def checkRA(self, stage): if self.rp_rule.get(stage): for rule in self.rp_rule.get(stage): try: rtask = REACTutils.read_yaml_file(self.inputRA + rule + ".yml") except OSError: print("Response Action %s not existing\n" % rule) continue self.task_prefix = int(self.task_prefix) self.task_prefix += 1 task = THC.TheHiveTask(order=self.task_order) self.task_order += 1 task.title = str(self.task_prefix) + " | "\ + rtask.get('id')\ + ": "\ + REACTutils.normalize_react_title(rtask.get('title'),REACTConfig.get('titlefmtrules')) if rtask.get('stage'): task.group = REACTutils.normalize_rs_name( rtask.get('stage')) else: task.group = 'Unknown stage' task.description = str(rtask.get('workflow')) if rtask.get('owner'): task.owner = str(rtask.get('owner')) self.case.tasks.append(task.return_dictionary())
def convertRPToTemplate(self, file_input, output_file): self.rp_rule = REACTutils.read_yaml_file(file_input) self.case = THC.TheHiveCase() self.case.name = self.rp_rule.get('id')\ + ": "\ + REACTutils.normalize_react_title(self.rp_rule.get('title'),REACTConfig.get('titlefmtrules')) self.case.description = str(self.rp_rule.get('description')) + \ '\n\nWorkflow:\n\n' + str(self.rp_rule.get('workflow')) try: self.case.tags += self.rp_rule.get('tags') except TypeError: pass self.case.tlp = self.checkTLP(self.rp_rule.get('tlp')) self.case.pap = self.checkPAP(self.rp_rule.get('pap')) if self.args.prefix: self.case.prefix = self.args.prefix self.task_prefix = 0.0 self.task_order = 0 stages = [ 'preparation', 'identification', 'containment', 'eradication', 'recovery', 'lessons_learned' ] for stage in stages: if stage in self.rp_rule.keys(): self.checkRA(stage) try: with open(output_file, 'w') as f: f.write(self.case.json()) except OSError: print("ERROR: No such directory %s" % os.path.dirname(os.path.abspath(output_file)))
def render_template(self, template_type): """Description template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception( "Bad template_type. Available values:" + " [\"markdown\", \"confluence\"]") # # PRE: Common for both Markdown and Confluence templates # self.ra_parsed_file.update( {'category': REACTutils.get_ra_category(self.ra_parsed_file .get('id'))} ) self.ra_parsed_file.update( {'description': self.ra_parsed_file.get('description').strip()} ) # Get proper template if template_type == "markdown": template = env.get_template( 'markdown_responseaction_template.md.j2' ) self.ra_parsed_file.update( {'title': REACTutils.normalize_react_title(self.ra_parsed_file .get('title'),REACTConfig.get('titlefmtrules'))} ) stage_list = [] stage = self.ra_parsed_file.get('stage') for rs_id, rs_name in rs_mapping.items(): if REACTutils.normalize_rs_name(stage) == rs_name: stage_list.append((rs_id, rs_name)) self.ra_parsed_file.update( {'stage': stage_list} ) elif template_type == "confluence": template = env.get_template( 'confluence_responseaction_template.html.j2') new_title = self.ra_parsed_file.get('id')\ + ": "\ + REACTutils.normalize_react_title(self.ra_parsed_file.get('title'),REACTConfig.get('titlefmtrules')) self.ra_parsed_file.update( {'title': new_title} ) self.ra_parsed_file.update( {'confluence_viewpage_url': REACTConfig.get('confluence_viewpage_url')}) ## ## Add link to a stage ## stage = self.ra_parsed_file.get('stage') rs_list = [] for rs_id, rs_name in rs_mapping.items(): if REACTutils.normalize_rs_name(stage) == rs_name: if self.apipath and self.auth and self.space: rs_confluence_page_name = rs_id + ": " + rs_name rs_confluence_page_id = str(REACTutils.confluence_get_page_id( self.apipath, self.auth, self.space, rs_confluence_page_name) ) rs_list.append((rs_id, rs_name, rs_confluence_page_id)) else: rs_confluence_page_id = "" rs_list.append((rs_id, rs_name, rs_confluence_page_id)) break self.ra_parsed_file.update( {'stage': rs_list} ) # # POST: Common for both Markdown and Confluence templates # self.content = template.render(self.ra_parsed_file)
def render_template(self, template_type): """Description template_type: - "markdown" - "confluence" """ if template_type not in ["markdown", "confluence"]: raise Exception("Bad template_type. Available values:" + " [\"markdown\", \"confluence\"]]") # Get proper template if template_type == "markdown": template = env.get_template( 'markdown_responseplaybook_template.md.j2') self.rp_parsed_file.update({ 'title': REACTutils.normalize_react_title( self.rp_parsed_file.get('title')) }) # MITRE ATT&CK Tactics and Techniques tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{4}(\.\d{3})?$') # AM!TT Tactics and Techniques amitt_tactic = [] amitt_tactic_re = re.compile(r'amitt\.\w\D+$') amitt_technique = [] amitt_technique_re = re.compile(r'amitt\.t\d{1,5}$') other_tags = [] for tag in self.rp_parsed_file.get('tags'): if tactic_re.match(tag): tactic.append(ta_mapping.get(tag)) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) elif amitt_tactic_re.match(tag): amitt_tactic.append(amitt_tactic_mapping.get(tag)) elif amitt_technique_re.match(tag): te = tag.upper()[6:] amitt_technique.append( (amitt_technique_mapping.get(te), te)) else: other_tags.append(tag) # Add MITRE ATT&CK Tactics and Techniques to J2 self.rp_parsed_file.update({'tactics': tactic}) self.rp_parsed_file.update({'techniques': technique}) # Add AM!TT Tactics and Techniques to J2 self.rp_parsed_file.update({'amitt_tactics': amitt_tactic}) self.rp_parsed_file.update({'amitt_techniques': amitt_technique}) self.rp_parsed_file.update({'other_tags': other_tags}) preparation = [] identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] detect = [] deny = [] disrupt = [] degrade = [] deceive = [] destroy = [] deter = [] stages = [('preparation', preparation), ('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned), ('detect', detect), ('deny', deny), ('disrupt', disrupt), ('degrade', degrade), ('deceive', deceive), ('destroy', destroy), ('deter', deter)] # grab workflow per action in each IR stages # error handling for playbooks with empty stages for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = REACTutils.read_yaml_file( REACTConfig.get('response_actions_dir') + '/' + task + '.yml') action_title = action.get('id')\ + ": "\ + REACTutils.normalize_react_title(action.get('title')) stage_list.append( (action_title, task, action.get('description'), action.get('workflow'))) except TypeError: pass elif template_type == "confluence": template = env.get_template( 'confluence_responseplaybook_template.html.j2') new_title = self.rp_parsed_file.get('id')\ + ": "\ + REACTutils.normalize_react_title(self.rp_parsed_file.get('title')) self.rp_parsed_file.update({'title': new_title}) self.rp_parsed_file.update({ 'confluence_viewpage_url': REACTConfig.get('confluence_viewpage_url') }) # MITRE ATT&CK Tactics and Techniques tactic = [] tactic_re = re.compile(r'attack\.\w\D+$') technique = [] technique_re = re.compile(r'attack\.t\d{4}(\.\d{3})?$') # AM!TT Tactics and Techniques amitt_tactic = [] amitt_tactic_re = re.compile(r'amitt\.\w\D+$') amitt_technique = [] amitt_technique_re = re.compile(r'amitt\.t\d{1,5}$') other_tags = [] for tag in self.rp_parsed_file.get('tags'): if tactic_re.match(tag): tactic.append(ta_mapping.get(tag)) elif technique_re.match(tag): te = tag.upper()[7:] technique.append((te_mapping.get(te), te)) elif amitt_tactic_re.match(tag): amitt_tactic.append(amitt_tactic_mapping.get(tag)) elif amitt_technique_re.match(tag): te = tag.upper()[6:] amitt_technique.append( (amitt_technique_mapping.get(te), te)) else: other_tags.append(tag) # Add MITRE ATT&CK Tactics and Techniques to J2 self.rp_parsed_file.update({'tactics': tactic}) self.rp_parsed_file.update({'techniques': technique}) # Add AM!TT Tactics and Techniques to J2 self.rp_parsed_file.update({'amitt_tactics': amitt_tactic}) self.rp_parsed_file.update({'amitt_techniques': amitt_technique}) self.rp_parsed_file.update({'other_tags': other_tags}) # get links to response action preparation = [] identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] detect = [] deny = [] disrupt = [] degrade = [] deceive = [] destroy = [] deter = [] stages = [('preparation', preparation), ('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned), ('detect', detect), ('deny', deny), ('disrupt', disrupt), ('degrade', degrade), ('deceive', deceive), ('destroy', destroy), ('deter', deter)] for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = REACTutils.read_yaml_file( REACTConfig.get('response_actions_dir') + '/' + task + '.yml') action_title = action.get('id')\ + ": "\ + REACTutils.normalize_react_title(action.get('title')) if self.apipath and self.auth and self.space: stage_list.append( (action_title, str( REACTutils.confluence_get_page_id( self.apipath, self.auth, self.space, action_title)))) else: stage_list.append((action_title, "")) except TypeError: pass # change stages name to more pretty format stages = [(stage_name.replace('_', ' ').capitalize(), stage_list) for stage_name, stage_list in stages] self.rp_parsed_file.update({'stages_with_id': stages}) # get descriptions for response actions preparation = [] identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] detect = [] deny = [] disrupt = [] degrade = [] deceive = [] destroy = [] deter = [] stages = [('preparation', preparation), ('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned), ('detect', detect), ('deny', deny), ('disrupt', disrupt), ('degrade', degrade), ('deceive', deceive), ('destroy', destroy), ('deter', deter)] # grab workflow per action in each IR stages # error handling for playbooks with empty stages for stage_name, stage_list in stages: try: for task in self.rp_parsed_file.get(stage_name): action = REACTutils.read_yaml_file( REACTConfig.get('response_actions_dir') + '/' + task + '.yml') stage_list.append((action.get('description'), action.get('workflow'))) except TypeError: pass # # POST: Common for both Markdown and Confluence templates # # change stages name to more pretty format stages = [(stage_name.replace('_', ' ').capitalize(), stage_list) for stage_name, stage_list in stages] self.rp_parsed_file.update({'stages': stages}) self.rp_parsed_file.update( {'description': self.rp_parsed_file.get('description').strip()}) # Render self.content = template.render(self.rp_parsed_file)
def __init__(self, ra=False, rp=False, rs=False, auto=False, ra_path=False, rp_path=False, rs_path=False, atc_dir=False, init=False): """Init""" # Check if atc_dir provided if atc_dir: self.atc_dir = atc_dir else: self.atc_dir = REACTConfig.get('md_name_of_root_directory') + '/' # Main logic if auto: self.response_action(ra_path) self.response_playbook(rp_path) self.response_stage(rs_path) if ra: self.response_action(ra_path) if rp: self.response_playbook(rp_path) if rs: self.response_stage(rs_path) if ra_path: ras, ra_paths = REACTutils.load_yamls_with_paths(ra_path) else: ras, ra_paths = REACTutils.load_yamls_with_paths( REACTConfig.get('response_actions_dir')) if rp_path: rps, rp_paths = REACTutils.load_yamls_with_paths(rp_path) else: rps, rp_paths = REACTutils.load_yamls_with_paths( REACTConfig.get('response_playbooks_dir')) if rs_path: rss, rs_paths = REACTutils.load_yamls_with_paths(rs_path) else: rss, rs_paths = REACTutils.load_yamls_with_paths( REACTConfig.get('response_stages_dir')) ra_filenames = [ ra_path.split('/')[-1].replace('.yml', '') for ra_path in ra_paths ] rp_filenames = [ rp_path.split('/')[-1].replace('.yml', '') for rp_path in rp_paths ] rs_filenames = [ rs_path.split('/')[-1].replace('.yml', '') for rs_path in rs_paths ] # Point to the templates directory env = Environment(loader=FileSystemLoader('scripts/templates')) # Get proper template template = env.get_template('mkdocs_config_template.md.j2') preparation = [] identification = [] containment = [] eradication = [] recovery = [] lessons_learned = [] detect = [] deny = [] disrupt = [] degrade = [] deceive = [] destroy = [] deter = [] stages = [('preparation', preparation), ('identification', identification), ('containment', containment), ('eradication', eradication), ('recovery', recovery), ('lessons_learned', lessons_learned), ('detect', detect), ('deny', deny), ('disrupt', disrupt), ('degrade', degrade), ('deceive', deceive), ('destroy', destroy), ('deter', deter)] playbooks = [] data_to_render = {} for i in range(len(ras)): ra_updated_title = ras[i].get('id')\ + ": "\ + REACTutils.normalize_react_title(ras[i].get('title'),REACTConfig.get('titlefmtrules')) if "RA1" in ras[i]['id']: preparation.append((ra_updated_title, ra_filenames[i])) elif "RA2" in ras[i]['id']: identification.append((ra_updated_title, ra_filenames[i])) elif "RA3" in ras[i]['id']: containment.append((ra_updated_title, ra_filenames[i])) elif "RA4" in ras[i]['id']: eradication.append((ra_updated_title, ra_filenames[i])) elif "RA5" in ras[i]['id']: recovery.append((ra_updated_title, ra_filenames[i])) elif "RA6" in ras[i]['id']: lessons_learned.append((ra_updated_title, ra_filenames[i])) stages = [(stage_name.replace('_', ' ').capitalize(), sorted(stage_list)) for stage_name, stage_list in stages] for i in range(len(rps)): rp_updated_title = rps[i].get('id')\ + ": "\ + REACTutils.normalize_react_title(rps[i].get('title'),REACTConfig.get('titlefmtrules')) playbooks.append((rp_updated_title, rp_filenames[i])) rs_list = [] for i in range(len(rss)): rs_title = rss[i].get('title') rs_id = rss[i].get('id') rs_list.append((rs_title, rs_id)) data_to_render.update({'stages': stages}) data_to_render.update({'playbooks': sorted(playbooks)}) data_to_render.update({'rs_list': rs_list}) content = template.render(data_to_render) try: REACTutils.write_file('mkdocs.yml', content) print("[+] Created mkdocs.yml") except: print("[-] Failed to create mkdocs.yml")
def __init__(self, ra=False, rp=False, auto=False, ra_path=False, rp_path=False, atc_dir=False, init=False): """Init""" # Check if atc_dir provided if atc_dir: self.atc_dir = atc_dir else: self.atc_dir = REACTConfig.get('md_name_of_root_directory') + '/' # Main logic if auto: self.response_action(ra_path) self.response_playbook(rp_path) if ra: self.response_action(ra_path) if rp: self.response_playbook(rp_path) if ra_path: ras, ra_paths = REACTutils.load_yamls_with_paths(ra_path) else: ras, ra_paths = REACTutils.load_yamls_with_paths( REACTConfig.get('response_actions_dir')) if rp_path: rps, rp_paths = REACTutils.load_yamls_with_paths(rp_path) else: rps, rp_paths = REACTutils.load_yamls_with_paths( REACTConfig.get('response_playbooks_dir')) ra_filenames = [ ra_path.split('/')[-1].replace('.yml', '') for ra_path in ra_paths ] rp_filenames = [ rp_path.split('/')[-1].replace('.yml', '') for rp_path in rp_paths ] _preparation = [] _identification = [] _containment = [] _eradication = [] _recovery = [] _lessons_learned = [] stages = [('preparation', _preparation), ('identification', _identification), ('containment', _containment), ('eradication', _eradication), ('recovery', _recovery), ('lessons_learned', _lessons_learned)] for i in range(len(ras)): normalized_title = REACTutils.normalize_react_title( ras[i].get('title'), REACTConfig.get('titlefmtrules')) ra_updated_title = ras[i].get('id')\ + ":"\ + normalized_title if "RA1" in ras[i]['id']: stage = 'preparation' elif "RA2" in ras[i]['id']: stage = 'identification' elif "RA3" in ras[i]['id']: stage = 'containment' elif "RA4" in ras[i]['id']: stage = 'eradication' elif "RA5" in ras[i]['id']: stage = 'recovery' elif "RA6" in ras[i]['id']: stage = 'lessons-learned' kill_chain_phases = [{ "kill_chain_name": 'atc-react', "phase_name": stage }] external_references = [{ "source_name": "atc-react", "external_id": ras[i].get('id'), "url": react_web_kb_base_url + "Response_Actions/" + ra_filenames[i] }] ra = ReactAction(name=normalized_title, description=ras[i].get('description'), external_references=external_references, kill_chain_phases=kill_chain_phases, x_mitre_platforms=['Windows', 'Linux', 'macOS'], allow_custom=True) stix_mem.add(ra) stix_mem.add([ preparation, identification, containment, eradication, recovery, lessons_learned ]) stix_mem.add(react_matrix) try: stix_mem.save_to_file(local_react_json_url) print("[+] Created react.json STIX file") except: print("[-] Failed to create react.json STIX file")