706 lines
23 KiB
PHP
706 lines
23 KiB
PHP
<?php
|
|
/*
|
|
* Plugin SIEM-Wazuh pour GLPI
|
|
* Classe de gestion des alertes Wazuh
|
|
*/
|
|
|
|
if (!defined('GLPI_ROOT')) {
|
|
die("Sorry. You can't access this file directly");
|
|
}
|
|
|
|
class PluginSiemWazuhAlert extends CommonDBTM {
|
|
|
|
public $dohistory = true;
|
|
|
|
static $rightname = 'plugin_siem_wazuh_alert';
|
|
|
|
const MATRIX_FIELD = '';
|
|
const SEARCHOPTIONS_INHERITANCE = true;
|
|
|
|
/**
|
|
* Return the localized name of the current Type
|
|
*/
|
|
static function getTypeName($nb = 0) {
|
|
return _n('Wazuh Alert', 'Wazuh Alerts', $nb, 'siem-wazuh');
|
|
}
|
|
|
|
/**
|
|
* Define search options
|
|
*/
|
|
function rawSearchOptions() {
|
|
$tab = [];
|
|
|
|
$tab[] = [
|
|
'id' => 'common',
|
|
'name' => __('Characteristics')
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '1',
|
|
'table' => $this->getTable(),
|
|
'field' => 'alert_id',
|
|
'name' => __('Alert ID', 'siem-wazuh'),
|
|
'datatype' => 'itemlink',
|
|
'massiveaction' => false
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '2',
|
|
'table' => 'glpi_plugin_siem_wazuh_servers',
|
|
'field' => 'name',
|
|
'name' => __('Wazuh Server', 'siem-wazuh'),
|
|
'datatype' => 'dropdown',
|
|
'massiveaction' => false,
|
|
'linkfield' => 'wazuh_server_id'
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '3',
|
|
'table' => $this->getTable(),
|
|
'field' => 'rule_id',
|
|
'name' => __('Rule ID', 'siem-wazuh'),
|
|
'datatype' => 'integer',
|
|
'massiveaction' => false
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '4',
|
|
'table' => $this->getTable(),
|
|
'field' => 'rule_level',
|
|
'name' => __('Rule Level', 'siem-wazuh'),
|
|
'datatype' => 'integer',
|
|
'massiveaction' => false
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '5',
|
|
'table' => $this->getTable(),
|
|
'field' => 'rule_description',
|
|
'name' => __('Rule Description', 'siem-wazuh'),
|
|
'datatype' => 'text',
|
|
'massiveaction' => false
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '6',
|
|
'table' => $this->getTable(),
|
|
'field' => 'agent_name',
|
|
'name' => __('Agent Name', 'siem-wazuh'),
|
|
'datatype' => 'string',
|
|
'massiveaction' => false
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '7',
|
|
'table' => $this->getTable(),
|
|
'field' => 'agent_ip',
|
|
'name' => __('Agent IP', 'siem-wazuh'),
|
|
'datatype' => 'string',
|
|
'massiveaction' => false
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '8',
|
|
'table' => $this->getTable(),
|
|
'field' => 'timestamp',
|
|
'name' => __('Alert Timestamp', 'siem-wazuh'),
|
|
'datatype' => 'datetime',
|
|
'massiveaction' => false
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '9',
|
|
'table' => $this->getTable(),
|
|
'field' => 'status',
|
|
'name' => __('Status'),
|
|
'datatype' => 'specific',
|
|
'searchtype' => 'equals',
|
|
'massiveaction' => true
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '10',
|
|
'table' => $this->getTable(),
|
|
'field' => 'severity',
|
|
'name' => __('Severity', 'siem-wazuh'),
|
|
'datatype' => 'specific',
|
|
'searchtype' => 'equals',
|
|
'massiveaction' => true
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '11',
|
|
'table' => 'glpi_computers',
|
|
'field' => 'name',
|
|
'name' => __('Associated Computer', 'siem-wazuh'),
|
|
'datatype' => 'dropdown',
|
|
'massiveaction' => false,
|
|
'linkfield' => 'computer_id'
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '12',
|
|
'table' => 'glpi_networkequipments',
|
|
'field' => 'name',
|
|
'name' => __('Associated Network Equipment', 'siem-wazuh'),
|
|
'datatype' => 'dropdown',
|
|
'massiveaction' => false,
|
|
'linkfield' => 'networkequipment_id'
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '13',
|
|
'table' => 'glpi_tickets',
|
|
'field' => 'name',
|
|
'name' => __('Associated Ticket', 'siem-wazuh'),
|
|
'datatype' => 'dropdown',
|
|
'massiveaction' => false,
|
|
'linkfield' => 'ticket_id'
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '30',
|
|
'table' => $this->getTable(),
|
|
'field' => 'date_creation',
|
|
'name' => __('Creation date'),
|
|
'datatype' => 'datetime',
|
|
'massiveaction' => false
|
|
];
|
|
|
|
$tab[] = [
|
|
'id' => '31',
|
|
'table' => $this->getTable(),
|
|
'field' => 'date_mod',
|
|
'name' => __('Last update'),
|
|
'datatype' => 'datetime',
|
|
'massiveaction' => false
|
|
];
|
|
|
|
return $tab;
|
|
}
|
|
|
|
/**
|
|
* Display specific values
|
|
*/
|
|
static function getSpecificValueToDisplay($field, $values, array $options = []) {
|
|
if (!is_array($values)) {
|
|
$values = [$field => $values];
|
|
}
|
|
|
|
switch ($field) {
|
|
case 'status':
|
|
$statuses = self::getStatusArray();
|
|
return $statuses[$values[$field]] ?? $values[$field];
|
|
|
|
case 'severity':
|
|
$severities = self::getSeverityArray();
|
|
return $severities[$values[$field]] ?? $values[$field];
|
|
}
|
|
|
|
return parent::getSpecificValueToDisplay($field, $values, $options);
|
|
}
|
|
|
|
/**
|
|
* Get status array
|
|
*/
|
|
static function getStatusArray() {
|
|
return [
|
|
'new' => __('New', 'siem-wazuh'),
|
|
'processed' => __('Processed', 'siem-wazuh'),
|
|
'ignored' => __('Ignored', 'siem-wazuh'),
|
|
'ticket_created' => __('Ticket Created', 'siem-wazuh')
|
|
];
|
|
}
|
|
|
|
/**
|
|
* Get severity array
|
|
*/
|
|
static function getSeverityArray() {
|
|
return [
|
|
'low' => __('Low', 'siem-wazuh'),
|
|
'medium' => __('Medium', 'siem-wazuh'),
|
|
'high' => __('High', 'siem-wazuh'),
|
|
'critical' => __('Critical', 'siem-wazuh')
|
|
];
|
|
}
|
|
|
|
/**
|
|
* Display form
|
|
*/
|
|
function showForm($ID, $options = []) {
|
|
$this->initForm($ID, $options);
|
|
$this->showFormHeader($options);
|
|
|
|
echo "<tr class='tab_bg_1'>";
|
|
echo "<td>".__('Alert ID', 'siem-wazuh')."</td>";
|
|
echo "<td>".$this->fields["alert_id"]."</td>";
|
|
echo "<td>".__('Rule ID', 'siem-wazuh')."</td>";
|
|
echo "<td>".$this->fields["rule_id"]."</td>";
|
|
echo "</tr>";
|
|
|
|
echo "<tr class='tab_bg_1'>";
|
|
echo "<td>".__('Rule Level', 'siem-wazuh')."</td>";
|
|
echo "<td>";
|
|
echo $this->fields["rule_level"];
|
|
if ($this->fields["rule_level"]) {
|
|
$severity = self::getSeverityFromLevel($this->fields["rule_level"]);
|
|
$severities = self::getSeverityArray();
|
|
echo " <span class='badge severity-$severity'>".$severities[$severity]."</span>";
|
|
}
|
|
echo "</td>";
|
|
echo "<td>".__('Agent Name', 'siem-wazuh')."</td>";
|
|
echo "<td>".$this->fields["agent_name"]."</td>";
|
|
echo "</tr>";
|
|
|
|
echo "<tr class='tab_bg_1'>";
|
|
echo "<td>".__('Agent IP', 'siem-wazuh')."</td>";
|
|
echo "<td>".$this->fields["agent_ip"]."</td>";
|
|
echo "<td>".__('Timestamp', 'siem-wazuh')."</td>";
|
|
echo "<td>".Html::convDateTime($this->fields["timestamp"])."</td>";
|
|
echo "</tr>";
|
|
|
|
echo "<tr class='tab_bg_1'>";
|
|
echo "<td>".__('Status')."</td>";
|
|
echo "<td>";
|
|
$statuses = self::getStatusArray();
|
|
Dropdown::showFromArray('status', $statuses, ['value' => $this->fields["status"]]);
|
|
echo "</td>";
|
|
echo "<td>".__('Severity', 'siem-wazuh')."</td>";
|
|
echo "<td>";
|
|
$severities = self::getSeverityArray();
|
|
Dropdown::showFromArray('severity', $severities, ['value' => $this->fields["severity"]]);
|
|
echo "</td>";
|
|
echo "</tr>";
|
|
|
|
echo "<tr class='tab_bg_1'>";
|
|
echo "<td>".__('Rule Description', 'siem-wazuh')."</td>";
|
|
echo "<td colspan='3'>";
|
|
echo nl2br(Html::entities_deep($this->fields["rule_description"]));
|
|
echo "</td>";
|
|
echo "</tr>";
|
|
|
|
// Affichage des associations
|
|
if ($this->fields["computer_id"]) {
|
|
$computer = new Computer();
|
|
$computer->getFromDB($this->fields["computer_id"]);
|
|
echo "<tr class='tab_bg_1'>";
|
|
echo "<td>".__('Associated Computer')."</td>";
|
|
echo "<td>";
|
|
echo $computer->getLink();
|
|
echo "</td>";
|
|
echo "<td></td><td></td>";
|
|
echo "</tr>";
|
|
}
|
|
|
|
if ($this->fields["networkequipment_id"]) {
|
|
$netequip = new NetworkEquipment();
|
|
$netequip->getFromDB($this->fields["networkequipment_id"]);
|
|
echo "<tr class='tab_bg_1'>";
|
|
echo "<td>".__('Associated Network Equipment')."</td>";
|
|
echo "<td>";
|
|
echo $netequip->getLink();
|
|
echo "</td>";
|
|
echo "<td></td><td></td>";
|
|
echo "</tr>";
|
|
}
|
|
|
|
if ($this->fields["ticket_id"]) {
|
|
$ticket = new Ticket();
|
|
$ticket->getFromDB($this->fields["ticket_id"]);
|
|
echo "<tr class='tab_bg_1'>";
|
|
echo "<td>".__('Associated Ticket')."</td>";
|
|
echo "<td>";
|
|
echo $ticket->getLink();
|
|
echo "</td>";
|
|
echo "<td></td><td></td>";
|
|
echo "</tr>";
|
|
}
|
|
|
|
// Affichage des données brutes
|
|
if (!empty($this->fields["raw_data"])) {
|
|
echo "<tr class='tab_bg_1'>";
|
|
echo "<td colspan='4'>";
|
|
echo "<details>";
|
|
echo "<summary>".__('Raw Alert Data', 'siem-wazuh')."</summary>";
|
|
echo "<pre class='json-data'>";
|
|
echo json_encode(json_decode($this->fields["raw_data"]), JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE);
|
|
echo "</pre>";
|
|
echo "</details>";
|
|
echo "</td>";
|
|
echo "</tr>";
|
|
}
|
|
|
|
$this->showFormButtons($options);
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Process alerts from Wazuh API
|
|
*/
|
|
function processAlerts($server_id, $alerts_data) {
|
|
$processed = 0;
|
|
$config = new PluginSiemWazuhConfig();
|
|
|
|
foreach ($alerts_data as $alert_data) {
|
|
$alert_id = $alert_data['id'] ?? $alert_data['_id'] ?? null;
|
|
if (!$alert_id) continue;
|
|
|
|
// Vérifier si l'alerte existe déjà
|
|
if ($this->getFromDBByCrit([
|
|
'wazuh_server_id' => $server_id,
|
|
'alert_id' => $alert_id
|
|
])) {
|
|
continue; // Alerte déjà traitée
|
|
}
|
|
|
|
// Extraire les informations de l'alerte
|
|
$rule_id = $alert_data['rule']['id'] ?? null;
|
|
$rule_level = $alert_data['rule']['level'] ?? 0;
|
|
$rule_description = $alert_data['rule']['description'] ?? '';
|
|
$agent_name = $alert_data['agent']['name'] ?? '';
|
|
$agent_ip = $alert_data['agent']['ip'] ?? '';
|
|
$timestamp = $alert_data['timestamp'] ?? $alert_data['@timestamp'] ?? date('Y-m-d H:i:s');
|
|
|
|
// Convertir le timestamp au format MySQL
|
|
if (strpos($timestamp, 'T') !== false) {
|
|
$timestamp = str_replace('T', ' ', substr($timestamp, 0, 19));
|
|
}
|
|
|
|
// Déterminer la sévérité
|
|
$severity = self::getSeverityFromLevel($rule_level);
|
|
|
|
// Créer l'alerte
|
|
$alert_input = [
|
|
'wazuh_server_id' => $server_id,
|
|
'alert_id' => $alert_id,
|
|
'rule_id' => $rule_id,
|
|
'rule_level' => $rule_level,
|
|
'rule_description' => $rule_description,
|
|
'agent_id' => $alert_data['agent']['id'] ?? '',
|
|
'agent_name' => $agent_name,
|
|
'agent_ip' => $agent_ip,
|
|
'timestamp' => $timestamp,
|
|
'raw_data' => json_encode($alert_data),
|
|
'severity' => $severity,
|
|
'status' => 'new'
|
|
];
|
|
|
|
// Tenter d'associer avec un asset
|
|
$this->associateWithAsset($alert_input, $agent_name, $agent_ip);
|
|
|
|
if ($alert_id = $this->add($alert_input)) {
|
|
$processed++;
|
|
|
|
// Créer automatiquement un ticket si configuré
|
|
if ($config->getConfiguration('auto_create_ticket', 1)) {
|
|
$this->createTicketFromAlert($alert_id);
|
|
}
|
|
}
|
|
}
|
|
|
|
return $processed;
|
|
}
|
|
|
|
/**
|
|
* Associate alert with GLPI asset
|
|
*/
|
|
private function associateWithAsset(&$alert_input, $agent_name, $agent_ip) {
|
|
global $DB;
|
|
|
|
// Recherche par nom d'agent
|
|
if (!empty($agent_name)) {
|
|
// Recherche dans les ordinateurs
|
|
$computer = $DB->request([
|
|
'SELECT' => ['id'],
|
|
'FROM' => 'glpi_computers',
|
|
'WHERE' => [
|
|
'name' => $agent_name,
|
|
'is_deleted' => 0
|
|
],
|
|
'LIMIT' => 1
|
|
])->current();
|
|
|
|
if ($computer) {
|
|
$alert_input['computer_id'] = $computer['id'];
|
|
return;
|
|
}
|
|
|
|
// Recherche dans les équipements réseau
|
|
$netequip = $DB->request([
|
|
'SELECT' => ['id'],
|
|
'FROM' => 'glpi_networkequipments',
|
|
'WHERE' => [
|
|
'name' => $agent_name,
|
|
'is_deleted' => 0
|
|
],
|
|
'LIMIT' => 1
|
|
])->current();
|
|
|
|
if ($netequip) {
|
|
$alert_input['networkequipment_id'] = $netequip['id'];
|
|
return;
|
|
}
|
|
}
|
|
|
|
// Recherche par adresse IP
|
|
if (!empty($agent_ip)) {
|
|
// Recherche dans les ports réseau
|
|
$port = $DB->request([
|
|
'SELECT' => ['items_id', 'itemtype'],
|
|
'FROM' => 'glpi_networkports',
|
|
'INNER JOIN' => [
|
|
'glpi_ipaddresses' => [
|
|
'ON' => [
|
|
'glpi_networkports' => 'id',
|
|
'glpi_ipaddresses' => 'items_id'
|
|
]
|
|
]
|
|
],
|
|
'WHERE' => [
|
|
'glpi_ipaddresses.name' => $agent_ip,
|
|
'glpi_ipaddresses.itemtype' => 'NetworkPort'
|
|
],
|
|
'LIMIT' => 1
|
|
])->current();
|
|
|
|
if ($port) {
|
|
if ($port['itemtype'] == 'Computer') {
|
|
$alert_input['computer_id'] = $port['items_id'];
|
|
} elseif ($port['itemtype'] == 'NetworkEquipment') {
|
|
$alert_input['networkequipment_id'] = $port['items_id'];
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Create ticket from alert
|
|
*/
|
|
function createTicketFromAlert($alert_id) {
|
|
if (!$this->getFromDB($alert_id)) {
|
|
return false;
|
|
}
|
|
|
|
$server = new PluginSiemWazuhServer();
|
|
if (!$server->getFromDB($this->fields['wazuh_server_id'])) {
|
|
return false;
|
|
}
|
|
|
|
$ticket = new Ticket();
|
|
$config = new PluginSiemWazuhConfig();
|
|
|
|
// Déterminer la priorité basée sur le niveau de règle
|
|
$priority = self::getPriorityFromLevel($this->fields['rule_level']);
|
|
|
|
$ticket_input = [
|
|
'name' => sprintf(__('Wazuh Alert: %s', 'siem-wazuh'), $this->fields['rule_description']),
|
|
'content' => $this->generateTicketContent(),
|
|
'type' => $server->fields['ticket_type'] ?: 1,
|
|
'itilcategories_id' => $server->fields['ticket_category'],
|
|
'priority' => $priority,
|
|
'urgency' => $priority,
|
|
'impact' => $priority,
|
|
'status' => CommonITILObject::INCOMING,
|
|
'_add_validation' => 0
|
|
];
|
|
|
|
// Associer le ticket à l'asset si trouvé
|
|
if ($this->fields['computer_id']) {
|
|
$ticket_input['_link']['items_id'] = $this->fields['computer_id'];
|
|
$ticket_input['_link']['itemtype'] = 'Computer';
|
|
} elseif ($this->fields['networkequipment_id']) {
|
|
$ticket_input['_link']['items_id'] = $this->fields['networkequipment_id'];
|
|
$ticket_input['_link']['itemtype'] = 'NetworkEquipment';
|
|
}
|
|
|
|
$ticket_id = $ticket->add($ticket_input);
|
|
|
|
if ($ticket_id) {
|
|
// Mettre à jour l'alerte
|
|
$this->update([
|
|
'id' => $alert_id,
|
|
'ticket_id' => $ticket_id,
|
|
'status' => 'ticket_created'
|
|
]);
|
|
|
|
return $ticket_id;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Generate ticket content from alert
|
|
*/
|
|
private function generateTicketContent() {
|
|
$content = "[WAZUH-ALERT]\n\n";
|
|
$content .= sprintf(__('Alert ID: %s', 'siem-wazuh'), $this->fields['alert_id']) . "\n";
|
|
$content .= sprintf(__('Rule ID: %s', 'siem-wazuh'), $this->fields['rule_id']) . "\n";
|
|
$content .= sprintf(__('Rule Level: %s', 'siem-wazuh'), $this->fields['rule_level']) . "\n";
|
|
$content .= sprintf(__('Agent: %s (%s)', 'siem-wazuh'), $this->fields['agent_name'], $this->fields['agent_ip']) . "\n";
|
|
$content .= sprintf(__('Timestamp: %s', 'siem-wazuh'), $this->fields['timestamp']) . "\n\n";
|
|
$content .= sprintf(__('Description: %s', 'siem-wazuh'), $this->fields['rule_description']) . "\n\n";
|
|
|
|
if ($this->fields['raw_data']) {
|
|
$content .= __('Raw Alert Data:', 'siem-wazuh') . "\n";
|
|
$content .= "```json\n";
|
|
$content .= json_encode(json_decode($this->fields['raw_data']), JSON_PRETTY_PRINT);
|
|
$content .= "\n```";
|
|
}
|
|
|
|
return $content;
|
|
}
|
|
|
|
/**
|
|
* Get severity from rule level
|
|
*/
|
|
static function getSeverityFromLevel($level) {
|
|
if ($level >= 12) return 'critical';
|
|
if ($level >= 10) return 'high';
|
|
if ($level >= 7) return 'medium';
|
|
return 'low';
|
|
}
|
|
|
|
/**
|
|
* Get priority from rule level
|
|
*/
|
|
static function getPriorityFromLevel($level) {
|
|
if ($level >= 12) return 5; // Very high
|
|
if ($level >= 10) return 4; // High
|
|
if ($level >= 7) return 3; // Medium
|
|
if ($level >= 5) return 2; // Low
|
|
return 1; // Very low
|
|
}
|
|
|
|
/**
|
|
* Show alerts for a server
|
|
*/
|
|
static function showForServer($server_id) {
|
|
global $DB;
|
|
|
|
$iterator = $DB->request([
|
|
'FROM' => 'glpi_plugin_siem_wazuh_alerts',
|
|
'WHERE' => ['wazuh_server_id' => $server_id],
|
|
'ORDER' => 'timestamp DESC',
|
|
'LIMIT' => 50
|
|
]);
|
|
|
|
echo "<div class='spaced'>";
|
|
echo "<table class='tab_cadre_fixehov'>";
|
|
echo "<tr class='tab_bg_2'>";
|
|
echo "<th>".__('Alert ID', 'siem-wazuh')."</th>";
|
|
echo "<th>".__('Rule', 'siem-wazuh')."</th>";
|
|
echo "<th>".__('Level', 'siem-wazuh')."</th>";
|
|
echo "<th>".__('Agent', 'siem-wazuh')."</th>";
|
|
echo "<th>".__('Timestamp', 'siem-wazuh')."</th>";
|
|
echo "<th>".__('Status')."</th>";
|
|
echo "<th>".__('Ticket')."</th>";
|
|
echo "</tr>";
|
|
|
|
$statuses = self::getStatusArray();
|
|
|
|
foreach ($iterator as $row) {
|
|
echo "<tr class='tab_bg_1'>";
|
|
echo "<td><a href='".PluginSiemWazuhAlert::getFormURLWithID($row['id'])."'>".$row['alert_id']."</a></td>";
|
|
echo "<td>".$row['rule_id']." - ".Html::clean($row['rule_description'])."</td>";
|
|
echo "<td>".$row['rule_level']."</td>";
|
|
echo "<td>".$row['agent_name']." (".$row['agent_ip'].")</td>";
|
|
echo "<td>".Html::convDateTime($row['timestamp'])."</td>";
|
|
echo "<td>".$statuses[$row['status']]."</td>";
|
|
echo "<td>";
|
|
if ($row['ticket_id']) {
|
|
$ticket = new Ticket();
|
|
if ($ticket->getFromDB($row['ticket_id'])) {
|
|
echo $ticket->getLink();
|
|
}
|
|
}
|
|
echo "</td>";
|
|
echo "</tr>";
|
|
}
|
|
|
|
echo "</table>";
|
|
echo "</div>";
|
|
}
|
|
|
|
/**
|
|
* Cron function to sync alerts
|
|
*/
|
|
static function cronSyncAlerts($task = null) {
|
|
global $DB;
|
|
|
|
$config = new PluginSiemWazuhConfig();
|
|
if (!$config->getConfiguration('sync_enabled', 1)) {
|
|
return 0; // Synchronisation désactivée
|
|
}
|
|
|
|
$iterator = $DB->request([
|
|
'FROM' => 'glpi_plugin_siem_wazuh_servers',
|
|
'WHERE' => ['is_active' => 1]
|
|
]);
|
|
|
|
$total_processed = 0;
|
|
|
|
foreach ($iterator as $server_data) {
|
|
$server = new PluginSiemWazuhServer();
|
|
$server->fields = $server_data;
|
|
|
|
$result = $server->syncAlerts();
|
|
if ($result['success']) {
|
|
$matches = [];
|
|
if (preg_match('/(\d+)/', $result['message'], $matches)) {
|
|
$total_processed += (int)$matches[1];
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($task) {
|
|
$task->addVolume($total_processed);
|
|
return 1;
|
|
}
|
|
|
|
return $total_processed;
|
|
}
|
|
|
|
/**
|
|
* Cron function to cleanup old alerts
|
|
*/
|
|
static function cronCleanupOldAlerts($task = null) {
|
|
global $DB;
|
|
|
|
$config = new PluginSiemWazuhConfig();
|
|
$retention_days = $config->getConfiguration('alert_retention_days', 90);
|
|
|
|
$query = "DELETE FROM glpi_plugin_siem_wazuh_alerts
|
|
WHERE date_creation < DATE_SUB(NOW(), INTERVAL $retention_days DAY)";
|
|
|
|
$result = $DB->query($query);
|
|
$deleted = $DB->affectedRows();
|
|
|
|
if ($task) {
|
|
$task->addVolume($deleted);
|
|
return 1;
|
|
}
|
|
|
|
return $deleted;
|
|
}
|
|
|
|
/**
|
|
* Get menu content
|
|
*/
|
|
static function getMenuContent() {
|
|
$menu = [];
|
|
if (Session::haveRight(static::$rightname, READ)) {
|
|
$menu['title'] = self::getMenuName();
|
|
$menu['page'] = "/plugins/siem-wazuh/front/wazuhalert.php";
|
|
$menu['links']['search'] = "/plugins/siem-wazuh/front/wazuhalert.php";
|
|
}
|
|
return $menu;
|
|
}
|
|
|
|
/**
|
|
* Get menu name
|
|
*/
|
|
static function getMenuName() {
|
|
return self::getTypeName(Session::getPluralNumber());
|
|
}
|
|
} |