diff --git a/backend/app_gen/openapi-parsers/generated/cyberreason.yaml b/backend/app_gen/openapi-parsers/generated/cyberreason.yaml deleted file mode 100644 index c6c33693..00000000 --- a/backend/app_gen/openapi-parsers/generated/cyberreason.yaml +++ /dev/null @@ -1,579 +0,0 @@ -components: - schemas: - tmp0: - properties: - outcome: - type: string - type: object - tmp1: - properties: - allRansomwareProcessesSuspended: - type: string - closeTime: - type: string - closerName: - type: string - creationTime: - type: string - customClassification: - type: string - decisionFeature: - type: string - detectionType: - type: string - elementDisplayName: - type: string - hasRansomwareSuspendedProcesses: - type: string - isBlocked: - type: string - malopActivityTypes: - type: string - malopLastUpdateTime: - type: string - malopStartTime: - type: string - managementStatus: - type: string - rootCauseElementNames: - type: string - rootCauseElementTypes: - type: string - type: object - tmp2: - properties: - blocking: - type: string - direction: - type: string - domain: - type: string - ipAddress: - type: string - ipAddressString: - type: string - lastUpdated: - type: string - port: - type: string - ruleId: - type: string - type: object - tmp3: - properties: - blacklistClassification: - type: string - classificationLink: - type: string - containsTorDomain: - type: string - domainClassificationSuspicion: - type: string - domainNameUniqueId: - type: string - elementDisplayName: - type: string - everResolvedDomain: - type: string - everResolvedSecondLevelDomain: - type: string - extendedDisplayId: - type: string - federationSegments: - type: string - getIpDiscoveryDomainList: - type: string - hasMalops: - type: string - hasResolvedClassificationEvidence: - type: string - hasSuspicions: - type: string - indifferentClassification: - type: string - isDomainMalicious: - type: string - isInIpDiscoveryDomainList: - type: string - isInternalDomain: - type: string - isInternalDomainByName: - type: string - isReverseLookup: - type: string - isTorrentDomain: - type: string - lookupDomainClassification: - type: string - maliciousClassification: - type: string - maliciousClassificationString: - type: string - maliciousClassificationType: - type: string - malwareClassification: - type: string - name: - type: string - relatedToMalop: - type: string - rootCauseKey: - type: string - secondLevelDomain: - type: string - sinkholedClassification: - type: string - sinkholedClassificationEvidence: - type: string - topLevelDomain: - type: string - unknownClassification: - type: string - unresolvedClassification: - type: string - unwantedClassification: - type: string - whitelistClassification: - type: string - type: object - tmp4: - properties: - attemptExecutionProcessSuspicion: - type: string - attributes: - type: string - blackListClassification: - type: string - canonizedPath: - type: string - classificationLink: - type: string - correctedPath: - type: string - createdTime: - type: string - detectionEventData: - type: string - dualExtensionName: - type: string - elementDisplayName: - type: string - extendedDisplayId: - type: string - extension: - type: string - extensionRecord: - type: string - extensionType: - type: string - externalProductClassification: - type: string - externalProductClassificationIsSigned: - type: string - externalProductClassificationSignatureVerificationStatus: - type: string - externalProductClassificationSignatureVerified: - type: string - externalProductClassificationSignatureVerifiedByVerificationStatus: - type: string - externalProductClassificationType: - type: string - federationSegments: - type: string - fileHasSystem32SubDirectories: - type: string - fileHasSystemSubDirectories: - type: string - fileHashUniqueId: - type: string - fileInSystemPath: - type: string - fileReputationSuspicion: - type: string - fileReputationSuspicionDecision: - type: string - fileVersionSuspicionDecision: - type: string - getNetworkScannersNames: - type: string - getToolsForUnusualNetworkEvidence: - type: string - hackingToolClassification: - type: string - hasAutorun: - type: string - hasClassification: - type: string - hasInternalName: - type: string - hasLegitClassification: - type: string - hasMalops: - type: string - hasNonLegitClassification: - type: string - hasNonLegitClassificationEvidence: - type: string - hasProductClassification: - type: string - hasRansomwareClassificationSubType: - type: string - hasSuspicions: - type: string - identifiedProduct: - type: string - indifferentClassification: - type: string - isDocument: - type: string - isExecutable: - type: string - isFromRemovableDevice: - type: string - isFromTemp: - type: string - isNoTypeFoundClassification: - type: string - isPEFile: - type: string - isProcessImageFile: - type: string - isScreenSaver: - type: string - isSigned: - type: string - isSuspicious: - type: string - lastDetectionEventData: - type: string - maliciousClassification: - type: string - maliciousClassificationString: - type: string - maliciousClassificationType: - type: string - maliciousToolClassification: - type: string - malwareClassification: - type: string - malwareClassificationEvidence: - type: string - malwareType: - type: string - md5: - type: string - md5String: - type: string - missingInterperterSectionValue: - type: string - modifiedTime: - type: string - name: - type: string - nameWithoutExtension: - type: string - path: - type: string - peSignedAndVerified: - type: string - productClassificationType: - type: string - productType: - type: string - profileId: - type: string - ransomwareClassification: - type: string - reasonSignatureVerificationStatus: - type: string - relatedToMalop: - type: string - reportedByAntiMalwareEvidence: - type: string - reportedByAntiMalwareSuspicion: - type: string - rootCauseKey: - type: string - sha1: - type: string - sha1String: - type: string - signatureVerified: - type: string - signatureVerifiedByVerificationStatus: - type: string - signatureVerifiedInternalOrExternal: - type: string - signedByApple: - type: string - signedByLinux: - type: string - signedByMicrosoft: - type: string - signedByOperatingSystem: - type: string - signedInternalOrExternal: - type: string - size: - type: string - suspiciousClassification: - type: string - suspiciousScreenSaverCondition: - type: string - unknownClassification: - type: string - unsignedPeFileEvidence: - type: string - unwantedClassification: - type: string - whitelistClassification: - type: string - type: object - tmp5: - properties: - address: - type: string - addressInternalExternalLocal: - type: string - addressString: - type: string - blackListClassification: - type: string - countryCode: - type: string - countryName: - type: string - countryNameOrNotExternalType: - type: string - elementDisplayName: - type: string - extendedDisplayId: - type: string - federationSegments: - type: string - geolocationLookup: - type: string - hasMalops: - type: string - hasSuspicions: - type: string - isDynamicConfiguration: - type: string - isExternalAddress: - type: string - isInternalAddress: - type: string - isLocalAddress: - type: string - latitude: - type: string - longitude: - type: string - lookupIpClassification: - type: string - maliciousClassification: - type: string - maliciousClassificationType: - type: string - rootCauseKey: - type: string - uniqueIpAddressHash: - type: string - version: - type: string - whiteListClassification: - type: string - type: object - securitySchemes: - BasicAuth: - scheme: basic - type: http -info: - contact: - email: frikky@shuffler.io - name: '@frikkylikeme' - url: https://twitter.com/frikkylikeme - description: Automated generation of Cyberreason Cyberreason - title: Cyberreason Cyberreason - version: 1.0.0 -openapi: 3.0.2 -paths: - tmp0: - post: - description: CyberReason Block or Unblock an Item - parameters: - - description: IP, Domain, or Hash CSV values to blacklist or whitelist - example: '' - in: query - name: Values - required: true - schema: - type: string - - description: Either 'blacklist' or 'whitelist' - example: '' - in: query - name: Action - required: true - schema: - type: string - responses: - '200': - content: - application/json: - schema: - $ref: '#/components/schemas/tmp0' - description: Successful request - summary: CyberReason Block Item - tmp1: - post: - description: CyberReason get alerts from MalOps - parameters: [] - responses: - '200': - content: - application/json: - schema: - $ref: '#/components/schemas/tmp1' - description: Successful request - summary: CyberReason Get MalOps Alerts - tmp2: - post: - description: CyberReason isolate a host by port - parameters: - - description: IP to block - example: '' - in: query - name: IP - required: true - schema: - type: string - - description: Port to block - example: '' - in: query - name: Port - required: true - schema: - type: string - - description: Direction to block traffic, one of 'ALL', 'INCOMING', 'OUTGOING' - example: '' - in: query - name: Direction to block - required: true - schema: - type: string - - description: If true will isolate, false will remove from isolation - example: '' - in: query - name: Block - required: true - schema: - type: string - responses: - '200': - content: - application/json: - schema: - $ref: '#/components/schemas/tmp2' - description: Successful request - summary: CyberReason Isolate Host - tmp3: - post: - description: Check CyberReason for a domain - parameters: - - description: Domain to search for - example: '' - in: query - name: Domain - required: true - schema: - type: string - - description: Limit of results to return - example: '' - in: body - name: Limit - required: false - schema: - type: string - - description: Timeout - example: '12000' - in: body - name: Timeout (ms) - required: false - schema: - type: string - responses: - '200': - content: - application/json: - schema: - $ref: '#/components/schemas/tmp3' - description: Successful request - summary: CyberReason Query for Domain - tmp4: - post: - description: Check CyberReason for a hash - parameters: - - description: Hash to search for - example: '' - in: query - name: Hash - required: true - schema: - type: string - - description: Limit of results to return - example: '' - in: body - name: Limit - required: false - schema: - type: string - - description: Timeout - example: '12000' - in: body - name: Timeout (ms) - required: false - schema: - type: string - responses: - '200': - content: - application/json: - schema: - $ref: '#/components/schemas/tmp4' - description: Successful request - summary: CyberReason Query for Hash - tmp5: - post: - description: Check CyberReason for a IP - parameters: - - description: IP to search for - example: '' - in: query - name: IP - required: true - schema: - type: string - - description: Limit of results to return - example: '' - in: body - name: Limit - required: false - schema: - type: string - - description: Timeout - example: '12000' - in: body - name: Timeout (ms) - required: false - schema: - type: string - responses: - '200': - content: - application/json: - schema: - $ref: '#/components/schemas/tmp5' - description: Successful request - summary: CyberReason Query for IP -tags: -- Endpoint Security & Management diff --git a/backend/app_gen/openapi-parsers/swimlane.py b/backend/app_gen/openapi-parsers/swimlane.py index c14855a5..6333da59 100644 --- a/backend/app_gen/openapi-parsers/swimlane.py +++ b/backend/app_gen/openapi-parsers/swimlane.py @@ -1,6 +1,7 @@ import requests import yaml import json +import os # USAGE: # 1. Find the item here: @@ -77,8 +78,8 @@ def parse_data(data): except KeyError as e: pass - if not authset: - print("AUTH NOT SET: %s" % inputparams) + #if not authset: + # print("AUTH NOT SET: %s" % inputparams) except KeyError as e: print("KeyError asset: %s" % e) @@ -135,10 +136,16 @@ def parse_data(data): description = value["description"] except KeyError: pass + + required = False + try: + required = value["required"] + except KeyError: + pass openapi["paths"]["tmp%d" % cnt][method]["parameters"].append({ "name": value["name"], - "required": value["required"], + "required": required, "example": example, "description": description, "schema": {"type": schema}, @@ -181,25 +188,44 @@ def parse_data(data): return filename, openapi -def dump_data(filename, openapi): - generatedfile = "generated/%s" % filename +def dump_data(filename, openapi, category): + generatedfile = "generated/%s/%s" % (category, filename) + try: + with open(generatedfile, "w+") as tmp: + tmp.write(yaml.dump(openapi)) + except FileNotFoundError: + os.mkdir("generated/%s" % category) + with open(generatedfile, "w+") as tmp: tmp.write(yaml.dump(openapi)) print("Generated %s" % generatedfile) if __name__ == "__main__": - #url = "https://apphub.swimlane.com/api/v1/bundles/cjuspytpz00rh0hpjo5chqg10" - #url = "https://apphub.swimlane.com/api/v1/bundles/cjyoy62ch04920lr26id5sr0e" - #url = "https://apphub.swimlane.com/api/v1/bundles/cjqrdc2yr02rs0fli6jrosiqb" - #url = "https://apphub.swimlane.com/api/v1/bundles/cjqrdat0u01ux0flipb68a0a0" - #url = "https://apphub.swimlane.com/api/v1/bundles/cjqrdhbwp07nf0fli23lyb52h" + number = 1 + #https://apphub.swimlane.com/ + categories = [ + "Endpoint Security & Management", + "SIEM & Log Management", + "Ticket Management", + ] - url = "https://apphub.swimlane.io/api/swimbundles/swimlane/sw_alienvault_threatcrowd" - url = "https://apphub.swimlane.com/api/swimbundles/swimlane/sw_anomali_threatstream" + search_category = categories[2] + total = 0 + while(True): + url = "https://apphub.swimlane.io/api/search/swimbundles?page=%d" % number + + json = {"fields": {"family": search_category}} + ret = requests.post( + url, + json=json, + ) - with open("swimlane_urls.json", "r") as tmp: - parsed = json.loads(tmp.read()) + if ret.status_code != 201: + print("RET NOT 201: %d" % ret.status_code) + break + + parsed = ret.json() try: category = parsed["data"][0]["swimbundleMeta"]["family"][0] except KeyError: @@ -207,9 +233,15 @@ if __name__ == "__main__": except IndexError: category = "" - print("CATEGORY: %s" % category) + if category == "": + break for data in parsed["data"]: filename, openapi = parse_data(data) openapi["tags"] = [category] - dump_data(filename, openapi) + dump_data(filename, openapi, category) + total += 1 + + number += 1 + + print("Created %d openapi specs from Swimlane with category %s" % (total, search_category))