§ „%±ñnJ¡ãó„—dZddlZddlZddlmZddlmZddlmZddlm Z ej e¦«ZGd„d¦«Z dS) z3Send WordPress incidents to the correlation server.éN)Údatetime)ÚAny)ÚSensorWordpressIncidentList)ÚMessageSinkcó—eZdZdZdedeeeffd„Zdedeefd„Z de dzd eedefd „Zde deefd„Z dS) ÚIncidentSendera Send WordPress incidents to the correlation server. WordPress incidents are already in the Incident table (visible to UI). This class sends them to correlation via Reportable messages, which are automatically handled by SendToServer/SendToServerFGW plugins. ÚincidentÚreturncóØ—t d|¦«| d¦«pi}t| d¦«pd¦«}t |¦«}|r'tj|¦« d¦«nd}id|“d|“d| d ¦«“d | d ¦«pd“d| d¦«“d | d¦«“d| d¦«“d| d¦«pd“d| d¦«pd“d| d¦«pd“d| d¦«pd“d| d¦«pd“d| d¦«pd“d| d¦«r| d¦«dknd“d| d¦«pd“d | d!¦«pd“d"| |¦«“| d#¦«pd| d$¦«pd| d%¦«pd| d&¦«pd|d'œ¥S)(aJ Prepare an incident for sending to the correlation server. WordPress incidents use extra_info JSON field to store plugin-specific data. Args: incident: WordpressIncident dictionary (with extra_info populated) Returns: Dictionary formatted for correlation server z&Preparing incident for correlation: %sÚ extra_infoÚ timestamprz%Y-%m-%dÚÚdtÚ plugin_idÚpluginÚruleÚunknownÚnameÚmessageÚdescriptionÚseverityÚattackers_ipÚabuserÚdomainÚretrieséÚuriÚrequest_uriÚ user_agentÚhttp_user_agentÚhttp_methodÚrequest_methodÚuser_logged_inÚtrueNÚ file_pathÚ site_pathÚuserÚusernameÚtagÚtargetÚslugÚversionÚmode)r*r+r,r-Údetails) ÚloggerÚinfoÚgetÚfloatÚintrÚ fromtimestampÚstrftimeÚ_build_tags)Úselfr ÚextraÚtimestamp_valuer rs ú^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/incident_sender.pyÚ!_prepare_incident_for_correlationz0IncidentSender._prepare_incident_for_correlationsÈ€õ ŠÐ<¸hÑGÔGÐGà—l’l <Ñ0Ô0Ð6°Bˆõ"' x§|¢|°KÑ'@Ô'@Ð'EÀAÑ!FÔ!FˆÝ˜Ñ(Ô(ˆ ðð HÔ" ?Ñ3Ô3×<Ò<¸ZÑHÔHÐHàð ð Ø˜ð à"ð ð ˜Ÿš hÑ/Ô/ð ð H—L’L Ñ(Ô(Ð5¨Ið ð H—L’L Ñ(Ô(ð ð x—|’| MÑ2Ô2ð ð ˜Ÿš ZÑ0Ô0ð ð ˜HŸLšL¨Ñ2Ô2Ð8°bð ð h—l’l 8Ñ,Ô,Ð2°ð ð x—|’| IÑ.Ô.Ð3°!ð ð 5—9’9˜]Ñ+Ô+Ð1¨rð ð ˜%Ÿ)š)Ð$5Ñ6Ô6Ð<¸"ð ð ˜5Ÿ9š9Ð%5Ñ6Ô6Ð<¸"ð ð ØyŠyÐ)Ñ*Ô*ð˜eŸišiÐ(8Ñ9Ô9¸VÒCÐCàð! ð" ˜Ÿš ;Ñ/Ô/Ð5°2ð# ð$ E—I’I˜jÑ)Ô)Ð/¨Rð% ð& 4×#Ò# EÑ*Ô*ð' ð*—i’i Ñ)Ô)Ð/¨RØ—I’I˜fÑ%Ô%Ð+¨Ø—y’y Ñ+Ô+Ð1¨rØ—I’I˜fÑ%Ô%Ð+¨Øð3 ð ð ð ór8có:—ddg}| d¦«r| |d¦«| d¦«r| d|d›¦«| d¦«r| d|d›¦«|S)NÚ wordpressÚcver*Útarget_r-Úmode_)r1Úappend)r7r8Útagss r:r6zIncidentSender._build_tagsNs¡€Ø˜UÐ#ˆà9Š9UÑÔð &ØKŠK˜˜eœÑ%Ô%Ð%Ø9Š9XÑÔð 5ØKŠKÐ3 %¨¤/Ð3Ð3Ñ4Ô4Ð4Ø9Š9VÑÔð 1ØKŠKÐ/ f¤ Ð/Ð/Ñ0Ô0Ð0àˆr<ÚsinkNÚ incidentscƒód‡K—|€t d¦«dSt|¦«dkrt d¦«dSt dt|¦«¦«ˆfd„|D¦«}‰ ||¦«ƒd{V—†t|¦«S)aC Send WordPress incidents to the correlation server. Since incidents are already in the WordpressIncident table (visible to UI), we just need to send them to correlation. Args: incidents: List of incidents to send Returns: Number of incidents sent Nz+No sink provided, skipping incident sendingrzNo incidents to send, skippingz*Sending %d incidents to correlation servercó:•—g|]}‰ |¦«‘ŒS©)r;)Ú.0r r7s €r:ú z1IncidentSender.send_incidents..us7ø€ð ð ð àð ×2Ò2°8Ñ<Ô<ð ð ð r<)r/ÚwarningÚlenÚdebugr0Ú_send_batch)r7rDrEÚcorrelation_batchs` r:Úsend_incidentszIncidentSender.send_incidentsZsÓøèè€ðˆ<ÝNŠNÐHÑIÔIÐIØ1åˆy‰>Œ>˜QÒÐÝLŠLÐ9Ñ:Ô:Ð:Ø1åŠØ8½#¸i¹.¼.ñ ô ð ð ð ð ð à%ð ñ ô Ðð ×Ò˜tÐ%6Ñ7Ô7Ð7Ð7Ð7Ð7Ð7Ð7Ð7åÐ$Ñ%Ô%Ð%r<rOcƒó¶K—t dt|¦«¦«t dtj|d¬¦«¦« | t |¦«¦«ƒd{V—†t dt|¦«¦«dS#t$r!}t d|¦«‚d}~wwxYw)a_ Send a batch of incidents to correlation server. Uses SensorIncidentList Reportable message which is automatically sent to correlation via SendToServer/SendToServerFGW plugins. Args: sink: MessageSink to send the batch to correlation_batch: Incidents formatted for correlation server z3Sending batch of %d incidents to correlation serverzCorrelation batch json: %sé)ÚindentNz6Queued %d wordpress incident(s) for correlation serverz"Failed to queue incident batch: %s) r/r0rLÚjsonÚdumpsÚprocess_messagerÚ ExceptionÚerror)r7rDrOÚes r:rNzIncidentSender._send_batch~sèè€õ ŠØAÝÐ!Ñ"Ô"ñ ô ð õ ŠØ(ÝŒJÐ(°Ð3Ñ3Ô3ñ ô ð ð ð×&Ò&Ý+Ð,=Ñ>Ô>ñôð ð ð ð ð ð ð õ KŠKØHÝÐ%Ñ&Ô&ñ ô ð ð ð øõ ð ð ð ÝLŠLØ4Øñ ô ð ð øøøøð øøøsÁAB-Â- CÂ7CÃC)Ú__name__Ú __module__Ú__qualname__Ú__doc__ÚdictÚstrrr;Úlistr6rr3rPrNrHr<r:rrsÏ€€€€€ððð5 Øð5 à ˆc3ˆhŒð5 ð5 ð5 ð5 ðn ð ¨$¨s¬)ð ð ð ð ð"&Ø $Ñ&ð"&Ø37¸´:ð"&à ð"&ð"&ð"&ð"&ðH&Øð&Ø48¸´Jð&ð&ð&ð&ð&ð&r<r)r]rTÚloggingrÚtypingrÚ"defence360agent.contracts.messagesrÚ!defence360agent.contracts.pluginsrÚ getLoggerrZr/rrHr<r:úrfs³ðØ9Ð9à€€€Ø€€€ØÐÐÐÐÐØÐÐÐÐÐàJÐJÐJÐJÐJÐJØ9Ð9Ð9Ð9Ð9Ð9à ˆÔ ˜8Ñ $Ô $€ðVðVðVðVðVñVôVðVðVðVr<