diff --git a/.appinspect.manualcheck.yaml b/.appinspect.manualcheck.yaml new file mode 100644 index 0000000..cf05cf7 --- /dev/null +++ b/.appinspect.manualcheck.yaml @@ -0,0 +1,18 @@ +# Required by pipeline +check_for_builtin_functions: + comment: 'Checking for built-in functions' + +check_for_generic_operating_system_services: + comment: 'Checking for generic operating system services' + +check_for_plain_text_credentials_in_python: + comment: 'Checking for plain text credentials in Python' + +check_for_insecure_http_calls_in_python: + comment: 'Checking for insecure HTTP calls in Python' + +check_for_secret_disclosure: + comment: 'Checking for secret disclosure' + +check_for_executable_flag: + comment: 'Checking for executable flag' \ No newline at end of file diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index e91d5d9..f622151 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -27,7 +27,7 @@ jobs: - name: Setup Python uses: actions/setup-python@v2 with: - python-version: 3.7 + python-version: 3.9 - name: Package Splunk App with CLI run: | diff --git a/.gitignore b/.gitignore index 48d92c0..4e339a6 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,9 @@ __pycache__/ # Splunk local configuration files sekoia.io/local/ sekoia.io/metadata/local.meta + +.venv +.venv-3.11 +.venv-3.10 +dist +.idea diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..558307a --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,17 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [Unreleased] + +## 2024-07-30 - 1.3.0 + +### Changed + +- Remove support of python2 +- Add `case_sensitive_match` option to the configuration +- Upgrade python build time version to 3.10 +- Custom wrapper over slim to have backward compatibility lower versions of python, as it is used by the splunk diff --git a/sekoia.io/app.manifest b/sekoia.io/app.manifest index 357bc5f..be13fcc 100644 --- a/sekoia.io/app.manifest +++ b/sekoia.io/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "sekoia.io", - "version": "1.2.2" + "version": "1.3.0" }, "author": [ { diff --git a/sekoia.io/bin/sekoia_indicators.py b/sekoia.io/bin/sekoia_indicators.py index f24d113..2b40669 100644 --- a/sekoia.io/bin/sekoia_indicators.py +++ b/sekoia.io/bin/sekoia_indicators.py @@ -248,8 +248,9 @@ def indicator_to_kv(self, indicator, api_root_url): elif server_root_url.endswith("/api/"): server_root_url = server_root_url[:-5] + # Applying _key to lowercase to avoid case sensitivity result = { - "_key": value.strip("'"), + "_key": value.strip("'").lower(), "indicator_id": indicator["id"], "server_root_url": server_root_url, "valid_until": indicator.get("valid_until"), diff --git a/sekoia.io/default/app.conf b/sekoia.io/default/app.conf index 834c657..23bb30e 100644 --- a/sekoia.io/default/app.conf +++ b/sekoia.io/default/app.conf @@ -14,7 +14,7 @@ setup_view = setup [launcher] author = support@sekoia.io description = Search your logs with Indicators of Compromise (IoCs) from SEKOIA.IO. -version = 1.2.2 +version = 1.3.0 [package] check_for_updates = 1 diff --git a/sekoia.io/default/transforms.conf b/sekoia.io/default/transforms.conf index 760ed1d..6cfd5cb 100644 --- a/sekoia.io/default/transforms.conf +++ b/sekoia.io/default/transforms.conf @@ -17,6 +17,7 @@ max_matches = 1 collection = sekoia_iocs_url external_type = kvstore fields_list = _key,type,valid_until,indicator_id +case_sensitive_match = false max_matches = 1 [sekoia_iocs_md5] diff --git a/sekoia.io/lib/py2/antlr4/BufferedTokenStream.py b/sekoia.io/lib/py2/antlr4/BufferedTokenStream.py deleted file mode 100644 index f541e77..0000000 --- a/sekoia.io/lib/py2/antlr4/BufferedTokenStream.py +++ /dev/null @@ -1,306 +0,0 @@ -# -# Copyright (c) 2012-2017 The ANTLR Project. All rights reserved. -# Use of this file is governed by the BSD 3-clause license that -# can be found in the LICENSE.txt file in the project root. - -# This implementation of {@link TokenStream} loads tokens from a -# {@link TokenSource} on-demand, and places the tokens in a buffer to provide -# access to any previous token by index. -# -#

-# This token stream ignores the value of {@link Token#getChannel}. If your -# parser requires the token stream filter tokens to only those on a particular -# channel, such as {@link Token#DEFAULT_CHANNEL} or -# {@link Token#HIDDEN_CHANNEL}, use a filtering token stream such a -# {@link CommonTokenStream}.

-from io import StringIO - -from antlr4.Token import Token -from antlr4.error.Errors import IllegalStateException - -# this is just to keep meaningful parameter types to Parser -class TokenStream(object): - - pass - - -class BufferedTokenStream(TokenStream): - - def __init__(self, tokenSource): - # The {@link TokenSource} from which tokens for this stream are fetched. - self.tokenSource = tokenSource - - # A collection of all tokens fetched from the token source. The list is - # considered a complete view of the input once {@link #fetchedEOF} is set - # to {@code true}. - self.tokens = [] - - # The index into {@link #tokens} of the current token (next token to - # {@link #consume}). {@link #tokens}{@code [}{@link #p}{@code ]} should be - # {@link #LT LT(1)}. - # - #

This field is set to -1 when the stream is first constructed or when - # {@link #setTokenSource} is called, indicating that the first token has - # not yet been fetched from the token source. For additional information, - # see the documentation of {@link IntStream} for a description of - # Initializing Methods.

- self.index = -1 - - # Indicates whether the {@link Token#EOF} token has been fetched from - # {@link #tokenSource} and added to {@link #tokens}. This field improves - # performance for the following cases: - # - #