diff --git a/agent-manager/go.mod b/agent-manager/go.mod index 9b9abd399..bcbfc4bb7 100644 --- a/agent-manager/go.mod +++ b/agent-manager/go.mod @@ -10,7 +10,7 @@ require ( google.golang.org/grpc v1.81.1 google.golang.org/protobuf v1.36.11 gorm.io/driver/postgres v1.6.0 - gorm.io/gorm v1.31.1 + gorm.io/gorm v1.31.2 ) require go.mongodb.org/mongo-driver/v2 v2.6.0 // indirect diff --git a/agent-manager/go.sum b/agent-manager/go.sum index d13015931..ca11374dc 100644 --- a/agent-manager/go.sum +++ b/agent-manager/go.sum @@ -63,6 +63,8 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ= github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= +github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU= +github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -139,5 +141,7 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4= gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo= -gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg= -gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= +gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ= +gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8= +gorm.io/gorm v1.31.2 h1:3o8FXNo9v9S858gil+3LlZA1LkCOzgb4g5BL64FgaCo= +gorm.io/gorm v1.31.2/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= diff --git a/agent/go.mod b/agent/go.mod index 0872ebf07..773c21b4d 100644 --- a/agent/go.mod +++ b/agent/go.mod @@ -5,7 +5,7 @@ go 1.25.5 require ( github.com/AtlasInsideCorp/AtlasInsideAES v1.0.0 github.com/elastic/go-libaudit/v2 v2.6.2 - github.com/elastic/go-sysinfo v1.15.4 + github.com/elastic/go-sysinfo v1.15.5 github.com/fsnotify/fsnotify v1.10.1 github.com/glebarez/sqlite v1.11.0 github.com/google/uuid v1.6.0 @@ -19,7 +19,7 @@ require ( golang.org/x/sys v0.46.0 google.golang.org/grpc v1.81.1 google.golang.org/protobuf v1.36.11 - gorm.io/gorm v1.31.1 + gorm.io/gorm v1.31.2 ) replace github.com/utmstack/UTMStack/shared => ../shared diff --git a/agent/go.sum b/agent/go.sum index 0ad73d31f..a9fb6f23c 100644 --- a/agent/go.sum +++ b/agent/go.sum @@ -25,8 +25,8 @@ github.com/elastic/go-libaudit/v2 v2.6.2 h1:1PM6wVBTJHJQYsKl8jfA9/Aw9pFty5uUezPi github.com/elastic/go-libaudit/v2 v2.6.2/go.mod h1:8205nkf2oSrXFlO4H5j8/cyVMoSF3Y7jt+FjgS4ubQU= github.com/elastic/go-licenser v0.4.1 h1:1xDURsc8pL5zYT9R29425J3vkHdt4RT5TNEMeRN48x4= github.com/elastic/go-licenser v0.4.1/go.mod h1:V56wHMpmdURfibNBggaSBfqgPxyT1Tldns1i87iTEvU= -github.com/elastic/go-sysinfo v1.15.4 h1:A3zQcunCxik14MgXu39cXFXcIw2sFXZ0zL886eyiv1Q= -github.com/elastic/go-sysinfo v1.15.4/go.mod h1:ZBVXmqS368dOn/jvijV/zHLfakWTYHBZPk3G244lHrU= +github.com/elastic/go-sysinfo v1.15.5 h1:fCVUDmjHgljLUQCygherMnsRRJ9AkuAQIywTL7dEH28= +github.com/elastic/go-sysinfo v1.15.5/go.mod h1:ZBVXmqS368dOn/jvijV/zHLfakWTYHBZPk3G244lHrU= github.com/elastic/go-windows v1.0.2 h1:yoLLsAsV5cfg9FLhZ9EXZ2n2sQFKeDYrHenkcivY4vI= github.com/elastic/go-windows v1.0.2/go.mod h1:bGcDpBzXgYSqM0Gx3DM4+UxFj300SZLixie9u9ixLM8= github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho= @@ -93,6 +93,8 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ= github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= +github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU= +github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -213,8 +215,10 @@ gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg= -gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= +gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ= +gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8= +gorm.io/gorm v1.31.2 h1:3o8FXNo9v9S858gil+3LlZA1LkCOzgb4g5BL64FgaCo= +gorm.io/gorm v1.31.2/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM= howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g= modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis= diff --git a/as400/go.mod b/as400/go.mod index 2eebf9324..951c10d0a 100644 --- a/as400/go.mod +++ b/as400/go.mod @@ -4,7 +4,7 @@ go 1.25.5 require ( github.com/AtlasInsideCorp/AtlasInsideAES v1.0.0 - github.com/elastic/go-sysinfo v1.15.4 + github.com/elastic/go-sysinfo v1.15.5 github.com/glebarez/sqlite v1.11.0 github.com/google/uuid v1.6.0 github.com/kardianos/service v1.2.4 @@ -13,7 +13,7 @@ require ( google.golang.org/grpc v1.81.1 google.golang.org/protobuf v1.36.11 gopkg.in/yaml.v2 v2.4.0 - gorm.io/gorm v1.31.1 + gorm.io/gorm v1.31.2 ) require ( diff --git a/as400/go.sum b/as400/go.sum index fc9bcfeb5..ec781adc0 100644 --- a/as400/go.sum +++ b/as400/go.sum @@ -20,8 +20,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= -github.com/elastic/go-sysinfo v1.15.4 h1:A3zQcunCxik14MgXu39cXFXcIw2sFXZ0zL886eyiv1Q= -github.com/elastic/go-sysinfo v1.15.4/go.mod h1:ZBVXmqS368dOn/jvijV/zHLfakWTYHBZPk3G244lHrU= +github.com/elastic/go-sysinfo v1.15.5 h1:fCVUDmjHgljLUQCygherMnsRRJ9AkuAQIywTL7dEH28= +github.com/elastic/go-sysinfo v1.15.5/go.mod h1:ZBVXmqS368dOn/jvijV/zHLfakWTYHBZPk3G244lHrU= github.com/elastic/go-windows v1.0.2 h1:yoLLsAsV5cfg9FLhZ9EXZ2n2sQFKeDYrHenkcivY4vI= github.com/elastic/go-windows v1.0.2/go.mod h1:bGcDpBzXgYSqM0Gx3DM4+UxFj300SZLixie9u9ixLM8= github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM= @@ -85,6 +85,8 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ= github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= +github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU= +github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -192,8 +194,10 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg= -gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= +gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ= +gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8= +gorm.io/gorm v1.31.2 h1:3o8FXNo9v9S858gil+3LlZA1LkCOzgb4g5BL64FgaCo= +gorm.io/gorm v1.31.2/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= howett.net/plist v0.0.0-20181124034731-591f970eefbb h1:jhnBjNi9UFpfpl8YZhA9CrOqpnJdvzuiHsl/dnxl11M= howett.net/plist v0.0.0-20181124034731-591f970eefbb/go.mod h1:vMygbs4qMhSZSc4lCUl2OEE+rDiIIJAIdR4m7MiMcm0= modernc.org/libc v1.22.5 h1:91BNch/e5B0uPbJFgqbxXuOnxBQjlS//icfQEGmvyjE= diff --git a/frontend/src/app/incident-response/incident-response-view/incident-response-view.component.html b/frontend/src/app/incident-response/incident-response-view/incident-response-view.component.html index 1be940bfe..97773ba9b 100644 --- a/frontend/src/app/incident-response/incident-response-view/incident-response-view.component.html +++ b/frontend/src/app/incident-response/incident-response-view/incident-response-view.component.html @@ -8,7 +8,8 @@
Incident Response Audit<
- Incident Response Audit< [loading]="!appliedTypes"> -
+
+ +
diff --git a/frontend/src/app/incident-response/incident-response-view/incident-response-view.component.ts b/frontend/src/app/incident-response/incident-response-view/incident-response-view.component.ts index 7035087e2..debd86c84 100644 --- a/frontend/src/app/incident-response/incident-response-view/incident-response-view.component.ts +++ b/frontend/src/app/incident-response/incident-response-view/incident-response-view.component.ts @@ -37,9 +37,13 @@ export class IncidentResponseViewComponent implements OnInit, OnDestroy { appliedTypes = [ {label: 'Alert', key: IncidentOriginTypeEnum.ALERT}, {label: 'Incident', key: IncidentOriginTypeEnum.INCIDENT}, - {label: 'Incident response', key: IncidentOriginTypeEnum.INCIDENT_RESPONSE}, + {label: 'Incident response (manual run)', key: IncidentOriginTypeEnum.INCIDENT_RESPONSE}, + {label: 'SOAR flow (automation)', key: IncidentOriginTypeEnum.INCIDENT_RESPONSE_AUTOMATION}, + {label: 'SOAR console', key: IncidentOriginTypeEnum.SOAR_CONSOLE}, {label: 'User execution', key: IncidentOriginTypeEnum.USER_EXECUTION}, ]; + selectedOriginType: IncidentOriginTypeEnum | null = null; + agentSelectVisible = true; constructor(private incidentResponseJobService: IncidentResponseJobService, private agentManagerService: UtmAgentManagerService, @@ -158,6 +162,24 @@ export class IncidentResponseViewComponent implements OnInit, OnDestroy { this.requestParams.searchQuery = this.convertParamMapToQueryParam(); this.getAgentCommandList(); } + + hasActiveFilters(): boolean { + return this.paramMap.size > 0; + } + + clearFilters() { + if (!this.hasActiveFilters()) { + return; + } + this.paramMap.clear(); + this.selectedOriginType = null; + this.requestParams.searchQuery = ''; + this.requestParams.pageNumber = 1; + this.page = 1; + this.agentSelectVisible = false; + setTimeout(() => this.agentSelectVisible = true); + this.getAgentCommandList(); + } } diff --git a/frontend/src/app/incident-response/playbook-builder/playbook-builder.component.ts b/frontend/src/app/incident-response/playbook-builder/playbook-builder.component.ts index 5b43eee28..0d538b051 100644 --- a/frontend/src/app/incident-response/playbook-builder/playbook-builder.component.ts +++ b/frontend/src/app/incident-response/playbook-builder/playbook-builder.component.ts @@ -128,7 +128,8 @@ export class PlaybookBuilderComponent implements OnInit, OnDestroy { this.formRule.get('excludedAgents').setValue(this.rule.excludedAgents); this.formRule.get('agentType').setValue(this.rule.excludedAgents.length === 0 && this.rule.defaultAgent !== ''); this.formRule.get('defaultAgent').setValue(this.rule.defaultAgent); - this.rule.actions.forEach(action => this.workflowService.addActions(action)); + const actionsWithConditional = this.workflowService.inferConditionals(this.rule.command, this.rule.actions); + actionsWithConditional.forEach(action => this.workflowService.addActions(action)); }, error => { @@ -203,9 +204,16 @@ export class PlaybookBuilderComponent implements OnInit, OnDestroy { } } + syncCommandFromActions() { + const actions = this.workflowService.getActions(); + this.formRule.get('actions').setValue(actions); + this.formRule.get('command').setValue(this.workflowService.buildCommand(actions)); + } + saveRule() { const action = 'created'; const actionError = 'creating'; + this.syncCommandFromActions(); this.incidentResponseRuleService.create(this.formRule.value) .subscribe(() => { this.utmToastService.showSuccessBottom('Flow ' + action + ' successfully'); @@ -216,7 +224,7 @@ export class PlaybookBuilderComponent implements OnInit, OnDestroy { editRule() { const action = 'edited'; const actionError = 'editing'; - this.formRule.get('command').setValue(this.command); + this.syncCommandFromActions(); this.incidentResponseRuleService.update(this.formRule.value).subscribe(() => { this.utmToastService.showSuccessBottom('Flow ' + action + ' successfully'); this.router.navigate(['soar/flows']); diff --git a/frontend/src/app/incident-response/shared/component/action-builder/action-builder.component.html b/frontend/src/app/incident-response/shared/component/action-builder/action-builder.component.html index d76795333..7b618ad01 100644 --- a/frontend/src/app/incident-response/shared/component/action-builder/action-builder.component.html +++ b/frontend/src/app/incident-response/shared/component/action-builder/action-builder.component.html @@ -120,7 +120,7 @@

Flow Actions

-
+
@@ -130,7 +130,7 @@

Flow Actions

+ (optionChange)="updateAction(action, i, $event)">
diff --git a/frontend/src/app/incident-response/shared/component/action-builder/action-builder.component.ts b/frontend/src/app/incident-response/shared/component/action-builder/action-builder.component.ts index 40cdc178c..3c19e3948 100644 --- a/frontend/src/app/incident-response/shared/component/action-builder/action-builder.component.ts +++ b/frontend/src/app/incident-response/shared/component/action-builder/action-builder.component.ts @@ -157,8 +157,8 @@ export class ActionBuilderComponent implements OnInit, OnDestroy { } - updateAction(action: any, $event: { key: ActionConditionalEnum; value: string }) { - this.workflowActionsService.updateAction({ + updateAction(action: any, index: number, $event: { key: ActionConditionalEnum; value: string }) { + this.workflowActionsService.updateAction(index, { ...action, conditional: $event }); diff --git a/frontend/src/app/incident-response/shared/component/interactive-console/interactive-console.component.ts b/frontend/src/app/incident-response/shared/component/interactive-console/interactive-console.component.ts index e870fb274..f555a2f19 100644 --- a/frontend/src/app/incident-response/shared/component/interactive-console/interactive-console.component.ts +++ b/frontend/src/app/incident-response/shared/component/interactive-console/interactive-console.component.ts @@ -1,6 +1,7 @@ import {Component, Input, OnInit} from '@angular/core'; import {Observable} from 'rxjs'; import {filter, tap} from 'rxjs/operators'; +import {IncidentOriginTypeEnum} from '../../../../shared/enums/incident-response/incident-origin-type.enum'; import {AgentType} from '../../../../shared/types/agent/agent.type'; import {IncidentCommandType} from '../../../../shared/types/incident/incident-command.type'; import {AgentSidebarService} from '../agent-sidebar/agent-sidebar.service'; @@ -25,7 +26,7 @@ export class InteractiveConsoleComponent implements OnInit { this.websocketCommand = { command: '', originId: agent.id.toString(), - originType: 'SOAR-CONSOLE', + originType: IncidentOriginTypeEnum.SOAR_CONSOLE, reason: 'Interactive console command', }; })); diff --git a/frontend/src/app/incident-response/shared/services/workflow-actions.service.ts b/frontend/src/app/incident-response/shared/services/workflow-actions.service.ts index 72ee2304b..23c2fbfe3 100644 --- a/frontend/src/app/incident-response/shared/services/workflow-actions.service.ts +++ b/frontend/src/app/incident-response/shared/services/workflow-actions.service.ts @@ -13,21 +13,60 @@ export class WorkflowActionsService { actions$ = this.actionsBehaviorSubject.asObservable(); readonly command$: Observable = this.actions$.pipe( - map(actions => { - if (actions.length === 1) { - return actions[0].command; + map(actions => this.buildCommand(actions)) + ); + + buildCommand(actions: IncidentResponseActionTemplate[] = this.getActions()): string { + if (!actions || actions.length === 0) { + return ''; + } + + if (actions.length === 1) { + return actions[0].command; + } + + return actions.map((action, index) => { + const operator = index === 0 ? '' + : action.conditional.key === ActionConditionalEnum.SUCCESS ? '&&' + : action.conditional.key === ActionConditionalEnum.FAILURE ? '||' + : ';'; + + return `${operator} ${action.command}`.trim(); + }).join(' ').trim(); + } + + inferConditionals(command: string, actions: IncidentResponseActionTemplate[]): IncidentResponseActionTemplate[] { + if (!actions || actions.length === 0) { + return actions || []; + } + + if (!command || actions.length === 1) { + return [{ ...actions[0], conditional: { key: ActionConditionalEnum.ALWAYS, value: ';' } }]; + } + + const result: IncidentResponseActionTemplate[] = []; + let cursor = 0; + + actions.forEach((action, index) => { + const idx = command.indexOf(action.command, cursor); + + if (index === 0 || idx === -1) { + result.push({ ...action, conditional: { key: ActionConditionalEnum.ALWAYS, value: ';' } }); + } else { + const gap = command.slice(cursor, idx).trim(); + const conditional = gap === '&&' ? { key: ActionConditionalEnum.SUCCESS, value: '&&' } + : gap === '||' ? { key: ActionConditionalEnum.FAILURE, value: '||' } + : { key: ActionConditionalEnum.ALWAYS, value: ';' }; + result.push({ ...action, conditional }); } - return actions.map((action, index) => { - const operator = index === 0 ? '' - : action.conditional.key === ActionConditionalEnum.SUCCESS ? '&&' - : action.conditional.key === ActionConditionalEnum.FAILURE ? '||' - : ';'; + if (idx !== -1) { + cursor = idx + action.command.length; + } + }); - return `${operator} ${action.command}`.trim(); - }).join(' ').trim(); - }) - ); + return result; + } addActions(action: any) { const actions = this.actionsBehaviorSubject.value ? this.actionsBehaviorSubject.value : []; @@ -38,18 +77,16 @@ export class WorkflowActionsService { }]); } - updateAction(action: any) { - const actions = this.actionsBehaviorSubject.value ? this.actionsBehaviorSubject.value : []; - - const index = actions.findIndex((act: any) => act.id === action.id); + updateAction(index: number, action: any) { + const actions = this.getActions(); + if (index < 0 || index >= actions.length) { + return; + } const newActions = [...actions]; - newActions[index] = { - ...action, - }; + newActions[index] = { ...action }; this.actionsBehaviorSubject.next(newActions); - } deleteAction(action: any) { diff --git a/frontend/src/app/shared/enums/incident-response/incident-origin-type.enum.ts b/frontend/src/app/shared/enums/incident-response/incident-origin-type.enum.ts index 2556954ba..967ecb501 100644 --- a/frontend/src/app/shared/enums/incident-response/incident-origin-type.enum.ts +++ b/frontend/src/app/shared/enums/incident-response/incident-origin-type.enum.ts @@ -4,5 +4,6 @@ export enum IncidentOriginTypeEnum { DATA_SOURCE = 'DATA_SOURCES', INCIDENT = 'INCIDENT', INCIDENT_RESPONSE = 'INCIDENT_RESPONSE', - INCIDENT_RESPONSE_AUTOMATION = 'INCIDENT_RESPONSE_AUTOMATION' + INCIDENT_RESPONSE_AUTOMATION = 'INCIDENT_RESPONSE_AUTOMATION', + SOAR_CONSOLE = 'SOAR-CONSOLE' } diff --git a/installer/go.mod b/installer/go.mod index 2aba0409e..4cd455478 100644 --- a/installer/go.mod +++ b/installer/go.mod @@ -3,7 +3,7 @@ module github.com/utmstack/UTMStack/installer go 1.25.1 require ( - github.com/cloudfoundry/gosigar v1.3.121 + github.com/cloudfoundry/gosigar v1.3.122 github.com/docker/docker v28.5.2+incompatible github.com/kardianos/service v1.2.4 github.com/shirou/gopsutil/v3 v3.24.5 diff --git a/installer/go.sum b/installer/go.sum index 6aef3ada7..96b306bad 100644 --- a/installer/go.sum +++ b/installer/go.sum @@ -16,8 +16,8 @@ github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1x github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/cloudfoundry/gosigar v1.3.121 h1:xI9QecCKAAlNrekPdyKWm2HhcawhdcDWz209SoLPFK8= -github.com/cloudfoundry/gosigar v1.3.121/go.mod h1:km183jBg82AQnCfmDHneesBBS2t6jT4vxWC+zP5RAoA= +github.com/cloudfoundry/gosigar v1.3.122 h1:Xo62JpG7wanqr+wBsXD3v6X8/+3aQzpvRslz6aBw/cY= +github.com/cloudfoundry/gosigar v1.3.122/go.mod h1:km183jBg82AQnCfmDHneesBBS2t6jT4vxWC+zP5RAoA= github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M= github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU= github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= diff --git a/plugins/aws/go.mod b/plugins/aws/go.mod index f2516e2ab..bdb4981bf 100644 --- a/plugins/aws/go.mod +++ b/plugins/aws/go.mod @@ -31,7 +31,7 @@ require ( github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 // indirect github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.77.0 + github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.78.0 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 // indirect github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 // indirect github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 // indirect diff --git a/plugins/aws/go.sum b/plugins/aws/go.sum index afe1f9292..1f60d1f8d 100644 --- a/plugins/aws/go.sum +++ b/plugins/aws/go.sum @@ -18,8 +18,8 @@ github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 h1:RdwIf/CuUsvJX3RgJa github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29/go.mod h1:71wt8W2EgswdZy9Mf9KNnzxZ3TiZlv4caKghPktDOkA= github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 h1:VTGy885W5DKBxWRUJbym9hytNaYzsyaPkCHGRRMAOhU= github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30/go.mod h1:AS0HycUvJRFvTt613AYDOgO2jzw+00cVSMny8XB3yMY= -github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.77.0 h1:tj7fwM3HuGZ7iuxmKWpi3nxvfxfz5u7yVToMCjmupbM= -github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.77.0/go.mod h1:N336OxQ6TvRbb6V1esVE8PtQFU86YvYaS+lVjsJTmP0= +github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.78.0 h1:6r+3E3bDRGiPm2x5t0eKy5jkAtWtgpwdCHi2dMaZy1c= +github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.78.0/go.mod h1:N336OxQ6TvRbb6V1esVE8PtQFU86YvYaS+lVjsJTmP0= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 h1:ZD2+BSw9vFsNlKYIasSNt3uDbjqqXIBcM13UJv/Lx2k= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12/go.mod h1:Ms4zlcVBbXbiP7EVLhl+lgjvA/a7YphqQ3Ih3174EmI= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 h1:DRebniUGZ2MqiiIVmQJ04vIXr918hubdHMnarSLEWyU= diff --git a/plugins/gcp/go.mod b/plugins/gcp/go.mod index c0662ae37..caaef5853 100644 --- a/plugins/gcp/go.mod +++ b/plugins/gcp/go.mod @@ -6,7 +6,7 @@ require ( cloud.google.com/go/pubsub v1.50.2 github.com/google/uuid v1.6.0 github.com/threatwinds/go-sdk v1.1.26 - google.golang.org/api v0.285.0 + google.golang.org/api v0.286.0 google.golang.org/grpc v1.81.1 google.golang.org/protobuf v1.36.11 ) diff --git a/plugins/gcp/go.sum b/plugins/gcp/go.sum index a934f30dd..73fde5b7a 100644 --- a/plugins/gcp/go.sum +++ b/plugins/gcp/go.sum @@ -250,8 +250,8 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.285.0 h1:B7eHHoKGAX/LrPkQvhQqnGwjgWxofbdGwCTQvpm8FkM= -google.golang.org/api v0.285.0/go.mod h1:NlOlUIr8MPoIhT9Bb/oUnRuHbJOLwxb6JSYJM8Yz+jQ= +google.golang.org/api v0.286.0 h1:TdTXMvzYKnWV1/lPbCdbXRqBrkDqjPto22H2xeZZ8LI= +google.golang.org/api v0.286.0/go.mod h1:NlOlUIr8MPoIhT9Bb/oUnRuHbJOLwxb6JSYJM8Yz+jQ= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= diff --git a/plugins/modules-config/go.mod b/plugins/modules-config/go.mod index 2d6b197a0..f060d3757 100644 --- a/plugins/modules-config/go.mod +++ b/plugins/modules-config/go.mod @@ -9,13 +9,13 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.0 github.com/aws/aws-sdk-go-v2/config v1.32.25 github.com/aws/aws-sdk-go-v2/credentials v1.19.24 - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.77.0 + github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.78.0 github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 github.com/crowdstrike/gofalcon v0.21.0 github.com/gin-gonic/gin v1.12.0 github.com/threatwinds/go-sdk v1.1.26 golang.org/x/sync v0.21.0 - google.golang.org/api v0.285.0 + google.golang.org/api v0.286.0 google.golang.org/grpc v1.81.1 google.golang.org/protobuf v1.36.11 ) diff --git a/plugins/modules-config/go.sum b/plugins/modules-config/go.sum index 999b4494b..1356ac18b 100644 --- a/plugins/modules-config/go.sum +++ b/plugins/modules-config/go.sum @@ -58,8 +58,8 @@ github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 h1:RdwIf/CuUsvJX3RgJa github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29/go.mod h1:71wt8W2EgswdZy9Mf9KNnzxZ3TiZlv4caKghPktDOkA= github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 h1:VTGy885W5DKBxWRUJbym9hytNaYzsyaPkCHGRRMAOhU= github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30/go.mod h1:AS0HycUvJRFvTt613AYDOgO2jzw+00cVSMny8XB3yMY= -github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.77.0 h1:tj7fwM3HuGZ7iuxmKWpi3nxvfxfz5u7yVToMCjmupbM= -github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.77.0/go.mod h1:N336OxQ6TvRbb6V1esVE8PtQFU86YvYaS+lVjsJTmP0= +github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.78.0 h1:6r+3E3bDRGiPm2x5t0eKy5jkAtWtgpwdCHi2dMaZy1c= +github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.78.0/go.mod h1:N336OxQ6TvRbb6V1esVE8PtQFU86YvYaS+lVjsJTmP0= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 h1:ZD2+BSw9vFsNlKYIasSNt3uDbjqqXIBcM13UJv/Lx2k= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12/go.mod h1:Ms4zlcVBbXbiP7EVLhl+lgjvA/a7YphqQ3Ih3174EmI= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 h1:DRebniUGZ2MqiiIVmQJ04vIXr918hubdHMnarSLEWyU= @@ -378,8 +378,8 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.285.0 h1:B7eHHoKGAX/LrPkQvhQqnGwjgWxofbdGwCTQvpm8FkM= -google.golang.org/api v0.285.0/go.mod h1:NlOlUIr8MPoIhT9Bb/oUnRuHbJOLwxb6JSYJM8Yz+jQ= +google.golang.org/api v0.286.0 h1:TdTXMvzYKnWV1/lPbCdbXRqBrkDqjPto22H2xeZZ8LI= +google.golang.org/api v0.286.0/go.mod h1:NlOlUIr8MPoIhT9Bb/oUnRuHbJOLwxb6JSYJM8Yz+jQ= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= diff --git a/utmstack-collector/go.mod b/utmstack-collector/go.mod index 8c783e622..c808c9b97 100644 --- a/utmstack-collector/go.mod +++ b/utmstack-collector/go.mod @@ -5,7 +5,7 @@ go 1.25.5 require ( github.com/AtlasInsideCorp/AtlasInsideAES v1.0.0 github.com/docker/docker v28.5.2+incompatible - github.com/elastic/go-sysinfo v1.15.4 + github.com/elastic/go-sysinfo v1.15.5 github.com/glebarez/sqlite v1.11.0 github.com/google/uuid v1.6.0 github.com/kardianos/service v1.2.4 @@ -14,7 +14,7 @@ require ( google.golang.org/grpc v1.81.1 google.golang.org/protobuf v1.36.11 gopkg.in/yaml.v2 v2.4.0 - gorm.io/gorm v1.31.1 + gorm.io/gorm v1.31.2 ) require ( diff --git a/utmstack-collector/go.sum b/utmstack-collector/go.sum index 94796ffa8..384085c6e 100644 --- a/utmstack-collector/go.sum +++ b/utmstack-collector/go.sum @@ -40,8 +40,8 @@ github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= -github.com/elastic/go-sysinfo v1.15.4 h1:A3zQcunCxik14MgXu39cXFXcIw2sFXZ0zL886eyiv1Q= -github.com/elastic/go-sysinfo v1.15.4/go.mod h1:ZBVXmqS368dOn/jvijV/zHLfakWTYHBZPk3G244lHrU= +github.com/elastic/go-sysinfo v1.15.5 h1:fCVUDmjHgljLUQCygherMnsRRJ9AkuAQIywTL7dEH28= +github.com/elastic/go-sysinfo v1.15.5/go.mod h1:ZBVXmqS368dOn/jvijV/zHLfakWTYHBZPk3G244lHrU= github.com/elastic/go-windows v1.0.2 h1:yoLLsAsV5cfg9FLhZ9EXZ2n2sQFKeDYrHenkcivY4vI= github.com/elastic/go-windows v1.0.2/go.mod h1:bGcDpBzXgYSqM0Gx3DM4+UxFj300SZLixie9u9ixLM8= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= @@ -107,6 +107,8 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ= github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= +github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU= +github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw= @@ -248,8 +250,10 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg= -gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= +gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ= +gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8= +gorm.io/gorm v1.31.2 h1:3o8FXNo9v9S858gil+3LlZA1LkCOzgb4g5BL64FgaCo= +gorm.io/gorm v1.31.2/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q= gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA= howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=