Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added support for Jira, Pagerduty and Increased Slack to include webooks and custom fields #149

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Added support for Jira, Pagerduty and Increased Slack to include webooks and custom fields #149

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9d6e6af
Added support for Jira, Pagerduty and Increased Slack to include webo…
0xrob May 20, 2024
a411665
Merge branch 'main' into jira_and_pagerduty_alert_action
josehelps Jun 21, 2024
e9c3815
Merge branch 'main' into jira_and_pagerduty_alert_action
pyth0n1c Jul 3, 2024
27aad49
Update deployment_slack.py
0xrob Jul 31, 2024
0ebe2c5
Update savedsearches_detections.j2
0xrob Jul 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions contentctl/objects/alert_action.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,17 @@
from contentctl.objects.deployment_rba import DeploymentRBA
from contentctl.objects.deployment_slack import DeploymentSlack
from contentctl.objects.deployment_phantom import DeploymentPhantom
from contentctl.objects.deployment_jira import DeploymentJira
from contentctl.objects.deployment_pagerduty import DeploymentPagerDuty

class AlertAction(BaseModel):
email: Optional[DeploymentEmail] = None
notable: Optional[DeploymentNotable] = None
rba: Optional[DeploymentRBA] = DeploymentRBA()
slack: Optional[DeploymentSlack] = None
phantom: Optional[DeploymentPhantom] = None
jira: Optional[DeploymentJira] = None
pagerduty: Optional[DeploymentPagerDuty] = None


@model_serializer
Expand All @@ -36,5 +40,11 @@ def serialize_model(self):
if self.phantom is not None:
raise Exception("Phantom not implemented")

if self.jira is not None:
raise Exception("Jira not implemented")

if self.pagerduty is not None:
raise Exception("PagerDuty not implemented")

#return the model
return model
15 changes: 15 additions & 0 deletions contentctl/objects/deployment_jira.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@

from __future__ import annotations
from pydantic import BaseModel

class DeploymentJira(BaseModel):
account: str
jira_attachment: str
jira_dedup: str
jira_dedup_content: str
jira_description: str
jira_project: str
jira_issue_type: str
jira_priority: str
jira_priority_dynamic: str
jira_summary: str
6 changes: 6 additions & 0 deletions contentctl/objects/deployment_pagerduty.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
from __future__ import annotations
from pydantic import BaseModel

class DeploymentPagerDuty(BaseModel):
pagerduty_description: str
integration_url_override: str
4 changes: 3 additions & 1 deletion contentctl/objects/deployment_slack.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,6 @@

class DeploymentSlack(BaseModel):
channel: str
message: str
message: str
webhook_url_override: str
fields: str
24 changes: 24 additions & 0 deletions contentctl/output/templates/savedsearches_detections.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,30 @@ action.slack = 1
action.slack.param.channel = {{ detection.deployment.alert_action.slack.channel | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.slack.param.message = {{ detection.deployment.alert_action.slack.message | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
{% endif %}
{% if detection.deployment.alert_action.slack.webhook_url_override is defined %}
action.slack.param.webhook_url_override = {{ detection.deployment.alert_action.slack.webhook_url_override | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
{% endif %}
{% if detection.deployment.alert_action.slack.fields is defined %}
action.slack.param.fields = {{ detection.deployment.alert_action.slack.fields | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
{% endif %}
{% if detection.deployment.alert_action.jira %}
action.jira_service_desk = 1
action.jira_service_desk.param.account = {{ detection.deployment.alert_action.jira.account | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.jira_service_desk.param.jira_attachment = {{ detection.deployment.alert_action.jira.jira_attachment | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.jira_service_desk.param.jira_dedup = {{ detection.deployment.alert_action.jira.jira_dedup | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.jira_service_desk.param.jira_dedup_content = {{ detection.deployment.alert_action.jira.jira_dedup_content | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.jira_service_desk.param.jira_description = {{ detection.deployment.alert_action.jira.jira_description | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.jira_service_desk.param.jira_issue_type = {{ detection.deployment.alert_action.jira.jira_issue_type | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.jira_service_desk.param.jira_priority = {{ detection.deployment.alert_action.jira.jira_priority | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.jira_service_desk.param.jira_priority_dynamic = {{ detection.deployment.alert_action.jira.jira_priority_dynamic | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.jira_service_desk.param.jira_summary = {{ detection.deployment.alert_action.jira.jira_summary | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.jira_service_desk.param.jira_project = {{ detection.deployment.alert_action.jira.jira_project | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
{% endif %}
{% if detection.deployment.alert_action.pagerduty %}
action.pagerduty = 1
action.pagerduty.description = {{ detection.deployment.alert_action.pagerduty.pagerduty_description | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
action.pagerduty.param.integration_url_override = {{ detection.deployment.alert_action.pagerduty.integration_url_override | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
{% endif %}
{% if detection.deployment.alert_action.phantom%}
action.sendtophantom = 1
action.sendtophantom.param._cam_workers = {{ detection.deployment.alert_action.phantom.cam_workers | custom_jinja2_enrichment_filter(detection) }}
Expand Down