diff --git a/Lib/montior.py b/Lib/montior.py index eb31f6e..5a3f529 100644 --- a/Lib/montior.py +++ b/Lib/montior.py @@ -82,8 +82,8 @@ class MainMonitor(object): # Start background tasks self.start_background_task(self.subscribe_pending_playbook, "subscribe_pending_playbook", delay_time) - self.start_background_task(self.subscribe_case_analysis_scheduler, "subscribe_case_analysis_scheduler", delay_time) - self.start_background_task(self.subscribe_case_analysis_queue, "subscribe_case_analysis_queue", delay_time) + # self.start_background_task(self.subscribe_case_analysis_scheduler, "subscribe_case_analysis_scheduler", delay_time) + # self.start_background_task(self.subscribe_case_analysis_queue, "subscribe_case_analysis_queue", delay_time) # engine # self.engine.start() diff --git a/MODULES/Cloud-01-AWS-IAM-Privilege-Escalation-via-AttachUserPolicy.py b/MODULES/Cloud-01-AWS-IAM-Privilege-Escalation-via-AttachUserPolicy.py index 387f7ab..119fd0c 100644 --- a/MODULES/Cloud-01-AWS-IAM-Privilege-Escalation-via-AttachUserPolicy.py +++ b/MODULES/Cloud-01-AWS-IAM-Privilege-Escalation-via-AttachUserPolicy.py @@ -112,7 +112,7 @@ class Module(BaseModule): correlation_uid = Correlation.generate_correlation_uid( rule_id=self.module_name, time_window="24h", - keys=[target_user, account_id], + keys=[principal_user, account_id], timestamp=event_time_formatted ) @@ -194,7 +194,7 @@ class Module(BaseModule): else: # 根据 Alert 计算 Case字段 new_case = CaseModel( - title=f"Potential IAM Privilege Escalation in Account {account_id} by {target_user}", + title=f"Potential IAM Privilege Escalation in Account {account_id} by {principal_user}", severity=severity, impact=Impact.HIGH if outcome == "success" else Impact.MEDIUM, priority=CasePriority.HIGH if outcome == "success" else CasePriority.MEDIUM, @@ -225,7 +225,7 @@ if __name__ == "__main__": # 批量测试最早的100条告警 module = Module() - message_ids = module.read_stream_head_ids(100) + message_ids = module.read_stream_head_ids(10) for message_id in message_ids: module.debug_message_id = message_id module.run() diff --git a/PLUGINS/SIRP/sirpextramodel.py b/PLUGINS/SIRP/sirpextramodel.py index 40357e1..4c3c29e 100644 --- a/PLUGINS/SIRP/sirpextramodel.py +++ b/PLUGINS/SIRP/sirpextramodel.py @@ -38,9 +38,9 @@ class PlaybookModel(BaseSystemModel): json_schema_extra={"ai": [AI_PROFILE_MCP]}) source_row_id: Optional[str] = Field(default="", description="Trigger source row ID (触发源行 ID)", json_schema_extra={"ai": [AI_PROFILE_MCP]}) - source_id: Optional[str] = Field(default="", - description="Trigger source record ID e.g. case_000001(触发源记录 ID e.g. case_0000001)", - json_schema_extra={"ai": [AI_PROFILE_MCP]}) + case_id: Optional[str] = Field(default="", + description="Trigger source record ID e.g. case_000001(触发源记录 ID e.g. case_0000001)", + json_schema_extra={"ai": [AI_PROFILE_MCP]}) name: Optional[str] = Field(default="", description="Executed playbook name (执行剧本名称)", json_schema_extra={"ai": [AI_PROFILE_MCP]}) user_input: Optional[str] = Field(default="", description="Initial or follow-up user input (初始或后续用户输入)", @@ -62,7 +62,8 @@ class KnowledgeModel(BaseSystemModel): json_schema_extra={"ai": [AI_PROFILE_MCP]}) body: Optional[str] = Field(default="", description="Knowledge content (知识内容)", json_schema_extra={"ai": [AI_PROFILE_MCP]}) - expires_at: Optional[AutoDatetime] = Field(default=None, description="Knowledge expiration time; empty means permanently valid (知识过期时间,空表示永久有效)", + expires_at: Optional[AutoDatetime] = Field(default=None, + description="Knowledge expiration time; empty means permanently valid (知识过期时间,空表示永久有效)", json_schema_extra={"ai": [AI_PROFILE_MCP]}) source: Optional[KnowledgeSource] = Field(default=None, description="Knowledge source (知识来源)", json_schema_extra={"ai": [AI_PROFILE_MCP]})