Skip to content

Commit c0caa27

Browse files
saltar-uasaltar-ua
committed
Initial commit UncoderIO code to community.
1 parent b12eac5 commit c0caa27

File tree

867 files changed

+32184
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

867 files changed

+32184
-0
lines changed

‎.gitignore

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
2+
3+
# misc
4+
.DS_Store
5+
*.pem
6+
7+
/.idea

‎docker-compose.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
version: '3'
2+
services:
3+
uncoder-os:
4+
build:
5+
context: './uncoder-os/'
6+
container_name: uncoder-os
7+
restart: always
8+
environment:
9+
- HOST=0.0.0.0
10+
ports:
11+
- '4010:4010'
12+
siem-converter:
13+
build:
14+
context: './siem-converter/'
15+
container_name: siem-converter
16+
restart: always
17+
environment:
18+
- HOST=0.0.0.0
19+
- PORT=8000
20+
ports:
21+
- '8000:8000'

‎siem-converter/.gitignore

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
# OS generated files
2+
.DS_Store?
3+
ehthumbs.db
4+
Icon?
5+
Thumbs.db
6+
*.DS_Store
7+
.DS_Store
8+
.gitmodules
9+
10+
# Files that might appear in the root of a volume
11+
.DocumentRevisions-V100
12+
.fseventsd
13+
.Spotlight-V100
14+
.TemporaryItems
15+
.Trashes
16+
.VolumeIcon.icns
17+
.com.apple.timemachine.donotpresent
18+
19+
# Directories potentially created on remote AFP share
20+
.AppleDB
21+
.AppleDesktop
22+
Network Trash Folder
23+
Temporary Items
24+
.apdisk
25+
26+
# Python venv
27+
venv/
28+
29+
# Pycharm IDE
30+
.idea/
31+
32+
# Python compile files
33+
__pycache__/
34+
*.pyc
35+
36+
# Config files
37+
*.ini
38+
39+
*.env
40+
41+
# Logs
42+
*.log
43+
44+
# Temp dirs or files
45+
sigma_git/
46+
!tmp/.gitkeep
47+
48+
49+
# Byte-compiled / optimized / DLL files
50+
__pycache__/
51+
*.py[cod]
52+
*$py.class
53+
54+
# C extensions
55+
*.so
56+
57+
# Distribution / packaging
58+
.Python
59+
build/
60+
develop-eggs/
61+
dist/
62+
downloads/
63+
eggs/
64+
.eggs/
65+
lib/
66+
lib64/
67+
parts/
68+
sdist/
69+
var/
70+
wheels/
71+
share/python-wheels/
72+
*.egg-info/
73+
.installed.cfg
74+
*.egg
75+
MANIFEST
76+
77+
# PyInstaller
78+
# Usually these files are written by a python script from a template
79+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
80+
*.manifest
81+
*.spec
82+
83+
# Installer logs
84+
pip-log.txt
85+
pip-delete-this-directory.txt
86+
87+
# Unit test / coverage reports
88+
htmlcov/
89+
.tox/
90+
.nox/
91+
.coverage
92+
.coverage.*
93+
.cache
94+
nosetests.xml
95+
coverage.xml
96+
*.cover
97+
*.py,cover
98+
.hypothesis/
99+
.pytest_cache/
100+
cover/
101+
102+
# Translations
103+
*.mo
104+
*.pot
105+
106+
# Django stuff:
107+
*.log
108+
local_settings.py
109+
db.sqlite3
110+
db.sqlite3-journal
111+
112+
# Flask stuff:
113+
instance/
114+
.webassets-cache
115+
116+
# Scrapy stuff:
117+
.scrapy
118+
119+
# Sphinx documentation
120+
docs/_build/
121+
122+
# PyBuilder
123+
.pybuilder/
124+
target/
125+
126+
# Jupyter Notebook
127+
.ipynb_checkpoints
128+
129+
# IPython
130+
profile_default/
131+
ipython_config.py
132+
133+
# pyenv
134+
# For a library or package, you might want to ignore these files since the code is
135+
# intended to run in multiple environments; otherwise, check them in:
136+
# .python-version
137+
138+
# pipenv
139+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
140+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
141+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
142+
# install all needed dependencies.
143+
#Pipfile.lock
144+
145+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow
146+
__pypackages__/
147+
148+
# Celery stuff
149+
celerybeat-schedule
150+
celerybeat.pid
151+
152+
# SageMath parsed files
153+
*.sage.py
154+
155+
# Environments
156+
.env
157+
.venv
158+
env/
159+
venv/
160+
ENV/
161+
env.bak/
162+
venv.bak/
163+
164+
# Visual Studio Code Environment
165+
.vscode/
166+
167+
# Spyder project settings
168+
.spyderproject
169+
.spyproject
170+
171+
# Rope project settings
172+
.ropeproject
173+
174+
# mkdocs documentation
175+
/site
176+
177+
# mypy
178+
.mypy_cache/
179+
.dmypy.json
180+
dmypy.json
181+
182+
# Pyre type checker
183+
.pyre/
184+
185+
# pytype static type analyzer
186+
.pytype/
187+
188+
# Cython debug symbols
189+
cython_debug/
190+
191+
# Temp file (deploy_key gitlab)
192+
deploy_key
193+
keys/
194+
195+
# temp test files
196+
test_data
197+
198+
# backup_logs
199+
.backup_logs
200+
201+
# sigmac tests stuff
202+
tactics.json
203+
techniques.json

‎siem-converter/Dockerfile

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
FROM python:3.9-alpine
2+
RUN apk add --update --no-cache linux-headers build-base python3-dev libffi-dev
3+
WORKDIR /siem_converter
4+
COPY . .
5+
RUN pip install --upgrade pip && \
6+
python -m pip install --upgrade setuptools && \
7+
pip install --trusted-host=pypi.python.org --trusted-host=pypi.org --trusted-host=files.pythonhosted.org --no-cache-dir -Ur requirements.txt
8+
EXPOSE 8000
9+
CMD ["python", "server.py"]

‎siem-converter/app/__init__.py

Whitespace-only changes.

‎siem-converter/app/converter/__init__.py

Whitespace-only changes.

‎siem-converter/app/converter/backends/__init__.py

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
from app.converter.backends.athena.parsers.athena import AthenaParser
2+
from app.converter.backends.athena.renders.athena import AthenaQueryRender
3+
from app.converter.backends.athena.renders.athena_cti import AthenaCTI
4+
from app.converter.backends.carbonblack.renders.carbonblack_cti import CarbonBlackCTI
5+
from app.converter.backends.chronicle.parsers.chronicle import ChronicleParser
6+
from app.converter.backends.chronicle.parsers.chronicle_rule import ChronicleRuleParser
7+
from app.converter.backends.chronicle.renders.chronicle import ChronicleQueryRender
8+
from app.converter.backends.chronicle.renders.chronicle_cti import ChronicleQueryCTI
9+
from app.converter.backends.chronicle.renders.chronicle_rule import ChronicleSecurityRuleRender
10+
from app.converter.backends.crowdstrike.parsers.crowdstrike import CrowdStrikeParser
11+
from app.converter.backends.crowdstrike.renders.crowdstrike import CrowdStrikeQueryRender
12+
from app.converter.backends.crowdstrike.renders.crowdstrike_cti import CrowdStrikeCTI
13+
from app.converter.backends.elasticsearch.parsers.detection_rule import ElasticSearchRuleParser
14+
from app.converter.backends.elasticsearch.parsers.elasticsearch import ElasticSearchParser
15+
from app.converter.backends.elasticsearch.renders.detection_rule import ElasticSearchRuleRender
16+
from app.converter.backends.elasticsearch.renders.elast_alert import ElastAlertRuleRender
17+
from app.converter.backends.elasticsearch.renders.elasticsearch import ElasticSearchQueryRender
18+
from app.converter.backends.elasticsearch.renders.elasticsearch_cti import ElasticsearchCTI
19+
from app.converter.backends.elasticsearch.renders.kibana import KibanaRuleRender
20+
from app.converter.backends.elasticsearch.renders.xpack_watcher import XPackWatcherRuleRender
21+
from app.converter.backends.fireeye_helix.renders.fireeye_helix_cti import FireeyeHelixCTI
22+
from app.converter.backends.graylog.renders.graylog_cti import GraylogCTI
23+
from app.converter.backends.logpoint.renders.logpoint_cti import LogpointCTI
24+
from app.converter.backends.logscale.parsers.logscale import LogScaleParser
25+
from app.converter.backends.logscale.parsers.logscale_alert import LogScaleAlertParser
26+
from app.converter.backends.logscale.renders.logscale_cti import LogScaleCTI
27+
from app.converter.backends.logscale.renders.logscale import LogScaleQueryRender
28+
from app.converter.backends.logscale.renders.logscale_alert import LogScaleAlertRender
29+
from app.converter.backends.microsoft.parsers.microsoft_defender import MicrosoftDefenderQueryParser
30+
from app.converter.backends.microsoft.parsers.microsoft_sentinel import MicrosoftParser
31+
from app.converter.backends.microsoft.parsers.microsoft_sentinel_rule import MicrosoftRuleParser
32+
from app.converter.backends.microsoft.renders.microsoft_defender import MicrosoftDefenderQueryRender
33+
from app.converter.backends.microsoft.renders.microsoft_defender_cti import MicrosoftDefenderCTI
34+
from app.converter.backends.microsoft.renders.microsoft_sentinel import MicrosoftSentinelQueryRender
35+
from app.converter.backends.microsoft.renders.microsoft_sentinel_cti import MicrosoftSentinelCTI
36+
from app.converter.backends.microsoft.renders.microsoft_sentinel_rule import MicrosoftSentinelRuleRender
37+
from app.converter.backends.opensearch.parsers.opensearch import OpenSearchParser
38+
from app.converter.backends.opensearch.renders.opensearch import OpenSearchQueryRender
39+
from app.converter.backends.opensearch.renders.opensearch_cti import OpenSearchCTI
40+
from app.converter.backends.opensearch.renders.opensearch_rule import OpenSearchRuleRender
41+
from app.converter.backends.qradar.parsers.qradar import QradarParser
42+
from app.converter.backends.qradar.renders.qradar import QradarQueryRender
43+
from app.converter.backends.qradar.renders.qradar_cti import QRadarCTI
44+
from app.converter.backends.qualys.renders.qualys_cti import QualysCTI
45+
from app.converter.backends.rsa_netwitness.renders.rsa_netwitness_cti import RSANetwitnessCTI
46+
from app.converter.backends.securonix.renders.securonix_cti import SecuronixCTI
47+
from app.converter.backends.sentinel_one.renders.s1_cti import S1EventsCTI
48+
from app.converter.backends.sigma.parsers.sigma import SigmaParser
49+
from app.converter.backends.sigma.renders.sigma import SigmaRender
50+
from app.converter.backends.snowflake.renders.snowflake_cti import SnowflakeCTI
51+
from app.converter.backends.splunk.parsers.splunk import SplunkParser
52+
from app.converter.backends.splunk.parsers.splunk_alert import SplunkAlertParser
53+
from app.converter.backends.splunk.renders.splunk import SplunkQueryRender
54+
from app.converter.backends.splunk.renders.splunk_alert import SplunkAlertRender
55+
from app.converter.backends.splunk.renders.splunk_cti import SplunkCTI
56+
from app.converter.backends.sumo_logic.renders.sumologic_cti import SumologicCTI
57+
58+
__ALL_RENDERS = (
59+
SigmaRender(),
60+
MicrosoftSentinelQueryRender(),
61+
MicrosoftSentinelRuleRender(),
62+
MicrosoftDefenderQueryRender(),
63+
QradarQueryRender(),
64+
CrowdStrikeQueryRender(),
65+
SplunkQueryRender(),
66+
SplunkAlertRender(),
67+
ChronicleQueryRender(),
68+
ChronicleSecurityRuleRender(),
69+
AthenaQueryRender(),
70+
ElasticSearchQueryRender(),
71+
LogScaleQueryRender(),
72+
LogScaleAlertRender(),
73+
ElasticSearchRuleRender(),
74+
ElastAlertRuleRender(),
75+
KibanaRuleRender(),
76+
XPackWatcherRuleRender(),
77+
OpenSearchQueryRender(),
78+
OpenSearchRuleRender()
79+
)
80+
81+
__ALL_PARSERS = (
82+
AthenaParser(),
83+
ChronicleParser(),
84+
ChronicleRuleParser(),
85+
SplunkParser(),
86+
SplunkAlertParser(),
87+
SigmaParser(),
88+
QradarParser(),
89+
MicrosoftParser(),
90+
MicrosoftRuleParser(),
91+
MicrosoftDefenderQueryParser(),
92+
CrowdStrikeParser(),
93+
LogScaleParser(),
94+
LogScaleAlertParser(),
95+
ElasticSearchParser(),
96+
ElasticSearchRuleParser(),
97+
OpenSearchParser()
98+
)
99+
100+
101+
__ALL_RENDERS_CTI = (
102+
MicrosoftSentinelCTI(),
103+
MicrosoftDefenderCTI(),
104+
QRadarCTI(),
105+
SplunkCTI(),
106+
ChronicleQueryCTI(),
107+
CrowdStrikeCTI(),
108+
SumologicCTI(),
109+
ElasticsearchCTI(),
110+
LogScaleCTI(),
111+
OpenSearchCTI(),
112+
FireeyeHelixCTI(),
113+
CarbonBlackCTI(),
114+
GraylogCTI(),
115+
LogpointCTI(),
116+
QualysCTI(),
117+
RSANetwitnessCTI(),
118+
S1EventsCTI(),
119+
SecuronixCTI(),
120+
SnowflakeCTI(),
121+
AthenaCTI()
122+
)

‎siem-converter/app/converter/backends/athena/__init__.py

Whitespace-only changes.

‎siem-converter/app/converter/backends/athena/const.py

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
from app.converter.core.models.platform_details import PlatformDetails
2+
3+
ATHENA_QUERY_DETAILS = {
4+
"siem_type": "athena-sql-query",
5+
"name": "AWS Athena Query",
6+
"group_name": "AWS Athena",
7+
"platform_name": "Query",
8+
"group_id": "athena",
9+
"alt_platform_name": "OCSF"
10+
}
11+
12+
athena_details = PlatformDetails(**ATHENA_QUERY_DETAILS)

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy