From e38950e285901df431bca1534c6a0a4d181c606a Mon Sep 17 00:00:00 2001
From: frikky <fredrik_9490@hotmail.com>
Date: Sat, 19 Dec 2020 10:27:50 +0100
Subject: [PATCH] Added extension folder for Shuffle

---
 .../cortex-responders/Shuffle/shuffle.json    | 35 +++++++++++++++
 .../cortex-responders/Shuffle/shuffle.py      | 28 ++++++++++++
 functions/extensions/wazuh/ossec.conf         |  7 +++
 functions/extensions/wazuh/requirements.txt   |  1 +
 functions/extensions/wazuh/shuffle.py         | 44 +++++++++++++++++++
 5 files changed, 115 insertions(+)
 create mode 100644 functions/extensions/cortex-responders/Shuffle/shuffle.json
 create mode 100644 functions/extensions/cortex-responders/Shuffle/shuffle.py
 create mode 100644 functions/extensions/wazuh/ossec.conf
 create mode 100644 functions/extensions/wazuh/requirements.txt
 create mode 100644 functions/extensions/wazuh/shuffle.py

diff --git a/functions/extensions/cortex-responders/Shuffle/shuffle.json b/functions/extensions/cortex-responders/Shuffle/shuffle.json
new file mode 100644
index 00000000..ef2610dd
--- /dev/null
+++ b/functions/extensions/cortex-responders/Shuffle/shuffle.json
@@ -0,0 +1,35 @@
+{
+  "name": "Shuffle",
+  "version": "1.0",
+  "author": "@frikkylikeme",
+  "url": "https://github.com/frikky/shuffle",
+  "license": "AGPL-V3",
+  "description": "Execute a workflow in Shuffle",
+  "dataTypeList": ["thehive:case", "thehive:alert"],
+  "command": "Shuffle/shuffle.py",
+  "baseConfig": "Shuffle",
+  "configurationItems": [
+    {
+      "name": "url",
+      "description": "The URL to your shuffle instance",
+      "type": "string",
+      "multi": false,
+      "required": true,
+      "defaultValue": "https://shuffler.io"
+    },
+		{
+      "name": "api_key",
+      "description": "The API key to your Shuffle user",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "workflow_id",
+      "description": "The ID of the workflow to execute",
+      "type": "string",
+      "multi": false,
+      "required": true
+    }
+  ]
+}
diff --git a/functions/extensions/cortex-responders/Shuffle/shuffle.py b/functions/extensions/cortex-responders/Shuffle/shuffle.py
new file mode 100644
index 00000000..0816ca53
--- /dev/null
+++ b/functions/extensions/cortex-responders/Shuffle/shuffle.py
@@ -0,0 +1,28 @@
+
+#!/usr/bin/env python
+# encoding: utf-8
+
+from cortexutils.responder import Responder
+import requests
+
+class Shuffle(Responder):
+    def __init__(self):
+        Responder.__init__(self)
+        self.api_key = self.get_param("config.api_key", "")
+        self.url = self.get_param("config.url", "")
+        self.workflow_id = self.get_param("config.workflow_id", "")
+
+    def run(self):
+        Responder.run(self)
+
+        parsed_url = "%s/api/v1/workflows/%s/execute" % (self.url, self.workflow_id)
+        headers = {
+            "Authorization": "Bearer %s"  % self.api_key
+        }
+        requests.post(parsed_url, headers=headers)
+
+        self.report({'message': 'message sent'})
+
+if __name__ == '__main__':
+    Shuffle().run()
+
diff --git a/functions/extensions/wazuh/ossec.conf b/functions/extensions/wazuh/ossec.conf
new file mode 100644
index 00000000..dfaf0394
--- /dev/null
+++ b/functions/extensions/wazuh/ossec.conf
@@ -0,0 +1,7 @@
+<integration>
+  <name>Shuffle</name>
+  <hook_url>http://<IP>:3001/api/v1/hooks/webhook_<HOOK_ID></hook_url>
+  <level>2</level>
+  <group>multiple_drops|authentication_failures</group>
+  <alert_format>json</alert_format>
+</integration>
diff --git a/functions/extensions/wazuh/requirements.txt b/functions/extensions/wazuh/requirements.txt
new file mode 100644
index 00000000..f2293605
--- /dev/null
+++ b/functions/extensions/wazuh/requirements.txt
@@ -0,0 +1 @@
+requests
diff --git a/functions/extensions/wazuh/shuffle.py b/functions/extensions/wazuh/shuffle.py
new file mode 100644
index 00000000..306d3715
--- /dev/null
+++ b/functions/extensions/wazuh/shuffle.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+
+# Based on 
+# https://wazuh.com/blog/how-to-integrate-external-software-using-integrator/
+  
+import sys
+import json
+import requests
+from requests.auth import HTTPBasicAuth
+  
+# Set the project attributes
+project_alias = 'TI'
+issue_name ='FIM'
+ 
+# Read configuration parameters
+alert_file = open(sys.argv[1])
+user = sys.argv[2].split(':')[0]
+api_key = sys.argv[2].split(':')[1]
+hook_url = sys.argv[3]
+  
+# Read the alert file
+alert_json = json.loads(alert_file.read())
+alert_file.close()
+  
+# Extract issue fields
+alert_level = alert_json['rule']['level']
+description = alert_json['rule']['description']
+path = alert_json['syscheck']['path']
+ 
+# Generate request
+msg_data = {}
+msg_data['fields'] = {}
+msg_data['fields']['project'] = {}
+msg_data['fields']['project']['key'] = project_alias
+msg_data['fields']['summary'] = 'FIM alert on [' + path + ']'
+msg_data['fields']['description'] = '- State: ' + description + '\n- Alert level: ' + str(alert_level)
+msg_data['fields']['issuetype'] = {}
+msg_data['fields']['issuetype']['name'] = issue_name
+headers = {'content-type': 'application/json', 'Accept-Charset': 'UTF-8'}
+ 
+# Send the request
+requests.post(hook_url, data=json.dumps(msg_data), headers=headers, auth=(user, api_key))
+ 
+sys.exit(0)