diff --git a/.env b/.env index 3f6cd40..249822d 100644 --- a/.env +++ b/.env @@ -36,16 +36,16 @@ EMAIL_USE_SSL=False EMAIL_HOST_USER= EMAIL_HOST_PASSWORD= WATCHER_URL=https://example.watcher.local -WATCHER_LOGO=https://raw.githubusercontent.com/thalesgroup-cert/Watcher/master/Watcher/static/Watcher-logo-simple.png -EMAIL_SUBJECT_TAG_SITE_MONITORING=INCIDENT +WATCHER_LOGO= +GITHUB_LOGO= +SUBJECT_TAG_SITE_MONITORING=INCIDENT EMAIL_CLASSIFICATION=INTERNAL # THE HIVE Setup THE_HIVE_URL= THE_HIVE_VERIFY_SSL=False THE_HIVE_KEY= -THE_HIVE_CASE_ASSIGNEE=watcher -THE_HIVE_TAGS=Watcher,Impersonation,Malicious Domain,Typosquatting +# Ensure the custom field referenced here is CREATED IN THEHIVE. Otherwise, Alert exports to TheHive will be impacted THE_HIVE_CUSTOM_FIELD=watcher-id THE_HIVE_EMAIL_SENDER=watcher@watcher.com diff --git a/Watcher/Watcher/common/core.py b/Watcher/Watcher/common/core.py index 61fe71c..82fea5f 100644 --- a/Watcher/Watcher/common/core.py +++ b/Watcher/Watcher/common/core.py @@ -63,7 +63,7 @@ def generate_ref(): }, 'website_monitoring': { 'content_template': ( - "*[SITE MONITORING - INCIDENT #{ticket_id}] 🔔 {alert_type} on {domain_name} 🔔*\n\n" + f"*[{settings.SUBJECT_TAG_SITE_MONITORING}" "{ticket_id}] 🔔 {alert_type} on {domain_name_sanitized} 🔔*\n\n" "Dear team,\n\n" "Please find the new incident detected below:\n\n" "*• Difference Score:* {difference_score}\n" @@ -82,10 +82,10 @@ def generate_ref(): }, 'dns_finder': { 'content_template': ( - "*[DNS FINDER - ALERT #{alert.pk}] 🚨 Suspicious DNS Detected: {alert.dns_twisted.domain_name} 🚨*\n\n" + "*[DNS FINDER - ALERT #{alert.pk}] 🚨 Suspicious DNS Detected: {dns_domain_name_sanitized} 🚨*\n\n" "Dear team,\n\n" "New Twisted DNS found: \n\n" - "*• Twisted DNS:* {alert.dns_twisted.domain_name}\n" + "*• Twisted DNS:* {dns_domain_name_sanitized}\n" "*• Corporate Keyword:* {alert.dns_twisted.keyword_monitored}\n" "*• Corporate DNS:* {alert.dns_twisted.dns_monitored}\n" "*• Fuzzer:* {alert.dns_twisted.fuzzer}\n\n" @@ -98,7 +98,7 @@ def generate_ref(): 'content_template': ( "*[{alerts_number} ALERTS] 🚨 DNS Finder 🚨*\n\n" "Dear team,\n\n" - "*{alerts_number}* New DNS Twisted Alerts for *{dns_monitored.domain_name}* asset.\n\n" + "*{alerts_number}* New DNS Twisted Alerts for *{dns_domain_name_sanitized_group}* asset.\n\n" "Please, find more details <{details_url}|here>." ), 'channel': settings.SLACK_CHANNEL, @@ -106,7 +106,6 @@ def generate_ref(): }, } - # Configuration for Citadel APP_CONFIG_CITADEL = { 'threats_watcher': { @@ -146,7 +145,7 @@ def generate_ref(): }, 'website_monitoring': { 'content_template': ( - "

[SITE MONITORING - INCIDENT #{ticket_id}] 🔔 {alert_type} on {domain_name} 🔔

" + f"

[{settings.SUBJECT_TAG_SITE_MONITORING}{{ticket_id}}] 🔔 {{alert_type}} on {{domain_name_sanitized}} 🔔

" "

Dear team,

" "

Please find the new incident detected below:

" "