Skip to content

Commit cffde2d

Browse files
NoamBAquaNoamBAqua
authored
Merge pull request #659 from aquasecurity/incident-email-template
add incident-html template
2 parents eadc601 + 84d67bb commit cffde2d

File tree

2 files changed

+136
-233
lines changed

2 files changed

+136
-233
lines changed

‎rego-templates/incident-html.rego‎

Lines changed: 136 additions & 224 deletions
Original file line numberDiff line numberDiff line change
@@ -1,242 +1,154 @@
11
package postee.incident.html
22

33
import data.postee.with_default
4+
import future.keywords.in
5+
import future.keywords.if
46

5-
############################################## Templates ################################################
7+
capitalize(str) := sprintf("%s%s", [upper(substring(str, 0, 1)), lower(substring(str, 1, -1))])
68

7-
# Main template to render message
8-
tpl := `
9+
# Outlook for windows use word for HTML rendering, so all styles have to be inline
10+
info_table(label1, value1, label2, value2) := sprintf(`
11+
<table width="100%%" border="0" cellpadding="4" cellspacing="0" style="width: 100%%; border-collapse: collapse; table-layout: fixed;">
12+
<tr>
13+
<td style="font-size: 15px; width: 40%%; padding: 10px 4px; color: #6B7887; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;"><strong>%s:</strong> %s</td>
14+
<td style="font-size: 15px; width: 40%%; padding: 10px 4px; color: #6B7887; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;"><strong>%s:</strong> %s</td>
15+
</tr>
16+
</table>
17+
`, [label1, value1, label2, value2])
18+
19+
severity_color := "#FF0036" if {
20+
input.severity_score == 3
21+
} else := "#BB0505"
22+
23+
parsed_data := json.unmarshal(input.data)
24+
25+
html_tpl := `
926
<!DOCTYPE html>
1027
<html lang="en">
1128
<head>
1229
<meta charset="UTF-8">
13-
%s
1430
<title>Incident Report</title>
1531
</head>
1632
<body>
17-
<div class="incident-container">
18-
<!-- Thin Red Line -->
19-
<div class="severity-indicator"></div>
20-
21-
<!-- Severity Box -->
22-
<div class="severity-box">
23-
<span style="font-size: 23px">%s</span> <br> <span style="font-size: 13px">%s Severity</span>
24-
</div>
25-
26-
<!-- Logo -->
27-
<div class="logo">
28-
%s
29-
</div>
30-
31-
<!-- Incident Overview -->
32-
<div class="section">
33-
<h3>Incident Overview</h3>
34-
<div class="info-grid divider">
35-
<p><strong>Category:</strong> %s</p>
36-
<p><strong>Host Name:</strong> %s</p>
37-
</div>
38-
<div class="info-grid divider">
39-
<p><strong>Type:</strong> %s</p>
40-
<p><strong>Host ID:</strong> %s</p>
41-
</div>
42-
<div class="info-grid">
43-
<p><strong>Name:</strong> %s</p>
44-
<p><strong>URL:</strong> <a href="%s">%s</a></p>
45-
<p><strong>Result:</strong> %s</p>
46-
</div>
47-
</div>
48-
49-
<!-- Malware Detection -->
50-
<div class="section">
51-
<h3>Malware Detection</h3>
52-
<div class="info-grid divider">
53-
<p><strong>Malware Name:</strong> %s</p>
54-
<p><strong>Host IP:</strong> %s</p>
55-
</div>
56-
<div class="info-grid divider">
57-
<p><strong>Malware Type:</strong> %s</p>
58-
<p><strong>Action:</strong> %s</p>
59-
</div>
60-
<div class="info-grid divider">
61-
<p><strong>Scan Type:</strong> %s</p>
62-
<p><strong>Level:</strong> %s</p>
63-
</div>
64-
<div class="info-grid">
65-
<p><strong>Resource:</strong> %s</p>
66-
<p><strong>Cluster:</strong> %s</p>
67-
</div>
68-
</div>
69-
70-
<!-- Attack Details -->
71-
<div class="section">
72-
<h3>Attack Details</h3>
73-
<p><strong>Tactics:</strong> %s</p>
74-
<p><strong>Techniques:</strong> %s</p>
75-
<p><strong>Rule Type:</strong> %s</p>
76-
</div>
77-
78-
<!-- Policy Information -->
79-
<div class="section policy-details">
80-
<p><strong>Response Policy Name:</strong> %s</p>
81-
<p><strong>Application Scope:</strong> %s</p>
82-
</div>
83-
84-
<div class="copyright">
85-
Copyright (C) 2022 Aqua Security Software Ltd.
86-
</div>
87-
</div>
33+
%s
8834
</body>
8935
</html>
9036
`
9137

92-
# Style definition with dynamic colors based on severity_score
93-
style := sprintf(`
94-
<style>
95-
body {
96-
font-family: Helvetica;
97-
margin: 0;
98-
padding: 0;
99-
color: #333;
100-
background-color: #f8f8f8;
101-
}
102-
103-
.incident-container {
104-
margin: 20px auto;
105-
padding: 20px;
106-
background-color: #fff;
107-
border-radius: 8px;
108-
box-shadow: 0px 4px 6px rgba(0, 0, 0, 0.1);
109-
max-width: 800px;
110-
}
111-
112-
.severity-indicator {
113-
background-color: %s;
114-
height: 5px;
115-
width: 100%%;
116-
margin: 0;
117-
}
118-
119-
.severity-box {
120-
margin-left: 44px;
121-
display: inline-block;
122-
background-color: %s;
123-
color: #fff;
124-
padding: 10px 15px;
125-
font-size: 18px;
126-
font-weight: bold;
127-
border-bottom-left-radius: 7px;
128-
border-bottom-right-radius: 7px;
129-
text-align: center;
130-
margin-bottom: 20px;
131-
}
132-
133-
.logo {
134-
text-align: center;
135-
margin: 20px 0;
136-
}
137-
138-
.logo img {
139-
height: 40px;
140-
}
141-
142-
h3 {
143-
color: #183278;
144-
margin-top: 30px;
145-
}
146-
147-
.section {
148-
margin-bottom: 20px;
149-
margin-left: 44px;
150-
color: #6B7887;
151-
}
152-
153-
.divider {
154-
border-bottom: 1px solid #F3F5F9;
155-
width: 100%%;
156-
margin-bottom: 20px;
157-
}
158-
159-
.info-grid {
160-
display: grid;
161-
grid-template-columns: 1fr 1fr;
162-
gap: 1rem;
163-
}
164-
165-
.info-grid p {
166-
display: inline-block;
167-
vertical-align: middle;
168-
max-width: 290px;
169-
white-space: nowrap;
170-
overflow: hidden;
171-
text-overflow: ellipsis;
172-
}
173-
174-
.policy-details {
175-
display: flex;
176-
justify-content: space-between;
177-
padding-right: 100px;
178-
}
179-
180-
.policy-details p {
181-
overflow-wrap: break-word;
182-
word-wrap: break-word;
183-
white-space: normal;
184-
}
185-
186-
.copyright {
187-
color: #405a75;
188-
font-family: "Inter-SemiBold", sans-serif;
189-
font-size: 15px;
190-
line-height: 26px;
191-
font-weight: 600;
192-
margin-top: 30px;
193-
text-align: center;
194-
}
195-
</style>
196-
`, [severity_color, severity_color])
197-
198-
logo := `<img
199-
class="aqua-logo"
200-
src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTEwIiBoZWlnaHQ9IjM1IiB2aWV3Qm94PSIwIDAgODggMjUiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CiAgPGcgY2xpcC1wYXRoPSJ1cmwoI2NsaXAwXzE0OTRfMTIzNjgpIj4KICAgIDxwYXRoIGQ9Ik0xNi45MDk5IDEwLjYxMjFWMS41NTEyOEMxNi45MTAxIDEuNDY1MTEgMTYuODkzMiAxLjM3OTc0IDE2Ljg2MDMgMS4zMDAwOUMxNi44MjczIDEuMjIwNDQgMTYuNzc4OSAxLjE0ODA3IDE2LjcxNzggMS4wODcxNEMxNi42NTY3IDEuMDI2MjEgMTYuNTg0MSAwLjk3NzkxIDE2LjUwNDIgMC45NDUwMjRDMTYuNDI0MyAwLjkxMjEzOSAxNi4zMzg3IDAuODk1MzEyIDE2LjI1MjMgMC44OTU1MUgxMy4xMjIxVjEzLjM4MTNDMTMuMTIyMSAxMy44ODM1IDEzLjczMDggMTQuMTM0NSAxNC4wODQxIDEzLjc3ODVMMTYuNjYxOSAxMS4yMDc5QzE2Ljc0MDUgMTEuMTI5NyAxNi44MDI4IDExLjAzNjkgMTYuODQ1NCAxMC45MzQ2QzE2Ljg4NzkgMTAuODMyNCAxNi45MDk5IDEwLjcyMjggMTYuOTA5OSAxMC42MTIxWiIgZmlsbD0iI0ZGMDAzNiI+PC9wYXRoPgogICAgPHBhdGggZD0iTTEzLjEyMiAwLjg5NTUwOEg3LjE2OTdDNy4wNTg3IDAuODk1NTY0IDYuOTQ4NzkgMC45MTc0MzYgNi44NDYyNyAwLjk1OTg3MkM2Ljc0Mzc1IDEuMDAyMzEgNi42NTA2MiAxLjA2NDQ4IDYuNTcyMjEgMS4xNDI4M0wzLjk5NDM2IDMuNzEzNDRDMy42NDExMyA0LjA2NTY4IDMuODg5MTUgNC42NzI3MyA0LjM5MjY5IDQuNjcyNzNIMTMuMTI1OFYwLjg5NTUwOEgxMy4xMjJaIiBmaWxsPSIjRkZDOTAwIj48L3BhdGg+CiAgICA8cGF0aCBkPSJNOS43NDM5NiAxNy43NTc3SDAuNjU3NjE1QzAuNTcxMjAxIDE3Ljc1NzkgMC40ODU1OTggMTcuNzQxMSAwLjQwNTcyMyAxNy43MDgyQzAuMzI1ODQ5IDE3LjY3NTMgMC4yNTMyNzUgMTcuNjI3IDAuMTkyMTcgMTcuNTY2MUMwLjEzMTA2NiAxNy41MDUxIDAuMDgyNjMzOSAxNy40MzI4IDAuMDQ5NjU1OSAxNy4zNTMxQzAuMDE2Njc3OSAxNy4yNzM1IC0wLjAwMDE5NjQ3NCAxNy4xODgxIDEuNzI1OWUtMDYgMTcuMTAxOVYxMy45ODA1SDEyLjUyMUMxMy4wMjQ1IDEzLjk4MDUgMTMuMjc2MyAxNC41ODc1IDEyLjkxOTMgMTQuOTM5OEwxMC4zNDE0IDE3LjUxMDRDMTAuMjYzMSAxNy41ODg4IDEwLjE3IDE3LjY1MTEgMTAuMDY3NSAxNy42OTM1QzkuOTY0OTMgMTcuNzM2IDkuODU0OTggMTcuNzU3OCA5Ljc0Mzk2IDE3Ljc1NzdaIiBmaWxsPSIjMTkwNERBIj48L3BhdGg+CiAgICA8cGF0aCBkPSJNMCAxMy45ODEyVjguMDQ1NThDNS42ODI1NmUtMDUgNy45MzQ4OCAwLjAyMTk5MDIgNy44MjUyOSAwLjA2NDU0NjEgNy43MjMwNkMwLjEwNzEwMiA3LjYyMDgyIDAuMTY5NDQ2IDcuNTI3OTYgMC4yNDgwMTQgNy40NDk3NkwyLjgyNTg2IDQuODc5MTVDMy4xNzkwOSA0LjUyNjkxIDMuNzg3ODYgNC43NzQyMyAzLjc4Nzg2IDUuMjc2MzZWMTMuOTg1TDAgMTMuOTgxMloiIGZpbGw9IiMwOEIxRDUiPjwvcGF0aD4KICAgIDxwYXRoIGQ9Ik0zNi44MTg4IDE2LjkyNjRIMjkuMTk4QzI0Ljk5NjcgMTYuOTI2NCAyMS41NzcxIDEzLjUxNjQgMjEuNTc3MSA5LjMyNjk1QzIxLjU3NzEgNS4xMzc1MyAyNC45OTY3IDEuNzI3NTQgMjkuMTk4IDEuNzI3NTRDMzMuMzk5MiAxLjcyNzU0IDM2LjgxODggNS4xMzc1MyAzNi44MTg4IDkuMzI2OTVWMTYuOTI2NFpNMjkuMTk4IDQuODE1MjdDMjguNjAzOCA0LjgxNTI3IDI4LjAxNTUgNC45MzE5NyAyNy40NjY1IDUuMTU4N0MyNi45MTc2IDUuMzg1NDMgMjYuNDE4OSA1LjcxNzc2IDI1Ljk5ODcgNi4xMzY3MUMyNS41Nzg2IDYuNTU1NjYgMjUuMjQ1MyA3LjA1MzAyIDI1LjAxOCA3LjYwMDQxQzI0Ljc5MDYgOC4xNDc3OSAyNC42NzM2IDguNzM0NDcgMjQuNjczNiA5LjMyNjk1QzI0LjY3MzYgOS45MTk0MyAyNC43OTA2IDEwLjUwNjEgMjUuMDE4IDExLjA1MzVDMjUuMjQ1MyAxMS42MDA5IDI1LjU3ODYgMTIuMDk4MiAyNS45OTg3IDEyLjUxNzJDMjYuNDE4OSAxMi45MzYxIDI2LjkxNzYgMTMuMjY4NSAyNy40NjY1IDEzLjQ5NTJDMjguMDE1NSAxMy43MjE5IDI4LjYwMzggMTMuODM4NiAyOS4xOTggMTMuODM4NkgzMy43MjIzVjkuMzI2OTVDMzMuNzIxMSA4LjEzMDc0IDMzLjI0NDEgNi45ODM4NyAzMi4zOTU5IDYuMTM4MDNDMzEuNTQ3NiA1LjI5MjE4IDMwLjM5NzUgNC44MTY0NiAyOS4xOTggNC44MTUyN1oiIGZpbGw9IiMwNzI0MkQiPjwvcGF0aD4KICAgIDxwYXRoIGQ9Ik04Ny45OTk5IDE2LjkyNjRIODAuMzc5MUM3Ni4xNzc5IDE2LjkyNjQgNzIuNzU4MyAxMy41MTY0IDcyLjc1ODMgOS4zMjY5NUM3Mi43NTgzIDUuMTM3NTMgNzYuMTc3OSAxLjcyNzU0IDgwLjM3OTEgMS43Mjc1NEM4NC41ODAzIDEuNzI3NTQgODcuOTk5OSA1LjEzNzUzIDg3Ljk5OTkgOS4zMjY5NVYxNi45MjY0Wk04MC4zNzkxIDQuODE1MjdDNzkuMTc5MiA0LjgxNTI3IDc4LjAyODQgNS4yOTA2MSA3Ny4xNzk5IDYuMTM2NzFDNzYuMzMxNCA2Ljk4MjgxIDc1Ljg1NDcgOC4xMzAzOCA3NS44NTQ3IDkuMzI2OTVDNzUuODU0NyAxMC41MjM1IDc2LjMzMTQgMTEuNjcxMSA3Ny4xNzk5IDEyLjUxNzJDNzguMDI4NCAxMy4zNjMzIDc5LjE3OTIgMTMuODM4NiA4MC4zNzkxIDEzLjgzODZIODQuOTAzNVY5LjMyNjk1Qzg0LjkwNzIgNi44Mzg3OCA4Mi44NzQzIDQuODE1MjcgODAuMzc5MSA0LjgxNTI3WiIgZmlsbD0iIzA3MjQyRCI+PC9wYXRoPgogICAgPHBhdGggZD0iTTYzLjI3MDEgMTYuOTMwNUM1OS4wNjUxIDE2LjkzMDUgNTUuNjQ1NSAxMy41MjA1IDU1LjY0NTUgOS4zMjczVjIuMTk2MjlINTguNzQxOVY5LjMyNzNDNTguNzQxOSAxMS44MTU1IDYwLjc3NDkgMTMuODQyNyA2My4yNzAxIDEzLjg0MjdDNjUuNzY1MiAxMy44NDI3IDY3Ljc5ODIgMTEuODE1NSA2Ny43OTgyIDkuMzI3M1YyLjE5NjI5SDcwLjg5NDZWOS4zMjczQzcwLjg5NDYgMTMuNTIwNSA2Ny40NzUgMTYuOTMwNSA2My4yNzAxIDE2LjkzMDVaIiBmaWxsPSIjMDcyNDJEIj48L3BhdGg+CiAgICA8cGF0aCBkPSJNNDYuMjQzNCAxLjcyNzU0QzQyLjA0MjEgMS43Mjc1NCAzOC42MjI2IDUuMTM3NTMgMzguNjIyNiA5LjMyNjk1QzM4LjYyMjYgMTMuNTE2NCA0Mi4wNDIxIDE2LjkyNjQgNDYuMjQzNCAxNi45MjY0TDQ5LjMzOTggMTMuODM4Nkg0Ni4yNDM0QzQ1LjM0ODUgMTMuODM4NiA0NC40NzM4IDEzLjU3NCA0My43Mjk3IDEzLjA3ODNDNDIuOTg1NyAxMi41ODI1IDQyLjQwNTggMTEuODc3OSA0Mi4wNjM0IDExLjA1MzVDNDEuNzIwOSAxMC4yMjkxIDQxLjYzMTMgOS4zMjE5NSA0MS44MDU5IDguNDQ2NzdDNDEuOTgwNSA3LjU3MTU5IDQyLjQxMTQgNi43Njc2OCA0My4wNDQxIDYuMTM2NzFDNDMuNjc2OSA1LjUwNTc0IDQ0LjQ4MzEgNS4wNzYwNCA0NS4zNjA3IDQuOTAxOTZDNDYuMjM4MyA0LjcyNzg4IDQ3LjE0OCA0LjgxNzIyIDQ3Ljk3NDggNS4xNTg3QzQ4LjgwMTUgNS41MDAxOCA0OS41MDgxIDYuMDc4NDUgNTAuMDA1MiA2LjgyMDM5QzUwLjUwMjQgNy41NjIzNCA1MC43Njc3IDguNDM0NjIgNTAuNzY3NyA5LjMyNjk1VjI0LjE4MUg1My44NjQyVjkuMzI2OTVDNTMuODY0MiA1LjEzNzUzIDUwLjQ0NDYgMS43Mjc1NCA0Ni4yNDM0IDEuNzI3NTRaIiBmaWxsPSIjMDcyNDJEIj48L3BhdGg+CiAgPC9nPgogIDxkZWZzPgogICAgPGNsaXBQYXRoIGlkPSJjbGlwMF8xNDk0XzEyMzY4Ij4KICAgICAgPHJlY3Qgd2lkdGg9Ijg4IiBoZWlnaHQ9IjIzLjI4NTQiIGZpbGw9IndoaXRlIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwIDAuODk1NTA4KSI+PC9yZWN0PgogICAgPC9jbGlwUGF0aD4KICA8L2RlZnM+Cjwvc3ZnPg=="
201-
alt="aqua"
202-
/>`
203-
204-
205-
# Determine colors based on input.severity_score
206-
severity_color = "#FF0036" {
207-
input.severity_score == 3
208-
} else = "#BB0505"
209-
210-
title:="Incident Detection"
38+
severity_indicator := sprintf(`
39+
<div style="height: 5px; background-color: %s; width: 100%%;"></div>
40+
`, [severity_color])
21141

212-
parsed_data := json.unmarshal(input.data)
42+
severity_box := sprintf(`
43+
<div style="padding-left: 44px; padding-bottom: 10px;">
44+
<div style="margin-left: 44px; display: inline-block; background-color: %s; color: #fff; font-weight: bold; border-bottom-left-radius: 7px; border-bottom-right-radius: 7px; width: 130px; height: 65px; text-align: center; margin-bottom: 20px; padding-top: 10px;">
45+
<span style="font-size: 28px;">%v</span><br>
46+
<span style="font-size: 16px;">%s</span>
47+
</div>
48+
</div>
49+
`, [severity_color, input.severity_score, capitalize(input.severity)])
21350

214-
result = msg {
215-
msg := sprintf(tpl, [
216-
style,
217-
sprintf("%v", [input.severity_score]),
218-
input.severity,
219-
logo,
220-
input.category,
221-
input.host,
222-
input.type,
223-
input.hostid,
224-
input.name,
225-
input.url,
226-
input.url,
227-
sprintf("%v", [with_default(parsed_data, "result", 0)]),
228-
parsed_data.malware,
229-
parsed_data.hostip,
230-
parsed_data.malware_type,
231-
parsed_data.action,
232-
parsed_data.malware_scan_type,
233-
parsed_data.level,
234-
parsed_data.resource,
235-
input.cluster,
236-
parsed_data.tactic,
237-
parsed_data.technique,
238-
parsed_data.rule_type,
239-
input.response_policy_name,
240-
concat(", ", with_default(input, "application_scope", []))
241-
])
242-
}
51+
logo := `
52+
<div align="center" style="padding-top: 20px; padding-bottom: 20px;">
53+
<img src="https://get.aquasec.com/aqua_email_logo.png" alt="Aqua Security" width="120" style="display: block;" />
54+
</div>
55+
`
56+
57+
policy_info := sprintf(`
58+
<div style="padding-left: 44px; padding-bottom: 20px; color: #6B7887;">
59+
<h3 style="color: #183278; margin: 0;">Policy Information</h3>
60+
%s
61+
</div>
62+
`, [info_table("Response Policy Name", input.response_policy_name, "Application Scope", concat(", ", with_default(input, "application_scope", [])))])
63+
64+
incident_overview := sprintf(`
65+
<div style="padding-left: 44px; padding-bottom: 20px; color: #6B7887;">
66+
<h3 style="color: #183278; margin: 0;">Incident Overview</h3>
67+
%s
68+
</div>
69+
`, [concat("", [
70+
info_table("Type", capitalize(input.main_category), "Name Space", with_default(input, "namespace", "")),
71+
info_table("Category", with_default(input, "category", ""), "Deployment", with_default(input, "deployment", "")),
72+
info_table("Incident Name", with_default(input, "name", ""), "Host Name", with_default(input, "host", "")),
73+
info_table("Enforcer Group", with_default(input, "host_group", ""), "Host ID", with_default(input, "hostid", "")),
74+
info_table("Image Name", with_default(input, "image", ""), "URL", sprintf("<a href=\"%s\" style=\"color: #007BFF; text-decoration: underline;\">%s</a>", [input.url, input.url])),
75+
info_table("Cluster Name", with_default(input, "cluster", ""), "Timestamp", time.format([input.timestamp * 1000000, "", "Jan 2, 2006 03:04:05.0"]))
76+
])])
77+
78+
malware_detection_section := sprintf(`
79+
<div style="padding-left: 44px; padding-bottom: 20px; color: #6B7887;">
80+
<h3 style="color: #183278; margin: 0;">Malware Detection</h3>
81+
%s
82+
<p style="color: #6B7887; padding: 10px 4px; font-size: 15px;"><strong>Resource Digest:</strong> %s</p>
83+
<h3 style="color: #183278; margin: 0;">Attack Details</h3>
84+
<p style="color: #6B7887; padding-top: 10px; font-size: 15px;"><strong>Tactics:</strong> %s</p>
85+
<p style="color: #6B7887; padding-top: 10px; font-size: 15px;"><strong>Techniques:</strong> %s</p>
86+
<p style="color: #6B7887; padding-top: 10px; font-size: 15px;"><strong>Rule Type:</strong> %s</p>
87+
</div>
88+
`, [
89+
concat("", [
90+
info_table("Malware Name", with_default(parsed_data, "malware", ""), "Host IP", with_default(parsed_data, "hostip", "")),
91+
info_table("Malware Type", with_default(parsed_data, "malware_type", ""), "Action", with_default(parsed_data, "action", "")),
92+
info_table("Resource", with_default(parsed_data, "resource", ""), "Cluster", with_default(input, "cluster", ""))
93+
]),
94+
with_default(parsed_data, "resource_digest", ""),
95+
with_default(parsed_data, "tactic", ""),
96+
with_default(parsed_data, "technique", ""),
97+
with_default(parsed_data, "rule_type", "")
98+
])
99+
100+
runtime_control_section := sprintf(`
101+
<div style="padding-left: 44px; padding-bottom: 20px; color: #6B7887;">
102+
<h3 style="color: #183278; margin: 0;">Runtime Control</h3>
103+
%s
104+
</div>
105+
`, [concat("", [
106+
info_table("Control Name", with_default(parsed_data, "control", ""), "Container Name", with_default(input, "container", "")),
107+
info_table("Runtime Policy", with_default(parsed_data, "rule", ""), "MITRE Tactic", with_default(parsed_data, "tactic", "")),
108+
info_table("Action", with_default(parsed_data, "level", ""), "MITRE Technique", with_default(parsed_data, "technique", "")),
109+
info_table("User", with_default(parsed_data, "user", ""), "Process Name", with_default(parsed_data, "resource", ""))
110+
])])
111+
112+
behavioral_detection_section := sprintf(`
113+
<div style="padding-left: 44px; padding-bottom: 20px; color: #6B7887;">
114+
<h3 style="color: #183278; margin: 0;">Behavioral Detection</h3>
115+
%s
116+
<p style="color: #6B7887; padding-top: 10px; font-size: 15px;"><strong>MITRE Tactic:</strong> %s</p>
117+
<p style="color: #6B7887; padding-top: 10px; font-size: 15px;"><strong>Description:</strong> %s</p>
118+
</div>
119+
`, [
120+
concat("", [
121+
info_table("User", with_default(parsed_data, "user", ""), "MITRE Technique", with_default(parsed_data, "technique", "")),
122+
info_table("Container Name", with_default(input, "container", ""), "Process Name", with_default(parsed_data, "process", ""))
123+
]),
124+
with_default(parsed_data, "tactic", ""),
125+
with_default(parsed_data, "signature_description", "")
126+
])
127+
128+
dynamic_section := malware_detection_section if {
129+
input.main_category == "malware"
130+
}
131+
dynamic_section := runtime_control_section if {
132+
input.main_category == "runtime"
133+
}
134+
dynamic_section := behavioral_detection_section if {
135+
input.main_category == "behavioral"
136+
}
137+
138+
sections := [
139+
severity_indicator,
140+
severity_box,
141+
logo,
142+
policy_info,
143+
incident_overview,
144+
dynamic_section
145+
]
146+
147+
html_content := concat("", sections)
148+
149+
location := input.container if {
150+
input.container != ""
151+
} else := input.host
152+
title := sprintf("%s Incident on %s", [capitalize(input.main_category), location])
153+
154+
result := sprintf(html_tpl, [html_content])

‎rego-templates/issues-email.rego‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -102,15 +102,6 @@ style := sprintf(`<style>
102102
white-space: normal;
103103
}
104104
105-
.copyright {
106-
color: #405a75;
107-
font-family: "Inter-SemiBold", sans-serif;
108-
font-size: 15px;
109-
line-height: 26px;
110-
font-weight: 600;
111-
margin-top: 30px;
112-
text-align: center;
113-
}
114105
table {
115106
width: 100%;
116107
border-collapse: collapse;

0 commit comments

Comments
 (0)