update SIEM agent

PLUGINS/Mock/SIEM/CONFIG.example.py

@@ -1,10 +1,10 @@
-# ELK 配置
+# ELK config
 ELK_ENABLED = True
 ELK_HOST = "https://10.10.10.10:9200"
 ELK_USER = "elastic"
 ELK_PASS = "XXX"
 
-# Splunk 配置
+# Splunk config
 SPLUNK_ENABLED = True
 SPLUNK_HEC_URL = "http://10.10.10.10:8088/services/collector"
 SPLUNK_TOKEN = "XXX-XXX-XXX-XXX-XXX"

PLUGINS/Mock/SIRP/main.py

@@ -0,0 +1,26 @@
+from PLUGINS.Mock.SIRP.mock_case import *
+from PLUGINS.SIRP.sirpapi import Case
+
+if __name__ == "__main__":
+    import os
+    import django
+
+    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "ASP.settings")
+    django.setup()
+
+    for case in [
+        case1_phishing,
+        case2_lateral_movement,
+        case3_dns_tunnel,
+        case4_brute_force,
+        case5_ransomware,
+        case6_unauthorized_access,
+        case7_data_exfil,
+        case8_email_campaign,
+        case9_priv_esc,
+        case10_cloud_misconfig,
+        case11_brute_force,
+        case12_sql_injection,
+        case13_ransomware
+    ]:
+        Case.update_or_create(case)

PLUGINS/Mock/SIRP/mock_case.py

@@ -8,7 +8,6 @@ from PLUGINS.Mock.SIRP.mock_enrichment import enrichment_business, enrichment_gr
     enrichment_urlhaus_malware, enrichment_geoip_russia, \
     enrichment_carbonblack_execution
 from PLUGINS.Mock.SIRP.mock_ticket import ticket_jira, ticket_servicenow, ticket_pagerduty
-from PLUGINS.SIRP.sirpapi import Case
 from PLUGINS.SIRP.sirpmodel import (
     CaseModel, Severity, ImpactLevel, Confidence, ProductCategory, CaseStatus,
     CasePriority, CaseVerdict
@@ -383,27 +382,3 @@ case13_ransomware = CaseModel(
     enrichments=[enrichment_carbonblack_execution],
     alerts=[alert_ransomware_siem]
 )
-
-if __name__ == "__main__":
-    import os
-    import django
-
-    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "ASP.settings")
-    django.setup()
-
-    for case in [
-        case1_phishing,
-        case2_lateral_movement,
-        case3_dns_tunnel,
-        case4_brute_force,
-        case5_ransomware,
-        case6_unauthorized_access,
-        case7_data_exfil,
-        case8_email_campaign,
-        case9_priv_esc,
-        case10_cloud_misconfig,
-        case11_brute_force,
-        case12_sql_injection,
-        case13_ransomware
-    ]:
-        Case.update_or_create(case)