From 693aca2840ebea74dfbf5b39df1469a0f62081e8 Mon Sep 17 00:00:00 2001 From: Greg Elin Date: Sun, 4 Jul 2021 11:02:34 -0500 Subject: [PATCH 1/6] Add Wazuh info via end-user form --- CHANGELOG.md | 1 + controls/forms.py | 1 + controls/urls.py | 1 + controls/views.py | 60 +++++++++++++++++++++++++- templates/systems/sar_list.html | 76 ++++++++++++++++++++++++++++++++- 5 files changed, 137 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d9b681bfe..615f46c24 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ v0.9.6-dev (June XX, 2021) * Display legacy control implementation statements within system's statements. * Added compare components button to compare one component's statements to other selected components. * Added a Select/Deselect button for component comparison choice +* Add accordion to assessment page to provide information on getting data from Wazuh. **Bug fixes** diff --git a/controls/forms.py b/controls/forms.py index dcb7abb64..2e1beeef3 100644 --- a/controls/forms.py +++ b/controls/forms.py @@ -155,3 +155,4 @@ def clean(self): assessment_results = forms.CharField(label='System assessment result items (JSON)', required=False, widget=forms.Textarea(), help_text="Listing of assessment items in JSON") + diff --git a/controls/urls.py b/controls/urls.py index 8cb91d766..dacd1a137 100644 --- a/controls/urls.py +++ b/controls/urls.py @@ -43,6 +43,7 @@ # Systems Assessment Results url(r'^(?P.*)/assessments$', views.system_assessment_results_list, name="system_assessment_results_list"), + url(r'^(?P.*)/assessments/new/wazuh$', views.new_system_assessment_result_wazuh, name="new_system_assessment_result_wazuh"), url(r'^(?P.*)/assessment/new$', views.manage_system_assessment_result, name="new_system_assessment_result"), url(r'^(?P.*)/sar/(?P.*)/view$', views.view_system_assessment_result_summary, name="view_system_assessment_result_summary"), url(r'^(?P.*)/sar/(?P.*)/edit$', views.manage_system_assessment_result, name="manage_system_assessment_result"), diff --git a/controls/views.py b/controls/views.py index 72bc10ef8..644e57e51 100644 --- a/controls/views.py +++ b/controls/views.py @@ -40,6 +40,7 @@ from .utilities import * from simple_history.utils import update_change_reason import functools +import subprocess logging.basicConfig() import structlog from structlog import get_logger @@ -3172,11 +3173,16 @@ def system_assessment_results_list(request, system_id=None): project = system.projects.all()[0] sars = system.system_assessment_result.all().order_by('created').reverse() - # Return the controls + # Retrieve user's API keys + api_keys = request.user.get_api_keys() + context = { "system": system, "project": project, "sars": sars, + "api_key_ro": api_keys['ro'], + "api_key_rw": api_keys['rw'], + "api_key_wo": api_keys['wo'] } return render(request, "systems/sar_list.html", context) @@ -3271,3 +3277,55 @@ def system_assessment_result_history(request, system_id, sar_id=None): "deployment": full_sar_history, } return render(request, "systems/sar_history.html", context) + +@login_required +def new_system_assessment_result_wazuh(request, system_id): + """Returns a SAR info from Wazuh and adds to system""" + + if request.method != "POST": + return HttpResponseNotAllowed(["POST"]) + + else: + print("Getting Wazuh information") + # Validate data + valid = True + for param in ["wazuhhost_val", "user_val", "passwd_val", "agents_val"]: + if param not in request.POST: + valid = False + messages.add_message(request, messages.WARNING, f"Please complete field {param.replace('_val','')}") + if not valid: + return HttpResponseRedirect(f"/systems/{system_id}/assessments") + + # Check user permissions + system = System.objects.get(pk=system_id) + if not request.user.has_perm('change_system', system): + # User does not have write permissions + # Log permission to save answer denied + logger.info( + event="delete_smt permission_denied", + object={"object": "statement", "id": statement.id}, + user={"id": request.user.id, "username": request.user.username} + ) + return HttpResponseForbidden( + "Permission denied. {} does not have change privileges to system and/or project.".format( + request.user.username)) + + #python tools/simple_sar_server/wazuh_etl.py N6auqvmM44aq9mkktZiGo72cZTIXQQPG https://wazuh-1.govready.com -s 269 --agents 001,002,0003,004 + #if subprocess.run(["python", "tools/simple_sar_server/wazuh_etl.py", "N6auqvmM44aq9mkktZiGo72cZTIXQQPG", "https://wazuh-1.govready.com", "-s", "269", "--agents", "001,002,0003,004"]): + if subprocess.run(["python", "tools/simple_sar_server/wazuh_etl.py", "N6auqvmM44aq9mkktZiGo72cZTIXQQPG", f"{request.POST['wazuhhost_val']}", "-s", f"{system_id}", "--agents", f"{request.POST['agents_val']}"]): + # see https://stackoverflow.com/questions/3878624/how-do-i-programmatically-determine-if-there-are-uncommitted-changes + print("Wazuh command executed") + messages.add_message(request, messages.INFO, f'OK. I hit the Wazuh API and added results to {system.root_element.name}.') + else: + messages.add_message(request, messages.INFO, f'Darn. There was a problem with the subprocess.') + print("Wazuh command failed") + + # Redirect + return HttpResponseRedirect(f"/systems/{system_id}/assessments") + + + + + + + diff --git a/templates/systems/sar_list.html b/templates/systems/sar_list.html index e1cef875d..52f165518 100644 --- a/templates/systems/sar_list.html +++ b/templates/systems/sar_list.html @@ -11,6 +11,18 @@ {% block head %} {{block.super}} + + {% include "controls/_style-controls.html" %} {% endblock %} @@ -18,7 +30,69 @@ {% block body_content %} -
+ +
+
+
Retrieve data from Wazuh
+ {% csrf_token %} +
+ + +    + + +    + + +    + + + +
+ +
+ View Wazuh Commandline +
+
+# Run wazuht_etl.py
+python tools/simple_sar_server/wazuh_etl.py {{api_key_wo}} https://wazuh.example.com:55000 -s {{project.system.id}} --agents 001,002,003,004
+
+# Authenticate and get Bearer token
+TOKEN=$(curl -u seabisbuit:secret -k -X GET "https://wazuh.example.com:55000/security/user/authenticate?raw=true")
+
+# Retrieve agent (e.g. monitored host) information
+curl -k -X GET "WAZUH_HOST/agents?pretty=true&sort=-ip,name" -H "Authorization: Bearer $TOKEN"
+
+ +
+
+ +
+ + + + +
System Assessment Results
 
From fdeba46c3be484e203c8eba8ea6f1e37e0d000e0 Mon Sep 17 00:00:00 2001 From: Greg Elin Date: Mon, 5 Jul 2021 18:19:28 -0500 Subject: [PATCH 2/6] Create SecurityService class to represent Security Service Create `sec_srvc.SecurityService` class to represent a security service from which data could be collected. Add form to Assessments page to collect info from Wazuh SecurityService. --- CHANGELOG.md | 7 +-- controls/views.py | 45 +++++++++++++---- sec_srvc/__init__.py | 0 sec_srvc/sec_srvc.py | 118 +++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 157 insertions(+), 13 deletions(-) create mode 100644 sec_srvc/__init__.py create mode 100644 sec_srvc/sec_srvc.py diff --git a/CHANGELOG.md b/CHANGELOG.md index 615f46c24..3d515564a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,8 +7,9 @@ v0.9.6-dev (June XX, 2021) * Display legacy control implementation statements within system's statements. * Added compare components button to compare one component's statements to other selected components. -* Added a Select/Deselect button for component comparison choice +* Added a Select/Deselect button for component comparison choice. * Add accordion to assessment page to provide information on getting data from Wazuh. +* Add form to Assessments page to collect Wazuh information. **Bug fixes** @@ -17,12 +18,12 @@ v0.9.6-dev (June XX, 2021) **Developer changes** * Add custom Django command to batch import legacy control implementation statements from legacy SSPs Excel spreadsheet exports. Currently supports CSAM. -* Added missing unit test for portfolio project endpoint +* Added missing unit test for portfolio project endpoint. +* Add `sec_srvc.SecurityService` class to represent a security service from which data could be collected. **Data changes** * Set all `StatementTypeEnum.