64 lines
3.1 KiB
Python
64 lines
3.1 KiB
Python
import logging
|
|
|
|
from django.core.validators import MinValueValidator
|
|
from django.db import models
|
|
from django.utils.translation import gettext_lazy
|
|
|
|
from console.models import NameDescriptionModel, UniqueNameDescriptionModel
|
|
from correlation.constants import Type
|
|
|
|
_log = logging.getLogger(__name__)
|
|
|
|
|
|
class Group(UniqueNameDescriptionModel):
|
|
""" Groups for correlator rules"""
|
|
pass
|
|
|
|
|
|
class Rule(NameDescriptionModel):
|
|
""" Model for correlator rule"""
|
|
|
|
group = models.ForeignKey(Group,
|
|
on_delete=models.SET_NULL,
|
|
related_name='rules',
|
|
null=True,
|
|
blank=True,
|
|
verbose_name=gettext_lazy("Group"))
|
|
multi = models.BooleanField(verbose_name=gettext_lazy("Multi reaction"),
|
|
help_text=gettext_lazy("Apply actions to every event that match the rule"),
|
|
default=False)
|
|
type = models.IntegerField(choices=Type.choices,
|
|
verbose_name=gettext_lazy("Type"))
|
|
status = models.BooleanField(verbose_name=gettext_lazy("Enabled"), help_text=gettext_lazy("Is rule enabled?"))
|
|
archived = models.BooleanField(verbose_name=gettext_lazy("Archived"),
|
|
help_text=gettext_lazy(
|
|
"Is rule archived? If set - than rule can never be enabled again"),
|
|
default=False)
|
|
depth = models.DurationField(verbose_name=gettext_lazy("Depth"),
|
|
help_text=gettext_lazy("Analize depth in format HH:MM:SS"))
|
|
created = models.DateTimeField(auto_now_add=True,
|
|
verbose_name=gettext_lazy('Created'))
|
|
updated = models.DateTimeField(auto_now=True,
|
|
verbose_name=gettext_lazy('Updated'))
|
|
rule_json = models.JSONField(verbose_name=gettext_lazy('Predicats'),
|
|
help_text=gettext_lazy('JSON object with predicats description'))
|
|
actions_json = models.JSONField(verbose_name=gettext_lazy('Actions'),
|
|
help_text=gettext_lazy('JSON object with actions description'))
|
|
|
|
rev = models.IntegerField(default=1,
|
|
verbose_name=gettext_lazy('Rule version'),
|
|
help_text=gettext_lazy('Shows rule current version. Increments on change'))
|
|
sid = models.IntegerField(blank=False,
|
|
verbose_name=gettext_lazy('Rule SID'),
|
|
help_text=gettext_lazy('SID of correlation rule'),
|
|
validators=[MinValueValidator(1)])
|
|
is_active = models.BooleanField(gettext_lazy('Is rule active'),
|
|
default=True,
|
|
help_text=gettext_lazy('Indicates if rule is activated or not'))
|
|
|
|
class Meta:
|
|
unique_together = ('rev', 'sid')
|
|
|
|
def save(self, *args, **kwargs):
|
|
self.is_being_parsed = kwargs.get("is_being_parsed", None)
|
|
super(Rule, self).save()
|