<commit_before>#!/usr/bin/env python

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# Copyright (c) 2014 Mozilla Corporation


from lib.alerttask import AlertTask
from mozdef_util.query_models import SearchQuery, PhraseMatch, TermsMatch, QueryStringMatch
import requests
import json
import logging
from requests_jwt import JWTAuth
import requests_jwt
import jwt
import sys

logger = logging.getLogger()
formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')


class AlertWatchList(AlertTask):
    def main(self):
        self.parse_config('get_watchlist.conf', ['api_url', 'jwt_secret'])

        jwt_token = JWTAuth(self.config.jwt_secret)
        jwt_token.set_header_format('Bearer %s')

        #Connect to rest api and grab response
        r = requests.get(self.config.api_url, auth=jwt_token)
        status = r.status_code
        index = 0
        if status == 200:
            status = r.status_code
            response = r.text
            terms_list = json.loads(response)
            while index < len(terms_list):
                term = terms_list[index]
                term = '"{}"'.format(term)
                index += 1

                # Create a query to look back the last 20 minutes
                search_query = SearchQuery(minutes=20)
                content = QueryStringMatch(str(term))
                search_query.add_must(content)
                self.filtersManual(search_query)
                self.searchEventsSimple()
                self.walkEvents()

        else:
            sys.stderr.write('The watchlist request failed. Status {0}.\n'.format(status))

    # Set alert properties
    def onEvent(self, event):
        category = 'watchlist'
        tags = ['watchtarget']
        severity = 'WARNING'

        ev = event['_source']
        user = ''
        sourceipaddress = ''
        hostname = ''

        # If the event severity is below what we want, just ignore
        # the event.
        if 'details' not in ev:
            return None
        if 'details' in ev:
            if 'sourceipaddress' in ev['details']:
                sourceipaddress = ev['details']['sourceipaddress']
            if 'username' in ev['details'] or 'originaluser' in ev['details']:
                user = ev['details']['username']
            if 'hostname' in ev:
                hostname = ev['hostname']
            else:
                return None

        summary = 'Watchlist term detected by {} from {} on {}'.format(user, sourceipaddress, hostname)
        return self.createAlertDict(summary, category, tags, [event], severity)<commit_msg>Updating username designation to pull from the many fields that could populate it.<commit_after>#!/usr/bin/env python

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# Copyright (c) 2014 Mozilla Corporation


from lib.alerttask import AlertTask
from mozdef_util.query_models import SearchQuery, PhraseMatch, TermsMatch, QueryStringMatch
import requests
import json
import logging
from requests_jwt import JWTAuth
import requests_jwt
import jwt
import sys

logger = logging.getLogger()
formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')


class AlertWatchList(AlertTask):
    def main(self):
        self.parse_config('get_watchlist.conf', ['api_url', 'jwt_secret'])

        jwt_token = JWTAuth(self.config.jwt_secret)
        jwt_token.set_header_format('Bearer %s')

        #Connect to rest api and grab response
        r = requests.get(self.config.api_url, auth=jwt_token)
        status = r.status_code
        index = 0
        if status == 200:
            status = r.status_code
            response = r.text
            terms_list = json.loads(response)
            while index < len(terms_list):
                term = terms_list[index]
                term = '"{}"'.format(term)
                index += 1

                # Create a query to look back the last 20 minutes
                search_query = SearchQuery(minutes=20)
                content = QueryStringMatch(str(term))
                search_query.add_must(content)
                self.filtersManual(search_query)
                self.searchEventsSimple()
                self.walkEvents()

        else:
            sys.stderr.write('The watchlist request failed. Status {0}.\n'.format(status))

    # Set alert properties
    def onEvent(self, event):
        category = 'watchlist'
        tags = ['watchtarget']
        severity = 'WARNING'

        ev = event['_source']
        user = ''
        sourceipaddress = ''
        hostname = ''

        # If the event severity is below what we want, just ignore
        # the event.
        if 'details' not in ev:
            return None
        if 'details' in ev:
            if 'sourceipaddress' in ev['details']:
                sourceipaddress = ev['details']['sourceipaddress']
            if 'username' in ev['details'] or 'originaluser' in ev['details'] or 'user' in ev['details']:
                if ev['details']['username'] is not None:
                    user = ev['details']['username']
                elif ev['details']['originaluser'] is not None:
                    user = ev['details']['originaluser']
                else:
                    user = ev['details']['user']
            if 'hostname' in ev:
                hostname = ev['hostname']
            else:
                return None

        summary = 'Watchlist term detected by {} from {} on {}'.format(user, sourceipaddress, hostname)
        return self.createAlertDict(summary, category, tags, [event], severity)
{'fraction_non_alphanumeric': 0.10211027910142954, 'fraction_numerical': 0.006126616746085773, 'mean_word_length': 2.181916621548457, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1966665', 'n_tokens_mistral': 1678, 'n_tokens_neox': 1569, 'n_words': 480}