Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WatchGuard - add connector #1166

Open
wants to merge 7 commits into
base: main
Choose a base branch
from

Conversation

lvoloshyn-sekoia
Copy link
Collaborator

No description provided.

Copy link

github-actions bot commented Nov 13, 2024

Test Results

17 tests  +7   16 ✅ +6   0s ⏱️ ±0s
 1 suites ±0    1 💤 +1 
 1 files   ±0    0 ❌ ±0 

Results for commit 10447b8. ± Comparison against base commit abca275.

This pull request removes 10 and adds 17 tests. Note that renamed tests count towards both.
tests.test_helpers ‑ test_get_upper_second
tests.test_mimecast_siem_logs ‑ test_authentication_failed
tests.test_mimecast_siem_logs ‑ test_fetch_batches
tests.test_mimecast_siem_logs ‑ test_most_recent_datetime_seen
tests.test_mimecast_siem_logs ‑ test_permission_denied
tests.test_mimecast_siem_logs ‑ test_start_consumers
tests.test_mimecast_siem_logs ‑ test_stop_consumers
tests.test_mimecast_siem_logs ‑ test_supervise_consumers
tests.test_retry ‑ test_get_retry_after
tests.test_retry ‑ test_parse_ratelimit_retry_after
tests.test_authorization ‑ test_authorization
tests.test_connector_security_events ‑ test_fetch_events
tests.test_connector_security_events ‑ test_fetch_next_events_with_empty_list
tests.test_connector_security_events ‑ test_fetch_next_events_with_no_response
tests.test_connector_security_events ‑ test_fetch_next_exploits
tests.test_connector_security_events ‑ test_fetch_next_intrusion_attempts
tests.test_connector_security_events ‑ test_fetch_next_malware_urls
tests.test_connector_security_events ‑ test_filter_security_events
tests.test_connector_security_events ‑ test_get_authorization_request_new_token_only_when_needed
tests.test_trigger_security_events ‑ test_fetch_events
…

♻️ This comment has been updated with latest results.

Copy link

codecov bot commented Nov 14, 2024

Codecov Report

Attention: Patch coverage is 82.42424% with 29 lines in your changes missing coverage. Please review.

Project coverage is 88.85%. Comparing base (abca275) to head (10447b8).
Report is 97 commits behind head on main.

Files with missing lines Patch % Lines
...her_endpoint_security_api/security_events_mixin.py 77.96% 13 Missing ⚠️
...endpoint_security_api/connector_security_events.py 73.33% 12 Missing ⚠️
...curity/aether_endpoint_security_api/client/auth.py 91.83% 4 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##             main    #1166       +/-   ##
===========================================
+ Coverage   75.53%   88.85%   +13.31%     
===========================================
  Files          26      259      +233     
  Lines         605     9440     +8835     
  Branches        0      554      +554     
===========================================
+ Hits          457     8388     +7931     
- Misses        148      981      +833     
- Partials        0       71       +71     
Flag Coverage Δ
PandaSecurity 80.63% <82.42%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@lvoloshyn-sekoia lvoloshyn-sekoia marked this pull request as ready for review November 14, 2024 10:51
Copy link
Collaborator

@squioc squioc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the work.
I pushed a suggestion and made some comments

@@ -0,0 +1,103 @@
import base64
from datetime import datetime, timedelta
from urllib.parse import urljoin
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest using from posixpath import join as urljoin instead (see SEKOIA-IO/sekoia-automation-sdk#139)

Comment on lines -97 to -98
INCOMING_MESSAGES.labels(type=event_type_name).inc(len(message_batch))

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you not keep the metrics here?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Metrics, without intake_key, are hardly exploitable. And, as this trigger is a trigger (and not connector), we don't have this information.

We did the same for Vade M365

Comment on lines -109 to -120
OUTCOMING_EVENTS.labels(type=event_type_name).inc(len(message_batch))

# get the ending time and compute the duration to fetch the events
batch_end_time = time.time()
batch_duration = int(batch_end_time - batch_start_time)
FORWARD_EVENTS_DURATION.labels(type=event_type_name).observe(batch_duration)

# compute the events lag
last_message_timestamp = datetime.strptime(last_message_date, self.RFC3339_STRICT_FORMAT)
events_lag = (datetime.utcnow() - last_message_timestamp).total_seconds()
EVENTS_LAG.labels(type=event_type_name).set(events_lag)

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants