diff --git a/frontend/src/views/Apps.jsx b/frontend/src/views/Apps.jsx index 6626e8c4..68081191 100644 --- a/frontend/src/views/Apps.jsx +++ b/frontend/src/views/Apps.jsx @@ -291,9 +291,9 @@ const Apps = (props) => { if (response.status !== 200) { console.log("Status not 200 for apps :O!"); - if (isCloud) { - window.location.pathname = "/search"; - } + //if (isCloud) { + // window.location.pathname = "/search"; + //} } return response.json(); diff --git a/functions/usecases/README.md b/functions/usecases/README.md new file mode 100644 index 00000000..553034c2 --- /dev/null +++ b/functions/usecases/README.md @@ -0,0 +1,16 @@ +# Mindmap exporter +Shuffle has a mindmap for Workflow use-cases. These can be changed and exported, with the most important piece being that they're explorable and editable. This has and will come in handy for us as we build it into the product. + +https://www.mindmeister.com/map/2172644474 + +## Editing the Mindmap +There are a few categories. To edit them, click the small plus next to the branch you want to change. + +## Exporting the Mindmap +Click "Export as RTF" in the top left corner of the URL. Download it there. + +## Generating the Shuffle-comaptible mindmap +1. Move the rtf file here +2. Rename it categories.rtf +3. Run the read_categories.py file (python3 read_categories.py) +4. You now have a file called categories.json locally with all the categories in JSON format, ready to be used in graphs. diff --git a/functions/usecases/categories.json b/functions/usecases/categories.json new file mode 100644 index 00000000..f32d9700 --- /dev/null +++ b/functions/usecases/categories.json @@ -0,0 +1,522 @@ +{ + "1. Collect & Distribute": { + "2-way Ticket synchronization": { + "name": "", + "description": "", + "image": "" + }, + "Email management": { + "name": "", + "description": "", + "image": "", + "Attachments": { + "name": "", + "description": "", + "image": "" + }, + "Manage senders": { + "name": "", + "description": "", + "image": "" + }, + "Manage URLs": { + "name": "", + "description": "", + "image": "" + }, + "Encode & Decode URLs": { + "name": "", + "description": "", + "image": "" + }, + "Release a quarantined message": { + "name": "", + "description": "", + "image": "" + } + }, + "EDR to ticket": { + "name": "", + "description": "", + "image": "", + "Fetch incidents & events": { + "name": "", + "description": "", + "image": "" + }, + "Quarantine files": { + "name": "", + "description": "", + "image": "" + }, + "Quarantine host (respond)": { + "name": "", + "description": "", + "image": "" + }, + "Get host information": { + "name": "", + "description": "", + "image": "" + } + }, + "SIEM to ticket": { + "name": "", + "description": "", + "image": "" + }, + "ChatOps": { + "name": "", + "description": "", + "image": "" + }, + "Threat Intel received": { + "name": "", + "description": "", + "image": "" + }, + "Domain investigation with LetsEncrypt": { + "name": "", + "description": "", + "image": "" + }, + "Botnet tracker": { + "name": "", + "description": "", + "image": "" + }, + "Get running containers": { + "name": "", + "description": "", + "image": "" + }, + "Assign tickets": { + "name": "", + "description": "", + "image": "" + }, + "Firewall alerts": { + "name": "", + "description": "", + "image": "", + "Block/accept policies": { + "name": "", + "description": "", + "image": "" + }, + "Add addresses and ports to groups": { + "name": "", + "description": "", + "image": "" + }, + "Support custom URL categories": { + "name": "", + "description": "", + "image": "" + }, + "Fetch logs for specific address": { + "name": "", + "description": "", + "image": "" + }, + "URL filtering": { + "name": "", + "description": "", + "image": "" + } + }, + "IDS/IPS alerts": { + "name": "", + "description": "", + "image": "", + "Get/Fetch alerts": { + "name": "", + "description": "", + "image": "" + }, + "Receive alerts real-time": { + "name": "", + "description": "", + "image": "" + }, + "Get PCAP files": { + "name": "", + "description": "", + "image": "" + }, + "Get network logs": { + "name": "", + "description": "", + "image": "" + }, + "Manage policies": { + "name": "", + "description": "", + "image": "" + } + }, + "Deduplicate information": { + "name": "", + "description": "", + "image": "" + }, + "Correlate information": { + "name": "", + "description": "", + "image": "" + } + }, + "3. Detect": { + "Search SIEM (Sigma)": { + "name": "", + "description": "", + "image": "", + "Network": { + "name": "", + "description": "", + "image": "" + }, + "Endpoint": { + "name": "", + "description": "", + "image": "" + } + }, + "Search EDR (OSQuery)": { + "name": "", + "description": "", + "image": "" + }, + "Search emails (Phish)": { + "name": "", + "description": "", + "image": "", + "Check malware": { + "name": "", + "description": "", + "image": "" + }, + "Check targeted": { + "name": "", + "description": "", + "image": "" + }, + "Check headers and IOCs": { + "name": "", + "description": "", + "image": "" + } + }, + "Search IOCs (ioc-finder)": { + "name": "", + "description": "", + "image": "" + }, + "Search files (Yara)": { + "name": "", + "description": "", + "image": "" + }, + "Correlate tickets": { + "name": "", + "description": "", + "image": "" + }, + "Honeypot access": { + "name": "", + "description": "", + "image": "", + "S3 Honeypot": { + "name": "", + "description": "", + "image": "" + }, + "SSH Honeypot": { + "name": "", + "description": "", + "image": "" + }, + "FTP honeypot": { + "name": "", + "description": "", + "image": "" + }, + "Network honeypot": { + "name": "", + "description": "", + "image": "" + }, + "...": { + "name": "", + "description": "", + "image": "" + } + } + }, + "Verify": { + "Discover vulnerabilities": { + "name": "", + "description": "", + "image": "" + }, + "Discover assets": { + "name": "", + "description": "", + "image": "" + }, + "Ensure policies are followed": { + "name": "", + "description": "", + "image": "" + }, + "Find Inactive users": { + "name": "", + "description": "", + "image": "" + }, + "Ensure access rights match HR systems": { + "name": "", + "description": "", + "image": "" + }, + "Ensure onboarding is followed": { + "name": "", + "description": "", + "image": "" + }, + "Third party apps in SaaS": { + "name": "", + "description": "", + "image": "" + }, + "Devices used for your cloud account": { + "name": "", + "description": "", + "image": "" + }, + "Too much access in GCP/Azure/AWS/ other clouds": { + "name": "", + "description": "", + "image": "" + }, + "Certificate validation": { + "name": "", + "description": "", + "image": "" + }, + "Monitor new DNS entries for domain with passive DNS": { + "name": "", + "description": "", + "image": "" + }, + "Monitor and track password dumps": { + "name": "", + "description": "", + "image": "" + }, + "Monitor for mentions of domain on darknet sites": { + "name": "", + "description": "", + "image": "" + }, + "Reporting": { + "name": "", + "description": "", + "image": "", + "Automation time saved": { + "name": "", + "description": "", + "image": "" + }, + "Automation money saved": { + "name": "", + "description": "", + "image": "" + }, + "Incident response report": { + "name": "", + "description": "", + "image": "" + }, + "Department cost": { + "name": "", + "description": "", + "image": "" + }, + "Monthly reports": { + "name": "", + "description": "", + "image": "", + "EDR alerts": { + "name": "", + "description": "", + "image": "" + }, + "SIEM alerts": { + "name": "", + "description": "", + "image": "" + }, + "Emails quarantined": { + "name": "", + "description": "", + "image": "" + }, + "...": { + "name": "", + "description": "", + "image": "" + } + } + } + }, + "4. Respond": { + "Eradicate malware": { + "name": "", + "description": "", + "image": "" + }, + "Quarantine host(s)": { + "name": "", + "description": "", + "image": "" + }, + "Trigger scans": { + "name": "", + "description": "", + "image": "" + }, + "Update indicators (FW, EDR, SIEM...)": { + "name": "", + "description": "", + "image": "" + }, + "Autoblock activity when threat intel is received": { + "name": "", + "description": "", + "image": "" + }, + "Lock/Delete/Reset account": { + "name": "", + "description": "", + "image": "" + }, + "Lock vault": { + "name": "", + "description": "", + "image": "" + }, + "Increase authentication": { + "name": "", + "description": "", + "image": "" + }, + "Get policies from assets": { + "name": "", + "description": "", + "image": "" + } + }, + "2. Enrich": { + "Internal Enrichment": { + "name": "", + "description": "", + "image": "", + "Users": { + "name": "", + "description": "", + "image": "" + }, + "Hostnames": { + "name": "", + "description": "", + "image": "" + }, + "IPs": { + "name": "", + "description": "", + "image": "" + }, + "Departments": { + "name": "", + "description": "", + "image": "" + }, + "Role": { + "name": "", + "description": "", + "image": "" + }, + "Software": { + "name": "", + "description": "", + "image": "" + }, + "...": { + "name": "", + "description": "", + "image": "" + } + }, + "External historical Enrichment": { + "name": "", + "description": "", + "image": "", + "IPs": { + "name": "", + "description": "", + "image": "" + }, + "URLs": { + "name": "", + "description": "", + "image": "" + }, + "Hashes": { + "name": "", + "description": "", + "image": "" + }, + "Files": { + "name": "", + "description": "", + "image": "" + }, + "...": { + "name": "", + "description": "", + "image": "" + } + }, + "Realtime": { + "name": "", + "description": "", + "image": "", + "File detonation": { + "name": "", + "description": "", + "image": "" + }, + "URL detonation": { + "name": "", + "description": "", + "image": "" + }, + "PCAP analysis": { + "name": "", + "description": "", + "image": "" + }, + "Analyze screenshots": { + "name": "", + "description": "", + "image": "" + } + }, + "Ticketing webhook verification": { + "name": "", + "description": "", + "image": "" + } + } +} \ No newline at end of file diff --git a/functions/usecases/categories.rtf b/functions/usecases/categories.rtf new file mode 100644 index 00000000..e66d5fbf --- /dev/null +++ b/functions/usecases/categories.rtf @@ -0,0 +1,560 @@ +{\rtf1\ansi\deff0\deflang2057\plain\fs24\fet1 +{\fonttbl +{\f0\froman Arial;} +} +{\info +{\createim\yr2022\mo2\dy18\hr17\min49} +} + +\paperw11907\paperh16840\margl1800\margr1800\margt1440\margb1440 +\slmult0\ltrpar\li0 +{\b\fs28 +Shuffle categories +} +\par\pard\plain +\slmult0\ltrpar\li200 +{\fs24 +1. Collect & Distribute +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +2-way Ticket synchronization +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Email management +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Attachments +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Manage senders +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Manage URLs +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Encode & Decode URLs +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Release a quarantined message +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +EDR to ticket +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Fetch incidents & events +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Quarantine files +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Quarantine host (respond) +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Get host information +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +SIEM to ticket +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +ChatOps +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Threat Intel received +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Domain investigation with LetsEncrypt +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Botnet tracker +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Get running containers +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Assign tickets +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Firewall alerts +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Block/accept policies +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Add addresses and ports to groups +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Support custom URL categories +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Fetch logs for specific address +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +URL filtering +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +IDS/IPS alerts +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Get/Fetch alerts +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Receive alerts real-time +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Get PCAP files +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Get network logs +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Manage policies +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Deduplicate information +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Correlate information +} +\par\pard\plain +\slmult0\ltrpar\li200 +{\fs24 +3. Detect +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Search SIEM (Sigma) +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Network +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Endpoint +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Search EDR (OSQuery) +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Search emails (Phish) +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Check malware +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Check targeted +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Check headers and IOCs +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Search IOCs (ioc-finder) +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Search files (Yara) +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Correlate tickets +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Honeypot access +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +S3 Honeypot +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +SSH Honeypot +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +FTP honeypot +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Network honeypot +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +... +} +\par\pard\plain +\slmult0\ltrpar\li200 +{\fs24 +rich +} +\par\pard\plain +\slmult0\ltrpar\li200 +{\fs24 +Verify +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Discover vulnerabilities +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Discover assets +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Ensure policies are followed +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Find Inactive users +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Ensure access rights match HR systems +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Ensure onboarding is followed +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Third party apps in SaaS +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Devices used for your cloud account +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Too much access in GCP/Azure/AWS/ other clouds +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Certificate validation +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Monitor new DNS entries for domain with passive DNS +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Monitor and track password dumps +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Monitor for mentions of domain on darknet sites +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Reporting +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Automation time saved +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Automation money saved +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Incident response report +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Department cost +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Monthly reports +} +\par\pard\plain +\slmult0\ltrpar\li800 +{\fs24 +EDR alerts +} +\par\pard\plain +\slmult0\ltrpar\li800 +{\fs24 +SIEM alerts +} +\par\pard\plain +\slmult0\ltrpar\li800 +{\fs24 +Emails quarantined +} +\par\pard\plain +\slmult0\ltrpar\li800 +{\fs24 +... +} +\par\pard\plain +\slmult0\ltrpar\li200 +{\fs24 +4. Respond +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Eradicate malware +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Quarantine host(s) +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Trigger scans +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Update indicators (FW, EDR, SIEM...) +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Autoblock activity when threat intel is received +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Lock/Delete/Reset account +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Lock vault +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Increase authentication +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Trigger scans +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Get policies from assets +} +\par\pard\plain +\slmult0\ltrpar\li200 +{\fs24 +2. Enrich +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Internal Enrichment +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Users +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Hostnames +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +IPs +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Departments +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Role +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Software +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +... +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +External historical Enrichment +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +IPs +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +URLs +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Hashes +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Files +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +... +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Realtime +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +File detonation +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +URL detonation +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +PCAP analysis +} +\par\pard\plain +\slmult0\ltrpar\li600 +{\fs24 +Analyze screenshots +} +\par\pard\plain +\slmult0\ltrpar\li400 +{\fs24 +Ticketing webhook verification +} +\par\pard\plain +} \ No newline at end of file diff --git a/functions/usecases/read_categories.py b/functions/usecases/read_categories.py new file mode 100644 index 00000000..c99c4f01 --- /dev/null +++ b/functions/usecases/read_categories.py @@ -0,0 +1,53 @@ +data = "" +with open("categories.rtf", "r") as tmp: + data = tmp.read() + +fixed_json = {} +linearity = 0 +heading = "" +subheading = "" +subsubheading = "" +for line in data.split("\n"): + if line == "rich": + continue + + if "li" in line: + lisplit = line.split("\\") + try: + linearity = int(lisplit[-1][2]) + except: + pass + + #print("Linearity: %s" % linearity) + + if line.startswith("{") or line.startswith("}"): + continue + + if line.startswith("\\"): + continue + + if linearity == 0: + continue + + if linearity == 2: + fixed_json[line] = {} + heading = line + elif linearity == 4: + fixed_json[heading][line] = {"name": "", "description": "", "image": ""} + subheading = line + elif linearity == 6: + fixed_json[heading][subheading][line] = {"name": "", "description": "", "image": ""} + subsubheading = line + elif linearity == 8: + fixed_json[heading][subheading][subsubheading][line] = {"name": "", "description": "", "image": ""} + else: + print("No handler for %s" % line) + +#print(line) +#print(data) +import json +filename = "categories.json" +with open(filename, "w+") as tmp: + tmp.write(json.dumps(fixed_json, indent=4)) + +print("Wrote to file %s" % filename)