Skip to content

Commit

Permalink
Mkdocs continued (#7)
Browse files Browse the repository at this point in the history
* wazuh manager mkdocs

* rest of services mkdocs
  • Loading branch information
taylorwalton authored Jul 11, 2023
1 parent 0385363 commit 1b3c6f4
Show file tree
Hide file tree
Showing 79 changed files with 22,244 additions and 42,002 deletions.
24 changes: 12 additions & 12 deletions backend/app/routes/dfir_iris.py
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@
@bp.route("/dfir_iris/cases", methods=["GET"])
def get_cases():
"""
Endpoint to retrieve all the cases from DFIR IRIS.
Handle GET requests at the "/cases" endpoint. Retrieve all cases from DFIR IRIS.
Returns:
json: A JSON response containing the list of cases.
Response: A Flask Response object carrying a JSON representation of the list of cases.
"""
service = CasesService()
cases = service.list_cases()
Expand All @@ -25,13 +25,13 @@ def get_cases():
@bp.route("/dfir_iris/cases/<case_id>", methods=["GET"])
def get_case(case_id: str):
"""
Endpoint to retrieve a specific case from DFIR IRIS.
Handle GET requests at the "/cases/<case_id>" endpoint. Retrieve a specific case from DFIR IRIS.
Args:
case_id (str): The ID of the case to retrieve.
Returns:
json: A JSON response containing the case data.
Response: A Flask Response object carrying a JSON representation of the case data.
"""
service = CasesService()
case = service.get_case(case_id=case_id)
Expand All @@ -41,13 +41,13 @@ def get_case(case_id: str):
@bp.route("/dfir_iris/cases/<case_id>/notes", methods=["GET"])
def get_case_notes(case_id: int):
"""
Endpoint to retrieve notes of a specific case from DFIR IRIS.
Handle GET requests at the "/cases/<case_id>/notes" endpoint. Retrieve notes of a specific case from DFIR IRIS.
Args:
case_id (str): The ID of the case to retrieve notes from.
Returns:
json: A JSON response containing the list of notes for the case.
Response: A Flask Response object carrying a JSON representation of the list of notes for the case.
"""
notes_service = NotesService()
notes = notes_service.get_case_notes(search_term="%", cid=case_id)
Expand All @@ -57,13 +57,13 @@ def get_case_notes(case_id: int):
@bp.route("/dfir_iris/cases/<case_id>/note", methods=["POST"])
def create_case_note(case_id: str):
"""
Endpoint to create a note for a specific case in DFIR IRIS.
Handle POST requests at the "/cases/<case_id>/note" endpoint. Create a note for a specific case in DFIR IRIS.
Args:
case_id (str): The ID of the case to create a note for.
Returns:
json: A JSON response containing the result of the note creation operation.
Response: A Flask Response object carrying a JSON representation of the result of the note creation operation.
"""
note_title = request.json["note_title"]
note_content = request.json["note_content"]
Expand All @@ -79,13 +79,13 @@ def create_case_note(case_id: str):
@bp.route("/dfir_iris/cases/<case_id>/assets", methods=["GET"])
def get_case_assets(case_id: str):
"""
Endpoint to retrieve assets of a specific case from DFIR IRIS.
Handle GET requests at the "/cases/<case_id>/assets" endpoint. Retrieve assets of a specific case from DFIR IRIS.
Args:
case_id (str): The ID of the case to retrieve assets from.
Returns:
json: A JSON response containing the list of assets for the case.
Response: A Flask Response object carrying a JSON representation of the list of assets for the case.
"""
asset_service = AssetsService()
assets = asset_service.get_case_assets(cid=case_id)
Expand All @@ -95,10 +95,10 @@ def get_case_assets(case_id: str):
@bp.route("/dfir_iris/alerts", methods=["GET"])
def get_alerts():
"""
Endpoint to retrieve all alerts from DFIR IRIS.
Handle GET requests at the "/alerts" endpoint. Retrieve all alerts from DFIR IRIS.
Returns:
json: A JSON response containing the list of alerts.
Response: A Flask Response object carrying a JSON representation of the list of alerts.
"""
service = AlertsService()
alerts = service.list_alerts()
Expand Down
60 changes: 31 additions & 29 deletions backend/app/routes/rules.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,9 @@
from flask import Blueprint
from flask import request
from loguru import logger
from typing import Any
from typing import Dict

# from app.models.connectors import Connector
# from app.models.connectors import WazuhManagerConnector
# from app.models.rules import DisabledRules
from app.services.WazuhManager.disabled_rule import DisableRuleService
from app.services.WazuhManager.enabled_rule import EnableRuleService
from app.services.WazuhManager.universal import UniversalService
Expand All @@ -14,47 +13,50 @@

bp = Blueprint("rules", __name__)


@bp.route("/rule/disable", methods=["POST"])
def disable_rule():
def disable_rule() -> str:
"""
Endpoint to disable a rule.
Flask route to disable a rule in Wazuh.
Args:
id (str): The id of the rule to be disabled.
This endpoint accepts a POST request with a JSON body containing the rule to be disabled.
Returns:
json: A JSON response containing the updated rule information.
str: A JSON string response containing the updated rule information. The actual content of the response depends on the implementation of `DisableRuleService.disable_rule`.
Example Request Body:
{
"rule_id": "200222",
"reason": "string",
"length_of_time": 1
}
"""
logger.info("Received request to disable rule")
data = request.get_json()
# wazuh_manager_connector = WazuhManagerConnector("Wazuh-Manager")
# wazuh_manager_service = WazuhManagerService(wazuh_manager_connector)
# result = wazuh_manager_service.disable_rule(data)
# Create instance of UniversalService
universal_service = UniversalService()
disable_service = DisableRuleService(universal_service)
result = disable_service.disable_rule(data)
data: Dict[str, Any] = request.get_json()
universal_service: UniversalService = UniversalService()
disable_service: DisableRuleService = DisableRuleService(universal_service)
result: str = disable_service.disable_rule(data)
return result


@bp.route("/rule/enable", methods=["POST"])
def enable_rule():
def enable_rule() -> str:
"""
Endpoint to enable a rule.
Flask route to enable a rule in Wazuh.
Args:
id (str): The id of the rule to be enabled.
This endpoint accepts a POST request with a JSON body containing the rule to be enabled.
Returns:
json: A JSON response containing the updated rule information.
str: A JSON string response containing the updated rule information. The actual content of the response depends on the implementation of `EnableRuleService.enable_rule`.
Example Request Body:
{
"rule_id": "100001"
}
"""
logger.info("Received request to enable rule")
data = request.get_json()
# wazuh_manager_connector = WazuhManagerConnector("Wazuh-Manager")
# wazuh_manager_service = WazuhManagerService(wazuh_manager_connector)
# result = wazuh_manager_service.enable_rule(data)
universal_service = UniversalService()
enable_service = EnableRuleService(universal_service)
result = enable_service.enable_rule(data)
data: Dict[str, Any] = request.get_json()
universal_service: UniversalService = UniversalService()
enable_service: EnableRuleService = EnableRuleService(universal_service)
result: str = enable_service.enable_rule(data)
return result

19 changes: 13 additions & 6 deletions backend/app/routes/shuffle.py
Original file line number Diff line number Diff line change
Expand Up @@ -15,25 +15,27 @@


@bp.route("/shuffle/workflows", methods=["GET"])
def get_workflows():
def get_workflows() -> jsonify:
"""
Endpoint to list all available Shuffle workflows.
Returns:
json: A JSON response containing the list of all configured Workflows.
jsonify: A JSON response containing the list of all configured Workflows in Shuffle.
"""
service = WorkflowsService()
workflows = service.collect_workflows()
return workflows


@bp.route("/shuffle/workflows/executions", methods=["GET"])
def get_workflows_executions():
def get_workflows_executions() -> jsonify:
"""
Endpoint to list all available Shuffle workflow execution status.
This endpoint retrieves the status of the most recent execution for each workflow in Shuffle.
Returns:
json: A JSON response containing the list of all configured workflows last execution status.
jsonify: A JSON response containing the list of all configured workflows and their last execution status.
"""
service = WorkflowsService()
workflow_details = service.collect_workflow_details()
Expand All @@ -48,12 +50,17 @@ def get_workflows_executions():


@bp.route("/shuffle/workflows/executions/<workflow_id>", methods=["GET"])
def get_workflow_executions(workflow_id):
def get_workflow_executions(workflow_id: str) -> jsonify:
"""
Endpoint to list execution status of a specified Shuffle workflow.
This endpoint retrieves the status of the most recent execution for a specific workflow in Shuffle.
Args:
workflow_id (str): The ID of the workflow to retrieve the execution status for.
Returns:
json: A JSON response containing the last execution status of the specified workflow.
jsonify: A JSON response containing the last execution status of the specified workflow.
"""
service = WorkflowsService()
workflow_details = service.collect_workflow_executions_status(workflow_id)
Expand Down
60 changes: 22 additions & 38 deletions backend/app/routes/wazuhindexer.py
Original file line number Diff line number Diff line change
@@ -1,37 +1,25 @@
from flask import Blueprint

# from app.models.connectors import Connector
# from app.models.connectors import WazuhManagerConnector
# from app.services.agents.agents import AgentService
# from app.services.agents.agents import AgentSyncService
# from app.services.WazuhIndexer.alerts import AlertsService
from app.services.WazuhIndexer.cluster import ClusterService
from app.services.WazuhIndexer.index import IndexService

# from flask import jsonify
# from flask import request
# from loguru import logger


bp = Blueprint("wazuh_indexer", __name__)


@bp.route("/wazuh_indexer/indices", methods=["GET"])
def get_indices_summary():
"""
Endpoint to list all available indices and collect.
{
"index": index["index"],
"health": index["health"],
"docs_count": index["docs.count"],
"store_size": index["store.size"],
"replica_count": index["rep"],
},
It processes each alert to verify the connection and returns the results.
HTTP GET endpoint to list all available indices and collect relevant information for each.
This includes:
- Index name
- Index health status
- Document count in the index
- Size of the index
- Number of replicas for the index
Returns:
json: A JSON response containing the list of all available indices along with their connection verification
status.
json: A JSON response containing a list of all available indices along with their respective details.
"""
service = IndexService()
indices = service.collect_indices_summary()
Expand All @@ -41,19 +29,17 @@ def get_indices_summary():
@bp.route("/wazuh_indexer/allocation", methods=["GET"])
def get_node_allocation():
"""
Endpoint to list all available indices allocation.
Returns:
{
"disk_used": index["disk.used"],
"disk_available": index["disk.avail"],
"disk_total": index["disk.total"],
"disk_percent": index["disk.percent"],
"node": index["node"],
},
HTTP GET endpoint to list all available indices allocation.
This includes:
- Disk space used by the index
- Available disk space
- Total disk space
- Disk usage percentage
- Node on which the index resides
Returns:
json: A JSON response containing the list of all available alerts along with their connection verification
status.
json: A JSON response containing a list of all available indices along with their respective allocation details.
"""
service = ClusterService()
indices = service.collect_node_allocation()
Expand All @@ -63,11 +49,10 @@ def get_node_allocation():
@bp.route("/wazuh_indexer/health", methods=["GET"])
def get_cluster_health():
"""
Endpoint to collect Wazuh-Indexer cluster health.
HTTP GET endpoint to collect Wazuh-Indexer cluster health information.
Returns:
json: A JSON response containing the list of all available alerts along with their connection verification
status.
json: A JSON response containing health information for the Wazuh-Indexer cluster.
"""
service = ClusterService()
indices = service.collect_cluster_health()
Expand All @@ -77,11 +62,10 @@ def get_cluster_health():
@bp.route("/wazuh_indexer/shards", methods=["GET"])
def get_shards():
"""
Endpoint to collect Wazuh-Indexer shards.
HTTP GET endpoint to collect information about Wazuh-Indexer shards.
Returns:
json: A JSON response containing the list of all available alerts along with their connection verification
status.
json: A JSON response containing information about the shards in the Wazuh-Indexer.
"""
service = ClusterService()
indices = service.collect_shards()
Expand Down
16 changes: 13 additions & 3 deletions backend/app/services/DFIR_IRIS/alerts.py
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,15 @@

class AlertsService:
"""
A service class that encapsulates the logic for pulling alerts from DFIR-IRIS.
A service class that encapsulates the logic for pulling alerts from DFIR-IRIS. It creates a DFIR-IRIS session upon
initialization and uses it to fetch alerts.
"""

def __init__(self):
"""
Initializes the AlertsService by creating a UniversalService object for "DFIR-IRIS" and establishing a session.
If the session creation is unsuccessful, an error is logged and the iris_session attribute is set to None.
"""
self.universal_service = UniversalService("DFIR-IRIS")
session_result = self.universal_service.create_session()

Expand All @@ -27,10 +32,15 @@ def __init__(self):

def list_alerts(self) -> Dict[str, object]:
"""
Lists all alerts from DFIR-IRIS
List all alerts from DFIR-IRIS. If the iris_session attribute is None, this indicates that the session creation
was unsuccessful, and a dictionary with "success" set to False is returned. Otherwise, it attempts to fetch and
parse the alerts data.
Returns:
dict: A dictionary containing the success status, a message and potentially the cases.
dict: A dictionary containing the success status, a message, and potentially the fetched alerts. The
"success" key is a boolean indicating whether the operation was successful. The "message" key is a string
providing details about the operation. The "results" key, included when "success" is True, contains the
fetched alerts data.
"""
if self.iris_session is None:
return {
Expand Down
Loading

0 comments on commit 1b3c6f4

Please sign in to comment.