def hardening_policy(self, hp_path): """Populate Hardening Policies""" print("[*] Populating Hardening Policies...") if hp_path: hp_list = glob.glob(hp_path + '*.yml') else: hp_dir = ATCconfig.get('hardening_policies_directory') hp_list = glob.glob(hp_dir + '/*.yml') for hp_file in hp_list: try: hp = HardeningPolicy(hp_file) hp.render_template("confluence") confluence_data = { "title": hp.hp_parsed_file["title"], "spacekey": self.space, "parentid": str(ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Hardening Policies")), "confluencecontent": hp.content, } res = ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: HP '" + hp.hp_parsed_file['title'] + "'") except Exception as err: print(hp_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("[+] Hardening Policies populated!")
def mitigation_policy(self, mp_path): """Populate Mitigation Policies""" print("[*] Populating Mitigation Policies...") if mp_path: mp_list = glob.glob(mp_path + '*.yml') else: mp_dir = ATCconfig.get('mitigation_policies_directory') mp_list = glob.glob(mp_dir + '/*.yml') for mp_file in mp_list: try: mp = MitigationPolicy(mp_file, apipath=self.apipath, auth=self.auth, space=self.space) mp.render_template("confluence") confluence_data = { "title": mp.mp_parsed_file["title"], "spacekey": self.space, "parentid": str(ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Mitigation Policies")), "confluencecontent": mp.content, } res = ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: MP '" + mp.mp_parsed_file['title'] + "'") except Exception as err: print(mp_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("[+] Mitigation Policies populated!")
def data_needed(self, dn_path): """Desc""" print("[*] Populating Data Needed...") if dn_path: dn_list = glob.glob(dn_path + '*.yml') else: dn_dir = ATCconfig.get('data_needed_dir') dn_list = glob.glob(dn_dir + '/*.yml') for dn_file in dn_list: try: dn = DataNeeded(dn_file, apipath=self.apipath, auth=self.auth, space=self.space) dn.render_template("confluence") confluence_data = { "title": dn.dn_fields["title"], "spacekey": self.space, "parentid": str(ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Data Needed")), "confluencecontent": dn.content, } res = ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: DN '" + dn.dn_fields['title'] + "'") # print("Done: ", dn.dn_fields['title']) except Exception as err: print(dn_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("[+] Data Needed populated!")
def logging_policy(self, lp_path): """Desc""" print("[*] Populating Logging Policies...") if lp_path: lp_list = glob.glob(lp_path + '*.yml') else: lp_dir = ATCconfig.get('logging_policies_dir') lp_list = glob.glob(lp_dir + '/*.yml') for lp_file in lp_list: try: lp = LoggingPolicy(lp_file) lp.render_template("confluence") confluence_data = { "title": lp.fields["title"], "spacekey": self.space, "parentid": str(ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Logging Policies")), "confluencecontent": lp.content, } res = ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: LP '" + lp.fields['title'] + "'") # print("Done: ", lp.fields['title']) except Exception as err: print(lp_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("[+] Logging Policies populated!")
def render_template(self, template_type): """Description template_type: - "confluence" """ if template_type not in ["confluence"]: raise Exception("Bad template_type. Available value:" + " \"confluence\"]") # Get proper template template = env.get_template( 'confluence_responseaction_template.html.j2') new_title = self.ra_parsed_file.get('id')\ + ": "\ + ATCutils.normalize_react_title(self.ra_parsed_file.get('title')) self.ra_parsed_file.update({'title': new_title}) self.ra_parsed_file.update({ 'confluence_viewpage_url': ATCconfig.get('confluence_viewpage_url') }) ## ## Add link to a stage ## stage = self.ra_parsed_file.get('stage') rs_list = [] for rs_id, rs_name in rs_mapping.items(): if ATCutils.normalize_rs_name(stage) == rs_name: if self.apipath and self.auth and self.space: rs_confluence_page_id = str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, rs_name)) rs_list.append((rs_id, rs_name, rs_confluence_page_id)) else: rs_confluence_page_id = "" rs_list.append((rs_id, rs_name, rs_confluence_page_id)) break self.ra_parsed_file.update({'stage': rs_list}) # Category self.ra_parsed_file.update({ 'category': ATCutils.get_ra_category(self.ra_parsed_file.get('id')) }) self.ra_parsed_file.update( {'description': self.ra_parsed_file.get('description').strip()}) self.ra_parsed_file.update( {'workflow': self.ra_parsed_file.get('workflow')}) self.content = template.render(self.ra_parsed_file)
def render_template(self, template_type): """Description template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception("Bad template_type. Available values:" + " [\"markdown\", \"confluence\"]") # Point to the templates directory env = Environment(loader=FileSystemLoader('templates')) # Get proper template if template_type == "markdown": template = env.get_template( 'markdown_responseaction_template.md.j2') self.ra_parsed_file.update({ 'description': self.ra_parsed_file.get('description').strip() }) elif template_type == "confluence": template = env.get_template( 'confluence_responseaction_template.html.j2') self.ra_parsed_file.update({ 'confluence_viewpage_url': ATCconfig.get('confluence_viewpage_url') }) linked_ra = self.ra_parsed_file.get("linked_ra") if linked_ra: linked_ra_with_id = [] for ra in linked_ra: if self.apipath and self.auth and self.space: linked_ra_id = str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, ra)) else: linked_ra_id = "" ra = (ra, linked_ra_id) linked_ra_with_id.append(ra) self.ra_parsed_file.update({'linkedra': linked_ra_with_id}) self.ra_parsed_file.update({ 'description': self.ra_parsed_file.get('description').strip() }) self.ra_parsed_file.update( {'workflow': self.ra_parsed_file.get('workflow') + ' \n\n.'}) self.content = template.render(self.ra_parsed_file)
def detection_rule(self, dr_path): """Desc""" print("Populating Detection Rules..") if dr_path: dr_list = glob.glob(dr_path + '*.yml') else: dr_dirs = ATCconfig.get('detection_rules_directories') # check if config provides multiple directories for detection rules if isinstance(dr_dirs, list): dr_list = [] for directory in dr_dirs: dr_list += glob.glob(directory + '/*.yml') elif isinstance(dr_dirs, str): dr_list = glob.glob(dr_dirs + '/*.yml') for dr_file in dr_list: try: dr = DetectionRule(dr_file, apipath=self.apipath, auth=self.auth, space=self.space) dr.render_template("confluence") confluence_data = { "title": dr.fields['title'], "spacekey": self.space, "parentid": str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Detection Rules")), "confluencecontent": dr.content, } res = ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: DR '" + dr.fields['title'] + "' (" + dr_file + ")") # print("Done: ", dr.fields['title']) except Exception as err: print(dr_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("Detection Rules populated!")
def response_playbook(self, rp_path): """Nothing here yet""" print("Populating Response Playbooks..") if rp_path: rp_list = glob.glob(rp_path + '*.yml') else: rp_dir = ATCconfig.get('response_playbooks_dir') rp_list = glob.glob(rp_dir + '/*.yml') for rp_file in rp_list: try: rp = ResponsePlaybook(rp_file, apipath=self.apipath, auth=self.auth, space=self.space) rp.render_template("confluence") base = os.path.basename(rp_file) confluence_data = { "title": rp.rp_parsed_file['title'], "spacekey": self.space, "parentid": str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Response Playbooks")), "confluencecontent": rp.content, } res = ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: RP '" + base + "'") # print("Done: ", rp.rp_parsed_file['title']) except Exception as err: print(rp_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("Response Playbooks populated!")
def enrichment(self, en_path): """Nothing here yet""" print("Populating Enrichments..") if en_path: en_list = glob.glob(en_path + '*.yml') else: en_dir = ATCconfig.get('enrichments_directory') en_list = glob.glob(en_dir + '/*.yml') for en_file in en_list: try: en = Enrichment(en_file, apipath=self.apipath, auth=self.auth, space=self.space) en.render_template("confluence") confluence_data = { "title": en.en_parsed_file['title'], "spacekey": self.space, "parentid": str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Enrichments")), "confluencecontent": en.content, } res = ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: EN '" + en.en_parsed_file['title'] + "'") # print("Done: ", en.en_parsed_file['title']) except Exception as err: print(en_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("Enrichments populated!")
def customer(self, cu_path): """Nothing here yet""" print("Populating Customers..") if cu_path: cu_list = glob.glob(cu_path + '*.yml') else: cu_dir = ATCconfig.get('customers_directory') cu_list = glob.glob(cu_dir + '/*.yml') for cu_file in cu_list: try: cu = Customer(cu_file, apipath=self.apipath, auth=self.auth, space=self.space) cu.render_template("confluence") confluence_data = { "title": cu.customer_name, "spacekey": self.space, "parentid": str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Customers")), "confluencecontent": cu.content, } res = ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: CU '" + cu.customer_name + "'") # print("Done: ", cu.title) except Exception as err: print(cu_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("Customers populated!")
def triggers(self, tg_path): """Populate Triggers""" print("Populating Triggers..") if tg_path: tg_list = glob.glob(tg_path + '*.yml') else: tg_list = glob.glob( ATCconfig.get("triggers_directory") + '/T*/*.yaml') for tg_file in tg_list: try: tg = Triggers(tg_file) tg.render_template("confluence") title = tg.fields["attack_technique"] + ": " + \ te_mapping.get(tg.fields["attack_technique"]) confluence_data = { "title": title, "spacekey": self.space, "parentid": str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Triggers")), "confluencecontent": tg.content, } res = ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: TR '" + title + "'") # print("Done: ", tg.fields["attack_technique"]) except Exception as err: print(tg_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("Triggers populated!")
def response_action(self, ra_path): """Nothing here yet""" print("Populating Response Actions..") if ra_path: ra_list = glob.glob(ra_path + '*.yml') else: ra_list = glob.glob('../response_actions/*.yml') for ra_file in ra_list: try: ra = ResponseAction(ra_file, apipath=self.apipath, auth=self.auth, space=self.space) ra.render_template("confluence") confluence_data = { "title": ra.ra_parsed_file['title'], "spacekey": self.space, "parentid": str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Response Actions")), "confluencecontent": ra.content, } ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) # print("Done: ", ra.ra_parsed_file['title']) except Exception as err: print(ra_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("Response Actions populated!")
def detection_rule(self, dr_path): """Desc""" print("Populating Detection Rules..") if dr_path: dr_list = glob.glob(dr_path + '*.yml') else: dr_list = glob.glob( ATCconfig.get('detection_rules_directory') + '/*.yml') for dr_file in dr_list: try: dr = DetectionRule(dr_file, apipath=self.apipath, auth=self.auth, space=self.space) dr.render_template("confluence") confluence_data = { "title": dr.fields['title'], "spacekey": self.space, "parentid": str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Detection Rules")), "confluencecontent": dr.content, } ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) print("Done: ", dr.fields['title']) except Exception as err: print(dr_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("Detection Rules populated!")
def mitigation_system(self, ms_path): """Populate Mitigation Systems""" print("Populating Mitigation Systems..") if ms_path: ms_list = glob.glob(ms_path + '*.yml') else: ms_dir = ATCconfig.get('mitigation_systems_directory') ms_list = glob.glob(ms_dir + '/*.yml') for ms_file in ms_list: try: ms = MitigationSystem(ms_file) ms.render_template("confluence") confluence_data = { "title": ms.ms_parsed_file["title"], "spacekey": self.space, "parentid": str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Mitigation Systems")), "confluencecontent": ms.content, } ATCutils.push_to_confluence(confluence_data, self.apipath, self.auth) except Exception as err: print(ms_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("Mitigation Systems populated!")
def render_template(self, template_type): """Description template_type: - "markdown" - "confluence" """ if template_type not in ["confluence"]: raise Exception("Bad template_type. Available values:" + " \"confluence\"]") # Point to the templates directory env = Environment(loader=FileSystemLoader('templates')) template = env.get_template( 'confluence_responseplaybook_template.html.j2') new_title = self.rp_parsed_file.get('id')\ + ": "\ + ATCutils.normalize_react_title(self.rp_parsed_file.get('title')) self.rp_parsed_file.update({'title': new_title}) self.rp_parsed_file.update({ 'confluence_viewpage_url': ATCconfig.get('confluence_viewpage_url') }) # MITRE ATT&CK Tactics and Techniques tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{1,5}$') # AM!TT Tactics and Techniques amitt_tactic = [] amitt_tactic_re = re.compile(r'amitt\.\w\D+$') amitt_technique = [] amitt_technique_re = re.compile(r'amitt\.t\d{1,5}$') other_tags = [] for tag in self.rp_parsed_file.get('tags'): if tactic_re.match(tag): tactic.append(ta_mapping.get(tag)) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) elif amitt_tactic_re.match(tag): amitt_tactic.append(amitt_tactic_mapping.get(tag)) elif amitt_technique_re.match(tag): te = tag.upper()[6:] amitt_technique.append((amitt_technique_mapping.get(te), te)) else: other_tags.append(tag) # Add MITRE ATT&CK Tactics and Techniques to J2 self.rp_parsed_file.update({'tactics': tactic}) self.rp_parsed_file.update({'techniques': technique}) # Add AM!TT Tactics and Techniques to J2 self.rp_parsed_file.update({'amitt_tactics': amitt_tactic}) self.rp_parsed_file.update({'amitt_techniques': amitt_technique}) self.rp_parsed_file.update({'other_tags': other_tags}) # get links to response action preparation = [] identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] detect = [] deny = [] disrupt = [] degrade = [] deceive = [] destroy = [] deter = [] stages = [('preparation', preparation), ('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned), ('detect', detect), ('deny', deny), ('disrupt', disrupt), ('degrade', degrade), ('deceive', deceive), ('destroy', destroy), ('deter', deter)] for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = ATCutils.read_yaml_file( ATCconfig.get('response_actions_dir') + '/' + task + '.yml') action_title = action.get('id')\ + ": "\ + ATCutils.normalize_react_title(action.get('title')) if self.apipath and self.auth and self.space: stage_list.append((action_title, str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, action_title)))) else: stage_list.append((action_title, "")) except TypeError: pass # change stages name to more pretty format stages = [(stage_name.replace('_', ' ').capitalize(), stage_list) for stage_name, stage_list in stages] self.rp_parsed_file.update({'stages_with_id': stages}) # get descriptions for response actions preparation = [] identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] detect = [] deny = [] disrupt = [] degrade = [] deceive = [] destroy = [] deter = [] stages = [('preparation', preparation), ('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned), ('detect', detect), ('deny', deny), ('disrupt', disrupt), ('degrade', degrade), ('deceive', deceive), ('destroy', destroy), ('deter', deter)] # grab workflow per action in each IR stages # error handling for playbooks with empty stages for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = ATCutils.read_yaml_file( ATCconfig.get('response_actions_dir') + '/' + task + '.yml') stage_list.append( (action.get('description'), action.get('workflow'))) except TypeError: pass # change stages name to more pretty format stages = [(stage_name.replace('_', ' ').capitalize(), stage_list) for stage_name, stage_list in stages] self.rp_parsed_file.update({'stages': stages}) self.rp_parsed_file.update( {'workflow': self.rp_parsed_file.get('workflow')}) self.rp_parsed_file.update( {'description': self.rp_parsed_file.get('description').strip()}) # Render self.content = template.render(self.rp_parsed_file)
def render_template(self, template_type): """Description template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception( "Bad template_type. Available values:" + " [\"markdown\", \"confluence\"]") # Point to the templates directory env = Environment(loader=FileSystemLoader('templates')) # Get proper template if template_type == "markdown": template = env.get_template('markdown_enrichments_template.md.j2') self.en_parsed_file.update( {'description': self.en_parsed_file .get('description').strip()} ) elif template_type == "confluence": template = env.get_template( 'confluence_enrichments_template.html.j2' ) self.en_parsed_file.update( {'confluence_viewpage_url': ATCconfig.get('confluence_viewpage_url')}) data_needed = self.en_parsed_file.get('data_needed') if data_needed: data_needed_with_id = [] for dn in data_needed: data_needed_id = str(ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, dn) ) dn = (dn, data_needed_id) data_needed_with_id.append(dn) self.en_parsed_file.update( {'data_needed': data_needed_with_id} ) data_to_enrich = self.en_parsed_file.get('data_to_enrich') if data_to_enrich: data_to_enrich_with_id = [] for de in data_to_enrich: data_to_enrich_id = str(ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, de) ) de = (de, data_to_enrich_id) data_to_enrich_with_id.append(de) self.en_parsed_file.update( {'data_to_enrich': data_to_enrich_with_id} ) requirements = self.en_parsed_file.get('requirements') if requirements: requirements_with_id = [] for req in requirements: requirements_id = str(ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, req) ) req = (req, requirements_id) requirements_with_id.append(req) self.en_parsed_file.update( {'requirements': requirements_with_id} ) self.en_parsed_file.update( {'description': self.en_parsed_file .get('description').strip()} ) # Render self.content = template.render(self.en_parsed_file)
def render_template(self, template_type): """Description template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception("Bad template_type. Available values:" + " [\"markdown\", \"confluence\"]") # Point to the templates directory env = Environment(loader=FileSystemLoader('templates')) # Get proper template if template_type == "markdown": template = env\ .get_template('markdown_dataneeded_template.md.j2') logging_policies = self.dn_fields.get("loggingpolicy") if isinstance(logging_policies, str): logging_policies = [logging_policies] refs = self.dn_fields.get("references") self.dn_fields.update({'loggingpolicy': logging_policies}) self.dn_fields.update( {'description': self.dn_fields.get('description').strip()}) if isinstance(refs, str): self.dn_fields.update({'references': [refs]}) elif template_type == "confluence": template = env\ .get_template('confluence_dataneeded_template.html.j2') self.dn_fields.update({ 'confluence_viewpage_url': ATCconfig.get('confluence_viewpage_url') }) self.dn_fields.update( {'description': self.dn_fields.get('description').strip()}) logging_policies = self.dn_fields.get("loggingpolicy") if not logging_policies: logging_policies = [ "None", ] logging_policies_with_id = [] for lp in logging_policies: if lp != "None" and self.apipath and self.auth and self.space: logging_policies_id = str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, lp)) else: logging_policies_id = "" lp = (lp, logging_policies_id) logging_policies_with_id.append(lp) refs = self.dn_fields.get("references") if isinstance(refs, str): self.dn_fields.update({'references': [refs]}) self.dn_fields.update({'loggingpolicy': logging_policies_with_id}) self.content = template.render(self.dn_fields) return True
def render_template(self, template_type): """Render template with data in it template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception("Bad template_type. Available values: " + "[\"markdown\", \"confluence\"]") # Point to the templates directory env = Environment(loader=FileSystemLoader('templates')) # Get proper template if template_type == "markdown": template = env.get_template('markdown_alert_template.md.j2') # Read raw sigma rule sigma_rule = ATCutils.read_rule_file(self.yaml_file) # Put raw sigma rule into fields var self.fields.update({'sigma_rule': sigma_rule}) # Define which queries we want from Sigma #queries = ["es-qs", "xpack-watcher", "graylog", "splunk", "logpoint", "grep", "fieldlist"] queries = ATCconfig.get('detection_queries').split(",") # dict to store query key + query values det_queries = {} # Convert sigma rule into queries (for instance, graylog query) for query in queries: # prepare command to execute from shell # (yes, we know) cmd = ATCconfig.get('sigmac_path') + " --shoot-yourself-in-the-foot -t " + \ query + " --ignore-backend-errors " + self.yaml_file #query + " --ignore-backend-errors " + self.yaml_file + \ #" 2> /dev/null" p = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True) (query2, err) = p.communicate() # Wait for date to terminate. Get return returncode # p_status = p.wait() p.wait() """ Had to remove '-' due to problems with Jinja2 variable naming, e.g es-qs throws error 'no es variable' """ det_queries[query] = str(query2)[2:-3] # Update detection rules self.fields.update({"det_queries": det_queries}) self.fields.update({"queries": queries}) # Data Needed data_needed = ATCutils.main_dn_calculatoin_func(self.yaml_file) # if there is only 1 element in the list, print it as a string, # without quotes # if isistance(data_needed, list) and len(data_needed) == 1: # [data_needed] = data_needed # print("%s || Dataneeded: \n%s\n" % # (self.fields.get("title"), data_needed)) self.fields.update({'data_needed': data_needed}) # Enrichments enrichments = self.fields.get("enrichment") if isinstance(enrichments, str): enrichments = [enrichments] self.fields.update({'enrichment': enrichments}) tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{1,5}$') other_tags = [] if self.fields.get('tags'): for tag in self.fields.get('tags'): if tactic_re.match(tag): if ta_mapping.get(tag): tactic.append(ta_mapping.get(tag)) else: other_tags.append(tag) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) else: other_tags.append(tag) if not tactic_re.match(tag) and not \ technique_re.match(tag): other_tags.append(tag) if len(tactic): self.fields.update({'tactics': tactic}) if len(technique): self.fields.update({'techniques': technique}) if len(other_tags): self.fields.update({'other_tags': other_tags}) triggers = [] for trigger in technique: if trigger is "None": continue try: triggers.append(trigger) except FileNotFoundError: print(trigger + ": No atomics trigger for this technique") """ triggers.append( trigger + ": No atomics trigger for this technique" ) """ self.fields.update( {'description': self.fields.get('description').strip()}) self.fields.update({'triggers': triggers}) elif template_type == "confluence": template = env.get_template('confluence_alert_template.html.j2') self.fields.update({ 'confluence_viewpage_url': ATCconfig.get('confluence_viewpage_url') }) sigma_rule = ATCutils.read_rule_file(self.yaml_file) self.fields.update({'sigma_rule': sigma_rule}) outputs = ["es-qs", "xpack-watcher", "graylog"] for output in outputs: cmd = ATCconfig.get('sigmac_path') + " -t " + \ output + " --ignore-backend-errors " + self.yaml_file + \ " 2> /dev/null" p = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True) (query, err) = p.communicate() # Wait for date to terminate. Get return returncode ## # p_status = p.wait() p.wait() # have to remove '-' due to problems with # Jinja2 variable naming,e.g es-qs throws error # 'no es variable' self.fields.update({output.replace("-", ""): str(query)[2:-3]}) # Data Needed data_needed = ATCutils.main_dn_calculatoin_func(self.yaml_file) data_needed_with_id = [] for data in data_needed: data_needed_id = str( ATCutils.confluence_get_page_id(self.apipath, self.auth, self.space, data)) data = (data, data_needed_id) data_needed_with_id.append(data) self.fields.update({'data_needed': data_needed_with_id}) # Enrichments enrichments = self.fields.get("enrichment") enrichments_with_page_id = [] if isinstance(enrichments, str): enrichments = [enrichments] if enrichments: for enrichment_name in enrichments: enrichment_page_id = str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, enrichment_name)) enrichment_data = (enrichment_name, enrichment_page_id) enrichments_with_page_id.append(enrichment_data) self.fields.update({'enrichment': enrichments_with_page_id}) tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{1,5}$') other_tags = [] if self.fields.get('tags'): for tag in self.fields.get('tags'): if tactic_re.match(tag): if ta_mapping.get(tag): tactic.append(ta_mapping.get(tag)) else: other_tags.append(tag) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) else: other_tags.append(tag) if not tactic_re.match(tag) and not \ technique_re.match(tag): other_tags.append(tag) if len(tactic): self.fields.update({'tactics': tactic}) if len(technique): self.fields.update({'techniques': technique}) if len(other_tags): self.fields.update({'other_tags': other_tags}) triggers = [] for trigger_name, trigger_id in technique: if trigger_id is "None": continue try: page_name = trigger_id + ": " + trigger_name trigger_page_id = str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, page_name)) trigger = (trigger_name, trigger_id, trigger_page_id) triggers.append(trigger) except FileNotFoundError: print(trigger + ": No atomics trigger for this technique") self.fields.update({'triggers': triggers}) self.content = template.render(self.fields) # Need to convert ampersand into HTML "save" format # Otherwise confluence throws an error # self.content = self.content.replace("&", "&") # Done in the template itself return True
def main(c_auth=None): try: ATCconfig = ATCutils.load_config("config.yml") confluence_space_name = ATCconfig.get('confluence_space_name') confluence_space_home_page_name = ATCconfig.get( 'confluence_space_home_page_name') confluence_rest_api_url = ATCconfig.get('confluence_rest_api_url') confluence_name_of_root_directory = ATCconfig.get( 'confluence_name_of_root_directory') except Exception as e: raise e pass if not c_auth: mail = input("Login: "******"" print("Creating ATC page..") # print(str(ATCutils.confluence_get_page_id(url, # auth, confluence_space_name, confluence_space_home_page_name))) data = { "title": confluence_name_of_root_directory, "spacekey": confluence_space_name, "parentid": str( ATCutils.confluence_get_page_id(url, auth, confluence_space_name, confluence_space_home_page_name)), "confluencecontent": content, } # print(push_to_confluence(data, url, auth)) if not ATCutils.push_to_confluence(data, url, auth): raise Exception("Could not create or update the page. " + "Is the parent name correct?") spaces = [ "Detection Rules", "Logging Policies", "Data Needed", "Triggers", "Response Actions", "Response Playbooks", "Enrichments", "Customers", "Mitigation Systems", "Mitigation Policies", "Hardening Policies" ] for space in spaces: print("Creating %s.." % space) data = { "title": space, "spacekey": confluence_space_name, "parentid": str( ATCutils.confluence_get_page_id( url, auth, confluence_space_name, confluence_name_of_root_directory)), "confluencecontent": content, } # print(push_to_confluence(data, url, auth)) if not ATCutils.push_to_confluence(data, url, auth): raise Exception("Could not create or update the page. " + "Is the parent name correct?") print("Done!") return True
def render_template(self, template_type): """Description template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception("Bad template_type. Available values:" + " [\"markdown\", \"confluence\"]") # Point to the templates directory env = Environment(loader=FileSystemLoader('templates')) # Get proper template if template_type == "markdown": template = env.get_template( 'markdown_responseplaybook_template.md.j2') tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{1,5}$') other_tags = [] for tag in self.rp_parsed_file.get('tags'): if tactic_re.match(tag): tactic.append(ta_mapping.get(tag)) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) else: other_tags.append(tag) self.rp_parsed_file.update({'tactics': tactic}) self.rp_parsed_file.update({'techniques': technique}) self.rp_parsed_file.update({'other_tags': other_tags}) identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] stages = [('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned)] # grab workflow per action in each IR stages # error handling for playbooks with empty stages for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = ATCutils.read_yaml_file( '../response_actions/' + task + '.yml') stage_list.append((action.get('description'), action.get('workflow'))) except TypeError: pass # change stages name to more pretty format stages = [(stage_name.replace('_', ' ').capitalize(), stage_list) for stage_name, stage_list in stages] self.rp_parsed_file.update({'stages': stages}) self.rp_parsed_file.update({ 'description': self.rp_parsed_file.get('description').strip() }) elif template_type == "confluence": template = env.get_template( 'confluence_responseplaybook_template.html.j2') self.rp_parsed_file.update({ 'confluence_viewpage_url': ATCconfig.get('confluence_viewpage_url') }) tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{1,5}$') other_tags = [] for tag in self.rp_parsed_file.get('tags'): if tactic_re.match(tag): tactic.append(ta_mapping.get(tag)) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) else: other_tags.append(tag) self.rp_parsed_file.update({'tactics': tactic}) self.rp_parsed_file.update({'techniques': technique}) self.rp_parsed_file.update({'other_tags': other_tags}) # get links to response action identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] stages = [('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned)] for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = ATCutils.read_yaml_file( '../response_actions/' + task + '.yml') action_title = action.get('title') if self.apipath and self.auth and self.space: stage_list.append( (action_title, str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, action_title)))) else: stage_list.append((action_title, "")) except TypeError: pass # change stages name to more pretty format stages = [(stage_name.replace('_', ' ').capitalize(), stage_list) for stage_name, stage_list in stages] self.rp_parsed_file.update({'stages_with_id': stages}) # get descriptions for response actions identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] stages = [('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned)] # grab workflow per action in each IR stages # error handling for playbooks with empty stages for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = ATCutils.read_yaml_file( '../response_actions/' + task + '.yml') stage_list.append((action.get('description'), action.get('workflow'))) except TypeError: pass # change stages name to more pretty format stages = [(stage_name.replace('_', ' ').capitalize(), stage_list) for stage_name, stage_list in stages] self.rp_parsed_file.update({'stages': stages}) self.rp_parsed_file.update( {'workflow': self.rp_parsed_file.get('workflow')}) self.rp_parsed_file.update({ 'description': self.rp_parsed_file.get('description').strip() }) # Render self.content = template.render(self.rp_parsed_file)
def render_template(self, template_type): """Render template with data in it template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception("Bad template_type. Available values: " + "[\"markdown\", \"confluence\"]") # Point to the templates directory env = Environment(loader=FileSystemLoader('templates')) self.cu_fields.update({'description': self.description.strip()}) # Transform variables to arrays if not provided correctly in yaml if isinstance(self.data_needed, str): self.cu_fields.update({'dataneeded': [self.data_needed]}) if isinstance(self.logging_policies, str): self.cu_fields.update({'loggingpolicy': [self.logging_policies]}) detectionrule_with_path = [] for title in self.detection_rules: if title is not None: name = rules_by_title.get(title)[1] else: name = '' dr = (title, name) detectionrule_with_path.append(dr) self.cu_fields.update({'detectionrule': detectionrule_with_path}) # Get proper template if template_type == "markdown": template = env\ .get_template('markdown_customer_template.md.j2') elif template_type == "confluence": template = env.get_template('confluence_customer_template.html.j2') self.cu_fields.update({ 'confluence_viewpage_url': ATCconfig.get('confluence_viewpage_url') }) if not self.logging_policies: self.logging_policies = [ "None", ] logging_policies_with_id = [] for lp in self.logging_policies: if lp != "None" and self.apipath and self.auth and self.space: logging_policies_id = str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, lp)) else: logging_policies_id = "" lp = (lp, logging_policies_id) logging_policies_with_id.append(lp) self.cu_fields.update({'loggingpolicy': logging_policies_with_id}) if not self.data_needed: self.data_needed = [ "None", ] data_needed_with_id = [] for dn in self.data_needed: if dn != "None" and self.apipath and self.auth and self.space: data_needed_id = str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, dn)) else: data_needed_id = "" dn = (dn, data_needed_id) data_needed_with_id.append(dn) self.cu_fields.update({'data_needed': data_needed_with_id}) detection_rules_with_id = [] for dn in self.detection_rules: if dn != "None" and self.apipath and self.auth and self.space: detection_rules_id = str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, dn)) else: detection_rules_id = "" dn = (dn, detection_rules_id) detection_rules_with_id.append(dn) self.cu_fields.update({'detectionrule': detection_rules_with_id}) self.content = template.render(self.cu_fields) return True
def render_template(self, template_type): """Description template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception("Bad template_type. Available values:" + " [\"markdown\", \"confluence\"]") # Point to the templates directory env = Environment(loader=FileSystemLoader('templates')) # Get proper template if template_type == "markdown": template = env.get_template( 'markdown_mitigationpolicies_template.md.j2') platform = self.mp_parsed_file.get("platform") if isinstance(platform, str): platform = [platform] self.mp_parsed_file.update({'platform': platform}) minimum_version = self.mp_parsed_file.get("minimum_version") if isinstance(minimum_version, str): minimum_version = [minimum_version] self.mp_parsed_file.update({'minimum_version': minimum_version}) mitigation_systems = self.mp_parsed_file.get("mitigation_system") if isinstance(mitigation_systems, str): mitigation_systems = [mitigation_systems] self.mp_parsed_file.update( {'mitigation_system': mitigation_systems}) self.mp_parsed_file.update({ 'configuration': self.mp_parsed_file.get('configuration').strip() }) self.mp_parsed_file.update({ 'description': self.mp_parsed_file.get('description').strip() }) # MITRE ATT&CK Tactics and Techniques tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{1,5}$') # AM!TT Tactics and Techniques amitt_tactic = [] amitt_tactic_re = re.compile(r'amitt\.\w\D+$') amitt_technique = [] amitt_technique_re = re.compile(r'amitt\.t\d{1,5}$') # MITRE ATT&CK Mitigation mitigation = [] mitigation_re = re.compile(r'attack\.m\d{1,5}$') # AM!TT Mitigation amitt_mitigation = [] amitt_mitigation_re = re.compile(r'amitt\.m\d{1,5}$') other_tags = [] if self.mp_parsed_file.get('tags'): for tag in self.mp_parsed_file.get('tags'): if tactic_re.match(tag): if ta_mapping.get(tag): tactic.append(ta_mapping.get(tag)) else: other_tags.append(tag) elif amitt_tactic_re.match(tag): if amitt_tactic_mapping.get(tag): amitt_tactic.append(amitt_tactic_mapping.get(tag)) else: other_tags.append(tag) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) elif amitt_technique_re.match(tag): te = tag.upper()[6:] technique.append((amitt_technique_mapping.get(te), te)) elif mitigation_re.match(tag): mi = tag.upper()[7:] mitigation.append((mi_mapping.get(mi), mi)) elif amitt_mitigation_re.match(tag): te = tag.upper()[6:] mitigation.append( (amitt_mitigation_mapping.get(te), te)) else: other_tags.append(tag) if not tactic_re.match(tag) and not \ technique_re.match(tag) and not \ mitigation_re.match(tag): other_tags.append(tag) if len(tactic): self.mp_parsed_file.update({'tactics': tactic}) if len(technique): self.mp_parsed_file.update({'techniques': technique}) if len(amitt_tactic): self.mp_parsed_file.update({'amitt_tactics': amitt_tactic}) if len(amitt_technique): self.mp_parsed_file.update( {'amitt_techniques': amitt_technique}) if len(mitigation): self.mp_parsed_file.update({'mitigations': mitigation}) if len(amitt_mitigation): self.mp_parsed_file.update( {'amitt_mitigations': amitt_mitigation}) if len(other_tags): self.mp_parsed_file.update({'other_tags': other_tags}) elif template_type == "confluence": template = env.get_template( 'confluence_mitigationpolicies_template.html.j2') self.mp_parsed_file.update({ 'confluence_viewpage_url': ATCconfig.get('confluence_viewpage_url') }) self.mp_parsed_file.update({ 'description': self.mp_parsed_file.get('description').strip() }) platform = self.mp_parsed_file.get("platform") if isinstance(platform, str): platform = [platform] self.mp_parsed_file.update({'platform': platform}) minimum_version = self.mp_parsed_file.get("minimum_version") if isinstance(minimum_version, str): minimum_version = [minimum_version] self.mp_parsed_file.update({'minimum_version': minimum_version}) mitigation_systems = self.mp_parsed_file.get("mitigation_system") if isinstance(mitigation_systems, str): mitigation_systems = [mitigation_systems] if not mitigation_systems: mitigation_systems = [ "None", ] mitigation_systems_with_id = [] if mitigation_systems: for ms in mitigation_systems: mitigation_systems_id = str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, ms)) ms = (ms, mitigation_systems_id) mitigation_systems_with_id.append(ms) self.mp_parsed_file.update( {'mitigation_system': mitigation_systems_with_id}) # MITRE ATT&CK Tactics and Techniques tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{1,5}$') # AM!TT Tactics and Techniques amitt_tactic = [] amitt_tactic_re = re.compile(r'amitt\.\w\D+$') amitt_technique = [] amitt_technique_re = re.compile(r'amitt\.t\d{1,5}$') # MITRE ATT&CK Mitigation mitigation = [] mitigation_re = re.compile(r'attack\.m\d{1,5}$') # AM!TT Mitigation amitt_mitigation = [] amitt_mitigation_re = re.compile(r'amitt\.m\d{1,5}$') other_tags = [] if self.mp_parsed_file.get('tags'): for tag in self.mp_parsed_file.get('tags'): if tactic_re.match(tag): if ta_mapping.get(tag): tactic.append(ta_mapping.get(tag)) else: other_tags.append(tag) elif amitt_tactic_re.match(tag): if amitt_tactic_mapping.get(tag): amitt_tactic.append(amitt_tactic_mapping.get(tag)) else: other_tags.append(tag) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) elif amitt_technique_re.match(tag): te = tag.upper()[6:] technique.append((amitt_technique_mapping.get(te), te)) elif mitigation_re.match(tag): mi = tag.upper()[7:] mitigation.append((mi_mapping.get(mi), mi)) elif amitt_mitigation_re.match(tag): te = tag.upper()[6:] mitigation.append( (amitt_mitigation_mapping.get(te), te)) else: other_tags.append(tag) if not tactic_re.match(tag) and not \ technique_re.match(tag) and not \ mitigation_re.match(tag): other_tags.append(tag) if len(tactic): self.mp_parsed_file.update({'tactics': tactic}) if len(technique): self.mp_parsed_file.update({'techniques': technique}) if len(amitt_tactic): self.mp_parsed_file.update({'amitt_tactics': amitt_tactic}) if len(amitt_technique): self.mp_parsed_file.update( {'amitt_techniques': amitt_technique}) if len(mitigation): self.mp_parsed_file.update({'mitigations': mitigation}) if len(amitt_mitigation): self.mp_parsed_file.update( {'amitt_mitigations': amitt_mitigation}) if len(other_tags): self.mp_parsed_file.update({'other_tags': other_tags}) # Render self.content = template.render(self.mp_parsed_file)
def render_template(self, template_type): """Description template_type: - "markdown" """ if template_type not in ["confluence"]: raise Exception("Bad template_type. Available values:" + " \"confluence\"]") template = env.get_template( 'confluence_responsestage_template.html.j2') self.rs_parsed_file.update( {'description': self.rs_parsed_file.get('description').strip()}) ras, ra_paths = ATCutils.load_yamls_with_paths( ATCconfig.get('response_actions_dir')) ra_filenames = [ ra_path.split('/')[-1].replace('.yml', '') for ra_path in ra_paths ] rs_id = self.rs_parsed_file.get('id') self.rs_parsed_file.update({ 'confluence_viewpage_url': ATCconfig.get('confluence_viewpage_url') }) stage_list = [] for i in range(len(ras)): if rs_mapping[rs_id] == ATCutils.normalize_rs_name( ras[i].get('stage')): ra_id = ras[i].get('id') ra_filename = ra_filenames[i] ra_title = ATCutils.normalize_react_title(ras[i].get('title')) ra_description = ras[i].get('description').strip() ra_confluence_page_name = ra_id + ": " + ra_title print(ra_confluence_page_name) if self.apipath and self.auth and self.space: ra_confluence_page_id = str( ATCutils.confluence_get_page_id( self.apipath, self.auth, self.space, ra_confluence_page_name)) else: ra_confluence_page_id = "" print(ra_confluence_page_id) stage_list.append((ra_id, ra_filename, ra_title, ra_description, ra_confluence_page_id)) new_title = self.rs_parsed_file.get('id')\ + ": "\ + ATCutils.normalize_react_title(self.rs_parsed_file.get('title')) self.rs_parsed_file.update({'title': new_title}) self.rs_parsed_file.update({'stage_list': sorted(stage_list)}) self.content = template.render(self.rs_parsed_file)