Skip to content

Commit 67ee4c9

Browse files
romain-filigranromain-filigran
authored
Dev 1.1.2 (#22)
* #21 * update filigran-sseclient version * change version to 1.1.2
1 parent 62edb0a commit 67ee4c9

File tree

16 files changed

+111
-74
lines changed

16 files changed

+111
-74
lines changed

‎README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@ The app is installed
1818

1919
### Installing from file
2020

21-
1. Download latest version of the Splunk App: [TA-opencti-add-on-1.1.1.spl](https://github.com/OpenCTI-Platform/splunk-add-on/releases/download/1.1.1/TA-opencti-add-on-1.1.1.spl)
21+
1. Download latest version of the Splunk App: [TA-opencti-add-on-1.1.2.spl](https://github.com/OpenCTI-Platform/splunk-add-on/releases/download/1.1.2/TA-opencti-add-on-1.1.2.spl)
2222
2. Log in to the Splunk Web UI and navigate to "Apps" and click on "Manage Apps"
2323
3. Click "Install app from file"
24-
4. Choose file and select the "TA-opencti-add-on-1.1.1.spl" file
24+
4. Choose file and select the "TA-opencti-add-on-1.1.2.spl" file
2525
5. Click on Upload
2626
The app is installed
2727

‎TA-opencti-add-on/app.manifest

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"id": {
66
"group": null,
77
"name": "TA-opencti-add-on",
8-
"version": "1.1.1"
8+
"version": "1.1.2"
99
},
1010
"author": [
1111
{

‎TA-opencti-add-on/appserver/static/js/build/globalConfig.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"meta": {
33
"name": "TA-opencti-add-on",
44
"displayName": "OpenCTI Add-on",
5-
"version": "1.1.1",
5+
"version": "1.1.2",
66
"restRoot": "TA_opencti_add_on",
77
"_uccVersion": "5.39.0",
88
"schemaVersion": "0.0.3"

‎TA-opencti-add-on/appserver/static/openapi.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"openapi": "3.0.0",
33
"info": {
44
"title": "TA-opencti-add-on",
5-
"version": "1.1.1",
5+
"version": "1.1.2",
66
"description": "OpenCTI Add-on",
77
"contact": {
88
"name": "Filigran"

‎TA-opencti-add-on/bin/input_module_opencti_indicators.py

Lines changed: 52 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# encoding = utf-8
22
import json
33
import sys
4+
import time
45
from datetime import datetime, timezone, timedelta
56

67
import six
@@ -141,7 +142,6 @@ def enrich_payload(splunk_helper, payload):
141142
return None
142143
payload["type"] = parsed_stix["type"]
143144
payload["value"] = parsed_stix["value"]
144-
payload["value"] = parsed_stix["value"]
145145

146146
if "extensions" in payload:
147147
for extension_definition in payload["extensions"].values():
@@ -160,6 +160,10 @@ def enrich_payload(splunk_helper, payload):
160160
payload["_key"] = attribute_value
161161
else:
162162
payload[attribute_name] = attribute_value
163+
164+
if "detection" not in payload:
165+
payload["detection"] = False
166+
163167
# remove extensions
164168
del payload["extensions"]
165169

@@ -324,44 +328,54 @@ def collect_events(helper, ew):
324328
)
325329

326330
for msg in messages:
327-
if msg.event in ["create", "update", "delete"]:
328-
data = json.loads(msg.data)["data"]
329-
if data['type'] == "indicator" and data['pattern_type'] == "stix":
330-
parsed_stix = enrich_payload(helper, data)
331-
if parsed_stix is None:
332-
helper.log_error(f"Unable to process indicator: {data['name']} - {data['pattern']}")
333-
continue
334-
helper.log_info("processing msg: " + msg.event + " - " + msg.id + " - " + parsed_stix['name']
335-
+ " - " + parsed_stix['pattern'])
336-
if msg.event == "create" or msg.event == "update":
337-
exist = exist_in_kvstore(kv_store, parsed_stix["_key"])
338-
if exist:
339-
kv_store.update(parsed_stix["_key"], parsed_stix)
340-
else:
331+
try:
332+
if msg.event in ["create", "update", "delete"]:
333+
data = json.loads(msg.data)["data"]
334+
if data['type'] == "indicator" and data['pattern_type'] == "stix":
335+
parsed_stix = enrich_payload(helper, data)
336+
if parsed_stix is None:
337+
helper.log_error(f"Unsupported indicator pattern: {data['name']} - {data['pattern']}")
338+
continue
339+
helper.log_info("processing msg: " + msg.event + " - " + msg.id + " - " + parsed_stix['name']
340+
+ " - " + parsed_stix['pattern'])
341+
if msg.event == "create" or msg.event == "update":
342+
# update code to use bach_save
341343
parsed_stix['added_at'] = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
342-
kv_store.insert(parsed_stix)
343-
if msg.event == "delete":
344-
exist = exist_in_kvstore(kv_store, parsed_stix["_key"])
345-
if exist:
346-
kv_store.delete_by_id(parsed_stix["_key"])
347-
348-
if data['type'] == "marking-definition":
349-
helper.log_info("processing msg: " + msg.event + " - " + msg.id +" - "
350-
+ data['name'] + " - " + data['id'])
351-
if msg.event == "create" or msg.event == "update":
352-
if data['id'] not in MARKING_DEFs:
353-
MARKING_DEFs[data['id']] = data['name']
354-
355-
if data['type'] == "identity":
356-
helper.log_info("processing msg: " + msg.event + " - " + msg.id + " - "
357-
+ data['name'] + " - " + data['id'])
358-
if msg.event == "create" or msg.event == "update":
359-
if data['id'] not in IDENTITY_DEFs:
360-
IDENTITY_DEFs[data['id']] = data['name']
361-
362-
# update checkpoint (take 0:00:00.005544 to update)
363-
state["start_from"] = msg.id
364-
helper.save_check_point(input_name, json.dumps(state))
344+
kv_store.batch_save(*[parsed_stix])
345+
"""
346+
exist = exist_in_kvstore(kv_store, parsed_stix["_key"])
347+
if exist:
348+
parsed_stix['added_at'] = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
349+
kv_store.update(parsed_stix["_key"], parsed_stix)
350+
else:
351+
parsed_stix['added_at'] = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
352+
kv_store.insert(parsed_stix)
353+
"""
354+
if msg.event == "delete":
355+
exist = exist_in_kvstore(kv_store, parsed_stix["_key"])
356+
if exist:
357+
kv_store.delete_by_id(parsed_stix["_key"])
358+
359+
if data['type'] == "marking-definition":
360+
helper.log_info("processing msg: " + msg.event + " - " + msg.id +" - "
361+
+ data['name'] + " - " + data['id'])
362+
if msg.event == "create" or msg.event == "update":
363+
if data['id'] not in MARKING_DEFs:
364+
MARKING_DEFs[data['id']] = data['name']
365+
366+
if data['type'] == "identity":
367+
helper.log_info("processing msg: " + msg.event + " - " + msg.id + " - "
368+
+ data['name'] + " - " + data['id'])
369+
if msg.event == "create" or msg.event == "update":
370+
if data['id'] not in IDENTITY_DEFs:
371+
IDENTITY_DEFs[data['id']] = data['name']
372+
373+
# update checkpoint (take 0:00:00.005544 to update)
374+
state["start_from"] = msg.id
375+
helper.save_check_point(input_name, json.dumps(state))
376+
except Exception as ex:
377+
helper.log_debug(f"Error when processing message, reason: {ex}, msg: {msg}")
378+
365379
except Exception as ex:
366380
helper.log_error(f"Error in ListenStream loop, exit, reason: {ex}")
367381
sys.excepthook(*sys.exc_info())

‎TA-opencti-add-on/bin/ta_opencti_add_on/aob_py3/filigran_sseclient-1.0.1.dist-info/RECORD

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎TA-opencti-add-on/bin/ta_opencti_add_on/aob_py3/filigran_sseclient-1.0.1.dist-info/INSTALLER renamed to ‎TA-opencti-add-on/bin/ta_opencti_add_on/aob_py3/filigran_sseclient-1.0.2.dist-info/INSTALLER

File renamed without changes.

‎TA-opencti-add-on/bin/ta_opencti_add_on/aob_py3/filigran_sseclient-1.0.1.dist-info/LICENSE renamed to ‎TA-opencti-add-on/bin/ta_opencti_add_on/aob_py3/filigran_sseclient-1.0.2.dist-info/LICENSE

File renamed without changes.

‎TA-opencti-add-on/bin/ta_opencti_add_on/aob_py3/filigran_sseclient-1.0.1.dist-info/METADATA renamed to ‎TA-opencti-add-on/bin/ta_opencti_add_on/aob_py3/filigran_sseclient-1.0.2.dist-info/METADATA

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Metadata-Version: 2.1
2-
Name: filigran-sseclient
3-
Version: 1.0.1
2+
Name: filigran_sseclient
3+
Version: 1.0.2
44
Summary: Python API client for OpenCTI.
55
Home-page: https://github.com/FiligranHQ/filigran-sseclient
66
Author: Filigran
@@ -15,24 +15,24 @@ Classifier: Programming Language :: Python :: 3
1515
Requires-Python: >=3.7
1616
Description-Content-Type: text/markdown
1717
License-File: LICENSE
18-
Requires-Dist: requests (>=2.9)
18+
Requires-Dist: requests>=2.9
1919
Requires-Dist: six
2020
Provides-Extra: dev
21-
Requires-Dist: black (~=23.1.0) ; extra == 'dev'
22-
Requires-Dist: build (~=0.8.0) ; extra == 'dev'
23-
Requires-Dist: isort (~=5.10.1) ; extra == 'dev'
24-
Requires-Dist: types-pytz (~=2022.2.1.0) ; extra == 'dev'
25-
Requires-Dist: pre-commit (~=2.20.0) ; extra == 'dev'
26-
Requires-Dist: pytest-cases (~=3.6.13) ; extra == 'dev'
27-
Requires-Dist: pytest-cov (~=3.0.0) ; extra == 'dev'
28-
Requires-Dist: pytest-randomly (~=3.12.0) ; extra == 'dev'
29-
Requires-Dist: pytest (~=7.1.2) ; extra == 'dev'
30-
Requires-Dist: types-python-dateutil (~=2.8.19) ; extra == 'dev'
31-
Requires-Dist: wheel (~=0.37.1) ; extra == 'dev'
21+
Requires-Dist: black~=23.1.0; extra == "dev"
22+
Requires-Dist: build~=0.8.0; extra == "dev"
23+
Requires-Dist: isort~=5.10.1; extra == "dev"
24+
Requires-Dist: types-pytz~=2022.2.1.0; extra == "dev"
25+
Requires-Dist: pre-commit~=2.20.0; extra == "dev"
26+
Requires-Dist: pytest-cases~=3.6.13; extra == "dev"
27+
Requires-Dist: pytest-cov~=3.0.0; extra == "dev"
28+
Requires-Dist: pytest_randomly~=3.12.0; extra == "dev"
29+
Requires-Dist: pytest~=7.1.2; extra == "dev"
30+
Requires-Dist: types-python-dateutil~=2.8.19; extra == "dev"
31+
Requires-Dist: wheel~=0.37.1; extra == "dev"
3232
Provides-Extra: doc
33-
Requires-Dist: autoapi (~=2.0.1) ; extra == 'doc'
34-
Requires-Dist: sphinx-autodoc-typehints (~=1.19.2) ; extra == 'doc'
35-
Requires-Dist: sphinx-rtd-theme (~=1.0.0) ; extra == 'doc'
33+
Requires-Dist: autoapi~=2.0.1; extra == "doc"
34+
Requires-Dist: sphinx-autodoc-typehints~=1.19.2; extra == "doc"
35+
Requires-Dist: sphinx-rtd-theme~=1.0.0; extra == "doc"
3636

3737
# Filigran Python SSE Client
3838

‎TA-opencti-add-on/bin/ta_opencti_add_on/aob_py3/filigran_sseclient-1.0.2.dist-info/RECORD

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
filigran_sseclient-1.0.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
2+
filigran_sseclient-1.0.2.dist-info/LICENSE,sha256=JG5WIzhHLJEXmX111sTkQJuE9v2uaeXJYJTZrr4yC04,1088
3+
filigran_sseclient-1.0.2.dist-info/METADATA,sha256=thig25fwpl0q-_1dOHx5gaDsyO_cFDuWZbw-NdijLRo,1855
4+
filigran_sseclient-1.0.2.dist-info/RECORD,,
5+
filigran_sseclient-1.0.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
6+
filigran_sseclient-1.0.2.dist-info/WHEEL,sha256=PZUExdf71Ui_so67QXpySuHtCi3-J3wvF4ORK6k_S8U,91
7+
filigran_sseclient-1.0.2.dist-info/top_level.txt,sha256=EwGXWyTELjIDm1mFTyFaYbegkrIeIX2aFdj4_hrdOWU,19
8+
filigran_sseclient/__init__.py,sha256=q8VnSpp7lBMfkUxCzf6hsuMSfqNM365xFgwC-xdR2m4,120
9+
filigran_sseclient/__pycache__/__init__.cpython-312.pyc,,
10+
filigran_sseclient/__pycache__/sseclient.cpython-312.pyc,,
11+
filigran_sseclient/sseclient.py,sha256=Mlp6p4N5wP5T6eIAlfINw_JzDW1J42HzltflQ5lQh-U,7886

0 commit comments

Comments
 (0)