added ioc search to mkdocs
Taylor committed
Jul 18, 2023 at 12:06 UTC
e632eb7404a41f21bf25f7c27a9996055385e24f
1 file changed
+52
backend/docs/wazuhindexer.md
+52
@@ -218,6 +218,58 @@ Overall, this module is used to facilitate the interaction between the applicati
218
219
::: app.services.WazuhIndexer.index
220
221
+### <span style="color:red">IoC Search Services</span>
222
+
223
+This Python script contains a class `IocSearchService` which is used to search for Indicators of Compromise (IoCs) within data indexed by Wazuh. Wazuh is an open-source security detection, visibility, and compliance project.
224
+
225
+Below is a detailed description of the `IocSearchService` class and its methods:
226
+
227
+Class Initialization (`__init__`):
228
+During initialization, the class fetches Wazuh-Indexer details and establishes a connection to Elasticsearch.
229
+
230
+`is_index_skipped (is_index_skipped)`:
231
+This method checks whether a given index name should be skipped based on a predefined list of indices.
232
+
233
+`is_valid_index (is_valid_index)`:
234
+This method verifies if an index name starts with "wazuh\_" and is not in the list of skipped indices.
235
+
236
+`_collect_indices_and_validate (_collect_indices_and_validate)`:
237
+This method collects all indices and validates the connector details.
238
+
239
+`search_ioc (search_ioc)`:
240
+This method is used to search for IoCs from a given field name within a specified time range. It collects and validates the indices, then collects the IoCs.
241
+
242
+`_error_response (_error_response)`:
243
+This method standardizes the format of the error response.
244
+
245
+`is_invalid_domain_name (is_invalid_domain_name)`:
246
+This method checks if the given field value is an internal domain name.
247
+
248
+`is_valid_ipv4 (is_valid_ipv4)`:
249
+This method checks if the given field value is a valid IPv4 address.
250
+
251
+`is_valid_md5 (is_valid_md5)`:
252
+This method checks if the given field value is a valid MD5 hash.
253
+
254
+`is_valid_sha256 (is_valid_sha256)`:
255
+This method checks if the given field value is a valid SHA256 hash.
256
+
257
+`is_valid_domain_name (is_valid_domain_name)`:
258
+This method checks if the given field value is a valid domain name.
259
+
260
+`_collect_iocs (_collect_iocs)`:
261
+This method builds an Elasticsearch query to retrieve all values of a given field and index to invoke the IoC service for checking if the value is malicious.
262
+
263
+`_filter_and_enrich_alerts (_filter_and_enrich_alerts)`:
264
+This method filters out invalid domain names and enriches the alerts with `socfortress_threat_intel`.
265
+
266
+`_build_query (_build_query)`:
267
+This method builds the Elasticsearch query to retrieve all values of a given field.
268
+
269
+This class is primarily designed to work with a service like `SocfortressThreatIntel`, and it interfaces with Elasticsearch to search for threat indicators across various indices. The class provides a high level of abstraction for interacting with Wazuh-Indexer and `SocfortressThreatIntel` services, allowing users to easily retrieve and filter IoCs.
270
+
271
+::: app.services.WazuhIndexer.ioc_search
272
+
273
### <span style="color:red">Universal Services</span>
274
275
::: app.services.WazuhIndexer.universal