mirror of
https://github.com/SecurityBrewery/catalyst.git
synced 2025-12-07 15:52:47 +01:00
Cleanup content (#39)
This commit is contained in:
Jonas Plum
GitHub
@@ -19,3 +19,6 @@ var MalwarePlaybook string
|
||||
|
||||
//go:embed playbooks/phishing.yml
|
||||
var PhishingPlaybook string
|
||||
|
||||
//go:embed playbooks/simple.yaml
|
||||
var SimplePlaybook string
|
||||
|
||||
@@ -49,6 +49,8 @@ func generateMigrations() ([]Migration, error) {
|
||||
&updateDocument{ID: "update-automation-hash.sha1-1", Collection: "automations", Key: "hash.sha1", Document: model.Automation{Image: "docker.io/python:3", Script: SHA1HashAutomation, Schema: pointer.String(`{"title":"Input","type":"object","properties":{"default":{"type":"string","title":"Value"}},"required":["default"]}`), Type: []string{"global", "artifact", "playbook"}}},
|
||||
|
||||
&createCollection{ID: "create-job-collection", Name: "jobs", DataType: "job", Schema: `{"properties":{"automation":{"type":"string"},"log":{"type":"string"},"payload":{},"origin":{"properties":{"artifact_origin":{"properties":{"artifact":{"type":"string"},"ticket_id":{"format":"int64","type":"integer"}},"required":["artifact","ticket_id"],"type":"object"},"task_origin":{"properties":{"playbook_id":{"type":"string"},"task_id":{"type":"string"},"ticket_id":{"format":"int64","type":"integer"}},"required":["playbook_id","task_id","ticket_id"],"type":"object"}},"type":"object"},"output":{"properties":{},"type":"object"},"running":{"type":"boolean"},"status":{"type":"string"}},"required":["automation","running","status"],"type":"object"}`},
|
||||
|
||||
&createDocument{ID: "create-playbook-simple", Collection: "playbooks", Document: &busdb.Keyed{Key: "simple", Doc: model.PlaybookTemplate{Name: "Simple", Yaml: SimplePlaybook}}},
|
||||
}, nil
|
||||
}
|
||||
|
||||
|
||||
@@ -1,208 +0,0 @@
|
||||
{
|
||||
"definitions": {},
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"$id": "https://example.com/object1618746510.json",
|
||||
"title": "Advanced",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"severity": {
|
||||
"$id": "#root/severity",
|
||||
"title": "Severity",
|
||||
"type": "string",
|
||||
"default": "Medium",
|
||||
"x-cols": 6,
|
||||
"x-class": "pr-2",
|
||||
"x-display": "icon",
|
||||
"x-itemIcon": "icon",
|
||||
"oneOf": [
|
||||
{
|
||||
"const": "Low",
|
||||
"title": "Low",
|
||||
"icon": "mdi-chevron-up"
|
||||
},
|
||||
{
|
||||
"const": "Medium",
|
||||
"title": "Medium",
|
||||
"icon": "mdi-chevron-double-up"
|
||||
},
|
||||
{
|
||||
"const": "High",
|
||||
"title": "High",
|
||||
"icon": "mdi-chevron-triple-up"
|
||||
}
|
||||
]
|
||||
},
|
||||
"tlp": {
|
||||
"$id": "#root/tlp",
|
||||
"title": "TLP",
|
||||
"type": "string",
|
||||
"nx-enum": [
|
||||
"White",
|
||||
"Green",
|
||||
"Amber",
|
||||
"Red"
|
||||
],
|
||||
"x-cols": 6,
|
||||
"x-class": "pr-2",
|
||||
"x-display": "icon",
|
||||
"x-itemIcon": "icon",
|
||||
"oneOf": [
|
||||
{
|
||||
"const": "White",
|
||||
"title": "White",
|
||||
"icon": "mdi-alpha-w"
|
||||
},
|
||||
{
|
||||
"const": "Green",
|
||||
"title": "Green",
|
||||
"icon": "mdi-alpha-g"
|
||||
},
|
||||
{
|
||||
"const": "Amber",
|
||||
"title": "Amber",
|
||||
"icon": "mdi-alpha-a"
|
||||
},
|
||||
{
|
||||
"const": "Red",
|
||||
"title": "Red",
|
||||
"icon": "mdi-alpha-r"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"$id": "#root/description",
|
||||
"title": "Description",
|
||||
"type": "string",
|
||||
"x-display": "textarea",
|
||||
"x-class": "pr-2"
|
||||
},
|
||||
|
||||
"type": {
|
||||
"type": "object",
|
||||
"title": "Select an incident type",
|
||||
"oneOf": [
|
||||
{
|
||||
"title": "Malware",
|
||||
"properties": {
|
||||
"schemaKey": {
|
||||
"type": "string",
|
||||
"const": "malware"
|
||||
},
|
||||
"malware_type": {
|
||||
"type": "string",
|
||||
"title": "Malware Type",
|
||||
"enum": ["Ransomware", "Worm", "Virus"]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"title": "Phishing",
|
||||
"properties": {
|
||||
"schemaKey": {
|
||||
"type": "string",
|
||||
"const": "phishing"
|
||||
},
|
||||
"phishing_type": {
|
||||
"type": "string",
|
||||
"title": "Phishing Type",
|
||||
"enum": ["Normal", "Spear", "Whale"]
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"x-cols": 12
|
||||
},
|
||||
"apt": {
|
||||
"type": "boolean",
|
||||
"x-display": "switch",
|
||||
"title": "APT involved?",
|
||||
"x-cols": 6
|
||||
},
|
||||
"apt-group": {
|
||||
"type": "string",
|
||||
"title": "Select APT",
|
||||
"enum": ["Lazarus Group", "Equation Group", "Fancy Bear (APT 28)", "OceanLotus (APT 32)", "Other"],
|
||||
"x-if": "apt",
|
||||
"x-cols": 6
|
||||
},
|
||||
"tactics": {
|
||||
"type": "array",
|
||||
"title": "MITRE Att&ck",
|
||||
"description": "This description is used as a help message.",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"oneOf": [
|
||||
{
|
||||
"title": "Reconnaissance",
|
||||
"properties": {
|
||||
"tactic": {
|
||||
"type": "string",
|
||||
"const": "reconnaissance",
|
||||
"title": "Tactic",
|
||||
"description": "The adversary is trying to gather information they can use to plan future operations."
|
||||
},
|
||||
"techniques": {
|
||||
"type": "array",
|
||||
"title": "Techniques",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"oneOf": [
|
||||
{
|
||||
"const": "T1595",
|
||||
"title": "Active Scanning",
|
||||
"description": "Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction."
|
||||
},
|
||||
{
|
||||
"const": "T1592",
|
||||
"title": "Gather Victim Host Information"
|
||||
}
|
||||
]
|
||||
},
|
||||
"minItems": 1,
|
||||
"uniqueItems": true
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"title": "Persistence",
|
||||
"properties": {
|
||||
"tactic": {
|
||||
"type": "string",
|
||||
"const": "persistence"
|
||||
},
|
||||
"techniques": {
|
||||
"type": "string",
|
||||
"title": "Techniques",
|
||||
"oneOf": [
|
||||
{
|
||||
"const": "T1098",
|
||||
"title": "Account Manipulation"
|
||||
},
|
||||
{
|
||||
"const": "T1197",
|
||||
"title": "BITS Jobs"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"uniqueItems": true
|
||||
},
|
||||
"tags": {
|
||||
"type": "array",
|
||||
"title": "Tags",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"examples": [
|
||||
"misp",
|
||||
"external report",
|
||||
"internal report"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["severity", "description", "tactics", "type"]
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user