Restore old function solution to create a time buffer for customers to switch

Author: gloo-shock

Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/__init__.py

@@ -0,0 +1,100 @@
+import logging
+import os
+
+import azure.functions as func
+import requests
+from azure.data.tables import TableServiceClient
+from azure.identity import ClientSecretCredential
+from azure.monitor.ingestion import LogsIngestionClient
+
+from lib.azure_storage_table import StorageTableClient
+from lib.log_ingestion_api import IngestionApiClient
+from lib.withsecure_client import WithSecureClient
+from lib.ws_connector import Connector
+
+app = func.FunctionApp()
+
+API_URL = "ELEMENTS_API_URL"
+ENGINE = "ENGINE"
+ENGINE_GROUP = "ENGINE_GROUP"
+
+CLIENT_ID_KEY = "ELEMENTS_API_CLIENT_ID"
+CLIENT_SECRET_KEY = "ELEMENTS_API_CLIENT_SECRET"
+ENTRA_ID_KEY = "ENTRA_CLIENT_ID"
+ENTRA_SECRET_KEY = "ENTRA_CLIENT_SECRET"
+ENTRA_TENANT_KEY = "ENTRA_TENANT_ID"
+
+CONNECTION_STRING = "STATE_TABLE_CS"
+TABLE_NAME = "STATE_TABLE"
+DATA_COLLECTION_ENDPOINT = "LOGS_ENDPOINT"
+DCR_RULE_ID = "LOGS_DCR_RULE_ID"
+DCR_STREAM = "LOGS_DCR_STREAM_NAME"
+
+MAX_EVENTS_COUNT = "MAX_EVENTS_COUNT"
+
+log = logging.getLogger(__name__)
+
+
+@app.schedule(
+    schedule="0 * * * * *", arg_name="timer", run_on_startup=True, use_monitor=True
+)
+def upload_security_events(timer):
+    if timer.past_due:
+        log.info("The timer is past due!")
+    try:
+        elements_api_url = os.environ.get(API_URL)
+        state_conn_str = os.environ.get(CONNECTION_STRING)
+        state_table = os.environ.get(TABLE_NAME)
+        logs_endpoint = os.environ.get(DATA_COLLECTION_ENDPOINT)
+        dcr_rule_id = os.environ.get(DCR_RULE_ID)
+        dcr_stream = os.environ.get(DCR_STREAM)
+        client_id = os.environ.get(CLIENT_ID_KEY)
+        client_secret = os.environ.get(CLIENT_SECRET_KEY)
+        entra_client = os.environ.get(ENTRA_ID_KEY)
+        entra_secret = os.environ.get(ENTRA_SECRET_KEY)
+        entra_tenant = os.environ.get(ENTRA_TENANT_KEY)
+        max_events_count = os.environ.get(MAX_EVENTS_COUNT, 1000)
+
+        log.info("Secret values ok " + client_id)
+
+        storage_client = storage_table_client(state_conn_str, state_table)
+
+        ingestion_client = ingestion_api_client(
+            logs_endpoint,
+            dcr_rule_id,
+            dcr_stream,
+            entra_tenant,
+            entra_client,
+            entra_secret,
+        )
+
+        engine = os.environ.get(ENGINE, "default")
+        engine_group = os.environ.get(ENGINE_GROUP, "default")
+        withsecure_client = WithSecureClient(
+            elements_api_url, client_id, client_secret, engine, engine_group, requests, max_events_count
+        )
+
+        connector = Connector(
+            storage_client=storage_client,
+            ingestion_client=ingestion_client,
+            withsecure_client=withsecure_client,
+        )
+
+        connector.execute()
+    except Exception:
+        log.exception("Execution error")
+
+
+def storage_table_client(connection_str, table_name):
+    table_service_client = TableServiceClient.from_connection_string(connection_str)
+    return StorageTableClient(table_service_client.get_table_client(table_name))
+
+
+def ingestion_api_client(
+    api_url, dcr_rule_id, dcr_stream, entra_tenant, entra_client, entra_secret
+):
+    creds = ClientSecretCredential(
+        tenant_id=entra_tenant, client_id=entra_client, client_secret=entra_secret
+    )
+    azure_client = LogsIngestionClient(api_url, credential=creds)
+    return IngestionApiClient(azure_client, dcr_rule_id, dcr_stream)

Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/function_app.py

@@ -0,0 +1,57 @@
+import logging
+from datetime import datetime, timedelta, timezone
+
+from azure.core.exceptions import ResourceExistsError, ResourceNotFoundError
+from azure.data.tables import UpdateMode
+
+log = logging.getLogger(__name__)
+
+
+class StorageTableClient:
+    def __init__(self, table_client):
+        self._table_client = table_client
+        self._partition_key = "WithSecureConnectorViaAPI"
+        self._row_key = "LastSuccessfulRead"
+
+    def get_start_timestamp(self):
+        last_timestamp = self._get_timestamp()
+        if last_timestamp is None:
+            last_minute_timestamp = datetime.now(timezone.utc) - timedelta(minutes=1)
+            last_timestamp = last_minute_timestamp.isoformat(
+                sep="T", timespec="milliseconds"
+            ).replace("+00:00", "Z")
+            log.info(
+                f"Timestamp missing from storage, generating with {last_timestamp}"
+            )
+            self._add_timestamp_entity(last_timestamp)
+        return last_timestamp
+
+    def save_start_timestamp(self, timestamp):
+        self._update_timestamp(timestamp)
+
+    def _add_timestamp_entity(self, timestamp):
+        try:
+            entity = self._timestamp_to_entity(timestamp)
+            resp = self._table_client.create_entity(entity)
+            log.info(f"Entity created: {resp}")
+        except ResourceExistsError:
+            log.info("Entity already exist")
+
+    def _get_timestamp(self):
+        try:
+            return self._table_client.get_entity(self._partition_key, self._row_key)[
+                self._row_key
+            ]
+        except ResourceNotFoundError:
+            return None
+
+    def _update_timestamp(self, timestamp):
+        entity = self._timestamp_to_entity(timestamp)
+        self._table_client.update_entity(entity, UpdateMode.REPLACE)
+
+    def _timestamp_to_entity(self, timestamp):
+        return {
+            "PartitionKey": self._partition_key,
+            "RowKey": self._row_key,
+            self._row_key: timestamp,
+        }

Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/__init__.py

@@ -0,0 +1,116 @@
+import re
+
+
+class Formatter:
+    SEVERITY_TO_INDEX = {
+        "critical": 10,
+        "fatal_error": 8,
+        "error": 6,
+        "warning": 4,
+        "info": 1,
+    }
+    ENGINE_TO_ACTIVITY = {
+        "webTrafficScanning": "Web Traffic Scanning event",
+        "webContentControl": "Web Content Control event",
+        "applicationControl": "Application Control event",
+        "fileScanning": "File Scanning event",
+        "manualScanning": "Manual Scanning event",
+        "realtimeScanning": "Real - time Scanning event",
+        "deviceControl": "Device Control event",
+        "deepGuard": "DeepGuard event",
+        "dataGuard": "DataGuard event",
+        "browsingProtection": "Browsing Protection event",
+        "connectionControl": "Network connection event",
+        "reputationBasedBrowsing": "Browsing Protection event",
+        "integrityChecker": "Integrity Checker event",
+        "tamperProtection": "Tamper Protection event",
+        "firewall": "Firewall event",
+        "amsi": "Antimalware Scan Interface (AMSI) event",
+        "connector": "Elements Connector event",
+        "setting": "Setting event",
+        "edr": "Endpoint Detection and Response (EDR) event",
+        "xFence": "XFENCE event",
+        "systemEventsLog": "System event",
+        "activityMonitor": "Server Share Protection event",
+        "emailScan": "Email scanning event",
+        "emailBreach": "Email breach event",
+        "teamsScan": "Microsoft Teams scanning event",
+        "oneDriveScan": "Microsoft OneDrive scanning event",
+        "sharePointScan": "Microsoft SharePoint scanning event",
+        "inboxRuleScan": "Suspicious inbox rule event",
+        "activityMonitorClientProtection": "Activity Monitor Client Protection",
+    }
+    DEEP_GUARD_RARITY_REPUTATION_REGEX = "Rarity: (\\d+), Reputation: (\\d+)"
+
+    def format(self, event):
+        engine = event.engine
+        result = {
+            "DeviceVendor": "WithSecure",
+            "DeviceEventClassID": f"{engine}.{event.action}",
+            "Activity": Formatter.ENGINE_TO_ACTIVITY.get(engine, engine),
+            "LogSeverity": Formatter.SEVERITY_TO_INDEX.get(event.severity),
+            "Message": event.message,
+            "DeviceAction": event.action,
+            "SimplifiedDeviceAction": event.action,
+            "PersistenceTimestamp": event.persistenceTimestamp,
+        }
+        details = event.details
+        infected_object = Formatter.get_infection_properties(engine, event)
+        if "infectedObject" in infected_object:
+            result["DeviceCustomString1"] = infected_object["infectedObject"]
+            result["DeviceCustomString1Label"] = "Infected object"
+        if "malwareName" in infected_object:
+            result["DeviceCustomString2"] = infected_object["malwareName"]
+            result["DeviceCustomString2Label"] = "Malware"
+        if "userName" in details:
+            result["SourceUserName"] = details["userName"]
+
+        host_name = event.host_name()
+        if host_name:
+            result["SourceHostName"] = host_name
+        additional_extensions = dict(details)
+        additional_extensions["accountName"] = event.organization["name"]
+        additional_extensions_string = ";".join(
+            [f"details_{k}={v}" for k, v in additional_extensions.items()]
+        )
+        result["AdditionalExtensions"] = additional_extensions_string
+        return result
+
+    @staticmethod
+    def get_infection_properties(engine, event):
+        details = event.details
+        match engine:
+            case "fileScanning" | "manualScanning":
+                return Formatter.get_infection_object(
+                    event.file_path(), event.infection_name()
+                )
+            case "deepGuard":
+                name = details.get("name", "")
+                match_result = re.findall(
+                    Formatter.DEEP_GUARD_RARITY_REPUTATION_REGEX, name
+                )
+                if not match_result and name != "DeepGuard blocks a rare application":
+                    return Formatter.get_infection_object(
+                        details.get("filePath", ""), details.get("name", "")
+                    )
+            case "webTrafficScanning":
+                if "alertType" in details:
+                    return Formatter.get_infection_object(
+                        details.get("url", ""),
+                        event.process_name(),
+                    )
+                else:
+                    return Formatter.get_infection_object(
+                        details.get("websiteUrl", ""), event.file_name()
+                    )
+            case "amsi":
+                return Formatter.get_infection_object(
+                    details.get("path", ""), details.get("infectionName", "")
+                )
+            case _:
+                return {}
+        return {}
+
+    @staticmethod
+    def get_infection_object(path, name):
+        return {"infectedObject": path, "malwareName": name}

Solutions/WithSecureElementsViaFunction/Data Connectors/WithSecureElementsAzureFunction/lib/azure_storage_table.py

@@ -0,0 +1,22 @@
+import logging
+
+from azure.core.exceptions import HttpResponseError
+
+log = logging.getLogger(__name__)
+
+
+class IngestionApiClient:
+    def __init__(self, azure_ingestion_client, dcr_rule_id, dcr_stream):
+        self._ingestion_client = azure_ingestion_client
+        self._dcr_rule_id = dcr_rule_id
+        self._dcr_stream = dcr_stream
+
+    def upload_events(self, events):
+        log.info("Uploading events to Log Workspace")
+        try:
+            self._ingestion_client.upload(
+                rule_id=self._dcr_rule_id, stream_name=self._dcr_stream, logs=events
+            )
+            log.info("Events are uploaded")
+        except HttpResponseError as e:
+            raise Exception("Couldn't send data to Azure") from e