Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add scanner.condition custom field to states-vulnerabilities #636

Merged

Conversation

QU3B1M
Copy link
Member

@QU3B1M QU3B1M commented Jan 10, 2025

Description

Update states-vulnerabilities index definition adding the scanner.condition custom field defined on wazuh/wazuh#27518 (comment).
Add required changes to the corresponding event_generator.

Related Issues

Resolves wazuh/wazuh#27519

Check List

  • Functionality includes testing.
  • API changes companion pull request created, if applicable.
  • Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Update event_generator to include new field scanner.condition
@QU3B1M QU3B1M self-assigned this Jan 10, 2025
@QU3B1M QU3B1M requested a review from a team as a code owner January 10, 2025 15:33
@QU3B1M
Copy link
Member Author

QU3B1M commented Jan 10, 2025

Generate a states-vulnerabilities event

% python states-vulnerabilities/event-generator/event_generator.py 
How many events do you want to generate? 1
Do you want to inject the generated data into your indexer? (y/n) y
Enter the IP of your Indexer (default: '127.0.0.1'): 
Enter the port of your Indexer (default: '9200'): 
Enter the index name (default: 'wazuh-states-vulnerabilities'): 
Username (default: 'admin'): 
Password (default: 'admin'): 

The document is indexed

% curl http://127.0.0.1:9200/wazuh-states-vulnerabilities/_search
{"took":32,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{"value":1,"relation":"eq"},"max_score":1.0,"hits":[{"_index":"wazuh-states-vulnerabilities","_id":"TjvLUJQB5X4nss0dFun5","_score":1.0,"_source":{"agent": {"id": "agent56", "name": "Agent66", "type": "macos", "version": "v3-stable", "groups": ["group83", "group82"], "host": {"architecture": "x86_64", "boot": {"id": "bootid5955"}, "cpu": {"usage": 47.80037740952474}, "disk": {"read": {"bytes": 644635}, "write": {"bytes": 46841}}, "domain": "domain938", "geo": {"city_name": "CityName", "continent_code": "NA", "continent_name": "North America", "country_iso_code": "US", "country_name": "United States", "location": {"lat": 25.160257, "lon": 20.792767}, "name": "location219", "postal_code": "31976", "region_iso_code": "US-CA", "region_name": "California", "timezone": "America/Los_Angeles"}, "hostname": "host376", "id": "id882", "ip": "171.238.55.2", "mac": "f2:21:a7:17:73:0e", "name": "host136", "network": {"egress": {"bytes": 560483, "packets": 4748}, "ingress": {"bytes": 828300, "packets": 8345}}, "os": {"family": "macos", "full": "ubuntu 73.68", "kernel": "4.4.6", "name": "macOS", "platform": "platform1", "type": "os_type1", "version": "0.3.5"}, "pid_ns_ino": "pid_ns7865", "risk": {"calculated_level": "low", "calculated_score": 3.054144338865896, "calculated_score_norm": 0.7725172234280974, "static_level": "medium", "static_score": 7.167125499587287, "static_score_norm": 0.530565876495784}, "type": "type1", "uptime": 73570}}, "host": {"architecture": "arm64", "boot": {"id": "bootid914"}, "cpu": {"usage": 96.82403311544601}, "disk": {"read": {"bytes": 851032}, "write": {"bytes": 910548}}, "domain": "domain342", "geo": {"city_name": "CityName", "continent_code": "NA", "continent_name": "North America", "country_iso_code": "US", "country_name": "United States", "location": {"lat": 43.782419, "lon": -9.662997}, "name": "location270", "postal_code": "35008", "region_iso_code": "US-CA", "region_name": "California", "timezone": "America/Los_Angeles"}, "hostname": "host129", "id": "id402", "ip": "241.40.120.87", "mac": "7a:2b:07:6f:ea:85", "name": "host640", "network": {"egress": {"bytes": 889035, "packets": 9689}, "ingress": {"bytes": 61876, "packets": 3812}}, "os": {"family": "ubuntu", "full": "android 19.78", "kernel": "2.1.4", "name": "Linux", "platform": "platform2", "type": "os_type1", "version": "1.9.7"}, "pid_ns_ino": "pid_ns481", "risk": {"calculated_level": "high", "calculated_score": 4.760020224587715, "calculated_score_norm": 0.6377607400945076, "static_level": "high", "static_score": 9.341585253181876, "static_score_norm": 0.39752174448910504}, "type": "type2", "uptime": 300660}, "package": {"architecture": "arm64", "build_version": "build929", "checksum": "checksum5832", "description": "description3675", "install_scope": "user", "installed": "2025-01-01T19:30:20.466995Z", "license": "MIT", "name": "package6690", "path": "/path/to/package4633", "reference": "reference8380", "size": 54540, "type": "rpm", "version": "4.3.1"}, "vulnerability": {"category": "security", "classification": "classification7212", "description": "description1209", "detected_at": "2025-01-05T05:48:37.825712Z", "enumeration": "enumeration6167", "id": "id1744", "published_at": "2025-01-02T05:13:30.321437Z", "reference": "reference9760", "report_id": "report6997", "scanner": {"source": "Nessus", "condition": "is"}, "score": {"base": 3.926902156892176e-05, "environmental": 7.158496524351846, "temporal": 1.315321868639242, "version": "v2"}, "severity": "medium", "under_evaluation": true}}}]}}

@AlexRuiz7 AlexRuiz7 merged commit 8949bfb into master Jan 10, 2025
7 checks passed
@AlexRuiz7 AlexRuiz7 deleted the ecs/27519-update-states-vulnerabilities-definition branch January 10, 2025 16:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Change VD template to support the package condition field
2 participants