mirror of
https://github.com/SecurityBrewery/catalyst.git
synced 2025-12-06 07:12:46 +01:00
Cleanup content (#39)
This commit is contained in:
Jonas Plum
GitHub
@@ -19,3 +19,6 @@ var MalwarePlaybook string
|
||||
|
||||
//go:embed playbooks/phishing.yml
|
||||
var PhishingPlaybook string
|
||||
|
||||
//go:embed playbooks/simple.yaml
|
||||
var SimplePlaybook string
|
||||
|
||||
@@ -49,6 +49,8 @@ func generateMigrations() ([]Migration, error) {
|
||||
&updateDocument{ID: "update-automation-hash.sha1-1", Collection: "automations", Key: "hash.sha1", Document: model.Automation{Image: "docker.io/python:3", Script: SHA1HashAutomation, Schema: pointer.String(`{"title":"Input","type":"object","properties":{"default":{"type":"string","title":"Value"}},"required":["default"]}`), Type: []string{"global", "artifact", "playbook"}}},
|
||||
|
||||
&createCollection{ID: "create-job-collection", Name: "jobs", DataType: "job", Schema: `{"properties":{"automation":{"type":"string"},"log":{"type":"string"},"payload":{},"origin":{"properties":{"artifact_origin":{"properties":{"artifact":{"type":"string"},"ticket_id":{"format":"int64","type":"integer"}},"required":["artifact","ticket_id"],"type":"object"},"task_origin":{"properties":{"playbook_id":{"type":"string"},"task_id":{"type":"string"},"ticket_id":{"format":"int64","type":"integer"}},"required":["playbook_id","task_id","ticket_id"],"type":"object"}},"type":"object"},"output":{"properties":{},"type":"object"},"running":{"type":"boolean"},"status":{"type":"string"}},"required":["automation","running","status"],"type":"object"}`},
|
||||
|
||||
&createDocument{ID: "create-playbook-simple", Collection: "playbooks", Document: &busdb.Keyed{Key: "simple", Doc: model.PlaybookTemplate{Name: "Simple", Yaml: SimplePlaybook}}},
|
||||
}, nil
|
||||
}
|
||||
|
||||
|
||||
@@ -1,208 +0,0 @@
|
||||
{
|
||||
"definitions": {},
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"$id": "https://example.com/object1618746510.json",
|
||||
"title": "Advanced",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"severity": {
|
||||
"$id": "#root/severity",
|
||||
"title": "Severity",
|
||||
"type": "string",
|
||||
"default": "Medium",
|
||||
"x-cols": 6,
|
||||
"x-class": "pr-2",
|
||||
"x-display": "icon",
|
||||
"x-itemIcon": "icon",
|
||||
"oneOf": [
|
||||
{
|
||||
"const": "Low",
|
||||
"title": "Low",
|
||||
"icon": "mdi-chevron-up"
|
||||
},
|
||||
{
|
||||
"const": "Medium",
|
||||
"title": "Medium",
|
||||
"icon": "mdi-chevron-double-up"
|
||||
},
|
||||
{
|
||||
"const": "High",
|
||||
"title": "High",
|
||||
"icon": "mdi-chevron-triple-up"
|
||||
}
|
||||
]
|
||||
},
|
||||
"tlp": {
|
||||
"$id": "#root/tlp",
|
||||
"title": "TLP",
|
||||
"type": "string",
|
||||
"nx-enum": [
|
||||
"White",
|
||||
"Green",
|
||||
"Amber",
|
||||
"Red"
|
||||
],
|
||||
"x-cols": 6,
|
||||
"x-class": "pr-2",
|
||||
"x-display": "icon",
|
||||
"x-itemIcon": "icon",
|
||||
"oneOf": [
|
||||
{
|
||||
"const": "White",
|
||||
"title": "White",
|
||||
"icon": "mdi-alpha-w"
|
||||
},
|
||||
{
|
||||
"const": "Green",
|
||||
"title": "Green",
|
||||
"icon": "mdi-alpha-g"
|
||||
},
|
||||
{
|
||||
"const": "Amber",
|
||||
"title": "Amber",
|
||||
"icon": "mdi-alpha-a"
|
||||
},
|
||||
{
|
||||
"const": "Red",
|
||||
"title": "Red",
|
||||
"icon": "mdi-alpha-r"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"$id": "#root/description",
|
||||
"title": "Description",
|
||||
"type": "string",
|
||||
"x-display": "textarea",
|
||||
"x-class": "pr-2"
|
||||
},
|
||||
|
||||
"type": {
|
||||
"type": "object",
|
||||
"title": "Select an incident type",
|
||||
"oneOf": [
|
||||
{
|
||||
"title": "Malware",
|
||||
"properties": {
|
||||
"schemaKey": {
|
||||
"type": "string",
|
||||
"const": "malware"
|
||||
},
|
||||
"malware_type": {
|
||||
"type": "string",
|
||||
"title": "Malware Type",
|
||||
"enum": ["Ransomware", "Worm", "Virus"]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"title": "Phishing",
|
||||
"properties": {
|
||||
"schemaKey": {
|
||||
"type": "string",
|
||||
"const": "phishing"
|
||||
},
|
||||
"phishing_type": {
|
||||
"type": "string",
|
||||
"title": "Phishing Type",
|
||||
"enum": ["Normal", "Spear", "Whale"]
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"x-cols": 12
|
||||
},
|
||||
"apt": {
|
||||
"type": "boolean",
|
||||
"x-display": "switch",
|
||||
"title": "APT involved?",
|
||||
"x-cols": 6
|
||||
},
|
||||
"apt-group": {
|
||||
"type": "string",
|
||||
"title": "Select APT",
|
||||
"enum": ["Lazarus Group", "Equation Group", "Fancy Bear (APT 28)", "OceanLotus (APT 32)", "Other"],
|
||||
"x-if": "apt",
|
||||
"x-cols": 6
|
||||
},
|
||||
"tactics": {
|
||||
"type": "array",
|
||||
"title": "MITRE Att&ck",
|
||||
"description": "This description is used as a help message.",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"oneOf": [
|
||||
{
|
||||
"title": "Reconnaissance",
|
||||
"properties": {
|
||||
"tactic": {
|
||||
"type": "string",
|
||||
"const": "reconnaissance",
|
||||
"title": "Tactic",
|
||||
"description": "The adversary is trying to gather information they can use to plan future operations."
|
||||
},
|
||||
"techniques": {
|
||||
"type": "array",
|
||||
"title": "Techniques",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"oneOf": [
|
||||
{
|
||||
"const": "T1595",
|
||||
"title": "Active Scanning",
|
||||
"description": "Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction."
|
||||
},
|
||||
{
|
||||
"const": "T1592",
|
||||
"title": "Gather Victim Host Information"
|
||||
}
|
||||
]
|
||||
},
|
||||
"minItems": 1,
|
||||
"uniqueItems": true
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"title": "Persistence",
|
||||
"properties": {
|
||||
"tactic": {
|
||||
"type": "string",
|
||||
"const": "persistence"
|
||||
},
|
||||
"techniques": {
|
||||
"type": "string",
|
||||
"title": "Techniques",
|
||||
"oneOf": [
|
||||
{
|
||||
"const": "T1098",
|
||||
"title": "Account Manipulation"
|
||||
},
|
||||
{
|
||||
"const": "T1197",
|
||||
"title": "BITS Jobs"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"uniqueItems": true
|
||||
},
|
||||
"tags": {
|
||||
"type": "array",
|
||||
"title": "Tags",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"examples": [
|
||||
"misp",
|
||||
"external report",
|
||||
"internal report"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["severity", "description", "tactics", "type"]
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -73,9 +73,6 @@ func SetupTestData(ctx context.Context, db *database.Database) error {
|
||||
if err := db.RelatedCreate(ctx, 8125, 8126); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := db.PlaybookCreate(ctx, &model.PlaybookTemplateForm{Yaml: "name: Simple\ntasks:\n input:\n name: Enter something to hash\n type: input\n schema:\n title: Something\n type: object\n properties:\n something:\n type: string\n title: Something\n default: \"\"\n next:\n hash: \"something != ''\"\n\n hash:\n name: Hash the something\n type: automation\n automation: hash.sha1\n payload:\n default: \"playbook.tasks['input'].data['something']\"\n next:\n comment: \"hash != ''\"\n\n comment:\n name: Comment the hash\n type: automation\n automation: comment\n payload:\n default: \"playbook.tasks['hash'].data['hash']\"\n next:\n done: \"done\"\n\n done:\n name: You can close this case now\n type: task\n"}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if _, err := db.LogCreate(ctx, "manual", "tickets/294511", "Fail run account resist lend solve incident centre priority temperature. Cause change distribution examine location technique shape partner milk customer. Rail tea plate soil report cook railway interpretation breath action. Exercise dream accept park conclusion addition shoot assistance may answer. Gold writer link stop combine hear power name commitment operation. Determine lifespan support grow degree henry exclude detail set religion. Direct library policy convention chain retain discover ride walk student. Gather proposal select march aspect play noise avoid encourage employ. Assessment preserve transport combine wish influence income guess run stand. Charge limit crime ignore statement foundation study issue stop claim."); err != nil {
|
||||
return err
|
||||
|
||||
Reference in New Issue
Block a user