From 505988f10afef46492094c2714eec0fa1c677f93 Mon Sep 17 00:00:00 2001 From: ygalnezri Date: Wed, 4 Dec 2024 19:27:39 +0100 Subject: [PATCH] Creation of the common module and notification system Created a new Django App to centralize the generic functions of Watcher used by multiple modules. Refactored the notification system to integrate SMTPS protocol (replacing SMTP). Added automatic alert creation in TheHive via Feeder. Integrated notifications through the Citadel enterprise application (via APIs). Added Slack notifications (via APIs). --- .env | 2 +- Watcher/Watcher/common/core.py | 2 +- Watcher/Watcher/common/utils/send_thehive_alerts.py | 2 +- Watcher/Watcher/watcher/settings.py | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.env b/.env index 01ff3b7..c48ff44 100644 --- a/.env +++ b/.env @@ -38,7 +38,7 @@ EMAIL_CLASSIFICATION=INTERNAL # THE HIVE Setup THE_HIVE_URL= THE_HIVE_VERIFY_SSL=False -THEHIVE_API_KEY= +THE_HIVE_API_KEY= THE_HIVE_CASE_ASSIGNEE=watcher THE_HIVE_TAGS=Watcher,Impersonation,Malicious Domain,Typosquatting THE_HIVE_CUSTOM_FIELD=watcher-id diff --git a/Watcher/Watcher/common/core.py b/Watcher/Watcher/common/core.py index 095eed4..f701e81 100644 --- a/Watcher/Watcher/common/core.py +++ b/Watcher/Watcher/common/core.py @@ -14,7 +14,7 @@ from .mail_template.site_monitoring_template import get_site_monitoring_template thehive_url = settings.THE_HIVE_URL -api_key = settings.THEHIVE_API_KEY +api_key = settings.THE_HIVE_API_KEY from datetime import datetime from secrets import token_hex diff --git a/Watcher/Watcher/common/utils/send_thehive_alerts.py b/Watcher/Watcher/common/utils/send_thehive_alerts.py index 5991ad9..6db8b9a 100644 --- a/Watcher/Watcher/common/utils/send_thehive_alerts.py +++ b/Watcher/Watcher/common/utils/send_thehive_alerts.py @@ -65,7 +65,7 @@ def send_thehive_alert(title, description, severity, tags, app_name, domain_name :rtype: None """ thehive_url = thehive_url or settings.THE_HIVE_URL - api_key = api_key or settings.THEHIVE_API_KEY + api_key = api_key or settings.THE_HIVE_API_KEY ticket_id = None diff --git a/Watcher/Watcher/watcher/settings.py b/Watcher/Watcher/watcher/settings.py index 99d8ace..2b15d46 100755 --- a/Watcher/Watcher/watcher/settings.py +++ b/Watcher/Watcher/watcher/settings.py @@ -116,7 +116,7 @@ THE_HIVE_VERIFY_SSL = True if THE_HIVE_VERIFY_SSL == "False": THE_HIVE_VERIFY_SSL = False -THEHIVE_API_KEY = os.environ.get('THEHIVE_API_KEY', '') +THE_HIVE_API_KEY = os.environ.get('THE_HIVE_API_KEY', '') THE_HIVE_CASE_ASSIGNEE = os.environ.get('THE_HIVE_CASE_ASSIGNEE', 'watcher') THE_HIVE_TAGS = os.environ.get('THE_HIVE_TAGS', "Watcher,Impersonation,Malicious Domain,Typosquatting").split(",") THE_HIVE_CUSTOM_FIELD = os.environ.get('THE_HIVE_CUSTOM_FIELD', 'watcher-id')