update SIEM agent

PLUGINS/Mock/SIRP/mock_alert.py

@@ -1,16 +1,7 @@
-import json
-
 from PLUGINS.Mock.SIRP.mock_api import past_10m, past_5m, now, past_1d_18h, past_2d_6h, past_3d_12h, past_4d_20h, past_5d_8h, past_6d_15h, past_7d, past_1h, \
     past_30m, past_2h
-from PLUGINS.Mock.SIRP.mock_artifact import artifact_evil_email, artifact_fake_url, artifact_malware_file, artifact_malware_hash, artifact_psexesvc, \
-    artifact_dc01, artifact_lsass, artifact_mimikatz, artifact_internal_ip, artifact_c2_domain, artifact_dns_port, artifact_google_dns, artifact_sql_server, \
-    artifact_ransomware_ip_2, artifact_powershell_script, artifact_malware_registry, artifact_user_account, artifact_suspicious_domain_3, artifact_aws_role, \
-    artifact_cloudtrail_event, artifact_brute_force_ip, artifact_target_user_brute, artifact_target_host_brute, artifact_malicious_url_sqli, \
-    artifact_sqlmap_tool, artifact_waf_server, artifact_vssadmin_process, artifact_decryptor_malware, artifact_ransom_note_file, artifact_encrypted_files, \
-    artifact_ransomware_host, artifact_ransomware_user
-from PLUGINS.Mock.SIRP.mock_enrichment import enrichment_virustotal, enrichment_otx_evil_domain, enrichment_greynoise_scanner, enrichment_carbonblack_execution, \
-    enrichment_splunk_anomaly, enrichment_darktrace_ai, enrichment_proofpoint_sandbox, enrichment_sentinel_threat, enrichment_aws_s3_public, \
-    enrichment_geoip_russia, enrichment_urlhaus_malware
+from PLUGINS.Mock.SIRP.mock_artifact import *
+from PLUGINS.Mock.SIRP.mock_enrichment import *
 from PLUGINS.SIRP.sirpmodel import AlertModel, Severity, ImpactLevel, Disposition, AlertAction, Confidence, AlertAnalyticType, AlertAnalyticState, \
     ProductCategory, AlertRiskLevel, AlertStatus, AlertPolicyType
 

PLUGINS/Mock/SIRP/mock_artifact.py

@@ -1,6 +1,4 @@
-from PLUGINS.Mock.SIRP.mock_enrichment import enrichment_otx_evil_domain, enrichment_virustotal, enrichment_otx_8888, enrichment_abuseipdb_ransomware, \
-    enrichment_geoip_russia, enrichment_virustotal_cryptominer, enrichment_whois_domain, enrichment_okta_user, enrichment_aws_s3_public, \
-    enrichment_greynoise_scanner, enrichment_cve_detail, enrichment_urlhaus_malware
+from PLUGINS.Mock.SIRP.mock_enrichment import *
 from PLUGINS.SIRP.sirpmodel import ArtifactModel, ArtifactType, ArtifactRole, ArtifactReputationScore
 
 artifact_evil_email = ArtifactModel(

PLUGINS/Mock/SIRP/mock_case.py

@@ -1,15 +1,8 @@
-from PLUGINS.Mock.SIRP.mock_alert import alert_user_reported_phishing, alert_malware_blocked, alert_psexec_lateral, alert_credential_dumping, \
-    alert_dns_tunnel_volume, alert_dns_long_query, alert_brute_force_ssh, alert_malware_execution, alert_unauthorized_access, alert_data_exfiltration, \
-    alert_malicious_email_attachment, alert_privilege_escalation, alert_cloud_config_change, alert_brute_force_siem, alert_sql_injection_siem, \
-    alert_ransomware_siem
-from PLUGINS.Mock.SIRP.mock_api import now, past_5m, past_30m, past_1h, past_2h, past_7d, past_1d_18h, past_2d_6h, past_3d_12h, past_4d_20h, \
-    past_5d_8h, past_6d_15h
-from PLUGINS.Mock.SIRP.mock_enrichment import enrichment_business, enrichment_greynoise_scanner, \
-    enrichment_urlhaus_malware, enrichment_geoip_russia, \
-    enrichment_carbonblack_execution
-from PLUGINS.Mock.SIRP.mock_ticket import ticket_jira, ticket_servicenow, ticket_pagerduty
+from PLUGINS.Mock.SIRP.mock_alert import *
+from PLUGINS.Mock.SIRP.mock_enrichment import *
+from PLUGINS.Mock.SIRP.mock_ticket import *
 from PLUGINS.SIRP.sirpmodel import (
-    CaseModel, Severity, ImpactLevel, Confidence, ProductCategory, CaseStatus,
+    CaseModel, CaseStatus,
     CasePriority, CaseVerdict
 )