feat(dlp): add enterprise phase scaffolds (policy role, content analysis, siem, case, compliance, cli)

aw-server/dlp-integrations/cef-exporter.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=AWatch DLP CEF Exporter
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=activitywatch
+Group=activitywatch
+ExecStart=/usr/bin/python3 /opt/activitywatch/dlp-integrations/cef_exporter.py
+
+[Install]
+WantedBy=multi-user.target

aw-server/dlp-integrations/cef-exporter.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Run AWatch DLP CEF Exporter every 5 minutes
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=5min
+Unit=cef-exporter.service
+Persistent=true
+
+[Install]
+WantedBy=timers.target

aw-server/dlp-integrations/cef_exporter.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import json
+import logging
+import os
+import socket
+from datetime import datetime, timezone
+
+logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
+
+
+def build_cef(event: dict) -> str:
+    sev_map = {"low": 3, "medium": 6, "high": 10}
+    sev = sev_map.get(event.get("severity", "low"), 3)
+    ts = datetime.now(timezone.utc).isoformat()
+    msg = event.get("message", "")
+    host = event.get("hostname", "unknown")
+    return f"CEF:0|AWatch-rus|DLP|1.0|{event.get('id','dlp')}|{msg}|{sev}|rt={ts} shost={host}"
+
+
+def send_syslog(line: str, host: str, port: int) -> None:
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    try:
+        sock.sendto(line.encode("utf-8", errors="ignore"), (host, port))
+    finally:
+        sock.close()
+
+
+def main() -> None:
+    sample = os.environ.get("AW_DLP_CEF_SAMPLE", "")
+    event = json.loads(sample) if sample else {"id": "startup", "message": "cef exporter heartbeat", "severity": "low"}
+    line = build_cef(event)
+    host = os.environ.get("AW_DLP_SYSLOG_HOST", "127.0.0.1")
+    port = int(os.environ.get("AW_DLP_SYSLOG_PORT", "514"))
+    send_syslog(line, host, port)
+    logging.info("sent CEF event to %s:%d", host, port)
+
+
+if __name__ == "__main__":
+    main()

aw-server/dlp-integrations/webhook_sender.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import json
+import os
+import time
+from urllib import request
+
+
+def post(url: str, payload: dict, retries: int = 3) -> bool:
+    body = json.dumps(payload).encode("utf-8")
+    for i in range(retries):
+        try:
+            req = request.Request(url, data=body, headers={"Content-Type": "application/json"}, method="POST")
+            with request.urlopen(req, timeout=10):
+                return True
+        except Exception:
+            time.sleep(2 ** i)
+    return False
+
+
+def main() -> None:
+    hooks = [h.strip() for h in os.environ.get("AW_DLP_CRITICAL_WEBHOOKS", "").split(",") if h.strip()]
+    payload = {"text": "AWatch DLP critical incident", "severity": "high"}
+    for hook in hooks:
+        post(hook, payload)
+
+
+if __name__ == "__main__":
+    main()