22

✏️ Editing: incident_sender.py

"""Send WordPress incidents to the correlation server."""

import json
import logging
from datetime import datetime
from typing import Any

from defence360agent.contracts.messages import SensorWordpressIncidentList
from defence360agent.contracts.plugins import MessageSink

logger = logging.getLogger(__name__)

class IncidentSender:
    """
    Send WordPress incidents to the correlation server.

WordPress incidents are already in the Incident table (visible to UI).
    This class sends them to correlation via Reportable messages, which are
    automatically handled by SendToServer/SendToServerFGW plugins.
    """

def _prepare_incident_for_correlation(
        self, incident: dict
    ) -> dict[str, Any]:
        """
        Prepare an incident for sending to the correlation server.

WordPress incidents use extra_info JSON field to store plugin-specific data.

Args:
            incident: WordpressIncident dictionary (with extra_info populated)

Returns:
            Dictionary formatted for correlation server
        """
        logger.info("Preparing incident for correlation: %s", incident)
        # JSONField automatically deserializes to dict, fallback to empty dict if None
        extra: dict = incident.get("extra_info") or {}

# Convert timestamp to int and format date
        timestamp_value: float = float(incident.get("timestamp") or 0)
        timestamp = int(timestamp_value)
        dt = (
            datetime.fromtimestamp(timestamp_value).strftime("%Y-%m-%d")
            if timestamp_value
            else ""
        )

return {
            "timestamp": timestamp,
            "dt": dt,
            "plugin_id": incident.get("plugin"),
            "rule": incident.get("rule") or "unknown",
            "name": incident.get("name"),
            "message": incident.get("description"),
            "severity": incident.get("severity"),
            "attackers_ip": incident.get("abuser") or "",
            "domain": incident.get("domain") or "",
            "retries": incident.get("retries") or 1,
            "uri": extra.get("request_uri") or "",
            "user_agent": extra.get("http_user_agent") or "",
            "http_method": extra.get("request_method") or "",
            "user_logged_in": extra.get("user_logged_in") == "true"
            if extra.get("user_logged_in")
            else None,
            "file_path": extra.get("site_path") or "",
            "user": extra.get("username") or "",
            "tag": self._build_tags(extra),
            # Include WordPress-specific fields
            "target": extra.get("target") or "",
            "slug": extra.get("slug") or "",
            "version": extra.get("version") or "",
            "mode": extra.get("mode") or "",
            "details": extra,
        }

def _build_tags(self, extra: dict) -> list[str]:
        tags = ["wordpress", "cve"]

if extra.get("cve"):
            tags.append(extra["cve"])
        if extra.get("target"):
            tags.append(f"target_{extra['target']}")
        if extra.get("mode"):
            tags.append(f"mode_{extra['mode']}")

return tags

async def send_incidents(
        self, sink: MessageSink | None, incidents: list[dict]
    ) -> int:
        """
        Send WordPress incidents to the correlation server.

Since incidents are already in the WordpressIncident table (visible to UI),
        we just need to send them to correlation.

Args:
            incidents: List of incidents to send

Returns:
            Number of incidents sent
        """
        if sink is None:
            logger.warning("No sink provided, skipping incident sending")
            return 0

if len(incidents) == 0:
            logger.debug("No incidents to send, skipping")
            return 0

logger.info(
            "Sending %d incidents to correlation server", len(incidents)
        )

correlation_batch = [
            self._prepare_incident_for_correlation(incident)
            for incident in incidents
        ]

await self._send_batch(sink, correlation_batch)

return len(correlation_batch)

async def _send_batch(
        self, sink: MessageSink, correlation_batch: list[dict]
    ):
        """
        Send a batch of incidents to correlation server.

Uses SensorIncidentList Reportable message which is automatically
        sent to correlation via SendToServer/SendToServerFGW plugins.

Args:
            sink: MessageSink to send the batch to
            correlation_batch: Incidents formatted for correlation server
        """
        logger.info(
            "Sending batch of %d incidents to correlation server",
            len(correlation_batch),
        )
        logger.info(
            "Correlation batch json: %s",
            json.dumps(correlation_batch, indent=2),
        )
        try:
            # Send as a Reportable message
            # The SendToServer/SendToServerFGW plugin will handle actual delivery
            await sink.process_message(
                SensorWordpressIncidentList(correlation_batch)
            )

logger.info(
                "Queued %d wordpress incident(s) for correlation server",
                len(correlation_batch),
            )

except Exception as e:
            logger.error(
                "Failed to queue incident batch: %s",
                e,
            )
            raise

MR SKB