Adding methods for rules and decoders #73

pro-akim · 2023-06-30T11:36:25Z

Related Issue
#66

Description

This PR includes new methods for adding and replacing rules and decoders.

Evidences

Running:

wh.change_decoders('manager1', '/home/akim/Desktop/decoder_total.xml')
wh.change_rules('manager1', '/home/akim/Desktop/rules_total.xml')
wh.add_decoder('manager1', '/home/akim/Desktop/decoder.xml', '/var/ossec/etc/decoders/local_decoder.xml')
wh.add_rule('manager1', '/home/akim/Desktop/rule.xml', '/var/ossec/etc/rules/local_rules.xml')

Results:

Changed '/var/ossec/etc/decoders/local_decoder.xml' by '/home/akim/Desktop/decoder.xml' content.
Changed '/var/ossec/etc/rules/local_rules.xml' by '/home/akim/Desktop/rules_total.xml' content.
Adding a decoder from '/home/akim/Desktop/decoder.xml' to '/var/ossec/etc/decoders/local_decoder.xml'
Adding a rule from '/home/akim/Desktop/rule.xml' to '/var/ossec/etc/rules/local_rules.xml'

src/wazuh_qa_framework/system/wazuh_handler.py

roronoasins · 2023-07-06T10:31:16Z

GJ! LGTM

pro-akim · 2023-07-06T11:56:53Z

06/07/2023

Small changes done around format of f'string use

src/wazuh_qa_framework/system/wazuh_handler.py

pro-akim · 2023-07-12T17:58:07Z

12/07/2023 Update

All changes were done.
Add and Change decoders were changed by create decoders
Same for rules.

Tests:

Evidences

Running:

wh.create_decoder('manager1', '/home/akim/Desktop/decoder_total.xml', '/var/ossec/etc/decoders/local_decoder.xml', overwrite=True)
wh.create_decoder('manager1', '/home/akim/Desktop/decoder_simple.xml', '/var/ossec/etc/decoders/local_decoder.xml', overwrite=False)
wh.create_rule('manager1', '/home/akim/Desktop/rule_total.xml', '/var/ossec/etc/rules/local_rules.xml', overwrite=True)
wh.create_rule('manager1', '/home/akim/Desktop/rule_simple.xml', '/var/ossec/etc/rules/local_rules.xml', overwrite=False)

Results:

/var/ossec/etc/decoders/local_decoder.xml changed by /home/akim/Desktop/decoder_total.xml
/home/akim/Desktop/decoder_simple.xml added to /var/ossec/etc/decoders/local_decoder.xml
/var/ossec/etc/rules/local_rules.xml changed by /home/akim/Desktop/rule_total.xml
/home/akim/Desktop/rule_simple.xml added to /var/ossec/etc/rules/local_rules.xml

pro-akim · 2023-07-13T09:03:42Z

13/07/2023 Update

The linter is not functioning properly.
Even though line 891 is not present in 72ccf45, the linter is still detecting a whitespace error. Therefore, a new pull request will be submitted for review, even if the linting error persists.

Rebits · 2023-07-27T10:30:04Z

src/wazuh_qa_framework/system/wazuh_handler.py

+ try:
+ with open(new_rule_filename, 'r') as file:
+ new_rules = file.read()
+ if overwrite:
+ self.logger.info(message=f'Changing {rules_filename} to {new_rule_filename}')
+ else:
+ current_rules = self.get_file_content(host, rules_filename)
+ index_rule = current_rules.rfind("</rule>")
+ if index_rule != -1:
+ new_rules = current_rules[:index_rule] + '</rule>\n' + new_rules + '\n</group>'
+ self.logger.info(message=f'Adding rule from {new_rule_filename} to {rules_filename}')
+
+ self.modify_file_content(host, rules_filename, new_rules)
+ self.logger.info(message=f'Rules succefully updated')
+
+ except FileNotFoundError:
+ self.logger.error(message=f'The file {new_rule_filename} does not exist.')


The method should create the file if it does not exists.

Fixed in 30e6c21

Rebits · 2023-07-27T10:41:40Z

src/wazuh_qa_framework/system/wazuh_handler.py

@@ -843,3 +843,57 @@ def is_manager(self, host):
 bool: True if host is manager
 """
 return host in self.get_managers()
+
+ def create_rule(self, host, new_rule_filename, rules_filename, overwrite=True):


The new_rule_filename is not the filename, it is the filepath. In addition respect the plural for the variables

Suggested change

def create_rule(self, host, new_rule_filename, rules_filename, overwrite=True):

def create_rule(self, host, new_rules_filepath, rules_filename, overwrite=True):

Fixed in 30e6c21

Rebits · 2023-07-27T10:54:23Z

src/wazuh_qa_framework/system/wazuh_handler.py

+ if overwrite:
+ self.logger.info(message=f'Changing {rules_filename} to {new_rule_filename}')


Move logger to the start of the method

With the new flow (adding creation of new file), it will make sense to keep it in this position

Rebits · 2023-07-27T10:55:00Z

src/wazuh_qa_framework/system/wazuh_handler.py

+ current_rules = self.get_file_content(host, rules_filename)
+ index_rule = current_rules.rfind("</rule>")
+ if index_rule != -1:
+ new_rules = current_rules[:index_rule] + '</rule>\n' + new_rules + '\n</group>'
+ self.logger.info(message=f'Adding rule from {new_rule_filename} to {rules_filename}')


Why do this? Why not simply append the new rules at the end of the file?

It is because should go inside and follow the previous (preexisting) rule.

Rebits · 2023-07-27T10:56:05Z

src/wazuh_qa_framework/system/wazuh_handler.py

+ host (str): Host name.
+ new_decoder_filename (str): New decoder filepath.
+ rules_filename (str): Host decoder filename.
+ overwrite (bool): replace the decoder file True, add decoders to decoders file, False. Defaults to True.


Suggested change

overwrite (bool): replace the decoder file True, add decoders to decoders file, False. Defaults to True.

overwrite (bool): Replace the decoder file. Defaults to True.

Fixed in 30e6c21

Rebits · 2023-07-27T10:56:51Z

src/wazuh_qa_framework/system/wazuh_handler.py

+ host (str): Host name.
+ new_rule_filename (str): New rules filepath.
+ rules_filename (str): Host rules filename.
+ overwrite (bool): replace the rules file True, add rules to rules file, False. Defaults to True.


Suggested change

overwrite (bool): replace the rules file True, add rules to rules file, False. Defaults to True.

overwrite (bool): Replace the rules file. Defaults to True.

Fixed in 30e6c21

Rebits · 2023-07-27T10:59:59Z

src/wazuh_qa_framework/system/wazuh_handler.py

+ current_decoders = self.get_file_content(host, decoder_filename)
+ index_decoder = current_decoders.rfind("</decoder>")
+ if index_decoder != -1:
+ new_decoders = current_decoders[:index_decoder] + '</decoder>\n' + new_decoders
+ self.logger.info(message=f'Adding decoder from {new_decoder_filename} to {decoder_filename}')
+ self.modify_file_content(host, decoder_filename, new_decoders)
+ self.logger.info(message=f'Rules succefully updated')


Same as before

Fixed in 30e6c21

Rebits · 2023-07-27T11:00:08Z

src/wazuh_qa_framework/system/wazuh_handler.py

+ new_decoders = file.read()
+
+ if overwrite:
+ self.logger.info(message=f'Changing {decoder_filename} to {new_decoder_filename}')


Same as before

Fixed in 30e6c21

pro-akim · 2023-08-01T13:38:42Z

Update

Fixes done after review.
Linting detects multiple spaces after operators in line 900. No multiple spaces were found.

Tests:

Evidences

Running for rules:

wh.create_decoder('manager1', '/home/akim/Desktop/decoder_total.xml', '/var/ossec/etc/decoders/local_decoder.xml', overwrite=True)
wh.create_decoder('manager1', '/home/akim/Desktop/decoder_simple.xml', '/var/ossec/etc/decoders/local_decoder.xml', overwrite=False)
wh.create_rule('manager1', '/home/akim/Desktop/rule_total.xml', '/var/ossec/etc/rules/local_rules.xml', overwrite=True)
wh.create_rule('manager1', '/home/akim/Desktop/rule_simple.xml', '/var/ossec/etc/rules/local_rules.xml', overwrite=False)
wh.create_decoder('manager1', '/home/akim/Desktop/decoder_total.xml', '/var/ossec/etc/decoders/unexisting_local_decoder.xml', overwrite=True)
wh.create_decoder('manager1', '/home/akim/Desktop/decoder_simple.xml', '/var/ossec/etc/decoders/unexisting_local_decoder.xml', overwrite=False)
wh.create_rule('manager1', '/home/akim/Desktop/rule_total.xml', '/var/ossec/etc/rules/unexisting_local_rules.xml', overwrite=True)
wh.create_rule('manager1', '/home/akim/Desktop/rule_simple.xml', '/var/ossec/etc/rules/unexisting_local_ruleslocal_rules.xml', overwrite=False)

Results:

/var/ossec/etc/decoders/local_decoder.xml changed by /home/akim/Desktop/decoder_total.xml
/home/akim/Desktop/decoder_simple.xml added to /var/ossec/etc/decoders/local_decoder.xml
/var/ossec/etc/rules/local_rules.xml changed by /home/akim/Desktop/rule_total.xml
/home/akim/Desktop/rule_simple.xml added to /var/ossec/etc/rules/local_rules.xml
/var/ossec/etc/decoders/unexisting_local_decoder.xm does not exist to be overwritten
Decoderrs succefully added into a new file named /var/ossec/etc/decoders/unexisting_local_decoder.xm
/var/ossec/etc/rules/unexisting_local_ruleslocal_rules.xml does not exist to be overwritten
Rules succefully added into a new rule file named /var/ossec/etc/rules/unexisting_local_ruleslocal_rules.xml

feature(#66): Adding rules and decoders methods

efdddbc

pro-akim self-assigned this Jun 30, 2023

pro-akim linked an issue Jun 30, 2023 that may be closed by this pull request

Wazuh Handler: Rules and decoders configuration #66

Closed

4 tasks

feature(#66): Adding logs to methods

0504021

roronoasins reviewed Jul 3, 2023

View reviewed changes

src/wazuh_qa_framework/system/wazuh_handler.py Outdated Show resolved Hide resolved

roronoasins reviewed Jul 3, 2023

View reviewed changes

src/wazuh_qa_framework/system/wazuh_handler.py Outdated Show resolved Hide resolved

roronoasins reviewed Jul 3, 2023

View reviewed changes

src/wazuh_qa_framework/system/wazuh_handler.py Outdated Show resolved Hide resolved

roronoasins reviewed Jul 3, 2023

View reviewed changes

src/wazuh_qa_framework/system/wazuh_handler.py Outdated Show resolved Hide resolved

roronoasins reviewed Jul 3, 2023

View reviewed changes

src/wazuh_qa_framework/system/wazuh_handler.py Outdated Show resolved Hide resolved

roronoasins reviewed Jul 3, 2023

View reviewed changes

src/wazuh_qa_framework/system/wazuh_handler.py Outdated Show resolved Hide resolved

roronoasins reviewed Jul 3, 2023

View reviewed changes

src/wazuh_qa_framework/system/wazuh_handler.py Outdated Show resolved Hide resolved

roronoasins reviewed Jul 3, 2023

View reviewed changes

src/wazuh_qa_framework/system/wazuh_handler.py Outdated Show resolved Hide resolved

fix(#66): fixes after review

dac8a05

fix(#66): Changing f'string format

626f7c9

Rebits requested changes Jul 11, 2023

View reviewed changes

fix(#66): Changes after review

f37fed0

pro-akim added 7 commits July 12, 2023 19:59

fix(#66): Changes after linting

2217c71

fix(#66): More changes after linting

339d935

fix(#66): More changes after linting

5e25d5c

fix(#66): More changes after linting

bb7ee40

fix(#66): fixing whitespaces after linting

8463fc1

fix(#66): fixing whitespaces after linting

316f56a

fix(#66): fixing whitespaces after linting

493d7d0

pro-akim marked this pull request as draft July 13, 2023 08:55

pro-akim marked this pull request as ready for review July 13, 2023 08:55

pro-akim added 2 commits July 13, 2023 10:58

fix(#66): testing to fix linting

72ccf45

fix(#66): last fixes after linting

98546cd

pro-akim requested review from Rebits and roronoasins July 13, 2023 09:03

fix(#66): doc fixes

413b9cf

Rebits requested changes Jul 27, 2023

View reviewed changes

pro-akim added 4 commits August 1, 2023 15:26

fix(#66): Adding file existance control

30e6c21

fix(#66): Fixes after linting

b0e5d10

fix(#66): More fixes after linting

02cc089

fix(#66): Changing host in create rule

5be2351

pro-akim requested a review from Rebits August 1, 2023 15:10

BelenValdivia approved these changes Aug 30, 2023

View reviewed changes

pro-akim merged commit aca23ac into system-refactor Sep 6, 2023
2 of 3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding methods for rules and decoders #73

Adding methods for rules and decoders #73

pro-akim commented Jun 30, 2023 •

edited

Loading

roronoasins commented Jul 6, 2023

pro-akim commented Jul 6, 2023

pro-akim commented Jul 12, 2023 •

edited

Loading

pro-akim commented Jul 13, 2023 •

edited

Loading

Rebits Jul 27, 2023

pro-akim Aug 1, 2023

Rebits Jul 27, 2023

pro-akim Aug 1, 2023

Rebits Jul 27, 2023

pro-akim Aug 1, 2023

Rebits Jul 27, 2023

pro-akim Aug 1, 2023

Rebits Jul 27, 2023

pro-akim Aug 1, 2023

Rebits Jul 27, 2023

pro-akim Aug 1, 2023

Rebits Jul 27, 2023

pro-akim Aug 1, 2023

Rebits Jul 27, 2023

pro-akim Aug 1, 2023

pro-akim commented Aug 1, 2023 •

edited

Loading

	def create_rule(self, host, new_rule_filename, rules_filename, overwrite=True):
	def create_rule(self, host, new_rules_filepath, rules_filename, overwrite=True):

		if overwrite:
		self.logger.info(message=f'Changing {rules_filename} to {new_rule_filename}')

	overwrite (bool): replace the decoder file True, add decoders to decoders file, False. Defaults to True.
	overwrite (bool): Replace the decoder file. Defaults to True.

	overwrite (bool): replace the rules file True, add rules to rules file, False. Defaults to True.
	overwrite (bool): Replace the rules file. Defaults to True.

Adding methods for rules and decoders #73

Adding methods for rules and decoders #73

Conversation

pro-akim commented Jun 30, 2023 • edited Loading

Description

Evidences

roronoasins commented Jul 6, 2023

pro-akim commented Jul 6, 2023

06/07/2023

pro-akim commented Jul 12, 2023 • edited Loading

12/07/2023 Update

Tests:

Evidences

pro-akim commented Jul 13, 2023 • edited Loading

13/07/2023 Update

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pro-akim commented Aug 1, 2023 • edited Loading

Update

Tests:

Evidences

pro-akim commented Jun 30, 2023 •

edited

Loading

pro-akim commented Jul 12, 2023 •

edited

Loading

pro-akim commented Jul 13, 2023 •

edited

Loading

pro-akim commented Aug 1, 2023 •

edited

Loading