wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(iwooos): add wazuh runtime owner review readback
Some checks failed
CD Pipeline / tests (push) Successful in 1m48s
Details
Code Review / ai-code-review (push) Failing after 19s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-06-28 11:28:31 +08:00
parent fde68fb843
commit 119267256a
9 changed files with 1462 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

92
apps/api/src/services/iwooos_runtime_security_readback.py
View File

@@ -23,6 +23,7 @@ _SNAPSHOT_FILES = {
"wazuh_live_metadata_gate": "wazuh-readonly-live-metadata-env-gate.snapshot.json",
"wazuh_owner_evidence_preflight": "wazuh-agent-visibility-owner-evidence-preflight.snapshot.json",
"wazuh_runtime_apply_preflight": "wazuh-runtime-controlled-apply-preflight.snapshot.json",
"wazuh_runtime_owner_review": "wazuh-runtime-gate-owner-review-readback.snapshot.json",
"kali_status": "kali-integration-status.snapshot.json",
"soc_control": "soc-siem-kali-wazuh-integration-control.snapshot.json",
"alert_readability": "telegram-alert-readability-guard.snapshot.json",
@@ -37,6 +38,7 @@ _EXPECTED_SCHEMAS = {
"wazuh_live_metadata_gate": "iwooos_wazuh_readonly_live_metadata_env_gate_v1",
"wazuh_owner_evidence_preflight": "wazuh_agent_visibility_owner_evidence_preflight_v1",
"wazuh_runtime_apply_preflight": "wazuh_runtime_controlled_apply_preflight_v1",
"wazuh_runtime_owner_review": "wazuh_runtime_gate_owner_review_readback_v1",
"kali_status": "kali_integration_status_v1",
"soc_control": "soc_siem_kali_wazuh_integration_control_v1",
"alert_readability": "telegram_alert_readability_guard_v1",
@@ -86,6 +88,7 @@ def load_latest_iwooos_runtime_security_readback(
runtime_apply_preflight_summary = _summary(
snapshots["wazuh_runtime_apply_preflight"]
)
runtime_owner_review_summary = _summary(snapshots["wazuh_runtime_owner_review"])
soc_summary = _summary(snapshots["soc_control"])
alert_summary = _summary(snapshots["alert_readability"])
dispatch_summary = _summary(snapshots["owner_dispatch"])
@@ -108,7 +111,7 @@ def load_latest_iwooos_runtime_security_readback(
"source_refs": source_refs,
"summary": {
"source_snapshot_count": len(source_refs),
"p0_lane_count": 10,
"p0_lane_count": 11,
"control_plane_visibility_percent": _average_percent(
soc_summary.get("coverage_percent_after_soc_integration_control"),
intrusion_summary.get("coverage_percent_after_prevention_control"),
@@ -234,6 +237,41 @@ def load_latest_iwooos_runtime_security_readback(
"wazuh_runtime_apply_runtime_gate_count": _int(
runtime_apply_preflight_summary.get("runtime_gate_count")
),
"wazuh_runtime_owner_review_target_selector_count": _int(
runtime_owner_review_summary.get("target_selector_count")
),
"wazuh_runtime_owner_review_source_diff_count": _int(
runtime_owner_review_summary.get("source_of_truth_diff_count")
),
"wazuh_runtime_owner_review_check_mode_plan_count": _int(
runtime_owner_review_summary.get("check_mode_plan_count")
),
"wazuh_runtime_owner_review_dry_run_evidence_count": _int(
runtime_owner_review_summary.get("dry_run_evidence_count")
),
"wazuh_runtime_owner_review_rollback_plan_count": _int(
runtime_owner_review_summary.get("rollback_plan_count")
),
"wazuh_runtime_owner_review_post_apply_verifier_count": _int(
runtime_owner_review_summary.get("post_apply_verifier_count")
),
"wazuh_runtime_owner_review_km_writeback_count": _int(
runtime_owner_review_summary.get("km_playbook_writeback_count")
),
"wazuh_runtime_owner_review_packet_received_count": _int(
runtime_owner_review_summary.get("owner_review_packet_received_count")
),
"wazuh_runtime_owner_review_packet_review_ready_count": _int(
runtime_owner_review_summary.get(
"owner_review_packet_review_ready_count"
)
),
"wazuh_runtime_owner_review_packet_accepted_count": _int(
runtime_owner_review_summary.get("owner_review_packet_accepted_count")
),
"wazuh_runtime_owner_review_runtime_gate_count": _int(
runtime_owner_review_summary.get("runtime_gate_count")
),
"kali_active_scan_authorized_count": _int(
soc_summary.get("kali_active_scan_authorized_count")
),
@@ -433,6 +471,57 @@ def load_latest_iwooos_runtime_security_readback(
"docs/security/wazuh-runtime-controlled-apply-preflight.snapshot.json"
],
),
_lane(
"wazuh_runtime_gate_owner_review",
snapshots["wazuh_runtime_owner_review"].get(
"status",
"runtime_gate_owner_review_packet_committed_no_runtime_action",
),
55
if _int(
runtime_owner_review_summary.get(
"owner_review_packet_accepted_count"
)
)
else 0,
"steady"
if _int(
runtime_owner_review_summary.get(
"owner_review_packet_accepted_count"
)
)
else "locked",
"進入 allowlisted check-mode 與 dry-run readback；runtime gate 仍關閉",
{
"target_selectors": runtime_owner_review_summary.get(
"target_selector_count", 0
),
"source_diff": runtime_owner_review_summary.get(
"source_of_truth_diff_count", 0
),
"check_mode": runtime_owner_review_summary.get(
"check_mode_plan_count", 0
),
"dry_run": runtime_owner_review_summary.get(
"dry_run_evidence_count", 0
),
"rollback": runtime_owner_review_summary.get(
"rollback_plan_count", 0
),
"post_apply_verifier": runtime_owner_review_summary.get(
"post_apply_verifier_count", 0
),
"owner_review_accepted": runtime_owner_review_summary.get(
"owner_review_packet_accepted_count", 0
),
"runtime_gate": runtime_owner_review_summary.get(
"runtime_gate_count", 0
),
},
[
"docs/security/wazuh-runtime-gate-owner-review-readback.snapshot.json"
],
),
_lane(
"wazuh_dashboard_api",
"degraded_api_connection_not_green",
@@ -562,6 +651,7 @@ def load_latest_iwooos_runtime_security_readback(
"Wazuh 即時中繼資料必須先通過負責人、機密中繼資料、唯讀範圍與啟用後讀回",
"Wazuh 負責人證據預檢 ready 不代表已收件、已接受或可啟用 active response",
"Wazuh controlled apply preflight ready 不代表 runtime gate 已開或已執行修復",
"Wazuh runtime gate owner-review accepted 只代表 review readiness，不代表已查 live Wazuh 或可寫主機",
],
}