108 lines
5.4 KiB
Python
108 lines
5.4 KiB
Python
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import json
|
|
import time
|
|
from collections import defaultdict
|
|
from pathlib import Path
|
|
|
|
from .entities import entity_type
|
|
from .models import AnomalyFinding
|
|
|
|
|
|
def build_incidents(anomalies: list[AnomalyFinding], field_deviations: dict[str, list[dict[str, object]]], correlations: list[dict[str, object]]) -> list[dict[str, object]]:
|
|
"""Build investigation units from any log source, not only network source IPs."""
|
|
groups: dict[str, dict[str, object]] = defaultdict(lambda: {"score": 0, "evidence": [], "fields": [], "correlations": [], "timeline": []})
|
|
for anomaly in anomalies:
|
|
group = groups[anomaly.subject]
|
|
group["score"] = max(int(group["score"]), anomaly.score)
|
|
group["evidence"].extend(anomaly.reasons)
|
|
for entity, deviations in field_deviations.items():
|
|
group = groups[entity]
|
|
group["fields"].extend(deviations)
|
|
active = [item for item in deviations if item.get("feedback") not in {"expected", "false_positive"}]
|
|
group["score"] = min(100, int(group["score"]) + min(30, sum(int(item.get("score", 0)) for item in active)))
|
|
group["evidence"].extend(str(item.get("reason", "")) for item in active)
|
|
for item in active:
|
|
group["timeline"].extend(item.get("sample_events", []))
|
|
for correlation in correlations:
|
|
entity = str(correlation.get("entity") or correlation.get("source_ip") or "")
|
|
if not entity:
|
|
continue
|
|
group = groups[entity]
|
|
group["correlations"].append(correlation)
|
|
group["score"] = min(100, int(group["score"]) + 10 + min(15, int(correlation.get("security_events", 0)) * 2))
|
|
group["evidence"].append(f"observed across {len(correlation.get('streams', []))} streams")
|
|
group["timeline"].extend(correlation.get("samples", []))
|
|
|
|
incidents = []
|
|
for entity, group in groups.items():
|
|
if not group["evidence"]:
|
|
continue
|
|
score = int(group["score"])
|
|
severity = "critical" if score >= 85 else "high" if score >= 60 else "medium" if score >= 35 else "low"
|
|
streams = sorted({stream for item in group["correlations"] for stream in item.get("streams", [])} | {str(item.get("stream_name") or item.get("stream_title") or item.get("stream_id", "")) for item in group["fields"] if item.get("stream_id") or item.get("stream_name") or item.get("stream_title")})
|
|
timeline = sorted(group["timeline"], key=lambda item: str(item.get("timestamp", "")))[:20]
|
|
incident_id = hashlib.sha256(json.dumps({"entity": entity, "streams": streams, "evidence": list(dict.fromkeys(str(item) for item in group["evidence"] if item))[:4]}, sort_keys=True).encode("utf-8")).hexdigest()[:16]
|
|
incidents.append({
|
|
"id": incident_id,
|
|
"entity": entity,
|
|
"entity_type": entity_type(entity),
|
|
"score": score,
|
|
"severity": severity,
|
|
"evidence": list(dict.fromkeys(str(item) for item in group["evidence"] if item))[:8],
|
|
"field_deviations": len(group["fields"]),
|
|
"correlated_streams": streams,
|
|
"timeline": timeline,
|
|
"first_seen": timeline[0].get("timestamp", "") if timeline else "",
|
|
"last_seen": timeline[-1].get("timestamp", "") if timeline else "",
|
|
})
|
|
return sorted(incidents, key=lambda item: int(item["score"]), reverse=True)
|
|
|
|
|
|
class IncidentStore:
|
|
def __init__(self, path: str = "state/signalscope-incidents.json") -> None:
|
|
self.path = Path(path)
|
|
|
|
def entries(self) -> dict[str, dict[str, object]]:
|
|
try:
|
|
items = json.loads(self.path.read_text(encoding="utf-8"))
|
|
except (FileNotFoundError, json.JSONDecodeError):
|
|
return {}
|
|
return {str(key): value for key, value in items.items() if isinstance(value, dict)} if isinstance(items, dict) else {}
|
|
|
|
def apply(self, incidents: list[dict[str, object]]) -> list[dict[str, object]]:
|
|
states = self.entries()
|
|
now = int(time.time())
|
|
changed = False
|
|
for incident in incidents:
|
|
incident_id = str(incident.get("id", ""))
|
|
if not incident_id:
|
|
continue
|
|
state = states.get(incident_id)
|
|
if not state:
|
|
state = {"status": "open", "note": "", "created_at": now, "updated_at": now}
|
|
states[incident_id] = state
|
|
changed = True
|
|
incident["lifecycle_status"] = str(state.get("status", "open"))
|
|
incident["note"] = str(state.get("note", ""))
|
|
incident["updated_at"] = int(state.get("updated_at", 0) or 0)
|
|
if changed:
|
|
self._write(states)
|
|
return incidents
|
|
|
|
def update(self, incident_id: str, status: str, note: str = "") -> dict[str, object]:
|
|
status = status.lower()
|
|
if status not in {"open", "acknowledged", "resolved"}:
|
|
raise ValueError("invalid incident status")
|
|
states = self.entries()
|
|
current = states.get(incident_id, {"created_at": int(time.time())})
|
|
entry = {**current, "status": status, "note": note, "updated_at": int(time.time())}
|
|
states[incident_id] = entry
|
|
self._write(states)
|
|
return {"id": incident_id, **entry}
|
|
|
|
def _write(self, states: dict[str, dict[str, object]]) -> None:
|
|
self.path.parent.mkdir(parents=True, exist_ok=True)
|
|
self.path.write_text(json.dumps(states, indent=2, sort_keys=True), encoding="utf-8")
|