Python Campaign.objects方法代码示例

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
 def setUp(self):
     prep_db()
     self.user = CRITsUser.objects(username=TUSER_NAME).first()
     self.user2 = CRITsUser.objects(username=TUSER2_NAME).first()
     self.campaign1 = Campaign.objects(name=TCAMPAIGN1).first()
     self.campaign2 = Campaign.objects(name=TCAMPAIGN2).first()
     forge_relationship(left_class=self.campaign1,
                        right_class=self.campaign2,
                        rel_type=TRELATIONSHIP_TYPE,
                        analyst=self.user.username,
                        rel_confidence=TRELATIONSHIP_CONFIDENCE)

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def add_ttp(cid, ttp, analyst):
    """
    Add a TTP to a Campaign.

    :param cid: ObjectId of the Campaign.
    :type cid: str
    :param ttp: The TTP to add.
    :type ttp: str
    :param analyst: The user adding the TTP.
    :type analyst: str
    :returns: dict with keys:
              'success' (boolean),
              'campaign' (:class:`crits.campaigns.campaign.Campaign`) if success,
              'message' (str) if failed.
    """

    campaign = Campaign.objects(id=cid).first()
    if campaign:
        new_ttp = EmbeddedTTP()
        new_ttp.analyst = analyst
        new_ttp.ttp = ttp
        try:
            campaign.add_ttp(new_ttp)
            campaign.save(username=analyst)
            return {'success': True, 'campaign': campaign}
        except ValidationError, e:
            return {'success': False, 'message': "Invalid value: %s" % e}

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def add_campaign_from_nodes(name, confidence, nodes, user):
    result = { "success": False }

    # Make sure Campaign exists
    campaign_obj = Campaign.objects(name=name).first()
    if not campaign_obj:
        result["message"] = "Invalid campaign name."
        return result

    campaign = EmbeddedCampaign(name=name, confidence=confidence, analyst=user)

    counter = 0
    for node in nodes:
        id_ = node.get('id', None)
        type_ = node.get('type', None)

        # Must have type and id, and type must not be Campaign
        if not id_ or not type_ or type_.lower() == 'campaign':
            continue

        obj = class_from_id(type_, id_)
        if not obj:
            continue

        obj.add_campaign(campaign)
        obj.save()
        counter += 1

    result["message"] = "%s nodes processed" % counter
    result["success"] = True
    return result

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def clean_db():
    """
    Clean database for test.
    """
    user = CRITsUser.objects(username=TUSER_NAME).first()
    if user:
        user.delete()
    user2 = CRITsUser.objects(username=TUSER2_NAME).first()
    if user2:
        user2.delete()
    campaign1 = Campaign.objects(name=TCAMPAIGN1).first()
    if campaign1:
        campaign1.delete()
    campaign2 = Campaign.objects(name=TCAMPAIGN2).first()
    if campaign2:
        campaign2.delete()

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def class_from_value(type_, value):
    """
    Return an instantiated class object.

    :param type_: The CRITs top-level object type.
    :type type_: str
    :param value: The value to search for.
    :type value: str
    :returns: class which inherits from
              :class:`crits.core.crits_mongoengine.CritsBaseAttributes`
    """

    # doing this to avoid circular imports
    from crits.campaigns.campaign import Campaign
    from crits.certificates.certificate import Certificate
    from crits.comments.comment import Comment
    from crits.domains.domain import Domain
    from crits.emails.email import Email
    from crits.events.event import Event
    from crits.indicators.indicator import Indicator
    from crits.ips.ip import IP
    from crits.pcaps.pcap import PCAP
    from crits.raw_data.raw_data import RawData
    from crits.samples.sample import Sample
    from crits.screenshots.screenshot import Screenshot
    from crits.targets.target import Target

    if type_ == 'Campaign':
        return Campaign.objects(name=value).first()
    elif type_ == 'Certificate':
        return Certificate.objects(md5=value).first()
    elif type_ == 'Comment':
        return Comment.objects(id=value).first()
    elif type_ == 'Domain':
        return Domain.objects(domain=value).first()
    elif type_ == 'Email':
        return Email.objects(id=value).first()
    elif type_ == 'Event':
        return Event.objects(id=value).first()
    elif type_ == 'Indicator':
        return Indicator.objects(id=value).first()
    elif type_ == 'IP':
        return IP.objects(ip=value).first()
    elif type_ == 'PCAP':
        return PCAP.objects(md5=value).first()
    elif type_ == 'RawData':
        return RawData.objects(md5=value).first()
    elif type_ == 'Sample':
        return Sample.objects(md5=value).first()
    elif type_ == 'Screenshot':
        return Screenshot.objects(id=value).first()
    elif type_ == 'Target':
        return Target.objects(email_address=value).first()
    else:
        return None

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def add_campaign(name, description, aliases, analyst, bucket_list=None,
                 ticket=None):
    """
    Add a Campaign.

    :param name: The name of the new Campaign.
    :type name: str
    :param description: Description of the new Campaign.
    :type description: str
    :param aliases: Aliases for the new Campaign.
    :type aliases: str (comma separated) or list.
    :param analyst: The user adding the Campaign.
    :type analyst: str
    :param bucket_list: Buckets to add to this Campaign.
    :type bucket_list: str (comma separated) or list.
    :param ticket: Ticket(s) to add to this Campaign.
    :type ticket: str (comma separated) or list.
    :returns: dict with key 'success' (boolean) and 'message' (str).
    """

    # Verify the Campaign does not exist.
    campaign = Campaign.objects(name=name).first()
    if campaign:
        return {'success': False, 'message': ['Campaign already exists.'],
                'id': str(campaign.id)}

    # Create new campaign.
    campaign = Campaign(name=name)
    campaign.edit_description(description)

    if bucket_list:
        campaign.add_bucket_list(bucket_list, analyst)
    if ticket:
        campaign.add_ticket(ticket, analyst)

    # Adjust aliases.
    if isinstance(aliases, basestring):
        alias_list = aliases.split(',')
        final_aliases = [a.strip() for a in alias_list]
    elif isinstance(aliases, list):
        final_aliases = [a.strip() for a in aliases]
    else:
        final_aliases = []
    campaign.add_alias(final_aliases)

    try:
        campaign.save(username=analyst)
        campaign.reload()
        return {'success': True,
                'message': 'Campaign created successfully!',
                'id': str(campaign.id)}
    except ValidationError, e:
        return {'success': False, 'message': "Invalid value: %s" % e}

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def remove_campaign(name, analyst):
    """
    Remove a Campaign.

    :param name: The name of the Campaign to remove.
    :type name: str
    :param analyst: The user removing the Campaign.
    :type analyst: str
    :returns: dict with key 'success' (boolean) and 'message' (str) if failed.
    """

    campaign = Campaign.objects(name=name).first()
    if campaign:
        campaign.delete(username=analyst)
        return {'success': True}
    else:
        return {'success': False, 'message': 'Campaign not found.'}

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def deactivate_campaign(name, analyst):
    """
    Deactivate a Campaign.

    :param name: Name of the Campaign.
    :type name: str
    :param analyst: The user deactivating the Campaign.
    :type analyst: str
    :returns: dict with key 'success' (boolean) and 'message' (str) if failed.
    """

    campaign = Campaign.objects(name=name).first()
    if campaign:
        campaign.deactivate()
        try:
            campaign.save(username=analyst)
            return {'success': True}
        except ValidationError, e:
            return {'success': False, 'message': "Invalid value: %s" % e}

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def modify_campaign_aliases(name, tags, analyst):
    """
    Modify the aliases for a Campaign.

    :param name: Name of the Campaign.
    :type name: str
    :param tags: The new aliases.
    :type tags: list
    :param analyst: The user setting the new aliases.
    :type analyst: str
    :returns: dict with key 'success' (boolean) and 'message' (str) if failed.
    """

    campaign = Campaign.objects(name=name).first()
    if campaign:
        campaign.set_aliases(tags)
        try:
            campaign.save(username=analyst)
            return {'success': True}
        except ValidationError, e:
            return {'success': False, 'message': "Invalid value: %s" % e}

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def update_campaign_description(cid, description, analyst):
    """
    Update a Campaign description.

    :param cid: ObjectId of the Campaign.
    :type cid: str
    :param description: The new description.
    :type description: str
    :param analyst: The user setting the new description.
    :type analyst: str
    :returns: dict with key 'success' (boolean) and 'message' (str) if failed.
    """

    if not description:
        return {'success': False, 'message': "No description to change"}
    campaign = Campaign.objects(id=cid).first()
    campaign.edit_description(description)
    try:
        campaign.save(username=analyst)
        return {'success': True}
    except ValidationError, e:
        return {'success': False, 'message': e}

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def edit_ttp(cid, old_ttp, new_ttp, analyst):
    """
    Edit an existing TTP.

    :param cid: ObjectId of the Campaign.
    :type cid: str
    :param old_ttp: Original value of the TTP.
    :type old_ttp: str
    :param new_ttp: New value of the TTP.
    :type new_ttp: str
    :param analyst: The user editing the TTP.
    :type analyst: str
    :returns: dict with key 'success' (boolean) and 'message' (str) if failed.
    """

    campaign = Campaign.objects(id=cid).first()
    if campaign:
        try:
            campaign.edit_ttp(old_ttp, new_ttp)
            campaign.save(username=analyst)
            return {'success': True}
        except ValidationError, e:
            return {'success': False, 'message': "Invalid value: %s" % e}

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def remove_ttp(cid, ttp, analyst):
    """
    Remove a TTP from a Campaign.

    :param cid: ObjectId of the Campaign.
    :type cid: str
    :param ttp: The TTP to remove.
    :type ttp: str
    :param analyst: The user removing the TTP.
    :type analyst: str
    :returns: dict with keys:
              'success' (boolean),
              'campaign' (:class:`crits.campaigns.campaign.Campaign`) if success,
              'message' (str) if failed.
    """

    campaign = Campaign.objects(id=cid).first()
    if campaign:
        try:
            campaign.remove_ttp(ttp)
            campaign.save(username=analyst)
            return {'success': True, 'campaign': campaign}
        except ValidationError, e:
            return {'success': False, 'message': "Invalid value: %s" % e}

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def class_from_value(type_, value):
    """
    Return an instantiated class object.

    :param type_: The CRITs top-level object type.
    :type type_: str
    :param value: The value to search for.
    :type value: str
    :returns: class which inherits from
              :class:`crits.core.crits_mongoengine.CritsBaseAttributes`
    """

    # doing this to avoid circular imports
    from crits.actors.actor import ActorThreatIdentifier, Actor
    from crits.backdoors.backdoor import Backdoor
    from crits.campaigns.campaign import Campaign
    from crits.certificates.certificate import Certificate
    from crits.comments.comment import Comment
    from crits.domains.domain import Domain
    from crits.emails.email import Email
    from crits.events.event import Event
    from crits.exploits.exploit import Exploit
    from crits.indicators.indicator import Indicator
    from crits.ips.ip import IP
    from crits.pcaps.pcap import PCAP
    from crits.raw_data.raw_data import RawData
    from crits.samples.sample import Sample
    from crits.screenshots.screenshot import Screenshot
    from crits.targets.target import Target

    # Make sure value is a string...
    value = str(value)

    # Use bson.ObjectId to make sure this is a valid ObjectId, otherwise
    # the queries below will raise a ValidationError exception.
    if (type_ in ['Backdoor', 'Comment', 'Email', 'Event', 'Exploit',
                  'Indicator', 'Screenshot'] and
       not ObjectId.is_valid(value.decode('utf8'))):
        return None

    if type_ == 'Actor':
        return Actor.objects(name=value).first()
    if type_ == 'Backdoor':
        return Backdoor.objects(id=value).first()
    elif type_ == 'ActorThreatIdentifier':
        return ActorThreatIdentifier.objects(name=value).first()
    elif type_ == 'Campaign':
        return Campaign.objects(name=value).first()
    elif type_ == 'Certificate':
        return Certificate.objects(md5=value).first()
    elif type_ == 'Comment':
        return Comment.objects(id=value).first()
    elif type_ == 'Domain':
        return Domain.objects(domain=value).first()
    elif type_ == 'Email':
        return Email.objects(id=value).first()
    elif type_ == 'Event':
        return Event.objects(id=value).first()
    elif type_ == 'Exploit':
        return Exploit.objects(id=value).first()
    elif type_ == 'Indicator':
        return Indicator.objects(id=value).first()
    elif type_ == 'IP':
        return IP.objects(ip=value).first()
    elif type_ == 'PCAP':
        return PCAP.objects(md5=value).first()
    elif type_ == 'RawData':
        return RawData.objects(md5=value).first()
    elif type_ == 'Sample':
        return Sample.objects(md5=value).first()
    elif type_ == 'Screenshot':
        return Screenshot.objects(id=value).first()
    elif type_ == 'Target':
        target = Target.objects(email_address=value).first()
        if target:
            return target
        else:
            return Target.objects(email_address__iexact=value).first()
    else:
        return None

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def handle_indicator_csv(csv_data, source, reference, ctype, username,
                         add_domain=False):
    """
    Handle adding Indicators in CSV format (file or blob).

    :param csv_data: The CSV data.
    :type csv_data: str or file handle
    :param source: The name of the source for these indicators.
    :type source: str
    :param reference: The reference to this data.
    :type reference: str
    :param ctype: The CSV type.
    :type ctype: str ("file" or "blob")
    :param username: The user adding these indicators.
    :type username: str
    :param add_domain: If the indicators being added are also other top-level
                       objects, add those too.
    :type add_domain: boolean
    :returns: dict with keys "success" (boolean) and "message" (str)
    """

    if ctype == "file":
        cdata = csv_data.read()
    else:
        cdata = csv_data.encode('ascii')
    data = csv.DictReader(StringIO(cdata), skipinitialspace=True)
    result = {'success': True}
    result_message = "Indicators added successfully!"
    # Compute permitted values in CSV
    valid_ratings = {
        'unknown': 'unknown',
        'benign': 'benign',
        'low': 'low',
        'medium': 'medium',
        'high': 'high'}
    valid_campaign_confidence = {
        'low': 'low',
        'medium': 'medium',
        'high': 'high'}
    valid_campaigns = {}
    for c in Campaign.objects(active='on'):
        valid_campaigns[c['name'].lower()] = c['name']
    valid_ind_types = {}
    for obj in ObjectType.objects(datatype__enum__exists=False, datatype__file__exists=False):
        if obj['object_type'] == obj['name']:
            name = obj['object_type']
        else:
            name = "%s - %s" % (obj['object_type'], obj['name'])
        valid_ind_types[name.lower()] = name

    # Start line-by-line import
    processed = 0
    for d in data:
        processed += 1
        ind = {}
        ind['value'] = d.get('Indicator', '').lower().strip()
        ind['type'] = get_verified_field(d, 'Type', valid_ind_types)
        if not ind['value'] or not ind['type']:
            # Mandatory value missing or malformed, cannot process csv row
            i = ""
            result['success'] = False
            if not ind['value']:
                i += "No valid Indicator value. "
            if not ind['type']:
                i += "No valid Indicator type. "
            result_message += "Cannot process row: %s. %s<br />" % (processed, i)
            continue
        campaign = get_verified_field(d, 'Campaign', valid_campaigns)
        if campaign:
            ind['campaign'] = campaign
            ind['campaign_confidence'] = get_verified_field(d, 'Campaign Confidence',
                                                            valid_campaign_confidence,
                                                            default='low')
        ind['confidence'] = get_verified_field(d, 'Confidence', valid_ratings,
                                               default='unknown')
        ind['impact'] = get_verified_field(d, 'Impact', valid_ratings,
                                           default='unknown')
        ind[form_consts.Common.BUCKET_LIST_VARIABLE_NAME] = d.get(form_consts.Common.BUCKET_LIST, '')
        ind[form_consts.Common.TICKET_VARIABLE_NAME] = d.get(form_consts.Common.TICKET, '')
        try:
            handle_indicator_insert(ind, source, reference, analyst=username,
                                    add_domain=add_domain)
        except Exception, e:
            result['success'] = False
            result['message'] = str(e)
            return result

# 需要导入模块: from crits.campaigns.campaign import Campaign [as 别名]
# 或者: from crits.campaigns.campaign.Campaign import objects [as 别名]
def get_campaign_details(campaign_name, analyst):
    """
    Generate the data to render the Campaign details template.

    :param campaign_name: The name of the Campaign to get details for.
    :type campaign_name: str
    :param analyst: The user requesting this information.
    :type analyst: str
    :returns: template (str), arguments (dict)
    """

    template = None
    sources = user_sources(analyst)
    campaign_detail = Campaign.objects(name=campaign_name).first()
    if not campaign_detail:
        template = "error.html"
        args = {"error": 'No data exists for this campaign.'}
        return template, args

    ttp_form = TTPForm()

    # remove pending notifications for user
    remove_user_from_notification("%s" % analyst, campaign_detail.id, 'Campaign')

    # subscription
    subscription = {
        'type': 'Campaign',
        'id': campaign_detail.id,
        'subscribed': is_user_subscribed("%s" % analyst,
                                         'Campaign',
                                         campaign_detail.id),
    }

    #objects
    objects = campaign_detail.sort_objects()

    #relationships
    relationships = campaign_detail.sort_relationships("%s" % analyst,
                                                       meta=True)

    # relationship
    relationship = {'type': 'Campaign', 'value': campaign_detail.id}

    #comments
    comments = {'comments': campaign_detail.get_comments(),
                'url_key': campaign_name}

    #screenshots
    screenshots = campaign_detail.get_screenshots(analyst)

    # Get item counts
    formatted_query = {'campaign.name': campaign_name}
    counts = {}
    for col_obj in [Sample, PCAP, Indicator, Email, Domain, IP, Event]:
        counts[col_obj._meta['crits_type']] = col_obj.objects(source__name__in=sources,
                                                              __raw__=formatted_query).count()

    # Item counts for targets
    emails = Email.objects(source__name__in=sources, __raw__=formatted_query)
    addresses = {}
    for email in emails:
        for to in email['to']:
            # This might be a slow operation since we're looking up all "to"
            # targets, could possibly bulk search this.
            target = Target.objects(email_address__iexact=to).first()

            if target is not None:
                addresses[target.email_address] = 1
            else:
                addresses[to] = 1
    uniq_addrs = addresses.keys()
    counts['Target'] = Target.objects(email_address__in=uniq_addrs).count()

    # favorites
    favorite = is_user_favorite("%s" % analyst, 'Campaign', campaign_detail.id)

    # analysis results
    service_results = campaign_detail.get_analysis_results()

    args = {'objects': objects,
            'relationships': relationships,
            "relationship": relationship,
            'comments': comments,
            "subscription": subscription,
            "campaign_detail": campaign_detail,
            "counts": counts,
            "favorite": favorite,
            "screenshots": screenshots,
            'service_results': service_results,
            "ttp_form": ttp_form}

    return template, args