73 lines
2.4 KiB
Python
73 lines
2.4 KiB
Python
#!/usr/bin/env python3
|
|
from __future__ import annotations
|
|
|
|
from datetime import datetime
|
|
from typing import Literal
|
|
|
|
from pydantic import BaseModel, Field
|
|
|
|
CaseStatus = Literal["open", "investigating", "resolved", "closed"]
|
|
|
|
|
|
class CaseHayabusaLink(BaseModel):
|
|
tool: Literal["hayabusa"] = "hayabusa"
|
|
host: str = Field(min_length=1, max_length=128)
|
|
mode: str = Field(min_length=1, max_length=32)
|
|
status: str = Field(min_length=1, max_length=64)
|
|
intake_id: str | None = Field(default=None, max_length=256)
|
|
package_path: str | None = Field(default=None, max_length=1024)
|
|
sha256: str | None = Field(default=None, max_length=128)
|
|
report_dir: str | None = Field(default=None, max_length=1024)
|
|
summary_html: str | None = Field(default=None, max_length=1024)
|
|
timeline_path: str | None = Field(default=None, max_length=1024)
|
|
manifest_path: str | None = Field(default=None, max_length=1024)
|
|
linked_at: str | None = Field(default=None, max_length=64)
|
|
link_source: str | None = Field(default=None, max_length=64)
|
|
|
|
|
|
class CaseCreate(BaseModel):
|
|
incident_id: str = Field(min_length=1, max_length=256)
|
|
host: str | None = Field(default=None, max_length=128)
|
|
title: str = Field(min_length=1, max_length=512)
|
|
severity: str = Field(default="medium", max_length=32)
|
|
assignee: str | None = Field(default=None, max_length=128)
|
|
source_bucket: str | None = Field(default=None, max_length=256)
|
|
source_event_ts: str | None = Field(default=None, max_length=64)
|
|
evidence: dict | None = None
|
|
|
|
|
|
class CaseUpdate(BaseModel):
|
|
status: CaseStatus | None = None
|
|
assignee: str | None = Field(default=None, max_length=128)
|
|
title: str | None = Field(default=None, max_length=512)
|
|
severity: str | None = Field(default=None, max_length=32)
|
|
|
|
|
|
class CaseCommentCreate(BaseModel):
|
|
comment: str = Field(min_length=1, max_length=2000)
|
|
author: str | None = Field(default=None, max_length=128)
|
|
|
|
|
|
class CaseComment(BaseModel):
|
|
id: int
|
|
case_id: int
|
|
comment: str
|
|
author: str | None
|
|
created_at: datetime
|
|
|
|
|
|
class CaseRecord(BaseModel):
|
|
id: int
|
|
incident_id: str
|
|
host: str | None
|
|
title: str
|
|
severity: str
|
|
assignee: str | None
|
|
status: CaseStatus
|
|
source_bucket: str | None
|
|
source_event_ts: str | None
|
|
evidence: dict | None
|
|
forensics: dict | None
|
|
created_at: datetime
|
|
updated_at: datetime
|