def main(c_auth=None): try: REACTConfig = REACTutils.load_config("config.yml") confluence_space_name = REACTConfig.get('confluence_space_name') confluence_space_home_page_name = REACTConfig.get( 'confluence_space_home_page_name') confluence_rest_api_url = REACTConfig.get('confluence_rest_api_url') confluence_name_of_root_directory = REACTConfig.get( 'confluence_name_of_root_directory') except Exception as e: raise e pass if not c_auth: mail = input("Login: "******"" print("[*] Creating RE&CT root page...") data = { "title": confluence_name_of_root_directory, "spacekey": confluence_space_name, "parentid": str(REACTutils.confluence_get_page_id( url, auth, confluence_space_name, confluence_space_home_page_name)), "confluencecontent": content, } if not REACTutils.push_to_confluence(data, url, auth): raise Exception("[-] Could not create or update the page. " + "Is the parent name correct?") pages = ["Response Actions","Response Playbooks","Response Stages"] for page in pages: print("[*] Creating %s..." % page) data = { "title": page, "spacekey": confluence_space_name, "parentid": str(REACTutils.confluence_get_page_id( url, auth, confluence_space_name, confluence_name_of_root_directory)), "confluencecontent": content, } if not REACTutils.push_to_confluence(data, url, auth): raise Exception("[*] Could not create or update the page. " + "Is the parent name correct?") print("[+] Initial Confluence page structure created!") return True
def response_action(self, ra_path): """Nothing here yet""" print("[*] Populating Response Actions...") if ra_path: ra_list = glob.glob(ra_path + '*.yml') else: ra_dir = REACTConfig.get('response_actions_dir') ra_list = glob.glob(ra_dir + '/*.yml') for ra_file in ra_list: try: ra = ResponseAction(ra_file, apipath=self.apipath, auth=self.auth, space=self.space) ra.render_template("confluence") confluence_data = { "title": ra.ra_parsed_file['title'], "spacekey": self.space, "parentid": str( REACTutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Response Actions")), "confluencecontent": ra.content, } res = REACTutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: RA '" + ra.ra_parsed_file['title'] + "'") # print("Done: ", ra.ra_parsed_file['title']) except Exception as err: print(ra_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("[+] Response Actions populated!")
def render_template(self, template_type): """Description template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception( "Bad template_type. Available values:" + " [\"markdown\", \"confluence\"]") # # PRE: Common for both Markdown and Confluence templates # self.ra_parsed_file.update( {'category': REACTutils.get_ra_category(self.ra_parsed_file .get('id'))} ) self.ra_parsed_file.update( {'description': self.ra_parsed_file.get('description').strip()} ) # Get proper template if template_type == "markdown": template = env.get_template( 'markdown_responseaction_template.md.j2' ) self.ra_parsed_file.update( {'title': REACTutils.normalize_react_title(self.ra_parsed_file .get('title'),REACTConfig.get('titlefmtrules'))} ) stage_list = [] stage = self.ra_parsed_file.get('stage') for rs_id, rs_name in rs_mapping.items(): if REACTutils.normalize_rs_name(stage) == rs_name: stage_list.append((rs_id, rs_name)) self.ra_parsed_file.update( {'stage': stage_list} ) elif template_type == "confluence": template = env.get_template( 'confluence_responseaction_template.html.j2') new_title = self.ra_parsed_file.get('id')\ + ": "\ + REACTutils.normalize_react_title(self.ra_parsed_file.get('title'),REACTConfig.get('titlefmtrules')) self.ra_parsed_file.update( {'title': new_title} ) self.ra_parsed_file.update( {'confluence_viewpage_url': REACTConfig.get('confluence_viewpage_url')}) ## ## Add link to a stage ## stage = self.ra_parsed_file.get('stage') rs_list = [] for rs_id, rs_name in rs_mapping.items(): if REACTutils.normalize_rs_name(stage) == rs_name: if self.apipath and self.auth and self.space: rs_confluence_page_name = rs_id + ": " + rs_name rs_confluence_page_id = str(REACTutils.confluence_get_page_id( self.apipath, self.auth, self.space, rs_confluence_page_name) ) rs_list.append((rs_id, rs_name, rs_confluence_page_id)) else: rs_confluence_page_id = "" rs_list.append((rs_id, rs_name, rs_confluence_page_id)) break self.ra_parsed_file.update( {'stage': rs_list} ) # # POST: Common for both Markdown and Confluence templates # self.content = template.render(self.ra_parsed_file)
def render_template(self, template_type): """Description template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception("Bad template_type. Available values:" + " [\"markdown\", \"confluence\"]]") # Get proper template if template_type == "markdown": template = env.get_template( 'markdown_responseplaybook_template.md.j2') self.rp_parsed_file.update({ 'title': REACTutils.normalize_react_title( self.rp_parsed_file.get('title')) }) # MITRE ATT&CK Tactics and Techniques tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{4}(\.\d{3})?$') # AM!TT Tactics and Techniques amitt_tactic = [] amitt_tactic_re = re.compile(r'amitt\.\w\D+$') amitt_technique = [] amitt_technique_re = re.compile(r'amitt\.t\d{1,5}$') other_tags = [] for tag in self.rp_parsed_file.get('tags'): if tactic_re.match(tag): tactic.append(ta_mapping.get(tag)) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) elif amitt_tactic_re.match(tag): amitt_tactic.append(amitt_tactic_mapping.get(tag)) elif amitt_technique_re.match(tag): te = tag.upper()[6:] amitt_technique.append( (amitt_technique_mapping.get(te), te)) else: other_tags.append(tag) # Add MITRE ATT&CK Tactics and Techniques to J2 self.rp_parsed_file.update({'tactics': tactic}) self.rp_parsed_file.update({'techniques': technique}) # Add AM!TT Tactics and Techniques to J2 self.rp_parsed_file.update({'amitt_tactics': amitt_tactic}) self.rp_parsed_file.update({'amitt_techniques': amitt_technique}) self.rp_parsed_file.update({'other_tags': other_tags}) preparation = [] identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] detect = [] deny = [] disrupt = [] degrade = [] deceive = [] destroy = [] deter = [] stages = [('preparation', preparation), ('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned), ('detect', detect), ('deny', deny), ('disrupt', disrupt), ('degrade', degrade), ('deceive', deceive), ('destroy', destroy), ('deter', deter)] # grab workflow per action in each IR stages # error handling for playbooks with empty stages for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = REACTutils.read_yaml_file( REACTConfig.get('response_actions_dir') + '/' + task + '.yml') action_title = action.get('id')\ + ": "\ + REACTutils.normalize_react_title(action.get('title')) stage_list.append( (action_title, task, action.get('description'), action.get('workflow'))) except TypeError: pass elif template_type == "confluence": template = env.get_template( 'confluence_responseplaybook_template.html.j2') new_title = self.rp_parsed_file.get('id')\ + ": "\ + REACTutils.normalize_react_title(self.rp_parsed_file.get('title')) self.rp_parsed_file.update({'title': new_title}) self.rp_parsed_file.update({ 'confluence_viewpage_url': REACTConfig.get('confluence_viewpage_url') }) # MITRE ATT&CK Tactics and Techniques tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{4}(\.\d{3})?$') # AM!TT Tactics and Techniques amitt_tactic = [] amitt_tactic_re = re.compile(r'amitt\.\w\D+$') amitt_technique = [] amitt_technique_re = re.compile(r'amitt\.t\d{1,5}$') other_tags = [] for tag in self.rp_parsed_file.get('tags'): if tactic_re.match(tag): tactic.append(ta_mapping.get(tag)) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) elif amitt_tactic_re.match(tag): amitt_tactic.append(amitt_tactic_mapping.get(tag)) elif amitt_technique_re.match(tag): te = tag.upper()[6:] amitt_technique.append( (amitt_technique_mapping.get(te), te)) else: other_tags.append(tag) # Add MITRE ATT&CK Tactics and Techniques to J2 self.rp_parsed_file.update({'tactics': tactic}) self.rp_parsed_file.update({'techniques': technique}) # Add AM!TT Tactics and Techniques to J2 self.rp_parsed_file.update({'amitt_tactics': amitt_tactic}) self.rp_parsed_file.update({'amitt_techniques': amitt_technique}) self.rp_parsed_file.update({'other_tags': other_tags}) # get links to response action preparation = [] identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] detect = [] deny = [] disrupt = [] degrade = [] deceive = [] destroy = [] deter = [] stages = [('preparation', preparation), ('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned), ('detect', detect), ('deny', deny), ('disrupt', disrupt), ('degrade', degrade), ('deceive', deceive), ('destroy', destroy), ('deter', deter)] for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = REACTutils.read_yaml_file( REACTConfig.get('response_actions_dir') + '/' + task + '.yml') action_title = action.get('id')\ + ": "\ + REACTutils.normalize_react_title(action.get('title')) if self.apipath and self.auth and self.space: stage_list.append( (action_title, str( REACTutils.confluence_get_page_id( self.apipath, self.auth, self.space, action_title)))) else: stage_list.append((action_title, "")) except TypeError: pass # change stages name to more pretty format stages = [(stage_name.replace('_', ' ').capitalize(), stage_list) for stage_name, stage_list in stages] self.rp_parsed_file.update({'stages_with_id': stages}) # get descriptions for response actions preparation = [] identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] detect = [] deny = [] disrupt = [] degrade = [] deceive = [] destroy = [] deter = [] stages = [('preparation', preparation), ('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned), ('detect', detect), ('deny', deny), ('disrupt', disrupt), ('degrade', degrade), ('deceive', deceive), ('destroy', destroy), ('deter', deter)] # grab workflow per action in each IR stages # error handling for playbooks with empty stages for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = REACTutils.read_yaml_file( REACTConfig.get('response_actions_dir') + '/' + task + '.yml') stage_list.append((action.get('description'), action.get('workflow'))) except TypeError: pass # # POST: Common for both Markdown and Confluence templates # # change stages name to more pretty format stages = [(stage_name.replace('_', ' ').capitalize(), stage_list) for stage_name, stage_list in stages] self.rp_parsed_file.update({'stages': stages}) self.rp_parsed_file.update( {'description': self.rp_parsed_file.get('description').strip()}) # Render self.content = template.render(self.rp_parsed_file)
def response_stage(self, rs_path): """Nothing here yet""" print("[*] Populating Response Stages...") if rs_path: rs_list = glob.glob(rs_path + '*.yml') else: rs_dir = REACTConfig.get('response_stages_dir') rs_list = glob.glob(rs_dir + '/*.yml') for rs_file in rs_list: try: rs = ResponseStage(rs_file, apipath=self.apipath, auth=self.auth, space=self.space) rs.render_template("confluence") base = os.path.basename(rs_file) confluence_data = { "title": rs.rs_parsed_file['title'], "spacekey": self.space, "parentid": str( REACTutils.confluence_get_page_id( self.apipath, self.auth, self.space, "Response Stages")), "confluencecontent": rs.content, } res = REACTutils.push_to_confluence(confluence_data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: RS '" + base + "'") except Exception as err: print(rs_file + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) # # Populate Response Stages root page # template = env.get_template( 'confluence_responsestage_main_template.html.j2') rss, rs_paths = REACTutils.load_yamls_with_paths( REACTConfig.get('response_stages_dir')) rss_dict = {} rss_list = [] for i in range(len(rss)): rs_id = rss[i].get('id') rs_title = rss[i].get('title') rs_confluence_page_name = rs_id + ": " + rs_title rs_confluence_page_id = str( REACTutils.confluence_get_page_id(self.apipath, self.auth, self.space, rs_confluence_page_name)) rs_description = rss[i].get('description') rss_list.append( (rs_id, rs_title, rs_description, rs_confluence_page_id)) rss_dict.update({'rss_list': sorted(rss_list)}) rss_dict.update({ 'confluence_viewpage_url': REACTConfig.get('confluence_viewpage_url') }) content = template.render(rss_dict) try: data = { "title": "Response Stages", "spacekey": self.space, "parentid": str( REACTutils.confluence_get_page_id(self.apipath, self.auth, self.space, self.root_name)), "confluencecontent": content, } res = REACTutils.push_to_confluence(data, self.apipath, self.auth) if res == 'Page updated': print("==> updated page: Response Stages root page") except Exception as err: print("Response Stages root page" + " failed") print("Err message: %s" % err) print('-' * 60) traceback.print_exc(file=sys.stdout) print('-' * 60) print("[+] Response Stages populated!")