Create import and export scripts

[Mikhail]

Create import and export scripts

[mrblacyk]

Not dependent Entities:

• Response Actions
• Mitigation Systems
• Mitigation Policies
• Hardening Policies (but I asked on our chat why it's not a list of Mitigation Policies so to be confirmed)
• Logging Policies
• Detection Rules (Sigma)
• Triggers

Dependent Entities:

• Enrichment (with itself)
• Response Playbooks (with Response Actions)
• Data Needed (with Logging Policies)
• Customer (with Data Needed, Logging Policies and Detection Rules)

mrblacyk takes:

• Response Actions
• Mitigation Systems
• Mitigation Policies
• Hardening Policies
• Enrichment (with itself)
• Response Playbooks (with Response Actions)

AverageS takes:

• Logging Policies
• Detection Rules (Sigma)
• Triggers
• Data Needed (with Logging Policies)
• Customer (with Data Needed, Logging Policies and Detection Rules)

[Mikhail]

I made examples of detection rule export ( with a set of associated data needed ).
I also made an example of how additional actions should look like:

This is detection rule upload

import requests
import yaml
from atcutils import ATCutils
import os

def export_dr(path_to_dr):

    dr = ATCutils.read_yaml_file(path_to_dr)
    dn = ATCutils.main_dn_calculatoin_func(path_to_dr)
    dr['data_needed_names'] = dn
    r = requests.post('http://127.0.0.1:8000/api/v0/atc/detectionrule/', data=dr)
    print(r)

if  __name__=='__main__':
    path = '../detection_rules/sigma/rules/apt/'
    for file in os.listdir(path):
        export_dr(f'{path}/{file}')

This is how additional actions should look like:

    @action(detail=True, methods=['get'])
    def markdown(self, request, pk):
        """
        Function wich will return Respnse with markdown inside
        :param request: 
        :param pk: 
        :return: 
        """
        pass

[mrblacyk]

Not valid anymore due to change in team.