kv_separator": {
536 + "@type": "string",
537 + "@value": ":"
538 + },
539 + "key_prefix": {
540 + "@type": "string",
541 + "@value": "misp_"
542 + },
543 + "key_separator": {
544 + "@type": "string",
545 + "@value": "_"
546 + },
547 + "replace_key_whitespace": {
548 + "@type": "boolean",
549 + "@value": false
550 + },
551 + "key_whitespace_replacement": {
552 + "@type": "string",
553 + "@value": "_"
554 + }
555 + },
556 + "source_field": {
557 + "@type": "string",
558 + "@value": "misp_Event"
559 + },
560 + "title": {
561 + "@type": "string",
562 + "@value": "MISP EVENT JSON EXTRACTOR"
563 + },
564 + "type": {
565 + "@type": "string",
566 + "@value": "JSON"
567 + },
568 + "cursor_strategy": {
569 + "@type": "string",
570 + "@value": "COPY"
571 + },
572 + "condition_type": {
573 + "@type": "string",
574 + "@value": "NONE"
575 + }
576 + },
577 + {
578 + "target_field": {
579 + "@type": "string",
580 + "@value": ""
581 + },
582 + "condition_value": {
583 + "@type": "string",
584 + "@value": ""
585 + },
586 + "order": {
587 + "@type": "integer",
588 + "@value": 9
589 + },
590 + "converters": [],
591 + "configuration": {
592 + "list_separator": {
593 + "@type": "string",
594 + "@value": ", "
595 + },
596 + "kv_separator": {
597 + "@type": "string",
598 + "@value": ":"
599 + },
600 + "key_prefix": {
601 + "@type": "string",
602 + "@value": ""
603 + },
604 + "key_separator": {
605 + "@type": "string",
606 + "@value": "_"
607 + },
608 + "replace_key_whitespace": {
609 + "@type": "boolean",
610 + "@value": false
611 + },
612 + "key_whitespace_replacement": {
613 + "@type": "string",
614 + "@value": "_"
615 + }
616 + },
617 + "source_field": {
618 + "@type": "string",
619 + "@value": "data_win_eventdata_rv_json"
620 + },
621 + "title": {
622 + "@type": "string",
623 + "@value": "EXTRACT KEY VALUE PAIRS FROM JSON F-SECURE MESSAGE"
624 + },
625 + "type": {
626 + "@type": "string",
627 + "@value": "JSON"
628 + },
629 + "cursor_strategy": {
630 + "@type": "string",
631 + "@value": "CUT"
632 + },
633 + "condition_type": {
634 + "@type": "string",
635 + "@value": "NONE"
636 + }
637 + },
638 + {
639 + "target_field": {
640 + "@type": "string",
641 + "@value": "imphash"
642 + },
643 + "condition_value": {
644 + "@type": "string",
645 + "@value": ""
646 + },
647 + "order": {
648 + "@type": "integer",
649 + "@value": 4
650 + },
651 + "converters": [
652 + {
653 + "type": {
654 + "@type": "string",
655 + "@value": "TOKENIZER"
656 + },
657 + "configuration": {}
658 + }
659 + ],
660 + "configuration": {
661 + "index": {
662 + "@type": "integer",
663 + "@value": 4
664 + },
665 + "split_by": {
666 + "@type": "string",
667 + "@value": ","
668 + }
669 + },
670 + "source_field": {
671 + "@type": "string",
672 + "@value": "data_win_eventdata_hash"
673 + },
674 + "title": {
675 + "@type": "string",
676 + "@value": "Extracted IMPHASH"
677 + },
678 + "type": {
679 + "@type": "string",
680 + "@value": "SPLIT_AND_INDEX"
681 + },
682 + "cursor_strategy": {
683 + "@type": "string",
684 + "@value": "COPY"
685 + },
686 + "condition_type": {
687 + "@type": "string",
688 + "@value": "NONE"
689 + }
690 + },
691 + {
692 + "target_field": {
693 + "@type": "string",
694 + "@value": "powershell_engine_version"
695 + },
696 + "condition_value": {
697 + "@type": "string",
698 + "@value": ""
699 + },
700 + "order": {
701 + "@type": "integer",
702 + "@value": 3
703 + },
704 + "converters": [],
705 + "configuration": {
706 + "regex_value": {
707 + "@type": "string",
708 + "@value": "EngineVersion=(\\d+.\\d+.\\d+.\\d+)"
709 + }
710 + },
711 + "source_field": {
712 + "@type": "string",
713 + "@value": "data_win_eventdata_data"
714 + },
715 + "title": {
716 + "@type": "string",
717 + "@value": "Powershell Engine Version"
718 + },
719 + "type": {
720 + "@type": "string",
721 + "@value": "REGEX"
722 + },
723 + "cursor_strategy": {
724 + "@type": "string",
725 + "@value": "COPY"
726 + },
727 + "condition_type": {
728 + "@type": "string",
729 + "@value": "NONE"
730 + }
731 + },
732 + {
733 + "target_field": {
734 + "@type": "string",
735 + "@value": ""
736 + },
737 + "condition_value": {
738 + "@type": "string",
739 + "@value": ""
740 + },
741 + "order": {
742 + "@type": "integer",
743 + "@value": 14
744 + },
745 + "converters": [],
746 + "configuration": {
747 + "list_separator": {
748 + "@type": "string",
749 + "@value": ", "
750 + },
751 + "kv_separator": {
752 + "@type": "string",
753 + "@value": ":"
754 + },
755 + "key_prefix": {
756 + "@type": "string",
757 + "@value": "opencti_json_"
758 + },
759 + "key_separator": {
760 + "@type": "string",
761 + "@value": "_"
762 + },
763 + "replace_key_whitespace": {
764 + "@type": "boolean",
765 + "@value": false
766 + },
767 + "key_whitespace_replacement": {
768 + "@type": "string",
769 + "@value": "_"
770 + }
771 + },
772 + "source_field": {
773 + "@type": "string",
774 + "@value": "opencti_source"
775 + },
776 + "title": {
777 + "@type": "string",
778 + "@value": "OPENCTI JSON EXTRACTOR I"
779 + },
780 + "type": {
781 + "@type": "string",
782 + "@value": "JSON"
783 + },
784 + "cursor_strategy": {
785 + "@type": "string",
786 + "@value": "COPY"
787 + },
788 + "condition_type": {
789 + "@type": "string",
790 + "@value": "NONE"
791 + }
792 + },
793 + {
794 + "target_field": {
795 + "@type": "string",
796 + "@value": "msg_timestamp"
797 + },
798 + "condition_value": {
799 + "@type": "string",
800 + "@value": ""
801 + },
802 + "order": {
803 + "@type": "integer",
804 + "@value": 1
805 + },
806 + "converters": [
807 + {
808 + "type": {
809 + "@type": "string",
810 + "@value": "DATE"
811 + },
812 + "configuration": {
813 + "date_format": {
814 + "@type": "string",
815 + "@value": "yyyy-MM-dd'T'HH:mm:ss.SSS"
816 + },
817 + "time_zone": {
818 + "@type": "string",
819 + "@value": "Etc/UTC"
820 + }
821 + }
822 + }
823 + ],
824 + "configuration": {
825 + "regex_value": {
826 + "@type": "string",
827 + "@value": "\"timestamp\":\"([^\"]*)\\+0000\""
828 + }
829 + },
830 + "source_field": {
831 + "@type": "string",
832 + "@value": "message"
833 + },
834 + "title": {
835 + "@type": "string",
836 + "@value": "MSG_TIMESTAMP"
837 + },
838 + "type": {
839 + "@type": "string",
840 + "@value": "REGEX"
841 + },
842 + "cursor_strategy": {
843 + "@type": "string",
844 + "@value": "COPY"
845 + },
846 + "condition_type": {
847 + "@type": "string",
848 + "@value": "NONE"
849 + }
850 + }
851 + ]
852 + },
853 + "constraints": [
854 + {
855 + "type": "server-version",
856 + "version": ">=5.0.13+083613e"
857 + }
858 + ]
859 + },
860 + {
861 + "id": "9b317b42-770d-46fb-b740-96c679c38f73",
862 + "type": {
863 + "name": "lookup_adapter",
864 + "version": "1"
865 + },
866 + "v": "1",
867 + "data": {
868 + "_scope": {
869 + "@type": "string",
870 + "@value": "DEFAULT"
871 + },
872 + "name": {
873 + "@type": "string",
874 + "@value": "software-vendors"
875 + },
876 + "title": {
877 + "@type": "string",
878 + "@value": "Software Vendors"
879 + },
880 + "description": {
881 + "@type": "string",
882 + "@value": "List of Approved Software Vendors"
883 + },
884 + "configuration": {
885 + "type": {
886 + "@type": "string",
887 + "@value": "csvfile"
888 + },
889 + "path": {
890 + "@type": "string",
891 + "@value": "/etc/graylog/software_vendors.csv"
892 + },
893 + "separator": {
894 + "@type": "string",
895 + "@value": ","
896 + },
897 + "quotechar": {
898 + "@type": "string",
899 + "@value": "\""
900 + },
901 + "key_column": {
902 + "@type": "string",
903 + "@value": "vendor"
904 + },
905 + "value_column": {
906 + "@type": "string",
907 + "@value": "approved"
908 + },
909 + "check_interval": {
910 + "@type": "long",
911 + "@value": 60
912 + },
913 + "case_insensitive_lookup": {
914 + "@type": "boolean",
915 + "@value": true
916 + }
917 + }
918 + },
919 + "constraints": [
920 + {
921 + "type": "server-version",
922 + "version": ">=5.0.13+083613e"
923 + }
924 + ]
925 + },
926 + {
927 + "id": "41437203-db84-46a2-9ea1-0db7ed2c699e",
928 + "type": {
929 + "name": "lookup_adapter",
930 + "version": "1"
931 + },
932 + "v": "1",
933 + "data": {
934 + "_scope": {
935 + "@type": "string",
936 + "@value": "DEFAULT"
937 + },
938 + "name": {
939 + "@type": "string",
940 + "@value": "nist-800-53-to-cui-controls"
941 + },
942 + "title": {
943 + "@type": "string",
944 + "@value": "NIST 800-53 TO CUI CONTROLS"
945 + },
946 + "description": {
947 + "@type": "string",
948 + "@value": "NIST 800-53 TO CUI CONTROLS"
949 + },
950 + "configuration": {
951 + "type": {
952 + "@type": "string",
953 + "@value": "csvfile"
954 + },
955 + "path": {
956 + "@type": "string",
957 + "@value": "/etc/graylog/nist_800_53_to_cui.csv"
958 + },
959 + "separator": {
960 + "@type": "string",
961 + "@value": ","
962 + },
963 + "quotechar": {
964 + "@type": "string",
965 + "@value": "\""
966 + },
967 + "key_column": {
968 + "@type": "string",
969 + "@value": "nist_800_53"
970 + },
971 + "value_column": {
972 + "@type": "string",
973 + "@value": "cui"
974 + },
975 + "check_interval": {
976 + "@type": "long",
977 + "@value": 60
978 + },
979 + "case_insensitive_lookup": {
980 + "@type": "boolean",
981 + "@value": false
982 + }
983 + }
984 + },
985 + "constraints": [
986 + {
987 + "type": "server-version",
988 + "version": ">=5.0.13+083613e"
989 + }
990 + ]
991 + },
992 + {
993 + "id": "5f2980e7-a0ea-46f1-99aa-da8b93365663",
994 + "type": {
995 + "name": "lookup_adapter",
996 + "version": "1"
997 + },
998 + "v": "1",
999 + "data": {
1000 + "_scope": {
1001 + "@type": "string",
1002 + "@value": "DEFAULT"
1003 + },
1004 + "name": {
1005 + "@type": "string",
1006 + "@value": "epss"
1007 + },
1008 + "title": {
1009 + "@type": "string",
1010 + "@value": "EPSS"
1011 + },
1012 + "description": {
1013 + "@type": "string",
1014 + "@value": "https://www.first.org/epss/api - Get CVE Score"
1015 + },
1016 + "configuration": {
1017 + "type": {
1018 + "@type": "string",
1019 + "@value": "httpjsonpath"
1020 + },
1021 + "url": {
1022 + "@type": "string",
1023 + "@value": "https://api.first.org/data/v1/epss?cve=${key}"
1024 + },
1025 + "single_value_jsonpath": {
1026 + "@type": "string",
1027 + "@value": "$.status"
1028 + },
1029 + "multi_value_jsonpath": {
1030 + "@type": "string",
1031 + "@value": "$.data[0]"
1032 + },
1033 + "user_agent": {
1034 + "@type": "string",
1035 + "@value": "Graylog Lookup - https://www.graylog.org/"
1036 + }
1037 + }
1038 + },
1039 + "constraints": [
1040 + {
1041 + "type": "server-version",
1042 + "version": ">=5.0.13+083613e"
1043 + }
1044 + ]
1045 + },
1046 + {
1047 + "id": "1405cf60-dda4-43d4-bb60-53ceb06e1bf1",
1048 + "type": {
1049 + "name": "lookup_adapter",
1050 + "version": "1"
1051 + },
1052 + "v": "1",
1053 + "data": {
1054 + "_scope": {
1055 + "@type": "string",
1056 + "@value": "DEFAULT"
1057 + },
1058 + "name": {
1059 + "@type": "string",
1060 + "@value": "socfortress-threat-intel"
1061 + },
1062 + "title": {
1063 + "@type": "string",
1064 + "@value": "SOCFortress Threat Intel"
1065 + },
1066 + "description": {
1067 + "@type": "string",
1068 + "@value": "SOCFortress Threat Intel"
1069 + },
1070 + "configuration": {
1071 + "type": {
1072 + "@type": "string",
1073 + "@value": "httpjsonpath"
1074 + },
1075 + "url": {
1076 + "@type": "string",
1077 + "@value": "https://intel.socfortress.co/search?value=${key}"
1078 + },
1079 + "single_value_jsonpath": {
1080 + "@type": "string",
1081 + "@value": "$.success"
1082 + },
1083 + "multi_value_jsonpath": {
1084 + "@type": "string",
1085 + "@value": "$.data"
1086 + },
1087 + "user_agent": {
1088 + "@type": "string",
1089 + "@value": "curl/7.74.0"
1090 + },
1091 + "headers": {
1092 + "Content-Type": {
1093 + "@type": "string",
1094 + "@value": "application/json"
1095 + },
1096 + "module-version": {
1097 + "@type": "string",
1098 + "@value": "1.0"
1099 + },
1100 + "x-api-key": {
1101 + "@type": "string",
1102 + "@value": "REPLACE_ME"
1103 + }
1104 + }
1105 + }
1106 + },
1107 + "constraints": [
1108 + {
1109 + "type": "server-version",
1110 + "version": ">=5.0.13+083613e"
1111 + }
1112 + ]
1113 + },
1114 + {
1115 + "id": "731af176-a847-4a28-bf32-bd5ba4462d79",
1116 + "type": {
1117 + "name": "lookup_adapter",
1118 + "version": "1"
1119 + },
1120 + "v": "1",
1121 + "data": {
1122 + "_scope": {
1123 + "@type": "string",
1124 + "@value": "DEFAULT"
1125 + },
1126 + "name": {
1127 + "@type": "string",
1128 + "@value": "network-ports"
1129 + },
1130 + "title": {
1131 + "@type": "string",
1132 + "@value": "Network Ports"
1133 + },
1134 + "description": {
1135 + "@type": "string",
1136 + "@value": "List of Common Network Ports"
1137 + },
1138 + "configuration": {
1139 + "type": {
1140 + "@type": "string",
1141 + "@value": "csvfile"
1142 + },
1143 + "path": {
1144 + "@type": "string",
1145 + "@value": "/etc/graylog/network_ports.csv"
1146 + },
1147 + "separator": {
1148 + "@type": "string",
1149 + "@value": ","
1150 + },
1151 + "quotechar": {
1152 + "@type": "string",
1153 + "@value": "\""
1154 + },
1155 + "key_column": {
1156 + "@type": "string",
1157 + "@value": "port"
1158 + },
1159 + "value_column": {
1160 + "@type": "string",
1161 + "@value": "common"
1162 + },
1163 + "check_interval": {
1164 + "@type": "long",
1165 + "@value": 60
1166 + },
1167 + "case_insensitive_lookup": {
1168 + "@type": "boolean",
1169 + "@value": true
1170 + }
1171 + }
1172 + },
1173 + "constraints": [
1174 + {
1175 + "type": "server-version",
1176 + "version": ">=5.0.13+083613e"
1177 + }
1178 + ]
1179 + },
1180 + {
1181 + "id": "009f38c0-0cf3-4010-8c8c-e4ea87e6f4f5",
1182 + "type": {
1183 + "name": "lookup_cache",
1184 + "version": "1"
1185 + },
1186 + "v": "1",
1187 + "data": {
1188 + "_scope": {
1189 + "@type": "string",
1190 + "@value": "DEFAULT"
1191 + },
1192 + "name": {
1193 + "@type": "string",
1194 + "@value": "epss-cache"
1195 + },
1196 + "title": {
1197 + "@type": "string",
1198 + "@value": "EPSS Cache"
1199 + },
1200 + "description": {
1201 + "@type": "string",
1202 + "@value": "EPSS Cache"
1203 + },
1204 + "configuration": {
1205 + "type": {
1206 + "@type": "string",
1207 + "@value": "guava_cache"
1208 + },
1209 + "max_size": {
1210 + "@type": "integer",
1211 + "@value": 1000
1212 + },
1213 + "expire_after_access": {
1214 + "@type": "long",
1215 + "@value": 60
1216 + },
1217 + "expire_after_access_unit": {
1218 + "@type": "string",
1219 + "@value": "MINUTES"
1220 + },
1221 + "expire_after_write": {
1222 + "@type": "long",
1223 + "@value": 0
1224 + }
1225 + }
1226 + },
1227 + "constraints": [
1228 + {
1229 + "type": "server-version",
1230 + "version": ">=5.0.13+083613e"
1231 + }
1232 + ]
1233 + },
1234 + {
1235 + "id": "d8301ead-3d48-46bf-875f-7994a5dbe558",
1236 + "type": {
1237 + "name": "lookup_cache",
1238 + "version": "1"
1239 + },
1240 + "v": "1",
1241 + "data": {
1242 + "_scope": {
1243 + "@type": "string",
1244 + "@value": "DEFAULT"
1245 + },
1246 + "name": {
1247 + "@type": "string",
1248 + "@value": "software-vendors"
1249 + },
1250 + "title": {
1251 + "@type": "string",
1252 + "@value": "Software Vendors"
1253 + },
1254 + "description": {
1255 + "@type": "string",
1256 + "@value": "Cache of approved software vendors"
1257 + },
1258 + "configuration": {
1259 + "type": {
1260 + "@type": "string",
1261 + "@value": "guava_cache"
1262 + },
1263 + "max_size": {
1264 + "@type": "integer",
1265 + "@value": 1000
1266 + },
1267 + "expire_after_access": {
1268 + "@type": "long",
1269 + "@value": 60
1270 + },
1271 + "expire_after_access_unit": {
1272 + "@type": "string",
1273 + "@value": "SECONDS"
1274 + },
1275 + "expire_after_write": {
1276 + "@type": "long",
1277 + "@value": 0
1278 + }
1279 + }
1280 + },
1281 + "constraints": [
1282 + {
1283 + "type": "server-version",
1284 + "version": ">=5.0.13+083613e"
1285 + }
1286 + ]
1287 + },
1288 + {
1289 + "id": "55ff2d16-b318-4717-893f-fed63ca005fc",
1290 + "type": {
1291 + "name": "lookup_cache",
1292 + "version": "1"
1293 + },
1294 + "v": "1",
1295 + "data": {
1296 + "_scope": {
1297 + "@type": "string",
1298 + "@value": "DEFAULT"
1299 + },
1300 + "name": {
1301 + "@type": "string",
1302 + "@value": "socfortress-threat-intel-cache"
1303 + },
1304 + "title": {
1305 + "@type": "string",
1306 + "@value": "SOCFortress Threat Intel Lookup Table"
1307 + },
1308 + "description": {
1309 + "@type": "string",
1310 + "@value": "SOCFortress Threat Intel Lookup Table"
1311 + },
1312 + "configuration": {
1313 + "type": {
1314 + "@type": "string",
1315 + "@value": "guava_cache"
1316 + },
1317 + "max_size": {
1318 + "@type": "integer",
1319 + "@value": 1000
1320 + },
1321 + "expire_after_access": {
1322 + "@type": "long",
1323 + "@value": 60
1324 + },
1325 + "expire_after_access_unit": {
1326 + "@type": "string",
1327 + "@value": "MINUTES"
1328 + },
1329 + "expire_after_write": {
1330 + "@type": "long",
1331 + "@value": 0
1332 + }
1333 + }
1334 + },
1335 + "constraints": [
1336 + {
1337 + "type": "server-version",
1338 + "version": ">=5.0.13+083613e"
1339 + }
1340 + ]
1341 + },
1342 + {
1343 + "id": "2a2edc22-1d0b-4ebb-adc6-068d0017a602",
1344 + "type": {
1345 + "name": "lookup_cache",
1346 + "version": "1"
1347 + },
1348 + "v": "1",
1349 + "data": {
1350 + "_scope": {
1351 + "@type": "string",
1352 + "@value": "DEFAULT"
1353 + },
1354 + "name": {
1355 + "@type": "string",
1356 + "@value": "network-ports"
1357 + },
1358 + "title": {
1359 + "@type": "string",
1360 + "@value": "Network Ports"
1361 + },
1362 + "description": {
1363 + "@type": "string",
1364 + "@value": "Cache of common network ports"
1365 + },
1366 + "configuration": {
1367 + "type": {
1368 + "@type": "string",
1369 + "@value": "guava_cache"
1370 + },
1371 + "max_size": {
1372 + "@type": "integer",
1373 + "@value": 1000
1374 + },
1375 + "expire_after_access": {
1376 + "@type": "long",
1377 + "@value": 60
1378 + },
1379 + "expire_after_access_unit": {
1380 + "@type": "string",
1381 + "@value": "SECONDS"
1382 + },
1383 + "expire_after_write": {
1384 + "@type": "long",
1385 + "@value": 0
1386 + }
1387 + }
1388 + },
1389 + "constraints": [
1390 + {
1391 + "type": "server-version",
1392 + "version": ">=5.0.13+083613e"
1393 + }
1394 + ]
1395 + },
1396 + {
1397 + "id": "bf37d686-3cb7-4eeb-9eb9-e08c0adc724b",
1398 + "type": {
1399 + "name": "lookup_cache",
1400 + "version": "1"
1401 + },
1402 + "v": "1",
1403 + "data": {
1404 + "_scope": {
1405 + "@type": "string",
1406 + "@value": "DEFAULT"
1407 + },
1408 + "name": {
1409 + "@type": "string",
1410 + "@value": "nist-800-53-to-cui-controls"
1411 + },
1412 + "title": {
1413 + "@type": "string",
1414 + "@value": "NIST 800-53 TO CUI CONTROLS"
1415 + },
1416 + "description": {
1417 + "@type": "string",
1418 + "@value": "NIST 800-53 TO CUI CONTROLS"
1419 + },
1420 + "configuration": {
1421 + "type": {
1422 + "@type": "string",
1423 + "@value": "guava_cache"
1424 + },
1425 + "max_size": {
1426 + "@type": "integer",
1427 + "@value": 1000
1428 + },
1429 + "expire_after_access": {
1430 + "@type": "long",
1431 + "@value": 60
1432 + },
1433 + "expire_after_access_unit": {
1434 + "@type": "string",
1435 + "@value": "SECONDS"
1436 + },
1437 + "expire_after_write": {
1438 + "@type": "long",
1439 + "@value": 0
1440 + }
1441 + }
1442 + },
1443 + "constraints": [
1444 + {
1445 + "type": "server-version",
1446 + "version": ">=5.0.13+083613e"
1447 + }
1448 + ]
1449 + },
1450 + {
1451 + "id": "5d81905e-723d-4e57-9b2b-e088ffb5241d",
1452 + "type": {
1453 + "name": "lookup_table",
1454 + "version": "1"
1455 + },
1456 + "v": "1",
1457 + "data": {
1458 + "default_single_value_type": {
1459 + "@type": "string",
1460 + "@value": "NULL"
1461 + },
1462 + "cache_name": {
1463 + "@type": "string",
1464 + "@value": "2a2edc22-1d0b-4ebb-adc6-068d0017a602"
1465 + },
1466 + "name": {
1467 + "@type": "string",
1468 + "@value": "network-ports"
1469 + },
1470 + "default_multi_value_type": {
1471 + "@type": "string",
1472 + "@value": "NULL"
1473 + },
1474 + "default_multi_value": {
1475 + "@type": "string",
1476 + "@value": ""
1477 + },
1478 + "data_adapter_name": {
1479 + "@type": "string",
1480 + "@value": "731af176-a847-4a28-bf32-bd5ba4462d79"
1481 + },
1482 + "_scope": {
1483 + "@type": "string",
1484 + "@value": "DEFAULT"
1485 + },
1486 + "title": {
1487 + "@type": "string",
1488 + "@value": "Network Ports"
1489 + },
1490 + "default_single_value": {
1491 + "@type": "string",
1492 + "@value": ""
1493 + },
1494 + "description": {
1495 + "@type": "string",
1496 + "@value": "Lookup table for network ports"
1497 + }
1498 + },
1499 + "constraints": [
1500 + {
1501 + "type": "server-version",
1502 + "version": ">=5.0.13+083613e"
1503 + }
1504 + ]
1505 + },
1506 + {
1507 + "id": "55c75b17-7e24-4859-b230-a4122fc8ec19",
1508 + "type": {
1509 + "name": "lookup_table",
1510 + "version": "1"
1511 + },
1512 + "v": "1",
1513 + "data": {
1514 + "default_single_value_type": {
1515 + "@type": "string",
1516 + "@value": "NULL"
1517 + },
1518 + "cache_name": {
1519 + "@type": "string",
1520 + "@value": "bf37d686-3cb7-4eeb-9eb9-e08c0adc724b"
1521 + },
1522 + "name": {
1523 + "@type": "string",
1524 + "@value": "nist_800_53_to_cui"
1525 + },
1526 + "default_multi_value_type": {
1527 + "@type": "string",
1528 + "@value": "NULL"
1529 + },
1530 + "default_multi_value": {
1531 + "@type": "string",
1532 + "@value": ""
1533 + },
1534 + "data_adapter_name": {
1535 + "@type": "string",
1536 + "@value": "41437203-db84-46a2-9ea1-0db7ed2c699e"
1537 + },
1538 + "_scope": {
1539 + "@type": "string",
1540 + "@value": "DEFAULT"
1541 + },
1542 + "title": {
1543 + "@type": "string",
1544 + "@value": "NIST 800-53 TO CUI CONTROLS"
1545 + },
1546 + "default_single_value": {
1547 + "@type": "string",
1548 + "@value": ""
1549 + },
1550 + "description": {
1551 + "@type": "string",
1552 + "@value": "NIST 800-53 TO CUI CONTROLS"
1553 + }
1554 + },
1555 + "constraints": [
1556 + {
1557 + "type": "server-version",
1558 + "version": ">=5.0.13+083613e"
1559 + }
1560 + ]
1561 + },
1562 + {
1563 + "id": "d1b3ac8a-ac53-4e8b-be76-abc431a5a80f",
1564 + "type": {
1565 + "name": "lookup_table",
1566 + "version": "1"
1567 + },
1568 + "v": "1",
1569 + "data": {
1570 + "default_single_value_type": {
1571 + "@type": "string",
1572 + "@value": "NULL"
1573 + },
1574 + "cache_name": {
1575 + "@type": "string",
1576 + "@value": "009f38c0-0cf3-4010-8c8c-e4ea87e6f4f5"
1577 + },
1578 + "name": {
1579 + "@type": "string",
1580 + "@value": "epss"
1581 + },
1582 + "default_multi_value_type": {
1583 + "@type": "string",
1584 + "@value": "NULL"
1585 + },
1586 + "default_multi_value": {
1587 + "@type": "string",
1588 + "@value": ""
1589 + },
1590 + "data_adapter_name": {
1591 + "@type": "string",
1592 + "@value": "5f2980e7-a0ea-46f1-99aa-da8b93365663"
1593 + },
1594 + "_scope": {
1595 + "@type": "string",
1596 + "@value": "DEFAULT"
1597 + },
1598 + "title": {
1599 + "@type": "string",
1600 + "@value": "EPSS Lookup Table"
1601 + },
1602 + "default_single_value": {
1603 + "@type": "string",
1604 + "@value": ""
1605 + },
1606 + "description": {
1607 + "@type": "string",
1608 + "@value": "https://www.first.org/epss/api"
1609 + }
1610 + },
1611 + "constraints": [
1612 + {
1613 + "type": "server-version",
1614 + "version": ">=5.0.13+083613e"
1615 + }
1616 + ]
1617 + },
1618 + {
1619 + "id": "37164c4c-c986-4c7c-a5e3-d9a8f1ddc337",
1620 + "type": {
1621 + "name": "lookup_table",
1622 + "version": "1"
1623 + },
1624 + "v": "1",
1625 + "data": {
1626 + "default_single_value_type": {
1627 + "@type": "string",
1628 + "@value": "NULL"
1629 + },
1630 + "cache_name": {
1631 + "@type": "string",
1632 + "@value": "d8301ead-3d48-46bf-875f-7994a5dbe558"
1633 + },
1634 + "name": {
1635 + "@type": "string",
1636 + "@value": "software-vendors"
1637 + },
1638 + "default_multi_value_type": {
1639 + "@type": "string",
1640 + "@value": "NULL"
1641 + },
1642 + "default_multi_value": {
1643 + "@type": "string",
1644 + "@value": ""
1645 + },
1646 + "data_adapter_name": {
1647 + "@type": "string",
1648 + "@value": "9b317b42-770d-46fb-b740-96c679c38f73"
1649 + },
1650 + "_scope": {
1651 + "@type": "string",
1652 + "@value": "DEFAULT"
1653 + },
1654 + "title": {
1655 + "@type": "string",
1656 + "@value": "Software Vendors"
1657 + },
1658 + "default_single_value": {
1659 + "@type": "string",
1660 + "@value": ""
1661 + },
1662 + "description": {
1663 + "@type": "string",
1664 + "@value": "Lookup table for Software Vendors"
1665 + }
1666 + },
1667 + "constraints": [
1668 + {
1669 + "type": "server-version",
1670 + "version": ">=5.0.13+083613e"
1671 + }
1672 + ]
1673 + },
1674 + {
1675 + "id": "0d0105b5-0256-4a15-8f26-eff5b18ae614",
1676 + "type": {
1677 + "name": "lookup_table",
1678 + "version": "1"
1679 + },
1680 + "v": "1",
1681 + "data": {
1682 + "default_single_value_type": {
1683 + "@type": "string",
1684 + "@value": "NULL"
1685 + },
1686 + "cache_name": {
1687 + "@type": "string",
1688 + "@value": "55ff2d16-b318-4717-893f-fed63ca005fc"
1689 + },
1690 + "name": {
1691 + "@type": "string",
1692 + "@value": "socfortress_threat_intel"
1693 + },
1694 + "default_multi_value_type": {
1695 + "@type": "string",
1696 + "@value": "NULL"
1697 + },
1698 + "default_multi_value": {
1699 + "@type": "string",
1700 + "@value": ""
1701 + },
1702 + "data_adapter_name": {
1703 + "@type": "string",
1704 + "@value": "1405cf60-dda4-43d4-bb60-53ceb06e1bf1"
1705 + },
1706 + "_scope": {
1707 + "@type": "string",
1708 + "@value": "DEFAULT"
1709 + },
1710 + "title": {
1711 + "@type": "string",
1712 + "@value": "SOCFortress Threat Intel Lookup Table"
1713 + },
1714 + "default_single_value": {
1715 + "@type": "string",
1716 + "@value": ""
1717 + },
1718 + "description": {
1719 + "@type": "string",
1720 + "@value": "SOCFortress Threat Intel Lookup Table"
1721 + }
1722 + },
1723 + "constraints": [
1724 + {
1725 + "type": "server-version",
1726 + "version": ">=5.0.13+083613e"
1727 + }
1728 + ]
1729 + },
1730 + {
1731 + "id": "aa38e373-4bad-4bed-b6fe-fe707d749fdb",
1732 + "type": {
1733 + "name": "pipeline",
1734 + "version": "1"
1735 + },
1736 + "v": "1",
1737 + "data": {
1738 + "title": {
1739 + "@type": "string",
1740 + "@value": "WAZUH PROCESSING PIPELINES"
1741 + },
1742 + "description": {
1743 + "@type": "string",
1744 + "@value": "WAZUH PROCESSING PIPELINES"
1745 + },
1746 + "source": {
1747 + "@type": "string",
1748 + "@value": "pipeline \"WAZUH PROCESSING PIPELINES\"\nstage 0 match pass\nrule \"DROP OSQUERY SOCKET EVENTS - WELL KNOWN PROCESSES\"\nrule \"DROP OSQUERY PROCESS EVENTS - WELL KNOWN PROCESSES\"\nrule \"DROP SYSMON EVT 7 LOGS - WELL KNOWN PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 12 LOGS - WELL KNOWN PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 10 LOGS - WELL KNOWN SOURCE PROCESS IMAGE\"\nrule \"DROP SYSMON EVT 13 LOGS - WELL KNOWN PROCESS IMAGE\"\nstage 1 match either\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - WARNING\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - INFO\"\nrule \"WAZUH CREATE FIELD SYSLOG LEVEL - ALERT\"\nrule \"Linux Sysmon Timestamp - UTC\"\nrule \"Office365 Timestamp - UTC\"\nrule \"Osquery Epoch Timestamp - UTC\"\nrule \"Packetbeat Timestamp - UTC\"\nrule \"Windows Timestamp - UTC\"\nrule \"URL Encode data_name field for ASK SOCFortress API\"\nrule \"NIST 800-53 TO CUI MAPPING\"\nstage 2 match pass\nrule \"USER ADDED TO PRIVILEGE ADMIN GROUP\"\nrule \"ASK SOCFORTRESS WINDOWS - CHAINSAW\"\nstage 3 match either\nrule \"LINUX SYSMON EVENT 1 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 5 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 9 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 11 LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 23 LOG NORMALIZATION\"\nrule \"LINUX PACKETBEAT DNS LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 1 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 11 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 2 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 22 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 23 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 5 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 9 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 7 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 10 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 12 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 13 LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 17 LOG NORMALIZATION\"\nrule \"LINUX OSQUERY PROCESS LIST LOG NORMALIZATION\"\nrule \"LINUX PACKETBEAT NETWORK LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nrule \"LINUX SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nrule \"WINDOWS SYSMON EVENT 15 LOG NORMALIZATION\"\nrule \"OSSEC SYSCHECK ADDED EVENT NORMALIZATION\"\nrule \"EPSS CVE Criticality\"\nrule \"EPSS CVE Criticality - NMAP\"\nrule \"WINDOWS PROCESS ID - No EventData Field\"\nrule \"WINDOWS PROCESS ID - Non SOCFortress Sysmon\"\nrule \"Timestamp Failsafe - UTC\"\nrule \"LINUX OSQUERY-BPF PROCESS LIST LOG NORMALIZATION\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_system_Execution_attributes_ProcessID\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_event_ProcessId\"\nrule \"WINDOWS PROCESS ID - SIGMA - data_event_SourceProcessId\"\nrule \"LINUX OSQUERY PROCESS ID - GENERIC\"\nrule \"MacOS OSQUERY PROCESS_EVENTS LOG NORMALIZATION\"\nrule \"OpenAudit Remove field - data_system_network_item_dhcp_lease_obtained\"\nrule \"OpenAudit Remove field - data_system_software_item_install_date\"\nstage 4 match pass\nrule \"WINDOWS SYSMON EVENT 1 - SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 1 - EMPTY SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - EMPTY SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 3 - NETWORK PORTS\"\nstage 5 match pass\nrule \"WINDOWS SYSMON EVENT 1 - UNAPPROVED SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 7 - UNAPPROVED SOFTWARE VENDORS\"\nrule \"WINDOWS SYSMON EVENT 3 - UNCOMMON PORT\"\nstage 7 match either\nrule \"OVERRIDE SYSLOG LEVEL AFTER IoC FOUND\"\nstage 6 match either\nrule \"LINUX SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nrule \"OSSEC SYSCHECK ADDED - SOCFORTRESS THREAT INTEL\"\nrule \"PACKETBEAT DNS QUERY - SOCFORTRESS THREAT INTEL\"\nrule \"PACKETBEAT HTTP/S CONNECTION - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 1 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 15 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 22 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 6 - SOCFORTRESS THREAT INTEL\"\nrule \"WINDOWS SYSMON EVENT 7 - SOCFORTRESS THREAT INTEL\"\nend"
1749 + },
1750 + "connected_streams": [
1751 + {
1752 + "@type": "string",
1753 + "@value": "feb9e1d7-9346-4a2a-9566-59ed483c1b83"
1754 + }
1755 + ]
1756 + },
1757 + "constraints": [
1758 + {
1759 + "type": "server-version",
1760 + "version": ">=5.0.13+083613e"
1761 + }
1762 + ]
1763 + },
1764 + {
1765 + "id": "5a6fdec9-fa76-41f2-be92-158fa380db42",
1766 + "type": {
1767 + "name": "pipeline_rule",
1768 + "version": "1"
1769 + },
1770 + "v": "1",
1771 + "data": {
1772 + "title": {
1773 + "@type": "string",
1774 + "@value": "NIST 800-53 TO CUI MAPPING"
1775 + },
1776 + "description": {
1777 + "@type": "string",
1778 + "@value": "NIST 800-53 TO CUI MAPPING"
1779 + },
1780 + "source": {
1781 + "@type": "string",
1782 + "@value": "rule \"NIST 800-53 TO CUI MAPPING\"\nwhen\n has_field(\"rule_nist_800_53\")\nthen\n let ldata = lookup(\n lookup_table: \"nist_800_53_to_cui\",\n key: to_string($message.rule_nist_800_53)\n );\n set_fields(\n fields: ldata,\n prefix: \"cui_\"\n );\nend"
1783 + }
1784 + },
1785 + "constraints": [
1786 + {
1787 + "type": "server-version",
1788 + "version": ">=5.0.13+083613e"
1789 + }
1790 + ]
1791 + },
1792 + {
1793 + "id": "1d4217e1-28ab-4950-b8be-a25fc8e9555c",
1794 + "type": {
1795 + "name": "pipeline_rule",
1796 + "version": "1"
1797 + },
1798 + "v": "1",
1799 + "data": {
1800 + "title": {
1801 + "@type": "string",
1802 + "@value": "LINUX SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL"
1803 + },
1804 + "description": {
1805 + "@type": "string",
1806 + "@value": "LINUX SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL"
1807 + },
1808 + "source": {
1809 + "@type": "string",
1810 + "@value": "rule \"LINUX SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_eventdata_DestinationIp != \"127.0.0.1\" AND $message.data_eventdata_DestinationIp != \"255.255.255.255\" AND $message.data_eventdata_DestinationIp != \"0.0.0.0\" AND $message.data_eventdata_destinationIsIpv6 == \"false\" AND ! in_private_net(to_string($message.data_eventdata_DestinationIp))\nthen\n let ip_and_ampersand = concat(to_string($message.data_eventdata_DestinationIp), \"&customer_code=\");\n let new_key = concat(ip_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
1811 + }
1812 + },
1813 + "constraints": [
1814 + {
1815 + "type": "server-version",
1816 + "version": ">=5.0.13+083613e"
1817 + }
1818 + ]
1819 + },
1820 + {
1821 + "id": "5745b55a-7958-45d6-bdbf-67b8feca5b3a",
1822 + "type": {
1823 + "name": "pipeline_rule",
1824 + "version": "1"
1825 + },
1826 + "v": "1",
1827 + "data": {
1828 + "title": {
1829 + "@type": "string",
1830 + "@value": "WINDOWS PROCESS ID - SIGMA - data_system_Execution_attributes_ProcessID"
1831 + },
1832 + "description": {
1833 + "@type": "string",
1834 + "@value": "WINDOWS PROCESS ID - SIGMA - data_system_Execution_attributes_ProcessID"
1835 + },
1836 + "source": {
1837 + "@type": "string",
1838 + "@value": "rule \"WINDOWS PROCESS ID - SIGMA - data_system_Execution_attributes_ProcessID\"\nwhen\n has_field(\"data_system_Execution_attributes_ProcessID\") AND $message.rule_group1 == \"windows\" AND $message.rule_group2 == \"chainsaw\"\nthen\n set_field(\"process_id\", $message.data_system_Execution_attributes_ProcessID);\nend"
1839 + }
1840 + },
1841 + "constraints": [
1842 + {
1843 + "type": "server-version",
1844 + "version": ">=5.0.13+083613e"
1845 + }
1846 + ]
1847 + },
1848 + {
1849 + "id": "cf069904-64d8-4b2f-b57a-25fbc07dd47e",
1850 + "type": {
1851 + "name": "pipeline_rule",
1852 + "version": "1"
1853 + },
1854 + "v": "1",
1855 + "data": {
1856 + "title": {
1857 + "@type": "string",
1858 + "@value": "OVERRIDE SYSLOG LEVEL AFTER IoC FOUND"
1859 + },
1860 + "description": {
1861 + "@type": "string",
1862 + "@value": "OVERRIDE SYSLOG LEVEL AFTER IoC FOUND"
1863 + },
1864 + "source": {
1865 + "@type": "string",
1866 + "@value": "rule \"OVERRIDE SYSLOG LEVEL AFTER IoC FOUND\"\nwhen\n has_field(\"threat_intel_value\")\nthen\n set_field(\"syslog_level\", \"ALERT\");\nend"
1867 + }
1868 + },
1869 + "constraints": [
1870 + {
1871 + "type": "server-version",
1872 + "version": ">=5.0.13+083613e"
1873 + }
1874 + ]
1875 + },
1876 + {
1877 + "id": "fcf8bf1f-5280-474a-88bd-0ef50f2049db",
1878 + "type": {
1879 + "name": "pipeline_rule",
1880 + "version": "1"
1881 + },
1882 + "v": "1",
1883 + "data": {
1884 + "title": {
1885 + "@type": "string",
1886 + "@value": "LINUX SYSMON EVENT 9 LOG NORMALIZATION"
1887 + },
1888 + "description": {
1889 + "@type": "string",
1890 + "@value": "LINUX SYSMON EVENT 9 LOG NORMALIZATION"
1891 + },
1892 + "source": {
1893 + "@type": "string",
1894 + "@value": "rule \"LINUX SYSMON EVENT 9 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event9\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"device\", $message.data_eventdata_device);\nend"
1895 + }
1896 + },
1897 + "constraints": [
1898 + {
1899 + "type": "server-version",
1900 + "version": ">=5.0.13+083613e"
1901 + }
1902 + ]
1903 + },
1904 + {
1905 + "id": "81633691-fa79-4ca8-a5ff-c67fc55ede49",
1906 + "type": {
1907 + "name": "pipeline_rule",
1908 + "version": "1"
1909 + },
1910 + "v": "1",
1911 + "data": {
1912 + "title": {
1913 + "@type": "string",
1914 + "@value": "WINDOWS SYSMON EVENT 22 LOG NORMALIZATION"
1915 + },
1916 + "description": {
1917 + "@type": "string",
1918 + "@value": "WINDOWS SYSMON EVENT 22 LOG NORMALIZATION"
1919 + },
1920 + "source": {
1921 + "@type": "string",
1922 + "@value": "rule \"WINDOWS SYSMON EVENT 22 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_22\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"dns_query\", $message.data_win_eventdata_queryName);\n set_field(\"dns_answer\", $message.data_win_eventdata_queryResults);\n set_field(\"dns_response_code\", $message.data_win_eventdata_queryStatus);\nend"
1923 + }
1924 + },
1925 + "constraints": [
1926 + {
1927 + "type": "server-version",
1928 + "version": ">=5.0.13+083613e"
1929 + }
1930 + ]
1931 + },
1932 + {
1933 + "id": "ed57ba97-b339-41cf-91c1-1837feecf032",
1934 + "type": {
1935 + "name": "pipeline_rule",
1936 + "version": "1"
1937 + },
1938 + "v": "1",
1939 + "data": {
1940 + "title": {
1941 + "@type": "string",
1942 + "@value": "DROP SYSMON EVT 12 LOGS - WELL KNOWN PROCESS IMAGE"
1943 + },
1944 + "description": {
1945 + "@type": "string",
1946 + "@value": "DROP SYSMON EVT 12 LOGS - WELL KNOWN PROCESS IMAGE"
1947 + },
1948 + "source": {
1949 + "@type": "string",
1950 + "@value": "rule \"DROP SYSMON EVT 12 LOGS - WELL KNOWN PROCESS IMAGE\"\nwhen\n$message.rule_group3 == \"sysmon_event_12\" AND ($message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\Packages\\\\\\\\AgentPackageHeartbeat\\\\\\\\AgentPackageHeartbeat.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\WINDOWS\\\\\\\\system32\\\\\\\\svchost.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\windows\\\\\\\\system32\\\\\\\\svchost.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\svchost.exe\")\nthen\n drop_message();\nend"
1951 + }
1952 + },
1953 + "constraints": [
1954 + {
1955 + "type": "server-version",
1956 + "version": ">=5.0.13+083613e"
1957 + }
1958 + ]
1959 + },
1960 + {
1961 + "id": "a711be64-131f-494f-9068-9dcd56da1b02",
1962 + "type": {
1963 + "name": "pipeline_rule",
1964 + "version": "1"
1965 + },
1966 + "v": "1",
1967 + "data": {
1968 + "title": {
1969 + "@type": "string",
1970 + "@value": "WINDOWS SYSMON EVENT 15 LOG NORMALIZATION"
1971 + },
1972 + "description": {
1973 + "@type": "string",
1974 + "@value": "WINDOWS SYSMON EVENT 15 LOG NORMALIZATION"
1975 + },
1976 + "source": {
1977 + "@type": "string",
1978 + "@value": "rule \"WINDOWS SYSMON EVENT 15 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_15\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"target_file\", $message.data_win_eventdata_targetFilename);\nend"
1979 + }
1980 + },
1981 + "constraints": [
1982 + {
1983 + "type": "server-version",
1984 + "version": ">=5.0.13+083613e"
1985 + }
1986 + ]
1987 + },
1988 + {
1989 + "id": "de7d8e04-ad04-4185-8811-569f0cc17bd5",
1990 + "type": {
1991 + "name": "pipeline_rule",
1992 + "version": "1"
1993 + },
1994 + "v": "1",
1995 + "data": {
1996 + "title": {
1997 + "@type": "string",
1998 + "@value": "PACKETBEAT DNS QUERY - SOCFORTRESS THREAT INTEL"
1999 + },
2000 + "description": {
2001 + "@type": "string",
2002 + "@value": "PACKETBEAT DNS QUERY - SOCFORTRESS THREAT INTEL"
2003 + },
2004 + "source": {
2005 + "@type": "string",
2006 + "@value": "rule \"PACKETBEAT DNS QUERY - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"dns\"\nthen\n let dns_question_name_and_ampersand = concat(to_string($message.data_dns_question_name), \"&customer_code=\");\n let new_key = concat(dns_question_name_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
2007 + }
2008 + },
2009 + "constraints": [
2010 + {
2011 + "type": "server-version",
2012 + "version": ">=5.0.13+083613e"
2013 + }
2014 + ]
2015 + },
2016 + {
2017 + "id": "73af67a1-87a4-4e61-bd96-f68557603a92",
2018 + "type": {
2019 + "name": "pipeline_rule",
2020 + "version": "1"
2021 + },
2022 + "v": "1",
2023 + "data": {
2024 + "title": {
2025 + "@type": "string",
2026 + "@value": "OSSEC SYSCHECK ADDED - SOCFORTRESS THREAT INTEL"
2027 + },
2028 + "description": {
2029 + "@type": "string",
2030 + "@value": "OSSEC SYSCHECK ADDED - SOCFORTRESS THREAT INTEL"
2031 + },
2032 + "source": {
2033 + "@type": "string",
2034 + "@value": "rule \"OSSEC SYSCHECK ADDED - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"ossec\" AND $message.rule_group2 == \"syscheck\" AND $message.syscheck_event == \"added\"\nthen\n let sha256_and_ampersand = concat(to_string($message.sha256), \"&customer_code=\");\n let new_key = concat(sha256_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend\n"
2035 + }
2036 + },
2037 + "constraints": [
2038 + {
2039 + "type": "server-version",
2040 + "version": ">=5.0.13+083613e"
2041 + }
2042 + ]
2043 + },
2044 + {
2045 + "id": "4105240a-13b3-4cf0-b62f-566227d522cb",
2046 + "type": {
2047 + "name": "pipeline_rule",
2048 + "version": "1"
2049 + },
2050 + "v": "1",
2051 + "data": {
2052 + "title": {
2053 + "@type": "string",
2054 + "@value": "Osquery Epoch Timestamp - UTC"
2055 + },
2056 + "description": {
2057 + "@type": "string",
2058 + "@value": "Osquery Epoch Timestamp - UTC"
2059 + },
2060 + "source": {
2061 + "@type": "string",
2062 + "@value": "rule \"Osquery Epoch Timestamp - UTC\"\nwhen\n has_field(\"data_unixTime\")\nthen\n let ts_millis = to_long($message.data_unixTime) * 1000;\n let new_date = parse_unix_milliseconds(ts_millis);\n set_field(\"timestamp_utc\", new_date);\nend"
2063 + }
2064 + },
2065 + "constraints": [
2066 + {
2067 + "type": "server-version",
2068 + "version": ">=5.0.13+083613e"
2069 + }
2070 + ]
2071 + },
2072 + {
2073 + "id": "546e667e-b3c4-482f-9f43-a836097290ed",
2074 + "type": {
2075 + "name": "pipeline_rule",
2076 + "version": "1"
2077 + },
2078 + "v": "1",
2079 + "data": {
2080 + "title": {
2081 + "@type": "string",
2082 + "@value": "WINDOWS SYSMON EVENT 2 LOG NORMALIZATION"
2083 + },
2084 + "description": {
2085 + "@type": "string",
2086 + "@value": "WINDOWS SYSMON EVENT 2 LOG NORMALIZATION"
2087 + },
2088 + "source": {
2089 + "@type": "string",
2090 + "@value": "rule \"WINDOWS SYSMON EVENT 2 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event2\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"target_file\", $message.data_win_eventdata_targetFilename);\nend"
2091 + }
2092 + },
2093 + "constraints": [
2094 + {
2095 + "type": "server-version",
2096 + "version": ">=5.0.13+083613e"
2097 + }
2098 + ]
2099 + },
2100 + {
2101 + "id": "5452ff04-d03a-4876-8417-63b00ecdd2ed",
2102 + "type": {
2103 + "name": "pipeline_rule",
2104 + "version": "1"
2105 + },
2106 + "v": "1",
2107 + "data": {
2108 + "title": {
2109 + "@type": "string",
2110 + "@value": "DROP OSQUERY PROCESS EVENTS - WELL KNOWN PROCESSES"
2111 + },
2112 + "description": {
2113 + "@type": "string",
2114 + "@value": "DROP OSQUERY PROCESS EVENTS - WELL KNOWN PROCESSES"
2115 + },
2116 + "source": {
2117 + "@type": "string",
2118 + "@value": "rule \"DROP OSQUERY PROCESS EVENTS - WELL KNOWN PROCESSES\"\nwhen\n$message.rule_group2 == \"process_events\" AND ($message.data_columns_path == \"/usr/bin/ls\" OR $message.data_columns_path == \"/usr/bin/ps\" OR $message.data_columns_path == \"/usr/bin/sleep\" OR $message.data_columns_path == \"/usr/bin/awk\" OR $message.data_columns_path == \"/var/ossec/bin/wazuh-control\" OR $message.data_columns_path == \"/usr/bin/runc\" OR $message.data_columns_path == \"/usr/libexec/docker/docker-init\")\nthen\n drop_message();\nend"
2119 + }
2120 + },
2121 + "constraints": [
2122 + {
2123 + "type": "server-version",
2124 + "version": ">=5.0.13+083613e"
2125 + }
2126 + ]
2127 + },
2128 + {
2129 + "id": "04371a3b-aaaf-4440-8cb4-4f53d0a74508",
2130 + "type": {
2131 + "name": "pipeline_rule",
2132 + "version": "1"
2133 + },
2134 + "v": "1",
2135 + "data": {
2136 + "title": {
2137 + "@type": "string",
2138 + "@value": "MacOS OSQUERY PROCESS_EVENTS LOG NORMALIZATION"
2139 + },
2140 + "description": {
2141 + "@type": "string",
2142 + "@value": "MacOS OSQUERY PROCESS_EVENTS LOG NORMALIZATION"
2143 + },
2144 + "source": {
2145 + "@type": "string",
2146 + "@value": "rule \"MacOS OSQUERY PROCESS_EVENTS LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"osquery\" AND $message.rule_group2 == \"process_events\"\nthen\n set_field(\"process_name\", $message.data_columns_path);\n set_field(\"process_image\", $message.data_columns_path);\n set_field(\"process_id\", $message.data_columns_pid);\n set_field(\"user_name\", $message.data_columns_username);\n set_field(\"software_vendor\", $message.data_columns_signing_id);\n set_field(\"software_product\", $message.data_columns_signing_id);\n set_field(\"process_image_hashes\", $message.data_columns_cdhash);\n set_field(\"parent_process_id\", $message.data_columns_parent);\n set_field(\"parent_process_image\", $message.data_columns_parent);\n set_field(\"parent_process_user\", $message.data_win_eventdata_parentUser);\nend"
2147 + }
2148 + },
2149 + "constraints": [
2150 + {
2151 + "type": "server-version",
2152 + "version": ">=5.0.13+083613e"
2153 + }
2154 + ]
2155 + },
2156 + {
2157 + "id": "d501207b-5195-4a20-be79-342b824e36fa",
2158 + "type": {
2159 + "name": "pipeline_rule",
2160 + "version": "1"
2161 + },
2162 + "v": "1",
2163 + "data": {
2164 + "title": {
2165 + "@type": "string",
2166 + "@value": "Linux Sysmon Timestamp - UTC"
2167 + },
2168 + "description": {
2169 + "@type": "string",
2170 + "@value": "Linux Sysmon Timestamp - UTC"
2171 + },
2172 + "source": {
2173 + "@type": "string",
2174 + "@value": "rule \"Linux Sysmon Timestamp - UTC\"\nwhen\n has_field(\"data_system_systemTime\")\nthen\n let time = parse_date(to_string($message.data_system_systemTime), \"yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSS'Z'\", \"Etc/UTC\");\n set_field(\"timestamp_utc\", time);\nend"
2175 + }
2176 + },
2177 + "constraints": [
2178 + {
2179 + "type": "server-version",
2180 + "version": ">=5.0.13+083613e"
2181 + }
2182 + ]
2183 + },
2184 + {
2185 + "id": "ba83edb5-a196-42b8-9367-04d44e9c2402",
2186 + "type": {
2187 + "name": "pipeline_rule",
2188 + "version": "1"
2189 + },
2190 + "v": "1",
2191 + "data": {
2192 + "title": {
2193 + "@type": "string",
2194 + "@value": "LINUX SYSMON EVENT 3 LOG NORMALIZATION"
2195 + },
2196 + "description": {
2197 + "@type": "string",
2198 + "@value": "LINUX SYSMON EVENT 3 LOG NORMALIZATION"
2199 + },
2200 + "source": {
2201 + "@type": "string",
2202 + "@value": "rule \"LINUX SYSMON EVENT 3 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event3\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"protocol\", $message.data_eventdata_protocol);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"dst_ip\", $message.data_eventdata_DestinationIp);\n set_field(\"dst_port\", $message.data_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_eventdata_sourcePort);\nend"
2203 + }
2204 + },
2205 + "constraints": [
2206 + {
2207 + "type": "server-version",
2208 + "version": ">=5.0.13+083613e"
2209 + }
2210 + ]
2211 + },
2212 + {
2213 + "id": "f19ebc4f-2a74-4e0e-844c-4b86087ff753",
2214 + "type": {
2215 + "name": "pipeline_rule",
2216 + "version": "1"
2217 + },
2218 + "v": "1",
2219 + "data": {
2220 + "title": {
2221 + "@type": "string",
2222 + "@value": "WINDOWS SYSMON EVENT 22 - SOCFORTRESS THREAT INTEL"
2223 + },
2224 + "description": {
2225 + "@type": "string",
2226 + "@value": "WINDOWS SYSMON EVENT 22 - SOCFORTRESS THREAT INTEL"
2227 + },
2228 + "source": {
2229 + "@type": "string",
2230 + "@value": "rule \"WINDOWS SYSMON EVENT 22 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_22\"\nthen\n let query_name_and_ampersand = concat(to_string($message.data_win_eventdata_queryName), \"&customer_code=\");\n let new_key = concat(query_name_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
2231 + }
2232 + },
2233 + "constraints": [
2234 + {
2235 + "type": "server-version",
2236 + "version": ">=5.0.13+083613e"
2237 + }
2238 + ]
2239 + },
2240 + {
2241 + "id": "90ec68d3-bf43-477d-8b1e-a9accf50b60e",
2242 + "type": {
2243 + "name": "pipeline_rule",
2244 + "version": "1"
2245 + },
2246 + "v": "1",
2247 + "data": {
2248 + "title": {
2249 + "@type": "string",
2250 + "@value": "DROP OSQUERY SOCKET EVENTS - WELL KNOWN PROCESSES"
2251 + },
2252 + "description": {
2253 + "@type": "string",
2254 + "@value": "DROP OSQUERY SOCKET EVENTS - WELL KNOWN PROCESSES"
2255 + },
2256 + "source": {
2257 + "@type": "string",
2258 + "@value": "rule \"DROP OSQUERY SOCKET EVENTS - WELL KNOWN PROCESSES\"\nwhen\n$message.rule_group2 == \"bpf_socket_events\" AND ($message.data_columns_path == \"/var/ossec/bin/wazuh-syscheckd\" OR $message.data_columns_path == \"/usr/bin/telegraf\" OR $message.data_columns_path == \"/usr/sbin/haproxy\" OR $message.data_columns_path == \"/var/ossec/bin/wazuh-control\" OR $message.data_columns_path == \"/opt/fluent-bit/bin/fluent-bit\" OR $message.data_columns_path == \"/var/ossec/framework/python/bin/python3.9\" OR $message.data_columns_path == \"/var/ossec/bin/wazuh-remoted\" OR $message.data_columns_path == \"/usr/share/filebeat/bin/filebeat\" OR $message.data_columns_path == \"/var/ossec/bin/wazuh-modulesd\" OR $message.data_columns_path == \"/worker\" OR $message.data_columns_path == \"/usr/bin/python3.9\" OR $message.data_columns_path == \"/usr/local/bin/python3.10\" OR $message.data_columns_path == \"/usr/local/sbin/haproxy\" OR $message.data_columns_path == \"/usr/bin/systemctl\" OR $message.data_columns_path == \"/usr/local/bin/python3.9\" OR $message.data_columns_path == \"/app/webapp\" OR $message.data_columns_path == \"/usr/share/graylog-server/jvm/bin/java\" OR $message.data_columns_path == \"/usr/share/grafana/bin/grafana\" OR $message.data_columns_path == \"/usr/bin/dockerd\" OR $message.data_columns_path == \"/usr/local/bin/velociraptor.bin\")\nthen\n drop_message();\nend"
2259 + }
2260 + },
2261 + "constraints": [
2262 + {
2263 + "type": "server-version",
2264 + "version": ">=5.0.13+083613e"
2265 + }
2266 + ]
2267 + },
2268 + {
2269 + "id": "7a45ad2d-e6f1-4d2b-8f9f-1f8b44a73f0b",
2270 + "type": {
2271 + "name": "pipeline_rule",
2272 + "version": "1"
2273 + },
2274 + "v": "1",
2275 + "data": {
2276 + "title": {
2277 + "@type": "string",
2278 + "@value": "WINDOWS SYSMON EVENT 23 LOG NORMALIZATION"
2279 + },
2280 + "description": {
2281 + "@type": "string",
2282 + "@value": "WINDOWS SYSMON EVENT 23 LOG NORMALIZATION"
2283 + },
2284 + "source": {
2285 + "@type": "string",
2286 + "@value": "rule \"WINDOWS SYSMON EVENT 23 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_23\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"target_file\", $message.data_win_eventdata_targetFilename);\n set_field(\"is_executable\", $message.data_win_eventdata_isExecutable);\n set_field(\"file_hashes\", $message.data_win_eventdata_hashes);\nend"
2287 + }
2288 + },
2289 + "constraints": [
2290 + {
2291 + "type": "server-version",
2292 + "version": ">=5.0.13+083613e"
2293 + }
2294 + ]
2295 + },
2296 + {
2297 + "id": "b807c042-0124-4a55-a92c-230c13fc1ca9",
2298 + "type": {
2299 + "name": "pipeline_rule",
2300 + "version": "1"
2301 + },
2302 + "v": "1",
2303 + "data": {
2304 + "title": {
2305 + "@type": "string",
2306 + "@value": "WINDOWS SYSMON EVENT 7 - SOFTWARE VENDORS"
2307 + },
2308 + "description": {
2309 + "@type": "string",
2310 + "@value": "WINDOWS SYSMON EVENT 7 - SOFTWARE VENDORS"
2311 + },
2312 + "source": {
2313 + "@type": "string",
2314 + "@value": "rule \"WINDOWS SYSMON EVENT 7 - SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event7\" AND has_field(\"data_win_eventdata_company\")\nthen\n let ldata = lookup_value(\n lookup_table: \"software-vendors\",\n key: to_string($message.data_win_eventdata_company,\"no\")\n );\n set_field(\"software_approved\", ldata);\nend"
2315 + }
2316 + },
2317 + "constraints": [
2318 + {
2319 + "type": "server-version",
2320 + "version": ">=5.0.13+083613e"
2321 + }
2322 + ]
2323 + },
2324 + {
2325 + "id": "b3d62cc1-de49-4e29-a39a-88d19ac6da02",
2326 + "type": {
2327 + "name": "pipeline_rule",
2328 + "version": "1"
2329 + },
2330 + "v": "1",
2331 + "data": {
2332 + "title": {
2333 + "@type": "string",
2334 + "@value": "WINDOWS SYSMON EVENT 7 - SOCFORTRESS THREAT INTEL"
2335 + },
2336 + "description": {
2337 + "@type": "string",
2338 + "@value": "WINDOWS SYSMON EVENT 7 - SOCFORTRESS THREAT INTEL"
2339 + },
2340 + "source": {
2341 + "@type": "string",
2342 + "@value": "rule \"WINDOWS SYSMON EVENT 7 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event7\" AND $message.data_win_eventdata_signed == \"false\"\nthen\n let sha256_and_ampersand = concat(to_string($message.sha256), \"&customer_code=\");\n let new_key = concat(sha256_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
2343 + }
2344 + },
2345 + "constraints": [
2346 + {
2347 + "type": "server-version",
2348 + "version": ">=5.0.13+083613e"
2349 + }
2350 + ]
2351 + },
2352 + {
2353 + "id": "f709c6a9-8e24-4a37-a86d-3507ffb67010",
2354 + "type": {
2355 + "name": "pipeline_rule",
2356 + "version": "1"
2357 + },
2358 + "v": "1",
2359 + "data": {
2360 + "title": {
2361 + "@type": "string",
2362 + "@value": "DROP SYSMON EVT 13 LOGS - WELL KNOWN PROCESS IMAGE"
2363 + },
2364 + "description": {
2365 + "@type": "string",
2366 + "@value": "DROP SYSMON EVT 13 LOGS - WELL KNOWN PROCESS IMAGE"
2367 + },
2368 + "source": {
2369 + "@type": "string",
2370 + "@value": "rule \"DROP SYSMON EVT 13 LOGS - WELL KNOWN PROCESS IMAGE\"\nwhen\n$message.rule_group3 == \"sysmon_event_13\" AND ($message.data_win_eventdata_image == \"C:\\\\\\\\WINDOWS\\\\\\\\system32\\\\\\\\svchost.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\windows\\\\\\\\system32\\\\\\\\svchost.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\svchost.exe\" OR $message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\Google\\\\\\\\Chrome\\\\\\\\Application\\\\\\\\chrome.exe\")\nthen\n drop_message();\nend"
2371 + }
2372 + },
2373 + "constraints": [
2374 + {
2375 + "type": "server-version",
2376 + "version": ">=5.0.13+083613e"
2377 + }
2378 + ]
2379 + },
2380 + {
2381 + "id": "dbad257a-932d-48e5-8a70-ac3313857a9c",
2382 + "type": {
2383 + "name": "pipeline_rule",
2384 + "version": "1"
2385 + },
2386 + "v": "1",
2387 + "data": {
2388 + "title": {
2389 + "@type": "string",
2390 + "@value": "LINUX SYSMON EVENT 23 LOG NORMALIZATION"
2391 + },
2392 + "description": {
2393 + "@type": "string",
2394 + "@value": "LINUX SYSMON EVENT 23 LOG NORMALIZATION"
2395 + },
2396 + "source": {
2397 + "@type": "string",
2398 + "@value": "rule \"LINUX SYSMON EVENT 23 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event_23\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"target_file\", $message.data_eventdata_targetFilename);\n set_field(\"is_executable\", $message.data_eventdata_isExecutable);\n set_field(\"file_hashes\", $message.data_eventdata_hashes);\nend"
2399 + }
2400 + },
2401 + "constraints": [
2402 + {
2403 + "type": "server-version",
2404 + "version": ">=5.0.13+083613e"
2405 + }
2406 + ]
2407 + },
2408 + {
2409 + "id": "31918fde-a64c-4ad6-b3c2-5a4407236ee4",
2410 + "type": {
2411 + "name": "pipeline_rule",
2412 + "version": "1"
2413 + },
2414 + "v": "1",
2415 + "data": {
2416 + "title": {
2417 + "@type": "string",
2418 + "@value": "LINUX OSQUERY PROCESS LIST LOG NORMALIZATION"
2419 + },
2420 + "description": {
2421 + "@type": "string",
2422 + "@value": "LINUX OSQUERY PROCESS LIST LOG NORMALIZATION"
2423 + },
2424 + "source": {
2425 + "@type": "string",
2426 + "@value": "rule \"LINUX OSQUERY PROCESS LIST LOG NORMALIZATION\"\nwhen\n$message.rule_group1 == \"osquery\" AND $message.rule_group2 == \"list_processes\"\nthen\n set_field(\"process_name\", $message.data_osquery_columns_name);\n set_field(\"process_image\", $message.data_osquery_columns_path);\n set_field(\"process_id\", $message.data_osquery_columns_pid);\n set_field(\"process_cmd_line\", $message.data_osquery_columns_cmdline);\n set_field(\"user_name\", $message.data_osquery_columns_username);\n set_field(\"parent_process_id\", $message.data_osquery_columns_parent);\nend"
2427 + }
2428 + },
2429 + "constraints": [
2430 + {
2431 + "type": "server-version",
2432 + "version": ">=5.0.13+083613e"
2433 + }
2434 + ]
2435 + },
2436 + {
2437 + "id": "2596c531-6959-4955-bfef-b32c5ce296fd",
2438 + "type": {
2439 + "name": "pipeline_rule",
2440 + "version": "1"
2441 + },
2442 + "v": "1",
2443 + "data": {
2444 + "title": {
2445 + "@type": "string",
2446 + "@value": "WINDOWS SYSMON EVENT 3 LOG NORMALIZATION"
2447 + },
2448 + "description": {
2449 + "@type": "string",
2450 + "@value": "WINDOWS SYSMON EVENT 3 LOG NORMALIZATION"
2451 + },
2452 + "source": {
2453 + "@type": "string",
2454 + "@value": "rule \"WINDOWS SYSMON EVENT 3 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"protocol\", $message.data_win_eventdata_protocol);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"dst_ip\", $message.data_win_eventdata_destinationIp);\n set_field(\"dst_port\", $message.data_win_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_win_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_win_eventdata_sourcePort);\nend"
2455 + }
2456 + },
2457 + "constraints": [
2458 + {
2459 + "type": "server-version",
2460 + "version": ">=5.0.13+083613e"
2461 + }
2462 + ]
2463 + },
2464 + {
2465 + "id": "3a47b63b-504a-4884-aac3-7c782988fa52",
2466 + "type": {
2467 + "name": "pipeline_rule",
2468 + "version": "1"
2469 + },
2470 + "v": "1",
2471 + "data": {
2472 + "title": {
2473 + "@type": "string",
2474 + "@value": "LINUX SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION"
2475 + },
2476 + "description": {
2477 + "@type": "string",
2478 + "@value": "LINUX SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION"
2479 + },
2480 + "source": {
2481 + "@type": "string",
2482 + "@value": "rule \"LINUX SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_eventdata_initiated == \"false\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"protocol\", $message.data_eventdata_protocol);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"dst_ip\", $message.data_eventdata_DestinationIp);\n set_field(\"dst_port\", $message.data_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_eventdata_sourcePort);\n set_field(\"traffic_direction\", \"ingress\"); \nend"
2483 + }
2484 + },
2485 + "constraints": [
2486 + {
2487 + "type": "server-version",
2488 + "version": ">=5.0.13+083613e"
2489 + }
2490 + ]
2491 + },
2492 + {
2493 + "id": "731ca120-24f1-4d56-ab8c-6706d4592ac8",
2494 + "type": {
2495 + "name": "pipeline_rule",
2496 + "version": "1"
2497 + },
2498 + "v": "1",
2499 + "data": {
2500 + "title": {
2501 + "@type": "string",
2502 + "@value": "PACKETBEAT HTTP/S CONNECTION - SOCFORTRESS THREAT INTEL"
2503 + },
2504 + "description": {
2505 + "@type": "string",
2506 + "@value": "PACKETBEAT HTTP/S CONNECTION - SOCFORTRESS THREAT INTEL"
2507 + },
2508 + "source": {
2509 + "@type": "string",
2510 + "@value": "rule \"PACKETBEAT HTTP/S CONNECTION - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"tls\" OR $message.rule_group3 == \"http\"\nthen\n let ip_and_ampersand = concat(to_string($message.data_destination_ip), \"&customer_code=\");\n let new_key = concat(ip_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
2511 + }
2512 + },
2513 + "constraints": [
2514 + {
2515 + "type": "server-version",
2516 + "version": ">=5.0.13+083613e"
2517 + }
2518 + ]
2519 + },
2520 + {
2521 + "id": "794068e2-fc89-41e8-a390-5f947695ba28",
2522 + "type": {
2523 + "name": "pipeline_rule",
2524 + "version": "1"
2525 + },
2526 + "v": "1",
2527 + "data": {
2528 + "title": {
2529 + "@type": "string",
2530 + "@value": "WINDOWS SYSMON EVENT 1 - UNAPPROVED SOFTWARE VENDORS"
2531 + },
2532 + "description": {
2533 + "@type": "string",
2534 + "@value": "WINDOWS SYSMON EVENT 1 - UNAPPROVED SOFTWARE VENDORS"
2535 + },
2536 + "source": {
2537 + "@type": "string",
2538 + "@value": "rule \"WINDOWS SYSMON EVENT 1 - UNAPPROVED SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event1\" AND ! has_field(\"software_approved\")\nthen\nset_field(\"software_approved\", \"no\");\nset_field(\"syslog_level\", \"WARNING\");\nlet build_message_0 = to_string(\" Sysmon - Event 1: Process creation Unapproved Software \");\nlet build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_company));\nset_field(\"rule_description\", build_message_1);\nend"
2539 + }
2540 + },
2541 + "constraints": [
2542 + {
2543 + "type": "server-version",
2544 + "version": ">=5.0.13+083613e"
2545 + }
2546 + ]
2547 + },
2548 + {
2549 + "id": "b4de7d44-01b1-4ec6-b4e4-92e991dcf6be",
2550 + "type": {
2551 + "name": "pipeline_rule",
2552 + "version": "1"
2553 + },
2554 + "v": "1",
2555 + "data": {
2556 + "title": {
2557 + "@type": "string",
2558 + "@value": "WINDOWS SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION"
2559 + },
2560 + "description": {
2561 + "@type": "string",
2562 + "@value": "WINDOWS SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION"
2563 + },
2564 + "source": {
2565 + "@type": "string",
2566 + "@value": "rule \"WINDOWS SYSMON EVENT 3 INBOUND CONNECTION LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_win_eventdata_initiated == \"false\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"protocol\", $message.data_win_eventdata_protocol);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"dst_ip\", $message.data_win_eventdata_destinationIp);\n set_field(\"dst_port\", $message.data_win_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_win_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_win_eventdata_sourcePort);\n set_field(\"traffic_direction\", \"ingress\"); \nend"
2567 + }
2568 + },
2569 + "constraints": [
2570 + {
2571 + "type": "server-version",
2572 + "version": ">=5.0.13+083613e"
2573 + }
2574 + ]
2575 + },
2576 + {
2577 + "id": "0f3bd968-508b-4fd4-9662-953b5a34e1e9",
2578 + "type": {
2579 + "name": "pipeline_rule",
2580 + "version": "1"
2581 + },
2582 + "v": "1",
2583 + "data": {
2584 + "title": {
2585 + "@type": "string",
2586 + "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - WARNING"
2587 + },
2588 + "description": {
2589 + "@type": "string",
2590 + "@value": "CREATE FIELD SYSLOG LEVEL - WARNING"
2591 + },
2592 + "source": {
2593 + "@type": "string",
2594 + "@value": "rule \"WAZUH CREATE FIELD SYSLOG LEVEL - WARNING\"\nwhen to_long($message.rule_level) > 7 AND to_long($message.rule_level) < 12\nthen\nset_field(\"syslog_level\", \"WARNING\");\nend"
2595 + }
2596 + },
2597 + "constraints": [
2598 + {
2599 + "type": "server-version",
2600 + "version": ">=5.0.13+083613e"
2601 + }
2602 + ]
2603 + },
2604 + {
2605 + "id": "f663f3fd-955e-4b78-85f4-93571a64c252",
2606 + "type": {
2607 + "name": "pipeline_rule",
2608 + "version": "1"
2609 + },
2610 + "v": "1",
2611 + "data": {
2612 + "title": {
2613 + "@type": "string",
2614 + "@value": "WINDOWS SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION"
2615 + },
2616 + "description": {
2617 + "@type": "string",
2618 + "@value": "WINDOWS SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION"
2619 + },
2620 + "source": {
2621 + "@type": "string",
2622 + "@value": "rule \"WINDOWS SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_win_eventdata_initiated == \"true\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"protocol\", $message.data_win_eventdata_protocol);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"dst_ip\", $message.data_win_eventdata_destinationIp);\n set_field(\"dst_port\", $message.data_win_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_win_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_win_eventdata_sourcePort);\n set_field(\"traffic_direction\", \"external\"); \nend"
2623 + }
2624 + },
2625 + "constraints": [
2626 + {
2627 + "type": "server-version",
2628 + "version": ">=5.0.13+083613e"
2629 + }
2630 + ]
2631 + },
2632 + {
2633 + "id": "694f2402-bb3e-4d24-b892-bcbcc73fecfb",
2634 + "type": {
2635 + "name": "pipeline_rule",
2636 + "version": "1"
2637 + },
2638 + "v": "1",
2639 + "data": {
2640 + "title": {
2641 + "@type": "string",
2642 + "@value": "LINUX SYSMON EVENT 11 LOG NORMALIZATION"
2643 + },
2644 + "description": {
2645 + "@type": "string",
2646 + "@value": "LINUX SYSMON EVENT 11 LOG NORMALIZATION"
2647 + },
2648 + "source": {
2649 + "@type": "string",
2650 + "@value": "rule \"LINUX SYSMON EVENT 11 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event_11\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"target_file\", $message.data_eventdata_targetFilename);\nend"
2651 + }
2652 + },
2653 + "constraints": [
2654 + {
2655 + "type": "server-version",
2656 + "version": ">=5.0.13+083613e"
2657 + }
2658 + ]
2659 + },
2660 + {
2661 + "id": "bf6d21ee-ab54-465f-a786-44ac833d3416",
2662 + "type": {
2663 + "name": "pipeline_rule",
2664 + "version": "1"
2665 + },
2666 + "v": "1",
2667 + "data": {
2668 + "title": {
2669 + "@type": "string",
2670 + "@value": "WINDOWS PROCESS ID - SIGMA - data_event_ProcessId"
2671 + },
2672 + "description": {
2673 + "@type": "string",
2674 + "@value": "WINDOWS PROCESS ID - SIGMA - data_event_ProcessId"
2675 + },
2676 + "source": {
2677 + "@type": "string",
2678 + "@value": "rule \"WINDOWS PROCESS ID - SIGMA - data_event_ProcessId\"\nwhen\n has_field(\"data_event_ProcessId\") AND $message.rule_group1 == \"windows\" AND $message.rule_group2 == \"chainsaw\"\nthen\n set_field(\"process_id\", $message.data_event_ProcessId);\nend"
2679 + }
2680 + },
2681 + "constraints": [
2682 + {
2683 + "type": "server-version",
2684 + "version": ">=5.0.13+083613e"
2685 + }
2686 + ]
2687 + },
2688 + {
2689 + "id": "76aec17e-8048-46ce-9bd3-6dad333b66e5",
2690 + "type": {
2691 + "name": "pipeline_rule",
2692 + "version": "1"
2693 + },
2694 + "v": "1",
2695 + "data": {
2696 + "title": {
2697 + "@type": "string",
2698 + "@value": "WINDOWS PROCESS ID - SIGMA - data_event_SourceProcessId"
2699 + },
2700 + "description": {
2701 + "@type": "string",
2702 + "@value": "WINDOWS PROCESS ID - SIGMA - data_event_SourceProcessId"
2703 + },
2704 + "source": {
2705 + "@type": "string",
2706 + "@value": "rule \"WINDOWS PROCESS ID - SIGMA - data_event_SourceProcessId\"\nwhen\n has_field(\"data_event_SourceProcessId\") AND $message.rule_group1 == \"windows\" AND $message.rule_group2 == \"chainsaw\"\nthen\n set_field(\"process_id\", $message.data_event_SourceProcessId);\nend"
2707 + }
2708 + },
2709 + "constraints": [
2710 + {
2711 + "type": "server-version",
2712 + "version": ">=5.0.13+083613e"
2713 + }
2714 + ]
2715 + },
2716 + {
2717 + "id": "96a20a8a-1da1-48d4-81f0-0ef51a2c9e8e",
2718 + "type": {
2719 + "name": "pipeline_rule",
2720 + "version": "1"
2721 + },
2722 + "v": "1",
2723 + "data": {
2724 + "title": {
2725 + "@type": "string",
2726 + "@value": "WINDOWS SYSMON EVENT 13 LOG NORMALIZATION"
2727 + },
2728 + "description": {
2729 + "@type": "string",
2730 + "@value": "WINDOWS SYSMON EVENT 13 LOG NORMALIZATION"
2731 + },
2732 + "source": {
2733 + "@type": "string",
2734 + "@value": "rule \"WINDOWS SYSMON EVENT 13 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_13\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"target_object\", $message.data_win_eventdata_targetObject);\n set_field(\"event_type\", $message.data_win_eventdata_eventType);\nend"
2735 + }
2736 + },
2737 + "constraints": [
2738 + {
2739 + "type": "server-version",
2740 + "version": ">=5.0.13+083613e"
2741 + }
2742 + ]
2743 + },
2744 + {
2745 + "id": "a47cbbda-bf0f-4b22-85c2-4ca03472c8dc",
2746 + "type": {
2747 + "name": "pipeline_rule",
2748 + "version": "1"
2749 + },
2750 + "v": "1",
2751 + "data": {
2752 + "title": {
2753 + "@type": "string",
2754 + "@value": "WINDOWS SYSMON EVENT 11 LOG NORMALIZATION"
2755 + },
2756 + "description": {
2757 + "@type": "string",
2758 + "@value": "WINDOWS SYSMON EVENT 11 LOG NORMALIZATION"
2759 + },
2760 + "source": {
2761 + "@type": "string",
2762 + "@value": "rule \"WINDOWS SYSMON EVENT 11 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_11\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"target_file\", $message.data_win_eventdata_targetFilename);\nend"
2763 + }
2764 + },
2765 + "constraints": [
2766 + {
2767 + "type": "server-version",
2768 + "version": ">=5.0.13+083613e"
2769 + }
2770 + ]
2771 + },
2772 + {
2773 + "id": "cae472b1-4e92-43d1-9433-4f29eca82916",
2774 + "type": {
2775 + "name": "pipeline_rule",
2776 + "version": "1"
2777 + },
2778 + "v": "1",
2779 + "data": {
2780 + "title": {
2781 + "@type": "string",
2782 + "@value": "LINUX PACKETBEAT NETWORK LOG NORMALIZATION"
2783 + },
2784 + "description": {
2785 + "@type": "string",
2786 + "@value": "LINUX PACKETBEAT NETWORK LOG NORMALIZATION"
2787 + },
2788 + "source": {
2789 + "@type": "string",
2790 + "@value": "rule \"LINUX PACKETBEAT NETWORK LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group2 == \"packetbeat\"\nthen\n set_field(\"protocol\", $message.data_network_transport);\n set_field(\"dst_ip\", $message.data_destination_ip);\n set_field(\"dst_port\", $message.data_destination_port);\n set_field(\"src_ip\", $message.data_source_ip);\n set_field(\"src_port\", $message.data_source_port);\n set_field(\"traffic_direction\", $message.data_network_direction); \n remove_field(\"$message.data_@metadata_beat\");\n remove_field(\"$message.data_@metadata_type\");\n remove_field(\"$message.data_@metadata_version\");\n remove_field(\"$message.data_agent_ephemeral_id\");\n remove_field(\"$message.data_host_architecture\");\n remove_field(\"$message.data_host_containerized\");\n remove_field(\"$message.data_host_hostname\");\n remove_field(\"$message.data_host_id\");\n remove_field(\"$message.data_host_ip\");\n remove_field(\"$message.data_host_mac\");\n remove_field(\"$message.data_host_name\");\n remove_field(\"$message.data_host_os_codename\");\n remove_field(\"$message.data_host_os_family\");\n remove_field(\"$message.data_host_os_kernel\");\n remove_field(\"$message.data_host_os_name\");\n remove_field(\"$message.data_host_os_platform\");\n remove_field(\"$message.data_host_os_type\");\n remove_field(\"$message.data_host_os_version\");\nend"
2791 + }
2792 + },
2793 + "constraints": [
2794 + {
2795 + "type": "server-version",
2796 + "version": ">=5.0.13+083613e"
2797 + }
2798 + ]
2799 + },
2800 + {
2801 + "id": "b709bcd4-70e1-4bf0-9a9c-c09ed9b5b09e",
2802 + "type": {
2803 + "name": "pipeline_rule",
2804 + "version": "1"
2805 + },
2806 + "v": "1",
2807 + "data": {
2808 + "title": {
2809 + "@type": "string",
2810 + "@value": "WINDOWS SYSMON EVENT 7 - UNAPPROVED SOFTWARE VENDORS"
2811 + },
2812 + "description": {
2813 + "@type": "string",
2814 + "@value": ""
2815 + },
2816 + "source": {
2817 + "@type": "string",
2818 + "@value": "rule \"WINDOWS SYSMON EVENT 7 - UNAPPROVED SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event7\" AND ! has_field(\"software_approved\")\nthen\nset_field(\"software_approved\", \"no\");\nlet build_message_0 = to_string(\" Sysmon - Event 7: Image Loaded by Unapproved Software \");\nlet build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_company));\nset_field(\"rule_description\", build_message_1);\nset_field(\"syslog_level\", \"WARNING\");\nend"
2819 + }
2820 + },
2821 + "constraints": [
2822 + {
2823 + "type": "server-version",
2824 + "version": ">=5.0.13+083613e"
2825 + }
2826 + ]
2827 + },
2828 + {
2829 + "id": "891d4cde-6e67-4b9d-98a7-52e9e73c5f4d",
2830 + "type": {
2831 + "name": "pipeline_rule",
2832 + "version": "1"
2833 + },
2834 + "v": "1",
2835 + "data": {
2836 + "title": {
2837 + "@type": "string",
2838 + "@value": "WINDOWS SYSMON EVENT 9 LOG NORMALIZATION"
2839 + },
2840 + "description": {
2841 + "@type": "string",
2842 + "@value": "WINDOWS SYSMON EVENT 9 LOG NORMALIZATION"
2843 + },
2844 + "source": {
2845 + "@type": "string",
2846 + "@value": "rule \"WINDOWS SYSMON EVENT 9 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event9\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"device\", $message.data_win_eventdata_device);\nend"
2847 + }
2848 + },
2849 + "constraints": [
2850 + {
2851 + "type": "server-version",
2852 + "version": ">=5.0.13+083613e"
2853 + }
2854 + ]
2855 + },
2856 + {
2857 + "id": "286ba66f-f2c2-49c3-a1c4-e7360db4fb11",
2858 + "type": {
2859 + "name": "pipeline_rule",
2860 + "version": "1"
2861 + },
2862 + "v": "1",
2863 + "data": {
2864 + "title": {
2865 + "@type": "string",
2866 + "@value": "EPSS CVE Criticality - NMAP"
2867 + },
2868 + "description": {
2869 + "@type": "string",
2870 + "@value": "EPSS CVE Criticality - NMAP"
2871 + },
2872 + "source": {
2873 + "@type": "string",
2874 + "@value": "rule \"EPSS CVE Criticality - NMAP\"\nwhen\n $message.rule_group3 == \"network_scan\"\nthen\n let ldata = lookup(\n lookup_table: \"epss\",\n key: to_string($message.data_nmap_port_cve_id)\n );\n set_fields(\n fields: ldata,\n prefix: \"epss_\"\n );\nend"
2875 + }
2876 + },
2877 + "constraints": [
2878 + {
2879 + "type": "server-version",
2880 + "version": ">=5.0.13+083613e"
2881 + }
2882 + ]
2883 + },
2884 + {
2885 + "id": "c18f97ef-48f9-47b8-ac56-9c7d870bbe6a",
2886 + "type": {
2887 + "name": "pipeline_rule",
2888 + "version": "1"
2889 + },
2890 + "v": "1",
2891 + "data": {
2892 + "title": {
2893 + "@type": "string",
2894 + "@value": "LINUX SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION"
2895 + },
2896 + "description": {
2897 + "@type": "string",
2898 + "@value": "LINUX SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION"
2899 + },
2900 + "source": {
2901 + "@type": "string",
2902 + "@value": "rule \"LINUX SYSMON EVENT 3 OUTBOUND CONNECTION LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_eventdata_initiated == \"true\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"protocol\", $message.data_eventdata_protocol);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"dst_ip\", $message.data_eventdata_DestinationIp);\n set_field(\"dst_port\", $message.data_eventdata_destinationPort);\n set_field(\"src_ip\", $message.data_eventdata_sourceIp);\n set_field(\"src_port\", $message.data_eventdata_sourcePort);\n set_field(\"traffic_direction\", \"external\"); \nend"
2903 + }
2904 + },
2905 + "constraints": [
2906 + {
2907 + "type": "server-version",
2908 + "version": ">=5.0.13+083613e"
2909 + }
2910 + ]
2911 + },
2912 + {
2913 + "id": "9544ca5f-1bd5-4c23-afab-ea30aa39e4c3",
2914 + "type": {
2915 + "name": "pipeline_rule",
2916 + "version": "1"
2917 + },
2918 + "v": "1",
2919 + "data": {
2920 + "title": {
2921 + "@type": "string",
2922 + "@value": "WINDOWS SYSMON EVENT 1 - SOFTWARE VENDORS"
2923 + },
2924 + "description": {
2925 + "@type": "string",
2926 + "@value": "WINDOWS SYSMON EVENT 1 - SOFTWARE VENDORS"
2927 + },
2928 + "source": {
2929 + "@type": "string",
2930 + "@value": "rule \"WINDOWS SYSMON EVENT 1 - SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event1\" AND has_field(\"data_win_eventdata_company\")\nthen\n let ldata = lookup_value(\n lookup_table: \"software-vendors\",\n key: to_string($message.data_win_eventdata_company)\n );\n set_field(\"software_approved\", ldata);\n let build_message_0 = to_string(\" Sysmon - Event 1: Process creation \");\n let build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_description));\n set_field(\"second_rule_description\", build_message_1);\nend"
2931 + }
2932 + },
2933 + "constraints": [
2934 + {
2935 + "type": "server-version",
2936 + "version": ">=5.0.13+083613e"
2937 + }
2938 + ]
2939 + },
2940 + {
2941 + "id": "917d7a35-5a98-4e8e-9b3a-daacc76e3d31",
2942 + "type": {
2943 + "name": "pipeline_rule",
2944 + "version": "1"
2945 + },
2946 + "v": "1",
2947 + "data": {
2948 + "title": {
2949 + "@type": "string",
2950 + "@value": "WINDOWS SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL"
2951 + },
2952 + "description": {
2953 + "@type": "string",
2954 + "@value": "WINDOWS SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL"
2955 + },
2956 + "source": {
2957 + "@type": "string",
2958 + "@value": "rule \"WINDOWS SYSMON EVENT 3 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\" AND $message.data_win_eventdata_destinationIp != \"127.0.0.1\" AND $message.data_win_eventdata_destinationIp != \"255.255.255.255\" AND $message.data_win_eventdata_destinationIp != \"0.0.0.0\" AND $message.data_win_eventdata_destinationIsIpv6 == \"false\" AND !in_private_net(to_string($message.data_win_eventdata_destinationIp))\nthen\n let ip_and_ampersand = concat(to_string($message.data_win_eventdata_destinationIp), \"&customer_code=\");\n let new_key = concat(ip_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
2959 + }
2960 + },
2961 + "constraints": [
2962 + {
2963 + "type": "server-version",
2964 + "version": ">=5.0.13+083613e"
2965 + }
2966 + ]
2967 + },
2968 + {
2969 + "id": "81cfe56d-b154-4be5-a7db-c062a863915c",
2970 + "type": {
2971 + "name": "pipeline_rule",
2972 + "version": "1"
2973 + },
2974 + "v": "1",
2975 + "data": {
2976 + "title": {
2977 + "@type": "string",
2978 + "@value": "WINDOWS SYSMON EVENT 10 LOG NORMALIZATION"
2979 + },
2980 + "description": {
2981 + "@type": "string",
2982 + "@value": "WINDOWS SYSMON EVENT 10 LOG NORMALIZATION"
2983 + },
2984 + "source": {
2985 + "@type": "string",
2986 + "@value": "rule \"WINDOWS SYSMON EVENT 10 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_10\"\nthen\n set_field(\"target_image\", $message.data_win_eventdata_targetImage);\n set_field(\"granted_access\", $message.data_win_eventdata_grantedAccess);\n set_field(\"source_image\", $message.data_win_eventdata_sourceImage);\n set_field(\"call_trace\", $message.data_win_eventdata_callTrace);\nend"
2987 + }
2988 + },
2989 + "constraints": [
2990 + {
2991 + "type": "server-version",
2992 + "version": ">=5.0.13+083613e"
2993 + }
2994 + ]
2995 + },
2996 + {
2997 + "id": "6f33986b-32cf-4c5c-bc9a-8e5626e29cce",
2998 + "type": {
2999 + "name": "pipeline_rule",
3000 + "version": "1"
3001 + },
3002 + "v": "1",
3003 + "data": {
3004 + "title": {
3005 + "@type": "string",
3006 + "@value": "WINDOWS SYSMON EVENT 1 LOG NORMALIZATION"
3007 + },
3008 + "description": {
3009 + "@type": "string",
3010 + "@value": "WINDOWS SYSMON EVENT 1 LOG NORMALIZATION"
3011 + },
3012 + "source": {
3013 + "@type": "string",
3014 + "@value": "rule \"WINDOWS SYSMON EVENT 1 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event1\"\nthen\n set_field(\"process_name\", $message.data_win_eventdata_originalFileName);\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"process_cmd_line\", $message.data_win_eventdata_commandLine);\n set_field(\"user_name\", $message.data_win_eventdata_user);\n set_field(\"software_vendor\", $message.data_win_eventdata_company);\n set_field(\"process_image_hashes\", $message.data_win_eventdata_hashes);\n set_field(\"software_product\", $message.data_win_eventdata_product);\n set_field(\"parent_process_image\", $message.data_win_eventdata_parentImage);\n set_field(\"parent_cmd_line\", $message.data_win_eventdata_parentCommandLine);\n set_field(\"parent_process_id\", $message.data_win_eventdata_parentProcessId);\n set_field(\"parent_process_user\", $message.data_win_eventdata_parentUser);\nend"
3015 + }
3016 + },
3017 + "constraints": [
3018 + {
3019 + "type": "server-version",
3020 + "version": ">=5.0.13+083613e"
3021 + }
3022 + ]
3023 + },
3024 + {
3025 + "id": "f70e4aea-2343-45d1-8b19-224c5bdb8632",
3026 + "type": {
3027 + "name": "pipeline_rule",
3028 + "version": "1"
3029 + },
3030 + "v": "1",
3031 + "data": {
3032 + "title": {
3033 + "@type": "string",
3034 + "@value": "Packetbeat Timestamp - UTC"
3035 + },
3036 + "description": {
3037 + "@type": "string",
3038 + "@value": "Packetbeat Timestamp - UTC"
3039 + },
3040 + "source": {
3041 + "@type": "string",
3042 + "@value": "rule \"Packetbeat Timestamp - UTC\"\nwhen\n has_field(\"data_event_start\")\nthen\n let time = parse_date(to_string($message.data_event_start), \"yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSS'Z'\", \"Etc/UTC\");\n set_field(\"timestamp_utc\", time);\nend"
3043 + }
3044 + },
3045 + "constraints": [
3046 + {
3047 + "type": "server-version",
3048 + "version": ">=5.0.13+083613e"
3049 + }
3050 + ]
3051 + },
3052 + {
3053 + "id": "4cf85cca-5ab5-4b1a-a503-e4f2d1d75bd6",
3054 + "type": {
3055 + "name": "pipeline_rule",
3056 + "version": "1"
3057 + },
3058 + "v": "1",
3059 + "data": {
3060 + "title": {
3061 + "@type": "string",
3062 + "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE"
3063 + },
3064 + "description": {
3065 + "@type": "string",
3066 + "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE"
3067 + },
3068 + "source": {
3069 + "@type": "string",
3070 + "@value": "rule \"WAZUH CREATE FIELD SYSLOG LEVEL - NOTICE\"\nwhen to_long($message.rule_level) > 3 AND to_long($message.rule_level) < 8\nthen\nset_field(\"syslog_level\", \"NOTICE\");\nend"
3071 + }
3072 + },
3073 + "constraints": [
3074 + {
3075 + "type": "server-version",
3076 + "version": ">=5.0.13+083613e"
3077 + }
3078 + ]
3079 + },
3080 + {
3081 + "id": "50303dca-8cc3-4367-9974-6fa0091d73a7",
3082 + "type": {
3083 + "name": "pipeline_rule",
3084 + "version": "1"
3085 + },
3086 + "v": "1",
3087 + "data": {
3088 + "title": {
3089 + "@type": "string",
3090 + "@value": "LINUX SYSMON EVENT 1 LOG NORMALIZATION"
3091 + },
3092 + "description": {
3093 + "@type": "string",
3094 + "@value": "LINUX SYSMON EVENT 1 LOG NORMALIZATION"
3095 + },
3096 + "source": {
3097 + "@type": "string",
3098 + "@value": "rule \"LINUX SYSMON EVENT 1 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event1\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"process_cmd_line\", $message.data_eventdata_commandLine);\n set_field(\"user_name\", $message.data_eventdata_user);\n set_field(\"parent_process_image\", $message.data_eventdata_parentImage);\n set_field(\"parent_cmd_line\", $message.data_eventdata_parentCommandLine);\n set_field(\"parent_process_id\", $message.data_eventdata_parentProcessId);\n set_field(\"parent_process_user\", $message.data_eventdata_parentUser);\nend"
3099 + }
3100 + },
3101 + "constraints": [
3102 + {
3103 + "type": "server-version",
3104 + "version": ">=5.0.13+083613e"
3105 + }
3106 + ]
3107 + },
3108 + {
3109 + "id": "bfe85101-5ed8-442d-a0c2-3b3c6d3f1cd6",
3110 + "type": {
3111 + "name": "pipeline_rule",
3112 + "version": "1"
3113 + },
3114 + "v": "1",
3115 + "data": {
3116 + "title": {
3117 + "@type": "string",
3118 + "@value": "WINDOWS SYSMON EVENT 7 LOG NORMALIZATION"
3119 + },
3120 + "description": {
3121 + "@type": "string",
3122 + "@value": "WINDOWS SYSMON EVENT 7 LOG NORMALIZATION"
3123 + },
3124 + "source": {
3125 + "@type": "string",
3126 + "@value": "rule \"WINDOWS SYSMON EVENT 7 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event7\"\nthen\n set_field(\"dll_name\", $message.data_win_eventdata_originalFileName);\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"software_vendor\", $message.data_win_eventdata_company);\n set_field(\"image_loaded\", $message.data_win_eventdata_imageLoaded);\n set_field(\"dll_signature\", $message.data_win_eventdata_signature);\n set_field(\"dll_signed\", $message.data_win_eventdata_signed);\n set_field(\"dll_signature_status\", $message.data_win_eventdata_signatureStatus);\n set_field(\"dll_hashes\", $message.data_win_eventdata_hashes);\nend"
3127 + }
3128 + },
3129 + "constraints": [
3130 + {
3131 + "type": "server-version",
3132 + "version": ">=5.0.13+083613e"
3133 + }
3134 + ]
3135 + },
3136 + {
3137 + "id": "66d12fb9-3e88-4060-b17f-512ac5dac6a7",
3138 + "type": {
3139 + "name": "pipeline_rule",
3140 + "version": "1"
3141 + },
3142 + "v": "1",
3143 + "data": {
3144 + "title": {
3145 + "@type": "string",
3146 + "@value": "WINDOWS SYSMON EVENT 6 - SOCFORTRESS THREAT INTEL"
3147 + },
3148 + "description": {
3149 + "@type": "string",
3150 + "@value": "WINDOWS SYSMON EVENT 6 - SOCFORTRESS THREAT INTEL"
3151 + },
3152 + "source": {
3153 + "@type": "string",
3154 + "@value": "rule \"WINDOWS SYSMON EVENT 6 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event6\" AND $message.data_win_eventdata_signed == \"false\"\nthen\n let sha256_and_ampersand = concat(to_string($message.sha256), \"&customer_code=\");\n let new_key = concat(sha256_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
3155 + }
3156 + },
3157 + "constraints": [
3158 + {
3159 + "type": "server-version",
3160 + "version": ">=5.0.13+083613e"
3161 + }
3162 + ]
3163 + },
3164 + {
3165 + "id": "da125db2-5391-4fa7-8cfc-effabd40641c",
3166 + "type": {
3167 + "name": "pipeline_rule",
3168 + "version": "1"
3169 + },
3170 + "v": "1",
3171 + "data": {
3172 + "title": {
3173 + "@type": "string",
3174 + "@value": "LINUX OSQUERY PROCESS ID - GENERIC"
3175 + },
3176 + "description": {
3177 + "@type": "string",
3178 + "@value": "LINUX OSQUERY PROCESS ID - GENERIC"
3179 + },
3180 + "source": {
3181 + "@type": "string",
3182 + "@value": "rule \"LINUX OSQUERY PROCESS ID - GENERIC\"\nwhen\n$message.rule_group1 == \"osquery\"\nthen\n set_field(\"process_id\", $message.data_columns_pid);\nend"
3183 + }
3184 + },
3185 + "constraints": [
3186 + {
3187 + "type": "server-version",
3188 + "version": ">=5.0.13+083613e"
3189 + }
3190 + ]
3191 + },
3192 + {
3193 + "id": "571ffe1c-0220-4b91-bc0f-04302d1e800c",
3194 + "type": {
3195 + "name": "pipeline_rule",
3196 + "version": "1"
3197 + },
3198 + "v": "1",
3199 + "data": {
3200 + "title": {
3201 + "@type": "string",
3202 + "@value": "WINDOWS SYSMON EVENT 1 - SOCFORTRESS THREAT INTEL"
3203 + },
3204 + "description": {
3205 + "@type": "string",
3206 + "@value": "WINDOWS SYSMON EVENT 1 - SOCFORTRESS THREAT INTEL"
3207 + },
3208 + "source": {
3209 + "@type": "string",
3210 + "@value": "rule \"WINDOWS SYSMON EVENT 1 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event1\" AND ! has_field(\"data_win_eventdata_company\")\nthen\n let sha256_and_ampersand = concat(to_string($message.sha256), \"&customer_code=\");\n let new_key = concat(sha256_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
3211 + }
3212 + },
3213 + "constraints": [
3214 + {
3215 + "type": "server-version",
3216 + "version": ">=5.0.13+083613e"
3217 + }
3218 + ]
3219 + },
3220 + {
3221 + "id": "721afb39-b970-4636-b1e9-a3bec5b3c8da",
3222 + "type": {
3223 + "name": "pipeline_rule",
3224 + "version": "1"
3225 + },
3226 + "v": "1",
3227 + "data": {
3228 + "title": {
3229 + "@type": "string",
3230 + "@value": "WINDOWS SYSMON EVENT 17 LOG NORMALIZATION"
3231 + },
3232 + "description": {
3233 + "@type": "string",
3234 + "@value": "WINDOWS SYSMON EVENT 17 LOG NORMALIZATION"
3235 + },
3236 + "source": {
3237 + "@type": "string",
3238 + "@value": "rule \"WINDOWS SYSMON EVENT 17 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_17\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"pipe_name\", $message.data_win_eventdata_pipeName);\nend"
3239 + }
3240 + },
3241 + "constraints": [
3242 + {
3243 + "type": "server-version",
3244 + "version": ">=5.0.13+083613e"
3245 + }
3246 + ]
3247 + },
3248 + {
3249 + "id": "056eeb4e-36ff-4ebe-9a79-77adc2f7106e",
3250 + "type": {
3251 + "name": "pipeline_rule",
3252 + "version": "1"
3253 + },
3254 + "v": "1",
3255 + "data": {
3256 + "title": {
3257 + "@type": "string",
3258 + "@value": "WINDOWS SYSMON EVENT 5 LOG NORMALIZATION"
3259 + },
3260 + "description": {
3261 + "@type": "string",
3262 + "@value": "WINDOWS SYSMON EVENT 5 LOG NORMALIZATION"
3263 + },
3264 + "source": {
3265 + "@type": "string",
3266 + "@value": "rule \"WINDOWS SYSMON EVENT 5 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event5\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"user_name\", $message.data_win_eventdata_user);\nend"
3267 + }
3268 + },
3269 + "constraints": [
3270 + {
3271 + "type": "server-version",
3272 + "version": ">=5.0.13+083613e"
3273 + }
3274 + ]
3275 + },
3276 + {
3277 + "id": "0fd58b5c-991c-418a-92dd-dadc2c1df8ee",
3278 + "type": {
3279 + "name": "pipeline_rule",
3280 + "version": "1"
3281 + },
3282 + "v": "1",
3283 + "data": {
3284 + "title": {
3285 + "@type": "string",
3286 + "@value": "WINDOWS SYSMON EVENT 7 - EMPTY SOFTWARE VENDORS"
3287 + },
3288 + "description": {
3289 + "@type": "string",
3290 + "@value": "WINDOWS SYSMON EVENT 7 - EMPTY SOFTWARE VENDORS"
3291 + },
3292 + "source": {
3293 + "@type": "string",
3294 + "@value": "rule \"WINDOWS SYSMON EVENT 7 - EMPTY SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event7\" AND ! has_field(\"data_win_eventdata_company\")\nthen\n let ldata = lookup_value(\n lookup_table: \"software-vendors\",\n key: to_string($message.data_win_eventdata_signature)\n );\n set_field(\"software_approved\", ldata);\n let build_message_0 = to_string(\" Sysmon - Event 7: Image Loaded With Empty Company Name - \");\n let build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_signature));\n set_field(\"rule_description\", build_message_1);\n set_field(\"syslog_level\", \"WARNING\");\nend"
3295 + }
3296 + },
3297 + "constraints": [
3298 + {
3299 + "type": "server-version",
3300 + "version": ">=5.0.13+083613e"
3301 + }
3302 + ]
3303 + },
3304 + {
3305 + "id": "169eaa47-8de6-4cd8-aa18-adb37ff884c0",
3306 + "type": {
3307 + "name": "pipeline_rule",
3308 + "version": "1"
3309 + },
3310 + "v": "1",
3311 + "data": {
3312 + "title": {
3313 + "@type": "string",
3314 + "@value": "LINUX PACKETBEAT DNS LOG NORMALIZATION"
3315 + },
3316 + "description": {
3317 + "@type": "string",
3318 + "@value": "LINUX PACKETBEAT DNS LOG NORMALIZATION"
3319 + },
3320 + "source": {
3321 + "@type": "string",
3322 + "@value": "rule \"LINUX PACKETBEAT DNS LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"dns\"\nthen\n set_field(\"dns_query\", $message.data_dns_question_name);\n set_field(\"dns_answer\", $message.data_dns_resolved_ip);\n set_field(\"dns_response_code\", $message.data_dns_response_code);\n remove_field(\"$message.data_@metadata_beat\");\n remove_field(\"$message.data_@metadata_type\");\n remove_field(\"$message.data_@metadata_version\");\n remove_field(\"$message.data_agent_ephemeral_id\");\n remove_field(\"$message.data_host_architecture\");\n remove_field(\"$message.data_host_containerized\");\n remove_field(\"$message.data_host_hostname\");\n remove_field(\"$message.data_host_id\");\n remove_field(\"$message.data_host_ip\");\n remove_field(\"$message.data_host_mac\");\n remove_field(\"$message.data_host_name\");\n remove_field(\"$message.data_host_os_codename\");\n remove_field(\"$message.data_host_os_family\");\n remove_field(\"$message.data_host_os_kernel\");\n remove_field(\"$message.data_host_os_name\");\n remove_field(\"$message.data_host_os_platform\");\n remove_field(\"$message.data_host_os_type\");\n remove_field(\"$message.data_host_os_version\");\nend"
3323 + }
3324 + },
3325 + "constraints": [
3326 + {
3327 + "type": "server-version",
3328 + "version": ">=5.0.13+083613e"
3329 + }
3330 + ]
3331 + },
3332 + {
3333 + "id": "09c78369-36ac-4956-a1de-fa636aadae92",
3334 + "type": {
3335 + "name": "pipeline_rule",
3336 + "version": "1"
3337 + },
3338 + "v": "1",
3339 + "data": {
3340 + "title": {
3341 + "@type": "string",
3342 + "@value": "Timestamp Failsafe - UTC"
3343 + },
3344 + "description": {
3345 + "@type": "string",
3346 + "@value": "Set Timestamp based upon `msg_timestamp` field which is the time Graylog ingested the message. This is a failsafe to catch if no other field names have been detected in the log that provide the timestamp value that the host assigned with the raw alert."
3347 + },
3348 + "source": {
3349 + "@type": "string",
3350 + "@value": "rule \"Timestamp Failsafe - UTC\"\nwhen\n ! has_field(\"timestamp_utc\")\nthen\n let msg_timestamp = $message.msg_timestamp;\n set_field(\"timestamp_utc\", msg_timestamp);\n remove_field(\"msg_timestamp\");\nend"
3351 + }
3352 + },
3353 + "constraints": [
3354 + {
3355 + "type": "server-version",
3356 + "version": ">=5.0.13+083613e"
3357 + }
3358 + ]
3359 + },
3360 + {
3361 + "id": "64b2b33d-f5a9-4365-9233-e9901abbf4c1",
3362 + "type": {
3363 + "name": "pipeline_rule",
3364 + "version": "1"
3365 + },
3366 + "v": "1",
3367 + "data": {
3368 + "title": {
3369 + "@type": "string",
3370 + "@value": "OSQUERY NETWORK CONNECTION LOG NORMALIZATION"
3371 + },
3372 + "description": {
3373 + "@type": "string",
3374 + "@value": "OSQUERY NETWORK CONNECTION LOG NORMALIZATION"
3375 + },
3376 + "source": {
3377 + "@type": "string",
3378 + "@value": "rule \"OSQUERY NETWORK CONNECTION LOG NORMALIZATION\"\nwhen\n $message.data_osquery_name == \"list_network_connection\"\nthen\n set_field(\"process_image\", $message.data_osquery_columns_name);\n set_field(\"process_id\", $message.data_osquery_columns_pid);\n set_field(\"protocol\", $message.data_osquery_columns_protocol);\n set_field(\"user_name\", $message.data_osquery_columns_username);\n set_field(\"dst_ip\", $message.data_osquery_columns_remote_address);\n set_field(\"dst_port\", $message.data_osquery_columns_remote_port);\n set_field(\"src_ip\", $message.data_osquery_columns_local_address);\n set_field(\"src_port\", $message.data_osquery_columns_local_port);\nend"
3379 + }
3380 + },
3381 + "constraints": [
3382 + {
3383 + "type": "server-version",
3384 + "version": ">=5.0.13+083613e"
3385 + }
3386 + ]
3387 + },
3388 + {
3389 + "id": "e71eaeef-b11b-4c97-afca-7f5875cd7459",
3390 + "type": {
3391 + "name": "pipeline_rule",
3392 + "version": "1"
3393 + },
3394 + "v": "1",
3395 + "data": {
3396 + "title": {
3397 + "@type": "string",
3398 + "@value": "WINDOWS SYSMON EVENT 15 - SOCFORTRESS THREAT INTEL"
3399 + },
3400 + "description": {
3401 + "@type": "string",
3402 + "@value": "WINDOWS SYSMON EVENT 15 - SOCFORTRESS THREAT INTEL"
3403 + },
3404 + "source": {
3405 + "@type": "string",
3406 + "@value": "rule \"WINDOWS SYSMON EVENT 15 - SOCFORTRESS THREAT INTEL\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_15\"\nthen\n let sha256_and_ampersand = concat(to_string($message.sha256), \"&customer_code=\");\n let new_key = concat(sha256_and_ampersand, to_string($message.agent_labels_customer));\n let ldata = lookup(\n lookup_table: \"socfortress_threat_intel\",\n key: new_key\n );\n set_fields(\n fields: ldata,\n prefix: \"threat_intel_\"\n );\nend"
3407 + }
3408 + },
3409 + "constraints": [
3410 + {
3411 + "type": "server-version",
3412 + "version": ">=5.0.13+083613e"
3413 + }
3414 + ]
3415 + },
3416 + {
3417 + "id": "af6d5827-98f8-4470-b580-05365c9562cc",
3418 + "type": {
3419 + "name": "pipeline_rule",
3420 + "version": "1"
3421 + },
3422 + "v": "1",
3423 + "data": {
3424 + "title": {
3425 + "@type": "string",
3426 + "@value": "WINDOWS SYSMON EVENT 12 LOG NORMALIZATION"
3427 + },
3428 + "description": {
3429 + "@type": "string",
3430 + "@value": "WINDOWS SYSMON EVENT 12 LOG NORMALIZATION"
3431 + },
3432 + "source": {
3433 + "@type": "string",
3434 + "@value": "rule \"WINDOWS SYSMON EVENT 12 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event_12\"\nthen\n set_field(\"process_image\", $message.data_win_eventdata_image);\n set_field(\"process_id\", $message.data_win_eventdata_processId);\n set_field(\"target_object\", $message.data_win_eventdata_targetObject);\n set_field(\"event_type\", $message.data_win_eventdata_eventType);\nend"
3435 + }
3436 + },
3437 + "constraints": [
3438 + {
3439 + "type": "server-version",
3440 + "version": ">=5.0.13+083613e"
3441 + }
3442 + ]
3443 + },
3444 + {
3445 + "id": "be2a3538-26f8-4b0c-8df4-dea7ed241ecc",
3446 + "type": {
3447 + "name": "pipeline_rule",
3448 + "version": "1"
3449 + },
3450 + "v": "1",
3451 + "data": {
3452 + "title": {
3453 + "@type": "string",
3454 + "@value": "OpenAudit Remove field - data_system_network_item_dhcp_lease_obtained"
3455 + },
3456 + "description": {
3457 + "@type": "string",
3458 + "@value": "OpenAudit Remove field - data_system_network_item_dhcp_lease_obtained"
3459 + },
3460 + "source": {
3461 + "@type": "string",
3462 + "@value": "rule \"OpenAudit Remove field - data_system_network_item_dhcp_lease_obtained\"\nwhen\n // Apply the rule when the specified field is present\n has_field(\"data_system_network_item_dhcp_lease_obtained\")\nthen\n // Remove the specified field\n remove_field(\"data_system_network_item_dhcp_lease_obtained\");\nend\n"
3463 + }
3464 + },
3465 + "constraints": [
3466 + {
3467 + "type": "server-version",
3468 + "version": ">=5.0.13+083613e"
3469 + }
3470 + ]
3471 + },
3472 + {
3473 + "id": "ad3d829e-ca93-42dc-b49e-4cc5104a8f69",
3474 + "type": {
3475 + "name": "pipeline_rule",
3476 + "version": "1"
3477 + },
3478 + "v": "1",
3479 + "data": {
3480 + "title": {
3481 + "@type": "string",
3482 + "@value": "LINUX SYSMON EVENT 5 LOG NORMALIZATION"
3483 + },
3484 + "description": {
3485 + "@type": "string",
3486 + "@value": "LINUX SYSMON EVENT 5 LOG NORMALIZATION"
3487 + },
3488 + "source": {
3489 + "@type": "string",
3490 + "@value": "rule \"LINUX SYSMON EVENT 5 LOG NORMALIZATION\"\nwhen\n $message.rule_group1 == \"linux\" AND $message.rule_group3 == \"sysmon_event5\"\nthen\n set_field(\"process_image\", $message.data_eventdata_image);\n set_field(\"process_id\", $message.data_eventdata_processId);\n set_field(\"user_name\", $message.data_eventdata_user);\nend\n"
3491 + }
3492 + },
3493 + "constraints": [
3494 + {
3495 + "type": "server-version",
3496 + "version": ">=5.0.13+083613e"
3497 + }
3498 + ]
3499 + },
3500 + {
3501 + "id": "af720a8a-6293-48cf-a8a6-a5edea7b7e0b",
3502 + "type": {
3503 + "name": "pipeline_rule",
3504 + "version": "1"
3505 + },
3506 + "v": "1",
3507 + "data": {
3508 + "title": {
3509 + "@type": "string",
3510 + "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - INFO"
3511 + },
3512 + "description": {
3513 + "@type": "string",
3514 + "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - INFO"
3515 + },
3516 + "source": {
3517 + "@type": "string",
3518 + "@value": "rule \"WAZUH CREATE FIELD SYSLOG LEVEL - INFO\"\nwhen to_long($message.rule_level) > 0 AND to_long($message.rule_level) < 4\nthen\nset_field(\"syslog_level\", \"INFO\");\nend"
3519 + }
3520 + },
3521 + "constraints": [
3522 + {
3523 + "type": "server-version",
3524 + "version": ">=5.0.13+083613e"
3525 + }
3526 + ]
3527 + },
3528 + {
3529 + "id": "1ab185cc-0e73-4a98-b9aa-2cb5045fd4e3",
3530 + "type": {
3531 + "name": "pipeline_rule",
3532 + "version": "1"
3533 + },
3534 + "v": "1",
3535 + "data": {
3536 + "title": {
3537 + "@type": "string",
3538 + "@value": "EPSS CVE Criticality"
3539 + },
3540 + "description": {
3541 + "@type": "string",
3542 + "@value": "EPSS CVE Criticality"
3543 + },
3544 + "source": {
3545 + "@type": "string",
3546 + "@value": "rule \"EPSS CVE Criticality\"\nwhen\n $message.rule_group1 == \"vulnerability-detector\"\nthen\n let ldata = lookup(\n lookup_table: \"epss\",\n key: to_string($message.data_vulnerability_cve)\n );\n set_fields(\n fields: ldata,\n prefix: \"epss_\"\n );\nend"
3547 + }
3548 + },
3549 + "constraints": [
3550 + {
3551 + "type": "server-version",
3552 + "version": ">=5.0.13+083613e"
3553 + }
3554 + ]
3555 + },
3556 + {
3557 + "id": "bc32db42-cff2-4750-ad22-00d82a01924b",
3558 + "type": {
3559 + "name": "pipeline_rule",
3560 + "version": "1"
3561 + },
3562 + "v": "1",
3563 + "data": {
3564 + "title": {
3565 + "@type": "string",
3566 + "@value": "WINDOWS SYSMON EVENT 3 - NETWORK PORTS"
3567 + },
3568 + "description": {
3569 + "@type": "string",
3570 + "@value": "WINDOWS SYSMON EVENT 3 - NETWORK PORTS"
3571 + },
3572 + "source": {
3573 + "@type": "string",
3574 + "@value": "rule \"WINDOWS SYSMON EVENT 3 - NETWORK PORTS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\" AND has_field(\"data_win_eventdata_destinationPort\")\nthen\n let ldata = lookup_value(\n lookup_table: \"network-ports\",\n key: to_string($message.data_win_eventdata_destinationPort)\n );\n set_field(\"port_common\", ldata);\nend"
3575 + }
3576 + },
3577 + "constraints": [
3578 + {
3579 + "type": "server-version",
3580 + "version": ">=5.0.13+083613e"
3581 + }
3582 + ]
3583 + },
3584 + {
3585 + "id": "76773053-f1c5-4e98-93be-69baf05f95b5",
3586 + "type": {
3587 + "name": "pipeline_rule",
3588 + "version": "1"
3589 + },
3590 + "v": "1",
3591 + "data": {
3592 + "title": {
3593 + "@type": "string",
3594 + "@value": "DROP SYSMON EVT 10 LOGS - WELL KNOWN SOURCE PROCESS IMAGE"
3595 + },
3596 + "description": {
3597 + "@type": "string",
3598 + "@value": "DROP SYSMON EVT 10 LOGS - WELL KNOWN SOURCE PROCESS IMAGE"
3599 + },
3600 + "source": {
3601 + "@type": "string",
3602 + "@value": "rule \"DROP SYSMON EVT 10 LOGS - WELL KNOWN SOURCE PROCESS IMAGE\"\nwhen\n$message.rule_group3 == \"sysmon_event_10\" AND $message.data_win_eventdata_sourceImage == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\AteraAgent.exe\"\nthen\n drop_message();\nend"
3603 + }
3604 + },
3605 + "constraints": [
3606 + {
3607 + "type": "server-version",
3608 + "version": ">=5.0.13+083613e"
3609 + }
3610 + ]
3611 + },
3612 + {
3613 + "id": "0f68d0d0-3555-4da1-8ef0-6fa3a028b8af",
3614 + "type": {
3615 + "name": "pipeline_rule",
3616 + "version": "1"
3617 + },
3618 + "v": "1",
3619 + "data": {
3620 + "title": {
3621 + "@type": "string",
3622 + "@value": "DROP SYSMON EVT 7 LOGS - WELL KNOWN PROCESS IMAGE"
3623 + },
3624 + "description": {
3625 + "@type": "string",
3626 + "@value": "DROP SYSMON EVT 7 LOGS - WELL KNOWN PROCESS IMAGE"
3627 + },
3628 + "source": {
3629 + "@type": "string",
3630 + "@value": "rule \"DROP SYSMON EVT 7 LOGS - WELL KNOWN PROCESS IMAGE\"\nwhen\n$message.rule_group3 == \"sysmon_event7\" AND \n($message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\Packages\\\\\\\\AgentPackageHeartbeat\\\\\\\\AgentPackageHeartbeat.exe\" \nOR $message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\Packages\\\\\\\\AgentPackageSTRemote\\\\\\\\AgentPackageSTRemote.exe\" \nOR $message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\Packages\\\\\\\\AgentPackageMonitoring\\\\\\\\AgentPackageMonitoring.exe\" \nOR $message.data_win_eventdata_image == \"C:\\\\\\\\Program Files\\\\\\\\ATERA Networks\\\\\\\\AteraAgent\\\\\\\\Packages\\\\\\\\AgentPackageInternalPoller\\\\\\\\AgentPackageInternalPoller.exe\")\nthen\n drop_message();\nend"
3631 + }
3632 + },
3633 + "constraints": [
3634 + {
3635 + "type": "server-version",
3636 + "version": ">=5.0.13+083613e"
3637 + }
3638 + ]
3639 + },
3640 + {
3641 + "id": "46b3df32-92c5-4cc7-8026-a66cc2623a52",
3642 + "type": {
3643 + "name": "pipeline_rule",
3644 + "version": "1"
3645 + },
3646 + "v": "1",
3647 + "data": {
3648 + "title": {
3649 + "@type": "string",
3650 + "@value": "Windows Timestamp - UTC"
3651 + },
3652 + "description": {
3653 + "@type": "string",
3654 + "@value": "Windows Timestamp - UTC"
3655 + },
3656 + "source": {
3657 + "@type": "string",
3658 + "@value": "rule \"Windows Timestamp - UTC\"\nwhen\n has_field(\"data_win_system_systemTime\")\nthen\n let time = parse_date(to_string($message.data_win_system_systemTime), \"yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSS'Z'\", \"Etc/UTC\");\n set_field(\"timestamp_utc\", time);\nend"
3659 + }
3660 + },
3661 + "constraints": [
3662 + {
3663 + "type": "server-version",
3664 + "version": ">=5.0.13+083613e"
3665 + }
3666 + ]
3667 + },
3668 + {
3669 + "id": "bb76d44c-45e5-4b3c-9414-a72c44370a7f",
3670 + "type": {
3671 + "name": "pipeline_rule",
3672 + "version": "1"
3673 + },
3674 + "v": "1",
3675 + "data": {
3676 + "title": {
3677 + "@type": "string",
3678 + "@value": "WINDOWS SYSMON EVENT 1 - EMPTY SOFTWARE VENDORS"
3679 + },
3680 + "description": {
3681 + "@type": "string",
3682 + "@value": "WINDOWS SYSMON EVENT 1 - EMPTY SOFTWARE VENDORS"
3683 + },
3684 + "source": {
3685 + "@type": "string",
3686 + "@value": "rule \"WINDOWS SYSMON EVENT 1 - EMPTY SOFTWARE VENDORS\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event1\" AND ! has_field(\"data_win_eventdata_company\")\nthen\n set_field(\"software_approved\", \"no\");\n let build_message_0 = to_string(\" Sysmon - Event 1: Process creation With Empty Company Name - \");\n let build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_image));\n set_field(\"second_rule_description\", build_message_1);\n set_field(\"syslog_level\", \"WARNING\");\nend"
3687 + }
3688 + },
3689 + "constraints": [
3690 + {
3691 + "type": "server-version",
3692 + "version": ">=5.0.13+083613e"
3693 + }
3694 + ]
3695 + },
3696 + {
3697 + "id": "992c3888-0fa5-42d8-8748-6a61c2b8464b",
3698 + "type": {
3699 + "name": "pipeline_rule",
3700 + "version": "1"
3701 + },
3702 + "v": "1",
3703 + "data": {
3704 + "title": {
3705 + "@type": "string",
3706 + "@value": "WINDOWS PROCESS ID - Non SOCFortress Sysmon"
3707 + },
3708 + "description": {
3709 + "@type": "string",
3710 + "@value": "WINDOWS PROCESS ID - Non SOCFortress Sysmon"
3711 + },
3712 + "source": {
3713 + "@type": "string",
3714 + "@value": "rule \"WINDOWS PROCESS ID - Non SOCFortress Sysmon\"\nwhen\n $message.rule_group1 != \"windows\" AND has_field(\"data_win_eventdata_processId\")\nthen\n set_field(\"process_id\", $message.data_win_eventdata_processId);\nend"
3715 + }
3716 + },
3717 + "constraints": [
3718 + {
3719 + "type": "server-version",
3720 + "version": ">=5.0.13+083613e"
3721 + }
3722 + ]
3723 + },
3724 + {
3725 + "id": "4d70e0a5-2a88-43aa-b659-16933a41c5da",
3726 + "type": {
3727 + "name": "pipeline_rule",
3728 + "version": "1"
3729 + },
3730 + "v": "1",
3731 + "data": {
3732 + "title": {
3733 + "@type": "string",
3734 + "@value": "OpenAudit Remove field - data_system_software_item_install_date"
3735 + },
3736 + "description": {
3737 + "@type": "string",
3738 + "@value": "OpenAudit Remove field - data_system_software_item_install_date"
3739 + },
3740 + "source": {
3741 + "@type": "string",
3742 + "@value": "rule \"OpenAudit Remove field - data_system_software_item_install_date\"\nwhen\n // Apply the rule when the specified field is present\n has_field(\"data_system_software_item_install_date\")\nthen\n // Remove the specified field\n remove_field(\"data_system_software_item_install_date\");\nend\n"
3743 + }
3744 + },
3745 + "constraints": [
3746 + {
3747 + "type": "server-version",
3748 + "version": ">=5.0.13+083613e"
3749 + }
3750 + ]
3751 + },
3752 + {
3753 + "id": "d049995b-2c18-407a-bdd2-141c94b93568",
3754 + "type": {
3755 + "name": "pipeline_rule",
3756 + "version": "1"
3757 + },
3758 + "v": "1",
3759 + "data": {
3760 + "title": {
3761 + "@type": "string",
3762 + "@value": "WAZUH CREATE FIELD SYSLOG LEVEL - ALERT"
3763 + },
3764 + "description": {
3765 + "@type": "string",
3766 + "@value": "CREATE FIELD SYSLOG LEVEL - ALERT"
3767 + },
3768 + "source": {
3769 + "@type": "string",
3770 + "@value": "rule \"WAZUH CREATE FIELD SYSLOG LEVEL - ALERT\"\nwhen to_long($message.rule_level) > 11\nthen\nset_field(\"syslog_level\", \"ALERT\");\nend"
3771 + }
3772 + },
3773 + "constraints": [
3774 + {
3775 + "type": "server-version",
3776 + "version": ">=5.0.13+083613e"
3777 + }
3778 + ]
3779 + },
3780 + {
3781 + "id": "fad6eb39-5771-42ec-b95c-0b363c33bdb1",
3782 + "type": {
3783 + "name": "pipeline_rule",
3784 + "version": "1"
3785 + },
3786 + "v": "1",
3787 + "data": {
3788 + "title": {
3789 + "@type": "string",
3790 + "@value": "USER ADDED TO PRIVILEGE ADMIN GROUP"
3791 + },
3792 + "description": {
3793 + "@type": "string",
3794 + "@value": "USER ADDED TO PRIVILEGE ADMIN GROUP"
3795 + },
3796 + "source": {
3797 + "@type": "string",
3798 + "@value": "rule \"USER ADDED TO PRIVILEGE ADMIN GROUP\"\nwhen\n $message.data_win_system_eventID == \"4728\" OR $message.data_win_system_eventID == \"4732\" OR $message.data_win_system_eventID == \"4756\"\nthen\n let ldata = lookup_value(\n lookup_table: \"ad-admin-groups\",\n key: to_string($message.data_win_eventdata_targetUserName)\n );\n set_field(\"is_admin_group\", ldata);\nend"
3799 + }
3800 + },
3801 + "constraints": [
3802 + {
3803 + "type": "server-version",
3804 + "version": ">=5.0.13+083613e"
3805 + }
3806 + ]
3807 + },
3808 + {
3809 + "id": "833dcc65-5743-4525-a9a0-cb08f5358d67",
3810 + "type": {
3811 + "name": "pipeline_rule",
3812 + "version": "1"
3813 + },
3814 + "v": "1",
3815 + "data": {
3816 + "title": {
3817 + "@type": "string",
3818 + "@value": "OSSEC SYSCHECK ADDED EVENT NORMALIZATION"
3819 + },
3820 + "description": {
3821 + "@type": "string",
3822 + "@value": "OSSEC SYSCHECK ADDED EVENT NORMALIZATION"
3823 + },
3824 + "source": {
3825 + "@type": "string",
3826 + "@value": "rule \"OSSEC SYSCHECK ADDED EVENT NORMALIZATION\"\nwhen\n $message.rule_group1 == \"ossec\" AND $message.rule_group2 == \"syscheck\" AND $message.syscheck_event == \"added\"\nthen\n set_field(\"sha256\", $message.syscheck_sha256_after);\nend"
3827 + }
3828 + },
3829 + "constraints": [
3830 + {
3831 + "type": "server-version",
3832 + "version": ">=5.0.13+083613e"
3833 + }
3834 + ]
3835 + },
3836 + {
3837 + "id": "862acb0a-e994-47fe-b3b7-ea8474cf953a",
3838 + "type": {
3839 + "name": "pipeline_rule",
3840 + "version": "1"
3841 + },
3842 + "v": "1",
3843 + "data": {
3844 + "title": {
3845 + "@type": "string",
3846 + "@value": "WINDOWS PROCESS ID - No EventData Field"
3847 + },
3848 + "description": {
3849 + "@type": "string",
3850 + "@value": "WINDOWS PROCESS ID - No EventData Field"
3851 + },
3852 + "source": {
3853 + "@type": "string",
3854 + "@value": "rule \"WINDOWS PROCESS ID - No EventData Field\"\nwhen\n ! has_field(\"data_win_eventdata_processId\") AND $message.rule_group1 == \"windows\"\nthen\n set_field(\"process_id\", $message.data_win_system_processID);\nend"
3855 + }
3856 + },
3857 + "constraints": [
3858 + {
3859 + "type": "server-version",
3860 + "version": ">=5.0.13+083613e"
3861 + }
3862 + ]
3863 + },
3864 + {
3865 + "id": "f8767b41-6060-40d2-b47b-949421652dbc",
3866 + "type": {
3867 + "name": "pipeline_rule",
3868 + "version": "1"
3869 + },
3870 + "v": "1",
3871 + "data": {
3872 + "title": {
3873 + "@type": "string",
3874 + "@value": "LINUX OSQUERY-BPF PROCESS LIST LOG NORMALIZATION"
3875 + },
3876 + "description": {
3877 + "@type": "string",
3878 + "@value": "LINUX OSQUERY-BPF PROCESS LIST LOG NORMALIZATION"
3879 + },
3880 + "source": {
3881 + "@type": "string",
3882 + "@value": "rule \"LINUX OSQUERY-BPF PROCESS LIST LOG NORMALIZATION\"\nwhen\n$message.rule_group1 == \"osquery\" AND ($message.rule_group2 == \"bpf_process_events\" OR $message.rule_group2 == \"list_processes_with_hash\")\nthen\n set_field(\"process_name\", $message.data_columns_path);\n set_field(\"process_image\", $message.data_columns_path);\n set_field(\"process_id\", $message.data_columns_pid);\n set_field(\"process_cmd_line\", $message.data_columns_cmdline);\n set_field(\"parent_process_id\", $message.data_columns_parent);\nend"
3883 + }
3884 + },
3885 + "constraints": [
3886 + {
3887 + "type": "server-version",
3888 + "version": ">=5.0.13+083613e"
3889 + }
3890 + ]
3891 + },
3892 + {
3893 + "id": "f11d88a6-077a-4b62-9979-f78e79920c54",
3894 + "type": {
3895 + "name": "pipeline_rule",
3896 + "version": "1"
3897 + },
3898 + "v": "1",
3899 + "data": {
3900 + "title": {
3901 + "@type": "string",
3902 + "@value": "WINDOWS SYSMON EVENT 3 - UNCOMMON PORT"
3903 + },
3904 + "description": {
3905 + "@type": "string",
3906 + "@value": "WINDOWS SYSMON EVENT 3 - UNCOMMON PORT"
3907 + },
3908 + "source": {
3909 + "@type": "string",
3910 + "@value": "rule \"WINDOWS SYSMON EVENT 3 - UNCOMMON PORT\"\nwhen\n $message.rule_group1 == \"windows\" AND $message.rule_group3 == \"sysmon_event3\" AND ! has_field(\"port_common\")\nthen\nset_field(\"port_common\", \"no\");\nset_field(\"syslog_level\", \"WARNING\");\nlet build_message_0 = to_string(\" Sysmon - Event 3: Network connection to Uncommon Port by \");\nlet build_message_1 = concat(build_message_0, to_string($message.data_win_eventdata_image));\nset_field(\"rule_description\", build_message_1);\nend"
3911 + }
3912 + },
3913 + "constraints": [
3914 + {
3915 + "type": "server-version",
3916 + "version": ">=5.0.13+083613e"
3917 + }
3918 + ]
3919 + },
3920 + {
3921 + "id": "a08b82b7-6df9-4643-9d6e-549ed2f87c6d",
3922 + "type": {
3923 + "name": "pipeline_rule",
3924 + "version": "1"
3925 + },
3926 + "v": "1",
3927 + "data": {
3928 + "title": {
3929 + "@type": "string",
3930 + "@value": "Office365 Timestamp - UTC"
3931 + },
3932 + "description": {
3933 + "@type": "string",
3934 + "@value": "Office365 Timestamp - UTC"
3935 + },
3936 + "source": {
3937 + "@type": "string",
3938 + "@value": "rule \"Office365 Timestamp - UTC\"\nwhen\n has_field(\"data_office_365_CreationTime\")\nthen\n let creation_time = $message.data_office_365_CreationTime;\n set_field(\"timestamp_utc\", creation_time);\nend"
3939 + }
3940 + },
3941 + "constraints": [
3942 + {
3943 + "type": "server-version",
3944 + "version": ">=5.0.13+083613e"
3945 + }
3946 + ]
3947 + },
3948 + {
3949 + "id": "6233a285-38ea-48ef-bb17-fc85f94a75fc",
3950 + "type": {
3951 + "name": "pipeline_rule",
3952 + "version": "1"
3953 + },
3954 + "v": "1",
3955 + "data": {
3956 + "title": {
3957 + "@type": "string",
3958 + "@value": "URL Encode data_name field for ASK SOCFortress API"
3959 + },
3960 + "description": {
3961 + "@type": "string",
3962 + "@value": "URL Encode `data_name` field for ASK SOCFortress API"
3963 + },
3964 + "source": {
3965 + "@type": "string",
3966 + "@value": "rule \"URL Encode data_name field for ASK SOCFortress API\"\nwhen\n has_field(\"data_name\") AND $message.rule_group2 == \"chainsaw\" AND $message.data_logsource_product == \"windows\"\nthen\n let replaced = replace(to_string($message.data_name), \" \", \"%20\");\n set_field(\"sigma_name_encoded\", replaced);\nend\n"
3967 + }
3968 + },
3969 + "constraints": [
3970 + {
3971 + "type": "server-version",
3972 + "version": ">=5.0.13+083613e"
3973 + }
3974 + ]
3975 + },
3976 + {
3977 + "id": "5e400ee7-a24d-4e5f-970d-9f20e01278f5",
3978 + "type": {
3979 + "name": "pipeline_rule",
3980 + "version": "1"
3981 + },
3982 + "v": "1",
3983 + "data": {
3984 + "title": {
3985 + "@type": "string",
3986 + "@value": "ASK SOCFORTRESS WINDOWS - CHAINSAW"
3987 + },
3988 + "description": {
3989 + "@type": "string",
3990 + "@value": "ASK SOCFORTRESS WINDOWS - CHAINSAW"
3991 + },
3992 + "source": {
3993 + "@type": "string",
3994 + "@value": "rule \"ASK SOCFORTRESS WINDOWS - CHAINSAW\"\nwhen\n has_field(\"sigma_name_encoded\")\nthen\n let ask_socfortress = to_string($message.sigma_name_encoded);\n let ldata = lookup_value(\"ask_socfortress_windows\", ask_socfortress);\n set_field(\"ask_socfortress_message\", ldata);\nend"
3995 + }
3996 + },
3997 + "constraints": [
3998 + {
3999 + "type": "server-version",
4000 + "version": ">=5.0.13+083613e"
4001 + }
4002 + ]
4003 + },
4004 + {
4005 + "id": "feb9e1d7-9346-4a2a-9566-59ed483c1b83",
4006 + "type": {
4007 + "name": "stream",
4008 + "version": "1"
4009 + },
4010 + "v": "1",
4011 + "data": {
4012 + "alarm_callbacks": [],
4013 + "outputs": [],
4014 + "remove_matches": {
4015 + "@type": "boolean",
4016 + "@value": true
4017 + },
4018 + "title": {
4019 + "@type": "string",
4020 + "@value": "WAZUH EDR AGENTS"
4021 + },
4022 + "stream_rules": [
4023 + {
4024 + "type": {
4025 + "@type": "string",
4026 + "@value": "EXACT"
4027 + },
4028 + "field": {
4029 + "@type": "string",
4030 + "@value": "rule_group1"
4031 + },
4032 + "value": {
4033 + "@type": "string",
4034 + "@value": "office365"
4035 + },
4036 + "inverted": {
4037 + "@type": "boolean",
4038 + "@value": true
4039 + },
4040 + "description": {
4041 + "@type": "string",
4042 + "@value": ""
4043 + }
4044 + },
4045 + {
4046 + "type": {
4047 + "@type": "string",
4048 + "@value": "EXACT"
4049 + },
4050 + "field": {
4051 + "@type": "string",
4052 + "@value": "rule_group1"
4053 + },
4054 + "value": {
4055 + "@type": "string",
4056 + "@value": "socfortress_healthcheck"
4057 + },
4058 + "inverted": {
4059 + "@type": "boolean",
4060 + "@value": true
4061 + },
4062 + "description": {
4063 + "@type": "string",
4064 + "@value": ""
4065 + }
4066 + },
4067 + {
4068 + "type": {
4069 + "@type": "string",
4070 + "@value": "EXACT"
4071 + },
4072 + "field": {
4073 + "@type": "string",
4074 + "@value": "rule_group1"
4075 + },
4076 + "value": {
4077 + "@type": "string",
4078 + "@value": "suricata"
4079 + },
4080 + "inverted": {
4081 + "@type": "boolean",
4082 + "@value": true
4083 + },
4084 + "description": {
4085 + "@type": "string",
4086 + "@value": ""
4087 + }
4088 + },
4089 + {
4090 + "type": {
4091 + "@type": "string",
4092 + "@value": "EXACT"
4093 + },
4094 + "field": {
4095 + "@type": "string",
4096 + "@value": "syslog_type"
4097 + },
4098 + "value": {
4099 + "@type": "string",
4100 + "@value": "wazuh"
4101 + },
4102 + "inverted": {
4103 + "@type": "boolean",
4104 + "@value": false
4105 + },
4106 + "description": {
4107 + "@type": "string",
4108 + "@value": ""
4109 + }
4110 + }
4111 + ],
4112 + "alert_conditions": [],
4113 + "matching_type": {
4114 + "@type": "string",
4115 + "@value": "AND"
4116 + },
4117 + "disabled": {
4118 + "@type": "boolean",
4119 + "@value": false
4120 + },
4121 + "description": {
4122 + "@type": "string",
4123 + "@value": "WAZUH EDR AGENTS"
4124 + },
4125 + "default_stream": {
4126 + "@type": "boolean",
4127 + "@value": false
4128 + }
4129 + },
4130 + "constraints": [
4131 + {
4132 + "type": "server-version",
4133 + "version": ">=5.0.13+083613e"
4134 + }
4135 + ]
4136 + }
4137 + ]
4138 +}
backend/copilot.py
+4
@@ -22,6 +22,7 @@ from app.middleware.exception_handlers import custom_http_exception_handler
22 from app.middleware.exception_handlers import validation_exception_handler
23 from app.middleware.exception_handlers import value_error_handler
24 from app.middleware.logger import log_requests
25 +from app.routers import active_response
26 from app.routers import agents
27 from app.routers import alert_creation
28 from app.routers import alert_creation_settings
@@ -46,6 +47,7 @@ from app.routers import sap_siem
47 from app.routers import scheduler
48 from app.routers import shuffle
49 from app.routers import smtp
50 +from app.routers import stack_provisioning
51 from app.routers import sublime
52 from app.routers import threat_intel
53 from app.routers import velociraptor
@@ -117,6 +119,8 @@ api_router.include_router(mimecast.router)
119 api_router.include_router(scheduler.router)
120 api_router.include_router(monitoring_alert.router)
121 api_router.include_router(sap_siem.router)
122 +api_router.include_router(stack_provisioning.router)
123 +api_router.include_router(active_response.router)
124
125 # Include the APIRouter in the FastAPI app
126 app.include_router(api_router)
frontend/package-lock.json
+142 -136
@@ -16,14 +16,14 @@
16 "@popperjs/core": "^2.11.8",
17 "@vueuse/components": "^10.7.2",
18 "@vueuse/core": "^10.7.2",
19 - "apexcharts": "^3.45.2",
19 + "apexcharts": "^3.46.0",
20 "bytes": "^3.1.2",
21 "colord": "^2.9.3",
22 "crypto-js": "^4.2.0",
23 "dayjs": "^1.11.10",
24 "detect-touch-device": "^1.1.6",
25 - "echarts": "^5.4.3",
26 - "jose": "^5.2.1",
25 + "echarts": "^5.5.0",
26 + "jose": "^5.2.2",
27 "js-md5": "^0.8.3",
28 "lodash": "^4.17.21",
29 "markdown-it-highlightjs": "^4.0.1",
@@ -34,14 +34,14 @@
34 "pinia-plugin-persistedstate": "^3.2.1",
35 "secure-ls": "^1.2.6",
36 "validator": "^13.11.0",
37 - "vue": "^3.4.16",
37 + "vue": "^3.4.19",
38 "vue-advanced-cropper": "^2.8.8",
39 "vue-highlight-words": "^3.0.1",
40 "vue-i18n": "^9.9.1",
41 "vue-router": "^4.2.5",
42 "vue-sjv": "^0.0.6",
43 - "vue3-apexcharts": "^1.4.4",
44 - "vue3-marquee": "^4.1.0"
43 + "vue3-apexcharts": "^1.5.2",
44 + "vue3-marquee": "^4.2.0"
45 },
46 "devDependencies": {
47 "@clack/prompts": "^0.7.0",
@@ -56,9 +56,9 @@
56 "@types/lodash": "^4.14.202",
57 "@types/markdown-it": "^13.0.7",
58 "@types/markdown-it-highlightjs": "^3.3.4",
59 - "@types/node": "^20.11.16",
59 + "@types/node": "^20.11.19",
60 "@types/validator": "^13.11.9",
61 - "@vitejs/plugin-vue": "^5.0.3",
61 + "@vitejs/plugin-vue": "^5.0.4",
62 "@vitejs/plugin-vue-jsx": "^3.1.0",
63 "@vue/eslint-config-prettier": "^9.0.0",
64 "@vue/eslint-config-typescript": "^12.0.0",
@@ -70,13 +70,14 @@
70 "eslint-plugin-cypress": "^2.15.1",
71 "eslint-plugin-vue": "^9.21.1",
72 "fs-extra": "^11.2.0",
73 + "ip": "^2.0.1",
74 "jsdom": "^24.0.0",
75 "json5": "^2.2.3",
76 "npm-run-all": "^4.1.5",
77 "picocolors": "^1.0.0",
78 "postcss": "^8.4.35",
79 "prettier": "^3.2.5",
79 - "sass": "^1.70.0",
80 + "sass": "^1.71.0",
81 "start-server-and-test": "^2.0.3",
82 "tailwind-config-viewer": "^1.7.3",
83 "tailwindcss": "^3.4.1",
@@ -84,11 +85,11 @@
85 "ts-node": "^10.9.2",
86 "typescript": "~5.3.3",
87 "unplugin-vue-components": "^0.26.0",
87 - "vite": "^5.1.0",
88 - "vite-bundle-analyzer": "^0.7.0",
88 + "vite": "^5.1.3",
89 + "vite-bundle-analyzer": "^0.8.0",
90 "vite-bundle-visualizer": "^1.0.1",
91 "vite-svg-loader": "^5.1.0",
91 - "vitest": "^1.2.2",
92 + "vitest": "^1.3.0",
93 "vue-tsc": "^1.8.27"
94 },
95 "engines": {
@@ -2415,9 +2416,9 @@
2416 "dev": true
2417 },
2418 "node_modules/@types/node": {
2418 - "version": "20.11.17",
2419 - "resolved": "https://registry.npmjs.org/@types/node/-/node-20.11.17.tgz",
2420 - "integrity": "sha512-QmgQZGWu1Yw9TDyAP9ZzpFJKynYNeOvwMJmaxABfieQoVoiVOS6MN1WSpqpRcbeA5+RW82kraAVxCCJg+780Qw==",
2419 + "version": "20.11.19",
2420 + "resolved": "https://registry.npmjs.org/@types/node/-/node-20.11.19.tgz",
2421 + "integrity": "sha512-7xMnVEcZFu0DikYjWOlRq7NTPETrm7teqUT2WkQjrTIkEgUyyGdWsj/Zg8bEJt5TNklzbPD1X3fqfsHw3SpapQ==",
2422 "dev": true,
2423 "dependencies": {
2424 "undici-types": "~5.26.4"
@@ -2750,13 +2751,13 @@
2751 }
2752 },
2753 "node_modules/@vitest/expect": {
2753 - "version": "1.2.2",
2754 - "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-1.2.2.tgz",
2755 - "integrity": "sha512-3jpcdPAD7LwHUUiT2pZTj2U82I2Tcgg2oVPvKxhn6mDI2On6tfvPQTjAI4628GUGDZrCm4Zna9iQHm5cEexOAg==",
2754 + "version": "1.3.0",
2755 + "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-1.3.0.tgz",
2756 + "integrity": "sha512-7bWt0vBTZj08B+Ikv70AnLRicohYwFgzNjFqo9SxxqHHxSlUJGSXmCRORhOnRMisiUryKMdvsi1n27Bc6jL9DQ==",
2757 "dev": true,
2758 "dependencies": {
2758 - "@vitest/spy": "1.2.2",
2759 - "@vitest/utils": "1.2.2",
2759 + "@vitest/spy": "1.3.0",
2760 + "@vitest/utils": "1.3.0",
2761 "chai": "^4.3.10"
2762 },
2763 "funding": {
@@ -2764,12 +2765,12 @@
2765 }
2766 },
2767 "node_modules/@vitest/runner": {
2767 - "version": "1.2.2",
2768 - "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-1.2.2.tgz",
2769 - "integrity": "sha512-JctG7QZ4LSDXr5CsUweFgcpEvrcxOV1Gft7uHrvkQ+fsAVylmWQvnaAr/HDp3LAH1fztGMQZugIheTWjaGzYIg==",
2768 + "version": "1.3.0",
2769 + "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-1.3.0.tgz",
2770 + "integrity": "sha512-1Jb15Vo/Oy7mwZ5bXi7zbgszsdIBNjc4IqP8Jpr/8RdBC4nF1CTzIAn2dxYvpF1nGSseeL39lfLQ2uvs5u1Y9A==",
2771 "dev": true,
2772 "dependencies": {
2772 - "@vitest/utils": "1.2.2",
2773 + "@vitest/utils": "1.3.0",
2774 "p-limit": "^5.0.0",
2775 "pathe": "^1.1.1"
2776 },
@@ -2805,9 +2806,9 @@
2806 }
2807 },
2808 "node_modules/@vitest/snapshot": {
2808 - "version": "1.2.2",
2809 - "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-1.2.2.tgz",
2810 - "integrity": "sha512-SmGY4saEw1+bwE1th6S/cZmPxz/Q4JWsl7LvbQIky2tKE35US4gd0Mjzqfr84/4OD0tikGWaWdMja/nWL5NIPA==",
2809 + "version": "1.3.0",
2810 + "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-1.3.0.tgz",
2811 + "integrity": "sha512-swmktcviVVPYx9U4SEQXLV6AEY51Y6bZ14jA2yo6TgMxQ3h+ZYiO0YhAHGJNp0ohCFbPAis1R9kK0cvN6lDPQA==",
2812 "dev": true,
2813 "dependencies": {
2814 "magic-string": "^0.30.5",
@@ -2819,9 +2820,9 @@
2820 }
2821 },
2822 "node_modules/@vitest/spy": {
2822 - "version": "1.2.2",
2823 - "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-1.2.2.tgz",
2824 - "integrity": "sha512-k9Gcahssw8d7X3pSLq3e3XEu/0L78mUkCjivUqCQeXJm9clfXR/Td8+AP+VC1O6fKPIDLcHDTAmBOINVuv6+7g==",
2823 + "version": "1.3.0",
2824 + "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-1.3.0.tgz",
2825 + "integrity": "sha512-AkCU0ThZunMvblDpPKgjIi025UxR8V7MZ/g/EwmAGpjIujLVV2X6rGYGmxE2D4FJbAy0/ijdROHMWa2M/6JVMw==",
2826 "dev": true,
2827 "dependencies": {
2828 "tinyspy": "^2.2.0"
@@ -2831,9 +2832,9 @@
2832 }
2833 },
2834 "node_modules/@vitest/utils": {
2834 - "version": "1.2.2",
2835 - "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-1.2.2.tgz",
2836 - "integrity": "sha512-WKITBHLsBHlpjnDQahr+XK6RE7MiAsgrIkr0pGhQ9ygoxBfUeG0lUG5iLlzqjmKSlBv3+j5EGsriBzh+C3Tq9g==",
2835 + "version": "1.3.0",
2836 + "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-1.3.0.tgz",
2837 + "integrity": "sha512-/LibEY/fkaXQufi4GDlQZhikQsPO2entBKtfuyIpr1jV4DpaeasqkeHjhdOhU24vSHshcSuEyVlWdzvv2XmYCw==",
2838 "dev": true,
2839 "dependencies": {
2840 "diff-sequences": "^29.6.3",
@@ -2932,36 +2933,36 @@
2933 }
2934 },
2935 "node_modules/@vue/compiler-core": {
2935 - "version": "3.4.18",
2936 - "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.4.18.tgz",
2937 - "integrity": "sha512-F7YK8lMK0iv6b9/Gdk15A67wM0KKZvxDxed0RR60C1z9tIJTKta+urs4j0RTN5XqHISzI3etN3mX0uHhjmoqjQ==",
2936 + "version": "3.4.19",
2937 + "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.4.19.tgz",
2938 + "integrity": "sha512-gj81785z0JNzRcU0Mq98E56e4ltO1yf8k5PQ+tV/7YHnbZkrM0fyFyuttnN8ngJZjbpofWE/m4qjKBiLl8Ju4w==",
2939 "dependencies": {
2940 "@babel/parser": "^7.23.9",
2940 - "@vue/shared": "3.4.18",
2941 + "@vue/shared": "3.4.19",
2942 "entities": "^4.5.0",
2943 "estree-walker": "^2.0.2",
2944 "source-map-js": "^1.0.2"
2945 }
2946 },
2947 "node_modules/@vue/compiler-dom": {
2947 - "version": "3.4.18",
2948 - "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.4.18.tgz",
2949 - "integrity": "sha512-24Eb8lcMfInefvQ6YlEVS18w5Q66f4+uXWVA+yb7praKbyjHRNuKVWGuinfSSjM0ZIiPi++QWukhkgznBaqpEA==",
2948 + "version": "3.4.19",
2949 + "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.4.19.tgz",
2950 + "integrity": "sha512-vm6+cogWrshjqEHTzIDCp72DKtea8Ry/QVpQRYoyTIg9k7QZDX6D8+HGURjtmatfgM8xgCFtJJaOlCaRYRK3QA==",
2951 "dependencies": {
2951 - "@vue/compiler-core": "3.4.18",
2952 - "@vue/shared": "3.4.18"
2952 + "@vue/compiler-core": "3.4.19",
2953 + "@vue/shared": "3.4.19"
2954 }
2955 },
2956 "node_modules/@vue/compiler-sfc": {
2956 - "version": "3.4.18",
2957 - "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.4.18.tgz",
2958 - "integrity": "sha512-rG5tqtnzwrVpMqAQ7FHtvHaV70G6LLfJIWLYZB/jZ9m/hrnZmIQh+H3ewnC5onwe/ibljm9+ZupxeElzqCkTAw==",
2957 + "version": "3.4.19",
2958 + "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.4.19.tgz",
2959 + "integrity": "sha512-LQ3U4SN0DlvV0xhr1lUsgLCYlwQfUfetyPxkKYu7dkfvx7g3ojrGAkw0AERLOKYXuAGnqFsEuytkdcComei3Yg==",
2960 "dependencies": {
2961 "@babel/parser": "^7.23.9",
2961 - "@vue/compiler-core": "3.4.18",
2962 - "@vue/compiler-dom": "3.4.18",
2963 - "@vue/compiler-ssr": "3.4.18",
2964 - "@vue/shared": "3.4.18",
2962 + "@vue/compiler-core": "3.4.19",
2963 + "@vue/compiler-dom": "3.4.19",
2964 + "@vue/compiler-ssr": "3.4.19",
2965 + "@vue/shared": "3.4.19",
2966 "estree-walker": "^2.0.2",
2967 "magic-string": "^0.30.6",
2968 "postcss": "^8.4.33",
@@ -2969,12 +2970,12 @@
2970 }
2971 },
2972 "node_modules/@vue/compiler-ssr": {
2972 - "version": "3.4.18",
2973 - "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.4.18.tgz",
2974 - "integrity": "sha512-hSlv20oUhPxo2UYUacHgGaxtqP0tvFo6ixxxD6JlXIkwzwoZ9eKK6PFQN4hNK/R13JlNyldwWt/fqGBKgWJ6nQ==",
2973 + "version": "3.4.19",
2974 + "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.4.19.tgz",
2975 + "integrity": "sha512-P0PLKC4+u4OMJ8sinba/5Z/iDT84uMRRlrWzadgLA69opCpI1gG4N55qDSC+dedwq2fJtzmGald05LWR5TFfLw==",
2976 "dependencies": {
2976 - "@vue/compiler-dom": "3.4.18",
2977 - "@vue/shared": "3.4.18"
2977 + "@vue/compiler-dom": "3.4.19",
2978 + "@vue/shared": "3.4.19"
2979 }
2980 },
2981 "node_modules/@vue/devtools-api": {
@@ -3046,48 +3047,48 @@
3047 }
3048 },
3049 "node_modules/@vue/reactivity": {
3049 - "version": "3.4.18",
3050 - "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.4.18.tgz",
3051 - "integrity": "sha512-7uda2/I0jpLiRygprDo5Jxs2HJkOVXcOMlyVlY54yRLxoycBpwGJRwJT9EdGB4adnoqJDXVT2BilUAYwI7qvmg==",
3050 + "version": "3.4.19",
3051 + "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.4.19.tgz",
3052 + "integrity": "sha512-+VcwrQvLZgEclGZRHx4O2XhyEEcKaBi50WbxdVItEezUf4fqRh838Ix6amWTdX0CNb/b6t3Gkz3eOebfcSt+UA==",
3053 "dependencies": {
3053 - "@vue/shared": "3.4.18"
3054 + "@vue/shared": "3.4.19"
3055 }
3056 },
3057 "node_modules/@vue/runtime-core": {
3057 - "version": "3.4.18",
3058 - "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.4.18.tgz",
3059 - "integrity": "sha512-7mU9diCa+4e+8/wZ7Udw5pwTH10A11sZ1nldmHOUKJnzCwvZxfJqAtw31mIf4T5H2FsLCSBQT3xgioA9vIjyDQ==",
3058 + "version": "3.4.19",
3059 + "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.4.19.tgz",
3060 + "integrity": "sha512-/Z3tFwOrerJB/oyutmJGoYbuoadphDcJAd5jOuJE86THNZji9pYjZroQ2NFsZkTxOq0GJbb+s2kxTYToDiyZzw==",
3061 "dependencies": {
3061 - "@vue/reactivity": "3.4.18",
3062 - "@vue/shared": "3.4.18"
3062 + "@vue/reactivity": "3.4.19",
3063 + "@vue/shared": "3.4.19"
3064 }
3065 },
3066 "node_modules/@vue/runtime-dom": {
3066 - "version": "3.4.18",
3067 - "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.4.18.tgz",
3068 - "integrity": "sha512-2y1Mkzcw1niSfG7z3Qx+2ir9Gb4hdTkZe5p/I8x1aTIKQE0vY0tPAEUPhZm5tx6183gG3D/KwHG728UR0sIufA==",
3067 + "version": "3.4.19",
3068 + "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.4.19.tgz",
3069 + "integrity": "sha512-IyZzIDqfNCF0OyZOauL+F4yzjMPN2rPd8nhqPP2N1lBn3kYqJpPHHru+83Rkvo2lHz5mW+rEeIMEF9qY3PB94g==",
3070 "dependencies": {
3070 - "@vue/runtime-core": "3.4.18",
3071 - "@vue/shared": "3.4.18",
3071 + "@vue/runtime-core": "3.4.19",
3072 + "@vue/shared": "3.4.19",
3073 "csstype": "^3.1.3"
3074 }
3075 },
3076 "node_modules/@vue/server-renderer": {
3076 - "version": "3.4.18",
3077 - "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.4.18.tgz",
3078 - "integrity": "sha512-YJd1wa7mzUN3NRqLEsrwEYWyO+PUBSROIGlCc3J/cvn7Zu6CxhNLgXa8Z4zZ5ja5/nviYO79J1InoPeXgwBTZA==",
3077 + "version": "3.4.19",
3078 + "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.4.19.tgz",
3079 + "integrity": "sha512-eAj2p0c429RZyyhtMRnttjcSToch+kTWxFPHlzGMkR28ZbF1PDlTcmGmlDxccBuqNd9iOQ7xPRPAGgPVj+YpQw==",
3080 "dependencies": {
3080 - "@vue/compiler-ssr": "3.4.18",
3081 - "@vue/shared": "3.4.18"
3081 + "@vue/compiler-ssr": "3.4.19",
3082 + "@vue/shared": "3.4.19"
3083 },
3084 "peerDependencies": {
3084 - "vue": "3.4.18"
3085 + "vue": "3.4.19"
3086 }
3087 },
3088 "node_modules/@vue/shared": {
3088 - "version": "3.4.18",
3089 - "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.4.18.tgz",
3090 - "integrity": "sha512-CxouGFxxaW5r1WbrSmWwck3No58rApXgRSBxrqgnY1K+jk20F6DrXJkHdH9n4HVT+/B6G2CAn213Uq3npWiy8Q=="
3089 + "version": "3.4.19",
3090 + "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.4.19.tgz",
3091 + "integrity": "sha512-/KliRRHMF6LoiThEy+4c1Z4KB/gbPrGjWwJR+crg2otgrf/egKzRaCPvJ51S5oetgsgXLfc4Rm5ZgrKHZrtMSw=="
3092 },
3093 "node_modules/@vue/test-utils": {
3094 "version": "2.4.4",
@@ -3403,9 +3404,9 @@
3404 }
3405 },
3406 "node_modules/apexcharts": {
3406 - "version": "3.45.2",
3407 - "resolved": "https://registry.npmjs.org/apexcharts/-/apexcharts-3.45.2.tgz",
3408 - "integrity": "sha512-PpuM4sJWy70sUh5U1IFn1m1p45MdHSChLUNnqEoUUUHSU2IHZugFrsVNhov1S8Q0cvfdrCRCvdBtHGSs6PSAWQ==",
3407 + "version": "3.46.0",
3408 + "resolved": "https://registry.npmjs.org/apexcharts/-/apexcharts-3.46.0.tgz",
3409 + "integrity": "sha512-ELAY6vj8JQD7QLktKasTzwm9Wt0qxqfQSo+3QWS7G7I774iK8HCkG1toGsqJH0mkK6PtYBtnSIe66uUcwoCw1w==",
3410 "dependencies": {
3411 "@yr/monotone-cubic-spline": "^1.0.3",
3412 "svg.draggable.js": "^2.2.2",
@@ -5168,12 +5169,12 @@
5169 }
5170 },
5171 "node_modules/echarts": {
5171 - "version": "5.4.3",
5172 - "resolved": "https://registry.npmjs.org/echarts/-/echarts-5.4.3.tgz",
5173 - "integrity": "sha512-mYKxLxhzy6zyTi/FaEbJMOZU1ULGEQHaeIeuMR5L+JnJTpz+YR03mnnpBhbR4+UYJAgiXgpyTVLffPAjOTLkZA==",
5172 + "version": "5.5.0",
5173 + "resolved": "https://registry.npmjs.org/echarts/-/echarts-5.5.0.tgz",
5174 + "integrity": "sha512-rNYnNCzqDAPCr4m/fqyUFv7fD9qIsd50S6GDFgO1DxZhncCsNsG7IfUlAlvZe5oSEQxtsjnHiUuppzccry93Xw==",
5175 "dependencies": {
5176 "tslib": "2.3.0",
5176 - "zrender": "5.4.4"
5177 + "zrender": "5.5.0"
5178 }
5179 },
5180 "node_modules/editorconfig": {
@@ -6834,9 +6835,9 @@
6835 }
6836 },
6837 "node_modules/ip": {
6837 - "version": "2.0.0",
6838 - "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.0.tgz",
6839 - "integrity": "sha512-WKa+XuLG1A1R0UWhl2+1XQSi+fZWMsYKffMZTTYsiZaUD8k2yDAj5atimTUD2TZkyCkNEeYE5NhFZmupOGtjYQ==",
6838 + "version": "2.0.1",
6839 + "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.1.tgz",
6840 + "integrity": "sha512-lJUL9imLTNi1ZfXT+DU6rBBdbiKGBuay9B6xGSPVjUeQwaH1RIGqef8RZkUtHioLmSNpPR5M4HVKJGm1j8FWVQ==",
6841 "dev": true
6842 },
6843 "node_modules/is-array-buffer": {
@@ -7298,9 +7299,9 @@
7299 }
7300 },
7301 "node_modules/jose": {
7301 - "version": "5.2.1",
7302 - "resolved": "https://registry.npmjs.org/jose/-/jose-5.2.1.tgz",
7303 - "integrity": "sha512-qiaQhtQRw6YrOaOj0v59h3R6hUY9NvxBmmnMfKemkqYmBB0tEc97NbLP7ix44VP5p9/0YHG8Vyhzuo5YBNwviA==",
7302 + "version": "5.2.2",
7303 + "resolved": "https://registry.npmjs.org/jose/-/jose-5.2.2.tgz",
7304 + "integrity": "sha512-/WByRr4jDcsKlvMd1dRJnPfS1GVO3WuKyaurJ/vvXcOaUQO8rnNObCQMlv/5uCceVQIq5Q4WLF44ohsdiTohdg==",
7305 "funding": {
7306 "url": "https://github.com/sponsors/panva"
7307 }
@@ -10548,9 +10549,9 @@
10549 "dev": true
10550 },
10551 "node_modules/sass": {
10551 - "version": "1.70.0",
10552 - "resolved": "https://registry.npmjs.org/sass/-/sass-1.70.0.tgz",
10553 - "integrity": "sha512-uUxNQ3zAHeAx5nRFskBnrWzDUJrrvpCPD5FNAoRvTi0WwremlheES3tg+56PaVtCs5QDRX5CBLxxKMDJMEa1WQ==",
10552 + "version": "1.71.0",
10553 + "resolved": "https://registry.npmjs.org/sass/-/sass-1.71.0.tgz",
10554 + "integrity": "sha512-HKKIKf49Vkxlrav3F/w6qRuPcmImGVbIXJ2I3Kg0VMA+3Bav+8yE9G5XmP5lMj6nl4OlqbPftGAscNaNu28b8w==",
10555 "dev": true,
10556 "dependencies": {
10557 "chokidar": ">=3.0.0 <4.0.0",
@@ -11186,17 +11187,23 @@
11187 }
11188 },
11189 "node_modules/strip-literal": {
11189 - "version": "1.3.0",
11190 - "resolved": "https://registry.npmjs.org/strip-literal/-/strip-literal-1.3.0.tgz",
11191 - "integrity": "sha512-PugKzOsyXpArk0yWmUwqOZecSO0GH0bPoctLcqNDH9J04pVW3lflYE0ujElBGTloevcxF5MofAOZ7C5l2b+wLg==",
11190 + "version": "2.0.0",
11191 + "resolved": "https://registry.npmjs.org/strip-literal/-/strip-literal-2.0.0.tgz",
11192 + "integrity": "sha512-f9vHgsCWBq2ugHAkGMiiYY+AYG0D/cbloKKg0nhaaaSNsujdGIpVXCNsrJpCKr5M0f4aI31mr13UjY6GAuXCKA==",
11193 "dev": true,
11194 "dependencies": {
11194 - "acorn": "^8.10.0"
11195 + "js-tokens": "^8.0.2"
11196 },
11197 "funding": {
11198 "url": "https://github.com/sponsors/antfu"
11199 }
11200 },
11201 + "node_modules/strip-literal/node_modules/js-tokens": {
11202 + "version": "8.0.3",
11203 + "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-8.0.3.tgz",
11204 + "integrity": "sha512-UfJMcSJc+SEXEl9lH/VLHSZbThQyLpw1vLO1Lb+j4RWDvG3N2f7yj3PVQA3cmkTBNldJ9eFnM+xEXxHIXrYiJw==",
11205 + "dev": true
11206 + },
11207 "node_modules/sucrase": {
11208 "version": "3.35.0",
11209 "resolved": "https://registry.npmjs.org/sucrase/-/sucrase-3.35.0.tgz",
@@ -12377,9 +12384,9 @@
12384 }
12385 },
12386 "node_modules/vite": {
12380 - "version": "5.1.1",
12381 - "resolved": "https://registry.npmjs.org/vite/-/vite-5.1.1.tgz",
12382 - "integrity": "sha512-wclpAgY3F1tR7t9LL5CcHC41YPkQIpKUGeIuT8MdNwNZr6OqOTLs7JX5vIHAtzqLWXts0T+GDrh9pN2arneKqg==",
12387 + "version": "5.1.3",
12388 + "resolved": "https://registry.npmjs.org/vite/-/vite-5.1.3.tgz",
12389 + "integrity": "sha512-UfmUD36DKkqhi/F75RrxvPpry+9+tTkrXfMNZD+SboZqBCMsxKtO52XeGzzuh7ioz+Eo/SYDBbdb0Z7vgcDJew==",
12390 "dev": true,
12391 "dependencies": {
12392 "esbuild": "^0.19.3",
@@ -12432,9 +12439,9 @@
12439 }
12440 },
12441 "node_modules/vite-bundle-analyzer": {
12435 - "version": "0.7.0",
12436 - "resolved": "https://registry.npmjs.org/vite-bundle-analyzer/-/vite-bundle-analyzer-0.7.0.tgz",
12437 - "integrity": "sha512-CaYVmRmlIupjutl50Ggl1tY5VNoAUyRZuMlqxBwAQxsysdHsJMHi66unwsonWmM3EmBbPSALvD5K1zgA1rviRA==",
12442 + "version": "0.8.0",
12443 + "resolved": "https://registry.npmjs.org/vite-bundle-analyzer/-/vite-bundle-analyzer-0.8.0.tgz",
12444 + "integrity": "sha512-qoUFZW7vo2H3c/j2+phhWS7BH7cEu64PAfb+Ze/LEbv15q+HiOadBvMlFlk0dPmJwc6T4LFlngIp2EWDwuFMvg==",
12445 "dev": true,
12446 "dependencies": {
12447 "fast-glob": "^3.3.1",
@@ -12490,9 +12497,9 @@
12497 }
12498 },
12499 "node_modules/vite-node": {
12493 - "version": "1.2.2",
12494 - "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-1.2.2.tgz",
12495 - "integrity": "sha512-1as4rDTgVWJO3n1uHmUYqq7nsFgINQ9u+mRcXpjeOMJUmviqNKjcZB7UfRZrlM7MjYXMKpuWp5oGkjaFLnjawg==",
12500 + "version": "1.3.0",
12501 + "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-1.3.0.tgz",
12502 + "integrity": "sha512-D/oiDVBw75XMnjAXne/4feCkCEwcbr2SU1bjAhCcfI5Bq3VoOHji8/wCPAfUkDIeohJ5nSZ39fNxM3dNZ6OBOA==",
12503 "dev": true,
12504 "dependencies": {
12505 "cac": "^6.7.14",
@@ -12524,18 +12531,17 @@
12531 }
12532 },
12533 "node_modules/vitest": {
12527 - "version": "1.2.2",
12528 - "resolved": "https://registry.npmjs.org/vitest/-/vitest-1.2.2.tgz",
12529 - "integrity": "sha512-d5Ouvrnms3GD9USIK36KG8OZ5bEvKEkITFtnGv56HFaSlbItJuYr7hv2Lkn903+AvRAgSixiamozUVfORUekjw==",
12534 + "version": "1.3.0",
12535 + "resolved": "https://registry.npmjs.org/vitest/-/vitest-1.3.0.tgz",
12536 + "integrity": "sha512-V9qb276J1jjSx9xb75T2VoYXdO1UKi+qfflY7V7w93jzX7oA/+RtYE6TcifxksxsZvygSSMwu2Uw6di7yqDMwg==",
12537 "dev": true,
12538 "dependencies": {
12532 - "@vitest/expect": "1.2.2",
12533 - "@vitest/runner": "1.2.2",
12534 - "@vitest/snapshot": "1.2.2",
12535 - "@vitest/spy": "1.2.2",
12536 - "@vitest/utils": "1.2.2",
12539 + "@vitest/expect": "1.3.0",
12540 + "@vitest/runner": "1.3.0",
12541 + "@vitest/snapshot": "1.3.0",
12542 + "@vitest/spy": "1.3.0",
12543 + "@vitest/utils": "1.3.0",
12544 "acorn-walk": "^8.3.2",
12538 - "cac": "^6.7.14",
12545 "chai": "^4.3.10",
12546 "debug": "^4.3.4",
12547 "execa": "^8.0.1",
@@ -12544,11 +12550,11 @@
12550 "pathe": "^1.1.1",
12551 "picocolors": "^1.0.0",
12552 "std-env": "^3.5.0",
12547 - "strip-literal": "^1.3.0",
12553 + "strip-literal": "^2.0.0",
12554 "tinybench": "^2.5.1",
12555 "tinypool": "^0.8.2",
12556 "vite": "^5.0.0",
12551 - "vite-node": "1.2.2",
12557 + "vite-node": "1.3.0",
12558 "why-is-node-running": "^2.2.2"
12559 },
12560 "bin": {
@@ -12563,8 +12569,8 @@
12569 "peerDependencies": {
12570 "@edge-runtime/vm": "*",
12571 "@types/node": "^18.0.0 || >=20.0.0",
12566 - "@vitest/browser": "^1.0.0",
12567 - "@vitest/ui": "^1.0.0",
12572 + "@vitest/browser": "1.3.0",
12573 + "@vitest/ui": "1.3.0",
12574 "happy-dom": "*",
12575 "jsdom": "*"
12576 },
@@ -12751,15 +12757,15 @@
12757 }
12758 },
12759 "node_modules/vue": {
12754 - "version": "3.4.18",
12755 - "resolved": "https://registry.npmjs.org/vue/-/vue-3.4.18.tgz",
12756 - "integrity": "sha512-0zLRYamFRe0wF4q2L3O24KQzLyLpL64ye1RUToOgOxuWZsb/FhaNRdGmeozdtVYLz6tl94OXLaK7/WQIrVCw1A==",
12760 + "version": "3.4.19",
12761 + "resolved": "https://registry.npmjs.org/vue/-/vue-3.4.19.tgz",
12762 + "integrity": "sha512-W/7Fc9KUkajFU8dBeDluM4sRGc/aa4YJnOYck8dkjgZoXtVsn3OeTGni66FV1l3+nvPA7VBFYtPioaGKUmEADw==",
12763 "dependencies": {
12758 - "@vue/compiler-dom": "3.4.18",
12759 - "@vue/compiler-sfc": "3.4.18",
12760 - "@vue/runtime-dom": "3.4.18",
12761 - "@vue/server-renderer": "3.4.18",
12762 - "@vue/shared": "3.4.18"
12764 + "@vue/compiler-dom": "3.4.19",
12765 + "@vue/compiler-sfc": "3.4.19",
12766 + "@vue/runtime-dom": "3.4.19",
12767 + "@vue/server-renderer": "3.4.19",
12768 + "@vue/shared": "3.4.19"
12769 },
12770 "peerDependencies": {
12771 "typescript": "*"
@@ -12896,18 +12902,18 @@
12902 }
12903 },
12904 "node_modules/vue3-apexcharts": {
12899 - "version": "1.4.4",
12900 - "resolved": "https://registry.npmjs.org/vue3-apexcharts/-/vue3-apexcharts-1.4.4.tgz",
12901 - "integrity": "sha512-TH89uZrxGjaDvkaYAISvj8+k6Bf1rUKFillc8oJirs5XZEPiwM1ELKZQ786wz0rfPqkSHHny2lqqUCK7Rw+LcQ==",
12905 + "version": "1.5.2",
12906 + "resolved": "https://registry.npmjs.org/vue3-apexcharts/-/vue3-apexcharts-1.5.2.tgz",
12907 + "integrity": "sha512-rGbgUJDjtsyjfRF0uzwDjzt8+M7ICSRAbm1N9KCDiczW8BSpbEZuaEsJDJYnJuLFIIVXIGilYzIcjNBf6NbeYA==",
12908 "peerDependencies": {
12909 "apexcharts": "> 3.0.0",
12910 "vue": "> 3.0.0"
12911 }
12912 },
12913 "node_modules/vue3-marquee": {
12908 - "version": "4.1.0",
12909 - "resolved": "https://registry.npmjs.org/vue3-marquee/-/vue3-marquee-4.1.0.tgz",
12910 - "integrity": "sha512-AkvpNC6+7CwvIBgiAr8qMs1XvhGhfSS2ahlMEp80YXAmDOP8nDdn/smQ6eWtusf+hLX21yTaSOoKGcill4bCRg==",
12914 + "version": "4.2.0",
12915 + "resolved": "https://registry.npmjs.org/vue3-marquee/-/vue3-marquee-4.2.0.tgz",
12916 + "integrity": "sha512-Ij4iyvHZjTHMrsPqblpJjq6TYbEFq3utihUllAOfuy0E6W2QKX1vX4E7e7qV/ShmHbCbG0pljcEDq3y0FtzBGw==",
12917 "engines": {
12918 "node": ">=12"
12919 },
@@ -13362,9 +13368,9 @@
13368 }
13369 },
13370 "node_modules/zrender": {
13365 - "version": "5.4.4",
13366 - "resolved": "https://registry.npmjs.org/zrender/-/zrender-5.4.4.tgz",
13367 - "integrity": "sha512-0VxCNJ7AGOMCWeHVyTrGzUgrK4asT4ml9PEkeGirAkKNYXYzoPJCLvmyfdoOXcjTHPs10OZVMfD1Rwg16AZyYw==",
13371 + "version": "5.5.0",
13372 + "resolved": "https://registry.npmjs.org/zrender/-/zrender-5.5.0.tgz",
13373 + "integrity": "sha512-O3MilSi/9mwoovx77m6ROZM7sXShR/O/JIanvzTwjN3FORfLSr81PsUGd7jlaYOeds9d8tw82oP44+3YucVo+w==",
13374 "dependencies": {
13375 "tslib": "2.3.0"
13376 }
frontend/package.json
+16 -14
@@ -19,7 +19,7 @@
19 "test:e2e": "start-server-and-test preview http://localhost:4173/ 'cypress open --e2e'",
20 "test:e2e:ci": "start-server-and-test preview http://localhost:4173/ 'cypress run --e2e'",
21 "type-check": "vue-tsc --noEmit -p tsconfig.vitest.json --composite false",
22 - "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore",
22 + "lint": "eslint . --ext .vue,.ts,.tsx,.cts,.mts --fix",
23 "tailwind-config-viewer": "tailwind-config-viewer -o",
24 "design-tokens": "node scripts/tokens-tool.js",
25 "start-server-old": "cd ../backend && uvicorn copilot:app --reload --port=5000",
@@ -29,7 +29,8 @@
29 "libs-check": "taze",
30 "libs-reload": "rm -rf node_modules package-lock.json && npm install",
31 "open:swagger": "open http://127.0.0.1:5000/docs#/",
32 - "open:redoc": "open http://127.0.0.1:5000/redoc"
32 + "open:redoc": "open http://127.0.0.1:5000/redoc",
33 + "prettify": "prettier --write ."
34 },
35 "dependencies": {
36 "@ajoelp/json-to-formdata": "^1.5.0",
@@ -40,14 +41,14 @@
41 "@popperjs/core": "^2.11.8",
42 "@vueuse/components": "^10.7.2",
43 "@vueuse/core": "^10.7.2",
43 - "apexcharts": "^3.45.2",
44 + "apexcharts": "^3.46.0",
45 "bytes": "^3.1.2",
46 "colord": "^2.9.3",
47 "crypto-js": "^4.2.0",
48 "dayjs": "^1.11.10",
49 "detect-touch-device": "^1.1.6",
49 - "echarts": "^5.4.3",
50 - "jose": "^5.2.1",
50 + "echarts": "^5.5.0",
51 + "jose": "^5.2.2",
52 "js-md5": "^0.8.3",
53 "lodash": "^4.17.21",
54 "markdown-it-highlightjs": "^4.0.1",
@@ -58,14 +59,14 @@
59 "pinia-plugin-persistedstate": "^3.2.1",
60 "secure-ls": "^1.2.6",
61 "validator": "^13.11.0",
61 - "vue": "^3.4.16",
62 + "vue": "^3.4.19",
63 "vue-advanced-cropper": "^2.8.8",
64 "vue-highlight-words": "^3.0.1",
65 "vue-i18n": "^9.9.1",
66 "vue-router": "^4.2.5",
67 "vue-sjv": "^0.0.6",
67 - "vue3-apexcharts": "^1.4.4",
68 - "vue3-marquee": "^4.1.0"
68 + "vue3-apexcharts": "^1.5.2",
69 + "vue3-marquee": "^4.2.0"
70 },
71 "devDependencies": {
72 "@clack/prompts": "^0.7.0",
@@ -80,9 +81,9 @@
81 "@types/lodash": "^4.14.202",
82 "@types/markdown-it": "^13.0.7",
83 "@types/markdown-it-highlightjs": "^3.3.4",
83 - "@types/node": "^20.11.16",
84 + "@types/node": "^20.11.19",
85 "@types/validator": "^13.11.9",
85 - "@vitejs/plugin-vue": "^5.0.3",
86 + "@vitejs/plugin-vue": "^5.0.4",
87 "@vitejs/plugin-vue-jsx": "^3.1.0",
88 "@vue/eslint-config-prettier": "^9.0.0",
89 "@vue/eslint-config-typescript": "^12.0.0",
@@ -94,13 +95,14 @@
95 "eslint-plugin-cypress": "^2.15.1",
96 "eslint-plugin-vue": "^9.21.1",
97 "fs-extra": "^11.2.0",
98 + "ip": "^2.0.1",
99 "jsdom": "^24.0.0",
100 "json5": "^2.2.3",
101 "npm-run-all": "^4.1.5",
102 "picocolors": "^1.0.0",
103 "postcss": "^8.4.35",
104 "prettier": "^3.2.5",
103 - "sass": "^1.70.0",
105 + "sass": "^1.71.0",
106 "start-server-and-test": "^2.0.3",
107 "tailwind-config-viewer": "^1.7.3",
108 "tailwindcss": "^3.4.1",
@@ -108,11 +110,11 @@
110 "ts-node": "^10.9.2",
111 "typescript": "~5.3.3",
112 "unplugin-vue-components": "^0.26.0",
111 - "vite": "^5.1.0",
112 - "vite-bundle-analyzer": "^0.7.0",
113 + "vite": "^5.1.3",
114 + "vite-bundle-analyzer": "^0.8.0",
115 "vite-bundle-visualizer": "^1.0.1",
116 "vite-svg-loader": "^5.1.0",
115 - "vitest": "^1.2.2",
117 + "vitest": "^1.3.0",
118 "vue-tsc": "^1.8.27"
119 },
120 "engines": {
frontend/src/api/soc.ts
+5 -2
@@ -2,7 +2,7 @@ import { type FlaskBaseResponse } from "@/types/flask.d"
2 import { HttpClient } from "./httpClient"
3 import type { SocAlert, SocAlertCaseResponse } from "@/types/soc/alert.d"
4 import type { SocCase, SocCaseExt } from "@/types/soc/case.d"
5 -import type { SocAsset, SocAssetsState } from "@/types/soc/asset.d"
5 +import type { SocAlertAsset, SocCaseAsset, SocCaseAssetsState } from "@/types/soc/asset.d"
6 import type { SocNewNote, SocNote } from "@/types/soc/note.d"
7 import type { SocUser } from "@/types/soc/user.d"
8
@@ -48,6 +48,9 @@ export default {
48 signal ? { signal } : {}
49 )
50 },
51 + getAssetsByAlert(alertId: string) {
52 + return HttpClient.get<FlaskBaseResponse & { assets: SocAlertAsset[] }>(`/soc/alerts/assets/${alertId}`)
53 + },
54 addAlertBookmark(alertId: string) {
55 return HttpClient.post<FlaskBaseResponse & { alert: SocAlert }>(`/soc/alerts/bookmark/${alertId}`)
56 },
@@ -111,7 +114,7 @@ export default {
114 )
115 },
116 getAssetsByCase(caseId: string) {
114 - return HttpClient.get<FlaskBaseResponse & { assets: SocAsset[]; state: SocAssetsState }>(
117 + return HttpClient.get<FlaskBaseResponse & { assets: SocCaseAsset[]; state: SocCaseAssetsState }>(
118 `/soc/assets/${caseId}`
119 )
120 },
frontend/src/components/soc/SocAlerts/SocAlertAssetsItem.vue new
+259
@@ -0,0 +1,259 @@
1 +<template>
2 + <div class="soc-asset-item">
3 + <div class="flex flex-col gap-2 px-5 py-4">
4 + <div class="header-box flex justify-between">
5 + <div class="flex items-center gap-2">
6 + <div class="id flex items-center gap-2 cursor-pointer" @click="showDetails = true">
7 + <span>#{{ asset.asset_id }} - {{ asset.asset_uuid }}</span>
8 + <Icon :name="InfoIcon" :size="16"></Icon>
9 + </div>
10 + </div>
11 + </div>
12 + <div class="main-box flex justify-between gap-4">
13 + <div class="content">
14 + <div class="title">{{ asset.asset_name }}</div>
15 + <div class="description mt-2" v-if="asset.asset_description">
16 + <template v-if="isUrl(asset.asset_description)">
17 + <a
18 + :href="asset.asset_description"
19 + class="asset-url"
20 + target="_blank"
21 + alt="asset url"
22 + rel="nofollow noopener noreferrer"
23 + >
24 + <code class="text-primary-color">
25 + <span>
26 + {{ asset.asset_description }}
27 + </span>
28 + <Icon :name="LinkIcon" :size="14" class="relative top-0.5" />
29 + </code>
30 + </a>
31 + </template>
32 + <template v-else>{{ excerpt }}</template>
33 + </div>
34 +
35 + <div class="badges-box flex flex-wrap items-center gap-3 mt-4">
36 + <Badge type="splitted" v-if="asset.date_added">
37 + <template #iconLeft>
38 + <Icon :name="ClockIcon" :size="14"></Icon>
39 + </template>
40 + <template #label>Added</template>
41 + <template #value>{{ formatDate(asset.date_added) }}</template>
42 + </Badge>
43 + <Badge type="splitted" v-if="asset.date_update">
44 + <template #iconLeft>
45 + <Icon :name="ClockIcon" :size="14"></Icon>
46 + </template>
47 + <template #label>Updated</template>
48 + <template #value>{{ formatDate(asset.date_update) }}</template>
49 + </Badge>
50 + <Badge type="active" class="cursor-pointer" @click="gotoAgentPage(asset.asset_tags)">
51 + <template #iconRight>
52 + <Icon :name="LinkIcon" :size="14"></Icon>
53 + </template>
54 + <template #label>Agent: {{ asset.asset_tags }}</template>
55 + </Badge>
56 + </div>
57 + </div>
58 + </div>
59 + </div>
60 +
61 + <n-modal
62 + v-model:show="showDetails"
63 + preset="card"
64 + content-style="padding:0px"
65 + :style="{ maxWidth: 'min(800px, 90vw)', minHeight: 'min(600px, 90vh)', overflow: 'hidden' }"
66 + :title="`Assets #${asset.asset_id} - ${asset.asset_uuid}`"
67 + :bordered="false"
68 + segmented
69 + >
70 + <n-tabs type="line" animated :tabs-padding="24">
71 + <n-tab-pane name="Info" tab="Info" display-directive="show">
72 + <div class="grid gap-2 grid-auto-flow-200 p-7 pt-4" v-if="properties">
73 + <KVCard v-for="(value, key) of properties" :key="key">
74 + <template #key>{{ key }}</template>
75 + <template #value>
76 + <template v-if="key === 'asset_tags'">
77 + <code
78 + class="cursor-pointer text-primary-color"
79 + @click="gotoAgentPage(value)"
80 + v-if="value && value !== '-'"
81 + >
82 + {{ value }}
83 + <Icon :name="LinkIcon" :size="13" class="relative top-0.5" />
84 + </code>
85 + <span v-else>-</span>
86 + </template>
87 + <template v-else>
88 + {{ value ?? "-" }}
89 + </template>
90 + </template>
91 + </KVCard>
92 + </div>
93 + </n-tab-pane>
94 + <n-tab-pane name="Type" tab="Type" display-directive="show">
95 + <div class="grid gap-2 grid-auto-flow-250 p-7 pt-4" v-if="assetType">
96 + <KVCard v-for="(value, key) of assetType" :key="key">
97 + <template #key>{{ key }}</template>
98 + <template #value>{{ value || "-" }}</template>
99 + </KVCard>
100 + </div>
101 + </n-tab-pane>
102 + <n-tab-pane name="Description" tab="Description" display-directive="show">
103 + <div class="p-7 pt-4">
104 + <template v-if="isUrl(asset.asset_description)">
105 + <a
106 + :href="asset.asset_description"
107 + class="asset-url"
108 + target="_blank"
109 + alt="asset url"
110 + rel="nofollow noopener noreferrer"
111 + >
112 + {{ asset.asset_description }}
113 + </a>
114 + </template>
115 + <template v-else>
116 + <div v-html="descriptionFull"></div>
117 + </template>
118 + </div>
119 + </n-tab-pane>
120 + </n-tabs>
121 + </n-modal>
122 + </div>
123 +</template>
124 +
125 +<script setup lang="ts">
126 +import Icon from "@/components/common/Icon.vue"
127 +import KVCard from "@/components/common/KVCard.vue"
128 +import Badge from "@/components/common/Badge.vue"
129 +import { computed, ref } from "vue"
130 +import { NModal, NTabs, NTabPane } from "naive-ui"
131 +import _omit from "lodash/omit"
132 +import dayjs from "@/utils/dayjs"
133 +import { isUrl } from "@/utils"
134 +import type { SocAlertAsset } from "@/types/soc/asset.d"
135 +import { useRouter } from "vue-router"
136 +import { useSettingsStore } from "@/stores/settings"
137 +
138 +const { asset } = defineProps<{ asset: SocAlertAsset }>()
139 +
140 +const InfoIcon = "carbon:information"
141 +const ClockIcon = "carbon:time"
142 +const LinkIcon = "carbon:launch"
143 +const router = useRouter()
144 +const showDetails = ref(false)
145 +
146 +const dFormats = useSettingsStore().dateFormat
147 +
148 +const excerpt = computed(() => {
149 + const text = asset.asset_description
150 + const truncated = text.split(" ").slice(0, 30).join(" ")
151 +
152 + return truncated + (truncated !== text ? "..." : "")
153 +})
154 +
155 +const descriptionFull = computed(() => {
156 + const text = asset.asset_description
157 +
158 + return text.replace(/\n/gim, "<br>") || "Empty"
159 +})
160 +
161 +const properties = computed(() => {
162 + const props = _omit<Record<string, any>>(asset, ["asset_description", "asset_type"])
163 + for (const key in props) {
164 + const prop = props[key]
165 + if (prop && (key === "date_added" || key === "date_update")) {
166 + props[key] = formatDate(prop, true)
167 + }
168 + }
169 + return props
170 +})
171 +
172 +const assetType = computed(() => {
173 + return asset.asset_type || {}
174 +})
175 +
176 +function gotoAgentPage(agentId: string) {
177 + router.push({ name: "Agent", params: { id: agentId } })
178 +}
179 +
180 +const formatDate = (date: string, useSec = false) => {
181 + const datejs = dayjs(date)
182 + if (!datejs.isValid()) return date
183 +
184 + return datejs.format(useSec ? dFormats.datetimesec : dFormats.datetime)
185 +}
186 +</script>
187 +
188 +<style lang="scss" scoped>
189 +.soc-asset-item {
190 + border-radius: var(--border-radius);
191 + background-color: var(--bg-secondary-color);
192 + transition: all 0.2s var(--bezier-ease);
193 + border: var(--border-small-050);
194 +
195 + .header-box {
196 + font-family: var(--font-family-mono);
197 + font-size: 13px;
198 + .id {
199 + word-break: break-word;
200 + color: var(--fg-secondary-color);
201 + line-height: 1.2;
202 +
203 + &:hover {
204 + color: var(--primary-color);
205 + }
206 + }
207 +
208 + .toggler-bookmark {
209 + &.active {
210 + color: var(--primary-color);
211 + }
212 + &:hover {
213 + color: var(--primary-color);
214 + }
215 + }
216 + .time {
217 + color: var(--fg-secondary-color);
218 +
219 + &:hover {
220 + color: var(--primary-color);
221 + }
222 + }
223 + }
224 +
225 + .main-box {
226 + word-break: break-word;
227 +
228 + .content {
229 + max-width: 100%;
230 +
231 + .description {
232 + color: var(--fg-secondary-color);
233 + font-size: 13px;
234 +
235 + .asset-url {
236 + display: block;
237 +
238 + code {
239 + padding: 8px 12px;
240 + display: flex;
241 + gap: 10px;
242 +
243 + span {
244 + white-space: nowrap;
245 + flex-grow: 1;
246 + overflow: hidden;
247 + text-overflow: ellipsis;
248 + }
249 + }
250 + }
251 + }
252 + }
253 + }
254 +
255 + &:hover {
256 + box-shadow: 0px 0px 0px 1px inset var(--primary-color);
257 + }
258 +}
259 +</style>
frontend/src/components/soc/SocAlerts/SocAlertAssetsList.vue new
+52
@@ -0,0 +1,52 @@
1 +<template>
2 + <div class="soc-assets-list">
3 + <n-spin :show="loadingAssets" style="min-height: 50px">
4 + <div v-if="assetsList?.length" class="p-7 flex flex-col gap-2">
5 + <SocAlertAssetsItem v-for="asset of assetsList" :key="asset.asset_id" :asset="asset" />
6 + </div>
7 + <template v-else>
8 + <n-empty description="No items found" class="justify-center h-48" v-if="!loadingAssets" />
9 + </template>
10 + </n-spin>
11 + </div>
12 +</template>
13 +
14 +<script setup lang="ts">
15 +import { ref } from "vue"
16 +import SocAlertAssetsItem from "./SocAlertAssetsItem.vue"
17 +import Api from "@/api"
18 +import { useMessage, NSpin, NEmpty } from "naive-ui"
19 +import type { SocAlertAsset } from "@/types/soc/asset.d"
20 +import { onBeforeMount } from "vue"
21 +
22 +const { alertId } = defineProps<{ alertId: string | number }>()
23 +
24 +const loadingAssets = ref(false)
25 +const message = useMessage()
26 +
27 +const assetsList = ref<SocAlertAsset[] | null>(null)
28 +
29 +function getAssets() {
30 + loadingAssets.value = true
31 +
32 + Api.soc
33 + .getAssetsByAlert(alertId.toString())
34 + .then(res => {
35 + if (res.data.success) {
36 + assetsList.value = res.data?.assets || null
37 + } else {
38 + message.warning(res.data?.message || "An error occurred. Please try again later.")
39 + }
40 + })
41 + .catch(err => {
42 + message.error(err.response?.data?.message || "An error occurred. Please try again later.")
43 + })
44 + .finally(() => {
45 + loadingAssets.value = false
46 + })
47 +}
48 +
49 +onBeforeMount(() => {
50 + getAssets()
51 +})
52 +</script>
frontend/src/components/soc/SocAlerts/SocAlertItem.vue
+4
@@ -288,6 +288,9 @@
288 />
289 </div>
290 </n-tab-pane>
291 + <n-tab-pane name="Assets" tab="Assets" display-directive="show:lazy">
292 + <SocAlertAssetsList v-if="alert" :alert-id="alert.alert_id" />
293 + </n-tab-pane>
294 </n-tabs>
295 </n-modal>
296 </n-spin>
@@ -306,6 +309,7 @@ import KVCard from "@/components/common/KVCard.vue"
309 import SocAlertTimeline from "./SocAlertTimeline.vue"
310 import SocAssignUser from "./SocAssignUser.vue"
311 import SocAlertItemActions from "./SocAlertItemActions.vue"
312 +import SocAlertAssetsList from "./SocAlertAssetsList.vue"
313 import "@/assets/scss/vuesjv-override.scss"
314 import Api from "@/api"
315 import {
frontend/src/components/soc/SocCases/SocCaseAssetLink.vue
+2 -2
@@ -70,11 +70,11 @@ import Api from "@/api"
70 import { useMessage, NSpin, NCollapse, NEmpty, NCollapseItem } from "naive-ui"
71 import { useSettingsStore } from "@/stores/settings"
72 import dayjs from "@/utils/dayjs"
73 -import type { SocAssetLink } from "@/types/soc/asset.d"
73 +import type { SocCaseAssetLink } from "@/types/soc/asset.d"
74 import type { SocCase } from "@/types/soc/case.d"
75 import SocCaseItem from "./SocCaseItem.vue"
76
77 -const { link } = defineProps<{ link: SocAssetLink }>()
77 +const { link } = defineProps<{ link: SocCaseAssetLink }>()
78
79 const ChevronIcon = "carbon:chevron-right"
80
frontend/src/components/soc/SocCases/SocCaseAssetsItem.vue
+68 -18
@@ -12,7 +12,25 @@
12 <div class="main-box flex justify-between gap-4">
13 <div class="content">
14 <div class="title" v-html="asset.asset_name"></div>
15 - <div class="description mt-2" v-if="asset.asset_description">{{ excerpt }}</div>
15 + <div class="description mt-2" v-if="asset.asset_description">
16 + <template v-if="isUrl(asset.asset_description)">
17 + <a
18 + :href="asset.asset_description"
19 + class="asset-url"
20 + target="_blank"
21 + alt="asset url"
22 + rel="nofollow noopener noreferrer"
23 + >
24 + <code class="text-primary-color">
25 + <span>
26 + {{ asset.asset_description }}
27 + </span>
28 + <Icon :name="LinkIcon" :size="14" class="relative top-0.5" />
29 + </code>
30 + </a>
31 + </template>
32 + <template v-else>{{ excerpt }}</template>
33 + </div>
34
35 <div class="badges-box flex flex-wrap items-center gap-3 mt-4">
36 <Badge type="splitted">
@@ -52,16 +70,20 @@
70 </n-tab-pane>
71 <n-tab-pane name="Description" tab="Description" display-directive="show">
72 <div class="p-7 pt-4">
55 - <n-input
56 - :value="asset.asset_description"
57 - type="textarea"
58 - readonly
59 - placeholder="Empty"
60 - :autosize="{
61 - minRows: 3,
62 - maxRows: 10
63 - }"
64 - />
73 + <template v-if="isUrl(asset.asset_description)">
74 + <a
75 + :href="asset.asset_description"
76 + class="asset-url"
77 + target="_blank"
78 + alt="asset url"
79 + rel="nofollow noopener noreferrer"
80 + >
81 + {{ asset.asset_description }}
82 + </a>
83 + </template>
84 + <template v-else>
85 + <div v-html="descriptionFull"></div>
86 + </template>
87 </div>
88 </n-tab-pane>
89 <n-tab-pane name="Link" tab="Link" display-directive="show:lazy">
@@ -87,15 +109,17 @@ import KVCard from "@/components/common/KVCard.vue"
109 import Badge from "@/components/common/Badge.vue"
110 import SocCaseAssetLink from "./SocCaseAssetLink.vue"
111 import { computed, ref } from "vue"
90 -import { NModal, NTabs, NTabPane, NInput } from "naive-ui"
112 +import { NModal, NTabs, NTabPane, NEmpty } from "naive-ui"
113 +import { isUrl } from "@/utils"
114 import _omit from "lodash/omit"
115 import _split from "lodash/split"
116 import _upperFirst from "lodash/upperFirst"
94 -import type { SocAsset } from "@/types/soc/asset.d"
117 +import type { SocCaseAsset } from "@/types/soc/asset.d"
118
96 -const { asset } = defineProps<{ asset: SocAsset }>()
119 +const { asset } = defineProps<{ asset: SocCaseAsset }>()
120
121 const InfoIcon = "carbon:information"
122 +const LinkIcon = "carbon:launch"
123
124 const showDetails = ref(false)
125
@@ -106,6 +130,12 @@ const excerpt = computed(() => {
130 return truncated + (truncated !== text ? "..." : "")
131 })
132
133 +const descriptionFull = computed(() => {
134 + const text = asset.asset_description
135 +
136 + return text.replace(/\n/gim, "<br>") || "Empty"
137 +})
138 +
139 const tags = computed<{ key: string; value?: string }[]>(() => {
140 if (!asset?.asset_tags) {
141 return []
@@ -167,10 +197,30 @@ const properties = computed(() => {
197
198 .main-box {
199 word-break: break-word;
170 -
171 - .description {
172 - color: var(--fg-secondary-color);
173 - font-size: 13px;
200 + .content {
201 + max-width: 100%;
202 +
203 + .description {
204 + color: var(--fg-secondary-color);
205 + font-size: 13px;
206 +
207 + .asset-url {
208 + display: block;
209 +
210 + code {
211 + padding: 8px 12px;
212 + display: flex;
213 + gap: 10px;
214 +
215 + span {
216 + white-space: nowrap;
217 + flex-grow: 1;
218 + overflow: hidden;
219 + text-overflow: ellipsis;
220 + }
221 + }
222 + }
223 + }
224 }
225 }
226
frontend/src/components/soc/SocCases/SocCaseAssetsList.vue
+3 -3
@@ -28,7 +28,7 @@ import Api from "@/api"
28 import { useMessage, NSpin, NEmpty } from "naive-ui"
29 import { useSettingsStore } from "@/stores/settings"
30 import dayjs from "@/utils/dayjs"
31 -import type { SocAsset, SocAssetsState } from "@/types/soc/asset.d"
31 +import type { SocCaseAsset, SocCaseAssetsState } from "@/types/soc/asset.d"
32 import { onBeforeMount } from "vue"
33
34 const { caseId } = defineProps<{ caseId: string | number }>()
@@ -36,8 +36,8 @@ const { caseId } = defineProps<{ caseId: string | number }>()
36 const loadingAssets = ref(false)
37 const message = useMessage()
38
39 -const assetsList = ref<SocAsset[] | null>(null)
40 -const assetsState = ref<SocAssetsState | null>(null)
39 +const assetsList = ref<SocCaseAsset[] | null>(null)
40 +const assetsState = ref<SocCaseAssetsState | null>(null)
41
42 const dFormats = useSettingsStore().dateFormat
43
frontend/src/types/soc/asset.d.ts
+33 -4
@@ -1,4 +1,4 @@
1 -export interface SocAsset {
1 +export interface SocCaseAsset {
2 analysis_status: string
3 analysis_status_id: number
4 asset_compromise_status_id: number
@@ -14,14 +14,14 @@ export interface SocAsset {
14 asset_type_id: number
15 asset_uuid: string
16 ioc_links: null | string
17 - link: SocAssetLink[]
17 + link: SocCaseAssetLink[]
18 }
19 type DateDay = number
20 type DateMonth = number
21 type DateYear = number
22 type DayFormatted = `${DateYear}-${DateMonth}-${DateDay}`
23
24 -export interface SocAssetLink {
24 +export interface SocCaseAssetLink {
25 case_name: string
26 case_open_date: DayFormatted
27 asset_description: string
@@ -30,7 +30,36 @@ export interface SocAssetLink {
30 case_id: number
31 }
32
33 -export interface SocAssetsState {
33 +export interface SocCaseAssetsState {
34 object_last_update: string | Date
35 object_state: number
36 }
37 +
38 +export interface SocAlertAsset {
39 + analysis_status_id?: number
40 + asset_compromise_status_id?: string
41 + asset_description: string
42 + asset_domain?: string
43 + asset_enrichment?: string
44 + asset_id: number
45 + asset_info?: string
46 + asset_ip: string
47 + asset_name: string
48 + asset_tags: string
49 + asset_type_id: number
50 + asset_type: SocAlertAssetType
51 + asset_uuid: string
52 + case_id?: number
53 + custom_attributes?: string
54 + date_added?: string
55 + date_update?: string
56 + user_id?: number
57 +}
58 +
59 +export interface SocAlertAssetType {
60 + asset_id: number
61 + asset_icon_compromised: string
62 + asset_name: string
63 + asset_icon_not_compromised: string
64 + asset_description: string
65 +}
frontend/src/utils/index.ts
+5
@@ -28,6 +28,11 @@ export const isMobile = () => {
28 return detectMobile
29 }
30
31 +export const isUrl = (text: string) => {
32 + const urlPattern = new RegExp("^(https?:\\/\\/)", "i")
33 + return urlPattern.test(text)
34 +}
35 +
36 export function renderIcon(icon: Component | string) {
37 if (typeof icon === "string") {
38 return () => h(Icon, { name: icon })
frontend/vite.config.mts
+44 -40
@@ -1,5 +1,5 @@
1 import { fileURLToPath, URL } from "node:url"
2 -import { defineConfig } from "vite"
2 +import { defineConfig, loadEnv } from "vite"
3 import vue from "@vitejs/plugin-vue"
4 import vueJsx from "@vitejs/plugin-vue-jsx"
5 import svgLoader from "vite-svg-loader"
@@ -8,45 +8,49 @@ import fs from "fs"
8 // import { analyzer } from "vite-bundle-analyzer"
9
10 // https://vitejs.dev/config/
11 -export default defineConfig({
12 - plugins: [
13 - vue({
14 - script: {
15 - defineModel: true,
16 - propsDestructure: true
11 +export default (args: any) => {
12 + process.env = { ...process.env, ...loadEnv(args.mode, process.cwd()) }
13 +
14 + return defineConfig({
15 + plugins: [
16 + vue({
17 + script: {
18 + defineModel: true,
19 + propsDestructure: true
20 + }
21 + }),
22 + vueJsx(),
23 + svgLoader(),
24 + Components({
25 + dirs: ["src/components/cards"],
26 + dts: "src/unplugin.components.d.ts"
27 + })
28 + // uncomment to enable analyzer after build
29 + // analyzer()
30 + ],
31 + resolve: {
32 + alias: {
33 + "@": fileURLToPath(new URL("./src", import.meta.url))
34 }
18 - }),
19 - vueJsx(),
20 - svgLoader(),
21 - Components({
22 - dirs: ["src/components/cards"],
23 - dts: "src/unplugin.components.d.ts"
24 - })
25 - // uncomment to enable analyzer after build
26 - // analyzer()
27 - ],
28 - resolve: {
29 - alias: {
30 - "@": fileURLToPath(new URL("./src", import.meta.url))
31 - }
32 - },
33 - optimizeDeps: {
34 - include: ["fast-deep-equal"]
35 - },
36 - server: {
37 - https:
38 - fs.existsSync("/certs/key.pem") && fs.existsSync("/certs/cert.pem")
39 - ? {
40 - key: fs.readFileSync("/certs/key.pem"),
41 - cert: fs.readFileSync("/certs/cert.pem")
42 - }
43 - : false,
44 - proxy: {
45 - "/api": {
46 - target: "http://copilot-backend:5000",
47 - //target: "http://127.0.0.1:5000", // for local development
48 - changeOrigin: true
35 + },
36 + optimizeDeps: {
37 + include: ["fast-deep-equal"]
38 + },
39 + server: {
40 + https:
41 + fs.existsSync("/certs/key.pem") && fs.existsSync("/certs/cert.pem")
42 + ? {
43 + key: fs.readFileSync("/certs/key.pem"),
44 + cert: fs.readFileSync("/certs/cert.pem")
45 + }
46 + : undefined,
47 + proxy: {
48 + "/api": {
49 + target: "http://copilot-backend:5000",
50 + //target: process.env.VITE_API_URL, // for local development
51 + changeOrigin: true
52 + }
53 }
54 }
51 - }
52 -})
55 + })
56 +}