Skip to content

Commit 7e9900f

Browse files
mstoromstoro
authored
Merge pull request #11 from CiscoSecurity/develop
Release 1.0.0
2 parents bd296c4 + 5733be8 commit 7e9900f

40 files changed

+2442
-1
lines changed

‎.dockerignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
code/tests
2+
code/observables.json

‎.gitignore

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# macOS
2+
.DS_Store
3+
4+
# PyCharm
5+
.idea/
6+
7+
# Python
8+
__pycache__/
9+
venv/
10+
11+
# dotenv
12+
.env

‎Dockerfile

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
FROM alpine:3.14
2+
LABEL maintainer="Ian Redden <iaredden@cisco.com>"
3+
4+
ENV PIP_IGNORE_INSTALLED 1
5+
6+
# install packages we need
7+
RUN apk update && apk add --no-cache musl-dev openssl-dev gcc py3-configobj \
8+
supervisor libffi-dev uwsgi-python3 uwsgi-http jq syslog-ng uwsgi-syslog \
9+
py3-pip python3-dev
10+
11+
# do the Python dependencies
12+
ADD code /app
13+
ADD code/Pipfile code/Pipfile.lock /
14+
RUN set -ex && pip install --no-cache-dir --upgrade pipenv && \
15+
pipenv install --system
16+
RUN chown -R uwsgi.uwsgi /etc/uwsgi
17+
18+
# copy over scripts to init
19+
ADD scripts /
20+
RUN mv /uwsgi.ini /etc/uwsgi
21+
RUN chmod +x /*.sh
22+
23+
# entrypoint
24+
ENTRYPOINT ["/entrypoint.sh"]
25+
CMD ["/start.sh"]

‎Jenkinsfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
@Library('softserve-jenkins-library@main') _
2+
3+
startPipeline()

‎LICENSE.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
2+
The MIT License (MIT)
3+
4+
Copyright (c) 2021 Cisco SecureX
5+
6+
Permission is hereby granted, free of charge, to any person obtaining a copy
7+
of this software and associated documentation files (the "Software"), to deal
8+
in the Software without restriction, including without limitation the rights
9+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
copies of the Software, and to permit persons to whom the Software is
11+
furnished to do so, subject to the following conditions:
12+
13+
The above copyright notice and this permission notice shall be included in all
14+
copies or substantial portions of the Software.
15+
16+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
SOFTWARE.

‎README.md

Lines changed: 101 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,101 @@
1-
placeholder
1+
[![Gitter Chat](https://img.shields.io/badge/gitter-join%20chat-brightgreen.svg)](https://gitter.im/CiscoSecurity/Threat-Response "Gitter Chat")
2+
3+
# Docker Relay Template (Cisco Hosted)
4+
5+
A Cisco SecureX Concrete Relay implementation using [CyberScan](https://www.cyberscan.io/)
6+
as a third-party Cyber Threat Intelligence service provider.
7+
8+
The Relay itself is just a simple application written in Python that can be
9+
easily packaged and deployed in docker container.
10+
11+
## Rationale
12+
13+
- We need an application that will translate API requests from SecureX Threat Response to the third-party integration, and vice versa.
14+
- We need an application that can be completely self-contained within a virtualized container using Docker.
15+
16+
## Testing (Optional)
17+
18+
Open the code folder in your terminal.
19+
```
20+
cd code
21+
```
22+
23+
If you want to test the application you have to install dependencies from the [Pipfile](code/Pipfile) file:
24+
```
25+
pip install --no-cache-dir --upgrade pipenv && pipenv install --dev
26+
```
27+
28+
You can perform two kinds of testing:
29+
30+
- Run static code analysis checking for any semantic discrepancies and
31+
[PEP 8](https://www.python.org/dev/peps/pep-0008/) compliance:
32+
33+
`flake8 .`
34+
35+
- Run the suite of unit tests and measure the code coverage:
36+
37+
`coverage run --source api/ -m pytest --verbose tests/unit/ && coverage report`
38+
39+
### Building the Docker Container
40+
In order to build the application, we need to use a `Dockerfile`.
41+
42+
1. Open a terminal. Build the container image using the `docker build` command.
43+
44+
```
45+
docker build -t tr-05-cyberscan .
46+
```
47+
48+
2. Once the container is built, and an image is successfully created, start your container using the `docker run` command and specify the name of the image we have just created. By default, the container will listen for HTTP requests using port 9090.
49+
50+
```
51+
docker run -dp 9090:9090 --name tr-05-cyberscan tr-05-cyberscan
52+
```
53+
54+
3. Watch the container logs to ensure it starts correctly.
55+
56+
```
57+
docker logs tr-05-cyberscan
58+
```
59+
60+
4. Once the container has started correctly, open your web browser to http://localhost:9090. You should see a response from the container.
61+
62+
```
63+
curl http://localhost:9090
64+
```
65+
66+
## Implementation Details
67+
68+
This application was developed and tested under Python version 3.9.
69+
70+
### Implemented Relay Endpoints
71+
72+
- `POST /health`
73+
- Verifies the Authorization Bearer JWT and decodes it to restore the original
74+
credentials.
75+
- Authenticates to the underlying external service to check that the provided
76+
credentials are valid and the service is available at the moment.
77+
78+
79+
- `POST /observe/observables`
80+
- Accepts a list of observables and filters out unsupported ones.
81+
- Verifies the Authorization Bearer JWT and decodes it to restore the original credentials.
82+
- Makes a series of requests to the underlying external service to query for some
83+
cyber threat intelligence data on each supported observable.
84+
- Maps the fetched data into appropriate CTIM entities.
85+
- Returns a list per each of the following CTIM entities (if any extracted):
86+
- `Sighting`
87+
88+
89+
- `POST /refer/observables`
90+
- Accepts a list of observables and filters out unsupported ones.
91+
- Builds a search link per each supported observable to pivot back to the underlying external service and look up the observable there.
92+
- Returns a list of those links.
93+
94+
95+
- `POST /version`
96+
- Returns the current version of the application
97+
98+
### Supported Types of Observables
99+
100+
- `ip`
101+
- `domain`

‎build.sh

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#! /usr/bin/env sh
2+
echo " .:|:.:|:. "
3+
echo " C I S C O "
4+
echo " SecureX "
5+
echo
6+
echo " Development Dockerfile build script."
7+
echo
8+
9+
module_name="Docker relay"
10+
image_name="tr-05-docker-relay"
11+
12+
CONFIG_FILE=code/container_settings.json
13+
if [ -f $CONFIG_FILE ]; then
14+
echo
15+
echo "The configuration file (container_settings.json) already exists."
16+
echo
17+
version=`jq -r .VERSION code/container_settings.json`
18+
else
19+
read -p 'Version: ' version
20+
echo {\"VERSION\": \"$version\", \"NAME\": \"$module_name\"} > code/container_settings.json
21+
fi
22+
23+
echo " Integration Module: $module_name"
24+
echo " Version: $version"
25+
echo
26+
echo "Starting build process ..."
27+
echo
28+
docker build -t "$image_name:$version" .
29+
30+
echo
31+
echo "Please ensure you update module_type.json with correct url."
32+
echo

‎code/Pipfile

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[[source]]
2+
url = "https://pypi.org/simple"
3+
verify_ssl = true
4+
name = "pypi"
5+
6+
[packages]
7+
cryptography = "==3.3.2"
8+
Flask = "==2.0.1"
9+
marshmallow = "==3.12.1"
10+
requests = "==2.25.1"
11+
PyJWT = "==2.1.0"
12+
13+
[dev-packages]
14+
flake8 = "==3.9.2"
15+
coverage = "==5.5"
16+
pytest = "==6.2.4"
17+
18+
[requires]
19+
python_version = "3.9"

0 commit comments

Comments
 (0)