Skip to content

Commit 6720e81

Browse files
alexvolhaalexvolha
authored
Merge pull request #53 from UncoderIO/forisiem-render
Fortisiem render
2 parents 11b0fe7 + f9e9d91 commit 6720e81

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+1210
-9
lines changed

‎translator/app/translator/core/custom_types/meta_info.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@ class SeverityType(CustomEnum):
66
high = "high"
77
medium = "medium"
88
low = "low"
9+
informational = "informational"

‎translator/app/translator/core/mapping.py‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
class LogSourceSignature(ABC):
1212
_default_source: dict
13+
wildcard_symbol = "*"
1314

1415
@abstractmethod
1516
def is_suitable(self, *args, **kwargs) -> bool:
@@ -79,21 +80,21 @@ def __init__(
7980

8081
class BasePlatformMappings:
8182
def __init__(self, platform_dir: str):
82-
self.__loader = LoaderFileMappings()
83-
self.__platform_dir = platform_dir
83+
self._loader = LoaderFileMappings()
84+
self._platform_dir = platform_dir
8485
self._source_mappings = self.prepare_mapping()
8586

8687
def prepare_mapping(self) -> dict[str, SourceMapping]:
8788
source_mappings = {}
8889
default_mapping = SourceMapping(source_id=DEFAULT_MAPPING_NAME)
89-
for mapping_dict in self.__loader.load_siem_mappings(self.__platform_dir):
90+
for mapping_dict in self._loader.load_siem_mappings(self._platform_dir):
91+
log_source_signature = self.prepare_log_source_signature(mapping=mapping_dict)
9092
if (source_id := mapping_dict["source"]) == DEFAULT_MAPPING_NAME:
91-
default_mapping.log_source_signature = self.prepare_log_source_signature(mapping=mapping_dict)
93+
default_mapping.log_source_signature = log_source_signature
9294
continue
9395

9496
fields_mapping = self.prepare_fields_mapping(field_mapping=mapping_dict.get("field_mapping", {}))
9597
default_mapping.fields_mapping.update(fields_mapping)
96-
log_source_signature = self.prepare_log_source_signature(mapping=mapping_dict)
9798
source_mappings[source_id] = SourceMapping(
9899
source_id=source_id, log_source_signature=log_source_signature, fields_mapping=fields_mapping
99100
)
@@ -123,3 +124,19 @@ def get_source_mapping(self, source_id: str) -> Optional[SourceMapping]:
123124
@property
124125
def default_mapping(self) -> SourceMapping:
125126
return self._source_mappings[DEFAULT_MAPPING_NAME]
127+
128+
129+
class BaseCommonPlatformMappings(ABC, BasePlatformMappings):
130+
def prepare_mapping(self) -> dict[str, SourceMapping]:
131+
source_mappings = {}
132+
common_field_mapping = self._loader.load_common_mapping(self._platform_dir).get("field_mapping", {})
133+
134+
for mapping_dict in self._loader.load_siem_mappings(self._platform_dir):
135+
source_id = mapping_dict["source"]
136+
log_source_signature = self.prepare_log_source_signature(mapping=mapping_dict)
137+
fields_mapping = self.prepare_fields_mapping(field_mapping=common_field_mapping)
138+
source_mappings[source_id] = SourceMapping(
139+
source_id=source_id, log_source_signature=log_source_signature, fields_mapping=fields_mapping
140+
)
141+
142+
return source_mappings

‎translator/app/translator/core/render.py‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,8 @@ def finalize_query(
194194
meta_info: Optional[MetaInfoContainer] = None,
195195
source_mapping: Optional[SourceMapping] = None, # noqa: ARG002
196196
not_supported_functions: Optional[list] = None,
197+
*args, # noqa: ARG002
198+
**kwargs, # noqa: ARG002
197199
) -> str:
198200
query = self.query_pattern.format(prefix=prefix, query=query, functions=functions).strip()
199201
query = self.wrap_query_with_meta_info(meta_info=meta_info, query=query)
@@ -228,7 +230,7 @@ def finalize(self, queries_map: dict[str, str]) -> str:
228230

229231
return result
230232

231-
def __get_source_mappings(self, source_mapping_ids: list[str]) -> list[SourceMapping]:
233+
def _get_source_mappings(self, source_mapping_ids: list[str]) -> list[SourceMapping]:
232234
source_mappings = []
233235
for source_mapping_id in source_mapping_ids:
234236
if source_mapping := self.mappings.get_source_mapping(source_mapping_id):
@@ -241,7 +243,7 @@ def __get_source_mappings(self, source_mapping_ids: list[str]) -> list[SourceMap
241243

242244
def generate(self, query: list, meta_info: MetaInfoContainer, functions: ParsedFunctions) -> str:
243245
queries_map = {}
244-
source_mappings = self.__get_source_mappings(meta_info.source_mapping_ids)
246+
source_mappings = self._get_source_mappings(meta_info.source_mapping_ids)
245247

246248
for source_mapping in source_mappings:
247249
prefix = self.generate_prefix(source_mapping.log_source_signature)

‎translator/app/translator/mappings/platforms/forti_siem/common.yml‎

Lines changed: 257 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,257 @@
1+
platform: FortiSiem
2+
description: Common field mapping
3+
4+
field_mapping:
5+
TargetDetails: details
6+
Account_Name: user
7+
Computer_Name: computer
8+
Originating_Computer: srcName
9+
FileHash: hashCode
10+
FilePath: filePath
11+
Fqbn: hostName
12+
RuleId: ruleId # int type
13+
RuleName: ruleName
14+
CallTrace: procPath
15+
IntegrityLevel: integrityLevel
16+
ParentIntegrityLevel: procTrustLevel # int type
17+
Company: company
18+
ParentProcessGuid: procOwner
19+
LogonGuid: uuid
20+
ParentUser: userGrp
21+
Hashes: hashCode
22+
Imphash: hashIMP
23+
OriginalFilename: srcFileName
24+
OriginalFileName: srcFileName
25+
ParentProcess: parentProcName
26+
Product: product
27+
sha1: hashSHA1
28+
DestPort: destIpPort # int type
29+
Destination: destIpAddr # ip type
30+
destination.port: destIpPort # int type
31+
HostApplication: appName
32+
TargetName: targetName
33+
TargetProcessAddress: destMACAddr
34+
Service: serviceName
35+
Source: eventSource
36+
ImagePath: serviceFileName
37+
Path: procPath
38+
Payload: dataPayload
39+
Properties: propName
40+
QueryName: queryId
41+
QueryResults: actionResult
42+
QueryStatus: status
43+
LogonProcessName: winLogonProc
44+
ServicePrincipalNames: principal
45+
HostVersion: version
46+
FailureCode: winKerbFailCode
47+
EngineVersion: version
48+
DeviceClassName: deviceType
49+
DeviceDescription: description
50+
Status: winLogonFailCode2
51+
AccessList: fileAccess
52+
AccessMask: fileAccess
53+
AttributeLDAPDisplayName: propName
54+
ContextInfo: lineContent
55+
AttributeValue: propValue
56+
GroupSid: groupID
57+
AuditPolicyChanges: actionName
58+
CallingProcessName: procName
59+
GrantedAccess: accessKeyId
60+
KeyLength: msgLen
61+
keywords: msg
62+
Keywords: msg
63+
LayerRTID: permissionLevelID
64+
Level: permissionLevelType
65+
LDAPDisplayName: propName
66+
Value: propValue
67+
ObjectClass: osObjType
68+
ObjectServer: serverName
69+
ObjectValueName: osObjValue
70+
PipeName: vpnTunnelName
71+
PrivilegeList: privName
72+
RelativeTargetName: targetName
73+
SAMAccountName: accountName
74+
ScriptBlockText: script
75+
ShareName: fileName
76+
SidHistory: essId
77+
Signed: authResult
78+
StartFunction: funName
79+
StartModule: module
80+
TicketEncryptionType: encryptAlgo
81+
TicketOptions: kerbTicketOption
82+
IpAddress: srcIpAddr # ip type
83+
HiveName: procName
84+
DestinationIsIpv6: isIpv6
85+
AllowedToDelegateTo: _win_isAllowedToDelegateTo_removed
86+
CallerProcessName: procName
87+
Caption: description
88+
CertThumbprint: certInfo
89+
ClassName: deviceType
90+
ModifyingApplication: appName
91+
OldTargetUserName: oldTargetUser
92+
ommandLine: command
93+
OriginalName: originalProcName
94+
Provider_Name: _win_providerName_removed
95+
param1: paraName
96+
param2: otherParaName
97+
RemoteAddress: remoteAddress
98+
SamAccountName: targetUser
99+
TargetUserSid: userId
100+
TargetSid: groupID
101+
TemplateContent: templateContent
102+
NewTemplateContent: newTemplateContent
103+
NewTargetUserName: targetUser
104+
RemoteName: targetName
105+
LocalName: filePath
106+
processPath: procName
107+
Action: eventAction # int type
108+
ApplicationPath: procPath
109+
SearchFilter: queryFilter
110+
Address: remoteAddress
111+
Origin: origLocation
112+
PasswordLastSet: passwordLastSet # Data type
113+
TargetServerName: targetName
114+
ServerName: serverName
115+
DeviceName: hostName
116+
AuditSourceName: resourceName
117+
TargetLogonId: winLogonId
118+
ComputerName: computer
119+
CurrentDirectory: dirName
120+
Description: description
121+
FileVersion: fileVersion
122+
GroupName: targetUserGrp
123+
LogonId: winLogonId
124+
NewName: newObjValue
125+
ProcessName: procName
126+
QNAME: destName
127+
TargetFilename: fileName
128+
User: user
129+
Image: procName
130+
ParentImage: parentProcName
131+
CommandLine: command
132+
TaskName: task
133+
ServiceName: serviceName
134+
TargetObject: regKeyPath
135+
EventType: osObjAction
136+
EventID: eventType
137+
EventCode: eventType
138+
Details: details
139+
ParentCommandLine: parentCommand
140+
Message: msg
141+
HostName: hostName
142+
FileName: fileName
143+
TargetImage: targetProcName
144+
Accesses: osObjAccessType
145+
AccountName: user
146+
DestinationIp: destIpAddr # ip type
147+
DestinationPort: destIpPort # int type
148+
DestinationHostname: destName
149+
DestinationAddress: destIpAddr # ip type
150+
ObjectType: osObjType
151+
ObjectName: osObjName
152+
SourceImage: procName
153+
SourceAddress: srcIpAddr # ip type
154+
SourcePort: srcIpPort # int type
155+
SourceNetworkAddress: srcIpAddr # ip type
156+
SourceWorkstation: srcName
157+
TargetUserName: user
158+
UserName: user
159+
SubjectDomainName: domain
160+
SubjectLogonId: winLogonId
161+
SubjectUserName: user
162+
SubjectUserSid: securityId
163+
Workstation: computer
164+
WorkstationName: computer
165+
ServiceFileName: serviceFileName
166+
Signature: signatureName
167+
ImageLoaded: loadedProcName
168+
LogonType: winLogonType # int type
169+
AuthenticationPackage: procName
170+
AuthenticationPackageName: authenMethod
171+
Device: deviceIdentification
172+
PolicyName: policyName
173+
TargetProcessId: targetProcId
174+
TargetUser: targetUser
175+
NewValue: newObjValue
176+
SubjectAccountName: user
177+
ClientAddress: srcIpAddr # ip type
178+
ProcessID: procId
179+
TargetFileName: fileName
180+
AccountDomain: domain
181+
Computer: computer
182+
DomainName: targetDomain
183+
Initiated: initiated
184+
Commandline: command
185+
ProcessCommandLine: command
186+
Channel: activityType
187+
ServiceType: serviceType
188+
ServiceStartType: serviceStartType
189+
#network
190+
dst_ip: destIpAddr # ip type
191+
src_ip: srcIpAddr # ip type
192+
dst_port: destIpPort # int type
193+
src_port: srcIpPort # int type
194+
dns_query: uriQuery
195+
uri_query: uriQuery
196+
parent_domain: domain
197+
record_type: type
198+
query: queryId
199+
action: activityName
200+
operation: opName
201+
c-useragent: httpUserAgent
202+
c-uri: httpEndUri
203+
endpoint: targetName
204+
service: serviceName
205+
path: procPath
206+
name: procName
207+
cipher: password
208+
request_type: type
209+
answer: actionResult
210+
resp_mime_types: type
211+
message_size: msgLen # int type
212+
question_length: size # int type
213+
cs-method: httpMethod
214+
sc-status: status
215+
method: httpMethod
216+
referer: httpReferrer
217+
useragent: httpUserAgent
218+
clientip: srcIpAddr # int type
219+
MachineName: hostName
220+
TargetPort: destIpPort # int type
221+
DestAddress: destIpAddr # ip type
222+
SourceIp: srcIpAddr # ip type
223+
AppName: appName
224+
Binary: code
225+
ClientProcessId: procId
226+
ParentProcessId: parentProcId
227+
Data: lineContent
228+
ErrorCode: errorCode
229+
FileNameBuffer: fileName
230+
ProcessNameBuffer: procName
231+
RequestedPolicy: policyIdentity
232+
ValidatedPolicy: recipientPolicyId
233+
FilterOrigin: filter
234+
Application: appName
235+
AppID: appName
236+
ImageName: procName
237+
ImpersonationLevel: permissionLevelID
238+
Name: procName
239+
PackageFullName: procName
240+
PackagePath: procPath
241+
ProcessId: procId
242+
ProcessPath: procPath
243+
Protocol: srcProto
244+
SidList: userId
245+
SourceCommandLine: command
246+
SourceHostname: srcName
247+
TargetOutboundUserName: user
248+
TaskContent: task
249+
TaskContentNew: task
250+
md5: hashMD5
251+
param3: swParam
252+
process: procName
253+
sha256: hashSHA256
254+
subjectName: subjectContainsWords
255+
ExceptionCode: errorCode
256+
SignatureStatus: signatureStatus
257+
payload: dataPayload

‎translator/app/translator/mappings/platforms/forti_siem/default.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
platform: FortiSiem
2+
source: default
3+
description: Text that describe current mapping
4+
5+
default_log_source: {}

‎translator/app/translator/mappings/platforms/forti_siem/linux_file_event.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
platform: FortiSiem
2+
source: linux_file_event
3+
description: Text that describe current mapping
4+
5+
log_source:
6+
eventType:
7+
- FSM_LINUX_FILE_*
8+
9+
default_log_source:
10+
eventType: FSM_LINUX_FILE_*

‎translator/app/translator/mappings/platforms/forti_siem/windows_app.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
platform: FortiSiem
2+
source: windows_app
3+
description: Text that describe current mapping
4+
5+
default_log_source:
6+
eventType: Win-App-*

‎translator/app/translator/mappings/platforms/forti_siem/windows_application.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
platform: FortiSiem
2+
source: windows_application
3+
description: Text that describe current mapping
4+
5+
default_log_source:
6+
eventType: Win-App-*

‎translator/app/translator/mappings/platforms/forti_siem/windows_appxdeployment.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
platform: FortiSiem
2+
source: windows_appxdeployment
3+
description: Text that describe current mapping
4+
5+
log_source:
6+
eventType:
7+
- Win-AppXDeployment-Server-400
8+
- Win-AppXDeployment-Server-401
9+
- Win-AppXDeployment-Server-157
10+
11+
default_log_source:
12+
eventType: Win-AppXDeployment-Server-*

0 commit comments

Comments
 (0)