admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

PEX-33: refactor yaml2json into generate

Browse Source
This commit is contained in:
Danny Leung
2021-11-07 01:41:34 -08:00
parent 27dab63453
commit 791ba24d1b
1 changed files with 66 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/generate.py
+66 -40
View File
@@ -15,6 +15,9 @@ import re
from attackcti import attack_client
import csv
import shutil
from bin.yaml_to_json import Yaml2Json
import os
import json
# Global variable
@@ -656,50 +659,73 @@ def get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
global global_product
global_product = PRODUCT
TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
if global_product == 'API':
json_types = []
# List of all YAML types to search in repo
yml_types = ['detections', 'baselines', 'lookups', 'macros', 'response_tasks', 'responses', 'stories', 'deployments']
# output directory name will be same as this filename
output_dir = OUTPUT_PATH
if VERBOSE: print("JSON output directory: " + output_dir)
# remove any pre-existing output directories
shutil.rmtree(output_dir, ignore_errors=True)
if VERBOSE: print("Remove pre-existing JSON directory")
# create output directory
os.mkdir(output_dir)
if VERBOSE: print("Created output directory")
# Generate all YAML types
for yt in yml_types:
processor = Yaml2Json(yt)
with open(os.path.join(output_dir, yt + '.json'), 'w') as json_out:
# write out YAML type
json.dump(processor.list_objects(yt), json_out)
if VERBOSE: print("Writing %s JSON" % yt)
try:
if VERBOSE:
print("generating Mitre lookups")
# generate_mitre_lookup(OUTPUT_PATH)
except Exception as e:
print('Error: ' + str(e))
print("WARNING: Generation of Mitre lookup failed.")
# calculate deprecation totals
deprecated = []
for d in objects['detections']:
if 'deprecated' in d:
deprecated.append(d)
detection_path = ''
lookups_path = ''
lookups_files= ''
use_case_lib_path = ''
macros_path = ''
workbench_panels_objects = ''
if global_product == 'SSA':
detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
objects["macros"] = []
else:
detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
if VERBOSE:
print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*"))
print("security content generation completed..")
objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
try:
if VERBOSE:
print("generating Mitre lookups")
# generate_mitre_lookup(OUTPUT_PATH)
except Exception as e:
print('Error: ' + str(e))
print("WARNING: Generation of Mitre lookup failed.")
# calculate deprecation totals
deprecated = []
for d in objects['detections']:
if 'deprecated' in d:
deprecated.append(d)
detection_path = ''
lookups_path = ''
lookups_files= ''
use_case_lib_path = ''
macros_path = ''
workbench_panels_objects = ''
if global_product == 'SSA':
detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
objects["macros"] = []
else:
detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
if VERBOSE:
print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*"))
print("security content generation completed..")
if __name__ == "__main__":