From 5d6f823189b236a5672fccc272119cf8c26f1be8 Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Tue, 21 Jul 2026 22:20:54 +0200 Subject: [PATCH] feat(harfanglab): threat triage commands (status, level, comment, note, history) Co-Authored-By: Claude Fable 5 --- .../harfanglab/scripts/threat_comment.py | 32 +++++++++++++++ .../harfanglab/scripts/threat_history.py | 32 +++++++++++++++ .../harfanglab/scripts/threat_level.py | 40 ++++++++++++++++++ .../harfanglab/scripts/threat_note_set.py | 36 ++++++++++++++++ .../harfanglab/scripts/threat_status.py | 41 +++++++++++++++++++ 5 files changed, 181 insertions(+) create mode 100644 integrations/harfanglab/scripts/threat_comment.py create mode 100644 integrations/harfanglab/scripts/threat_history.py create mode 100644 integrations/harfanglab/scripts/threat_level.py create mode 100644 integrations/harfanglab/scripts/threat_note_set.py create mode 100644 integrations/harfanglab/scripts/threat_status.py diff --git a/integrations/harfanglab/scripts/threat_comment.py b/integrations/harfanglab/scripts/threat_comment.py new file mode 100644 index 0000000..0d6999b --- /dev/null +++ b/integrations/harfanglab/scripts/threat_comment.py @@ -0,0 +1,32 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + url = base + "/api/data/alert/alert/Threat/" + str(inputs.get("threat_id")) + "/comment/" + print(json.dumps(request("POST", url, headers, {"comment": inputs.get("comment")}))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/harfanglab/scripts/threat_history.py b/integrations/harfanglab/scripts/threat_history.py new file mode 100644 index 0000000..1ba0cd4 --- /dev/null +++ b/integrations/harfanglab/scripts/threat_history.py @@ -0,0 +1,32 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + url = base + "/api/data/alert/alert/Threat/" + str(inputs.get("threat_id")) + "/history/" + print(json.dumps(request("GET", url, headers))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/harfanglab/scripts/threat_level.py b/integrations/harfanglab/scripts/threat_level.py new file mode 100644 index 0000000..325fbe7 --- /dev/null +++ b/integrations/harfanglab/scripts/threat_level.py @@ -0,0 +1,40 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + + +def csv(v): + return [x.strip() for x in str(v or "").split(",") if x.strip()] + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + body = { + "threat_ids": csv(inputs.get("threat_ids")), + "new_level": inputs.get("new_level"), + "update_by_query": False, + } + print(json.dumps(request("PATCH", base + "/api/data/alert/alert/Threat/level/", headers, body))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/harfanglab/scripts/threat_note_set.py b/integrations/harfanglab/scripts/threat_note_set.py new file mode 100644 index 0000000..1edc534 --- /dev/null +++ b/integrations/harfanglab/scripts/threat_note_set.py @@ -0,0 +1,36 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + url = base + "/api/data/alert/alert/Threat/" + str(inputs.get("threat_id")) + "/note/" + body = {"title": inputs.get("title"), "content": inputs.get("content")} + try: + print(json.dumps(request("POST", url, headers, body))) + except urllib.error.HTTPError: + print(json.dumps(request("PUT", url, headers, body))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/harfanglab/scripts/threat_status.py b/integrations/harfanglab/scripts/threat_status.py new file mode 100644 index 0000000..a290202 --- /dev/null +++ b/integrations/harfanglab/scripts/threat_status.py @@ -0,0 +1,41 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + + +def csv(v): + return [x.strip() for x in str(v or "").split(",") if x.strip()] + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + body = { + "threat_ids": csv(inputs.get("threat_ids")), + "new_status": inputs.get("new_status"), + "update_by_query": False, + "tag_security_events": bool(inputs.get("tag_security_events", False)), + } + print(json.dumps(request("PATCH", base + "/api/data/alert/alert/Threat/status/", headers, body))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1)