diff --git a/PLUGINS/Mock/SIRP/mock_alert.py b/PLUGINS/Mock/SIRP/mock_alert.py index 441cecf..2065a12 100644 --- a/PLUGINS/Mock/SIRP/mock_alert.py +++ b/PLUGINS/Mock/SIRP/mock_alert.py @@ -1,16 +1,7 @@ -import json - from PLUGINS.Mock.SIRP.mock_api import past_10m, past_5m, now, past_1d_18h, past_2d_6h, past_3d_12h, past_4d_20h, past_5d_8h, past_6d_15h, past_7d, past_1h, \ past_30m, past_2h -from PLUGINS.Mock.SIRP.mock_artifact import artifact_evil_email, artifact_fake_url, artifact_malware_file, artifact_malware_hash, artifact_psexesvc, \ - artifact_dc01, artifact_lsass, artifact_mimikatz, artifact_internal_ip, artifact_c2_domain, artifact_dns_port, artifact_google_dns, artifact_sql_server, \ - artifact_ransomware_ip_2, artifact_powershell_script, artifact_malware_registry, artifact_user_account, artifact_suspicious_domain_3, artifact_aws_role, \ - artifact_cloudtrail_event, artifact_brute_force_ip, artifact_target_user_brute, artifact_target_host_brute, artifact_malicious_url_sqli, \ - artifact_sqlmap_tool, artifact_waf_server, artifact_vssadmin_process, artifact_decryptor_malware, artifact_ransom_note_file, artifact_encrypted_files, \ - artifact_ransomware_host, artifact_ransomware_user -from PLUGINS.Mock.SIRP.mock_enrichment import enrichment_virustotal, enrichment_otx_evil_domain, enrichment_greynoise_scanner, enrichment_carbonblack_execution, \ - enrichment_splunk_anomaly, enrichment_darktrace_ai, enrichment_proofpoint_sandbox, enrichment_sentinel_threat, enrichment_aws_s3_public, \ - enrichment_geoip_russia, enrichment_urlhaus_malware +from PLUGINS.Mock.SIRP.mock_artifact import * +from PLUGINS.Mock.SIRP.mock_enrichment import * from PLUGINS.SIRP.sirpmodel import AlertModel, Severity, ImpactLevel, Disposition, AlertAction, Confidence, AlertAnalyticType, AlertAnalyticState, \ ProductCategory, AlertRiskLevel, AlertStatus, AlertPolicyType diff --git a/PLUGINS/Mock/SIRP/mock_artifact.py b/PLUGINS/Mock/SIRP/mock_artifact.py index 18d0ee3..b4780b7 100644 --- a/PLUGINS/Mock/SIRP/mock_artifact.py +++ b/PLUGINS/Mock/SIRP/mock_artifact.py @@ -1,6 +1,4 @@ -from PLUGINS.Mock.SIRP.mock_enrichment import enrichment_otx_evil_domain, enrichment_virustotal, enrichment_otx_8888, enrichment_abuseipdb_ransomware, \ - enrichment_geoip_russia, enrichment_virustotal_cryptominer, enrichment_whois_domain, enrichment_okta_user, enrichment_aws_s3_public, \ - enrichment_greynoise_scanner, enrichment_cve_detail, enrichment_urlhaus_malware +from PLUGINS.Mock.SIRP.mock_enrichment import * from PLUGINS.SIRP.sirpmodel import ArtifactModel, ArtifactType, ArtifactRole, ArtifactReputationScore artifact_evil_email = ArtifactModel( diff --git a/PLUGINS/Mock/SIRP/mock_case.py b/PLUGINS/Mock/SIRP/mock_case.py index 90f04e9..781939f 100644 --- a/PLUGINS/Mock/SIRP/mock_case.py +++ b/PLUGINS/Mock/SIRP/mock_case.py @@ -1,15 +1,8 @@ -from PLUGINS.Mock.SIRP.mock_alert import alert_user_reported_phishing, alert_malware_blocked, alert_psexec_lateral, alert_credential_dumping, \ - alert_dns_tunnel_volume, alert_dns_long_query, alert_brute_force_ssh, alert_malware_execution, alert_unauthorized_access, alert_data_exfiltration, \ - alert_malicious_email_attachment, alert_privilege_escalation, alert_cloud_config_change, alert_brute_force_siem, alert_sql_injection_siem, \ - alert_ransomware_siem -from PLUGINS.Mock.SIRP.mock_api import now, past_5m, past_30m, past_1h, past_2h, past_7d, past_1d_18h, past_2d_6h, past_3d_12h, past_4d_20h, \ - past_5d_8h, past_6d_15h -from PLUGINS.Mock.SIRP.mock_enrichment import enrichment_business, enrichment_greynoise_scanner, \ - enrichment_urlhaus_malware, enrichment_geoip_russia, \ - enrichment_carbonblack_execution -from PLUGINS.Mock.SIRP.mock_ticket import ticket_jira, ticket_servicenow, ticket_pagerduty +from PLUGINS.Mock.SIRP.mock_alert import * +from PLUGINS.Mock.SIRP.mock_enrichment import * +from PLUGINS.Mock.SIRP.mock_ticket import * from PLUGINS.SIRP.sirpmodel import ( - CaseModel, Severity, ImpactLevel, Confidence, ProductCategory, CaseStatus, + CaseModel, CaseStatus, CasePriority, CaseVerdict )