wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(iwooos): add wazuh incident closure contract
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / tests (push) Has been cancelled
Details

Browse Source
This commit is contained in:
ogt
2026-07-10 20:53:15 +08:00
parent 2d2349a292
commit 98557b01ed
9 changed files with 1030 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
apps/api/src/services/iwooos_security_tool_closure_readback.py
View File

@@ -22,6 +22,9 @@ from src.services.iwooos_wazuh_allowlisted_check_mode_dry_run import (
from src.services.iwooos_wazuh_fim_vulnerability_alert_verifier import (
load_latest_iwooos_wazuh_fim_vulnerability_alert_verifier,
)
from src.services.iwooos_wazuh_incident_response_closure import (
load_latest_iwooos_wazuh_incident_response_closure,
)
from src.services.iwooos_wazuh_managed_host_coverage import (
load_latest_iwooos_wazuh_managed_host_coverage,
)
@@ -58,6 +61,11 @@ def load_latest_iwooos_security_tool_closure_readback(
wazuh_verifier = load_latest_iwooos_wazuh_fim_vulnerability_alert_verifier(
alert_receipt_readback=alert_receipt_readback
)
wazuh_incident_response_closure = (
load_latest_iwooos_wazuh_incident_response_closure(
alert_receipt_readback=alert_receipt_readback
)
)
source_payloads = [
coverage,
@@ -68,6 +76,7 @@ def load_latest_iwooos_security_tool_closure_readback(
owner_review,
dry_run,
wazuh_verifier,
wazuh_incident_response_closure,
]
_require_runtime_boundaries(source_payloads)
@@ -80,6 +89,9 @@ def load_latest_iwooos_security_tool_closure_readback(
"owner_review": _summary(owner_review),
"dry_run": _summary(dry_run),
"wazuh_verifier": _summary(wazuh_verifier),
"wazuh_incident_response_closure": _summary(
wazuh_incident_response_closure
),
}
tracks = _tool_tracks(source_summaries)
summary = _summary_rollup(source_summaries, tracks)
@@ -132,6 +144,7 @@ def load_latest_iwooos_security_tool_closure_readback(
*owner_review.get("source_refs", []),
*dry_run.get("source_refs", []),
*wazuh_verifier.get("source_refs", []),
*wazuh_incident_response_closure.get("source_refs", []),
],
}
@@ -145,6 +158,9 @@ def _tool_tracks(source_summaries: dict[str, dict[str, Any]]) -> list[dict[str,
owner_review = source_summaries["owner_review"]
dry_run = source_summaries["dry_run"]
wazuh_verifier = source_summaries["wazuh_verifier"]
wazuh_incident_response_closure = source_summaries[
"wazuh_incident_response_closure"
]
expected_hosts = max(
_int(managed_hosts.get("expected_host_scope_count")),
@@ -385,6 +401,9 @@ def _summary_rollup(
owner_review = source_summaries["owner_review"]
dry_run = source_summaries["dry_run"]
wazuh_verifier = source_summaries["wazuh_verifier"]
wazuh_incident_response_closure = source_summaries[
"wazuh_incident_response_closure"
]
expected_hosts = max(
_int(managed_hosts.get("expected_host_scope_count")),
@@ -460,6 +479,27 @@ def _summary_rollup(
"wazuh_fim_vulnerability_alert_verifier_ready_signal_count": _int(
wazuh_verifier.get("verifier_ready_signal_count")
),
"wazuh_incident_response_closure_validator_available_count": _int(
wazuh_incident_response_closure.get(
"closure_packet_validator_available_count"
)
),
"wazuh_incident_response_same_run_stage_ready_count": _int(
wazuh_incident_response_closure.get("same_run_source_stage_ready_count")
),
"wazuh_incident_response_same_run_required_stage_count": _int(
wazuh_incident_response_closure.get("same_run_required_stage_count")
),
"wazuh_incident_response_same_run_candidate_ready_count": _int(
wazuh_incident_response_closure.get(
"same_run_closure_candidate_ready_count"
)
),
"wazuh_incident_response_runtime_closed_count": _int(
wazuh_incident_response_closure.get(
"wazuh_incident_response_runtime_closed_count"
)
),
"alert_receipt_observed_count": _int(
security_os.get("alert_receipt_observed_count")
),
@@ -500,6 +540,9 @@ def _next_executable_queue(
managed_hosts = source_summaries["managed_hosts"]
registry = source_summaries["registry"]
wazuh_verifier = source_summaries["wazuh_verifier"]
wazuh_incident_response_closure = source_summaries[
"wazuh_incident_response_closure"
]
controlled_apply = source_summaries["controlled_apply"]
dry_run = source_summaries["dry_run"]
expected_hosts = max(
@@ -526,9 +569,22 @@ def _next_executable_queue(
)
> 0
)
same_run_candidate_ready = (
_int(
wazuh_incident_response_closure.get(
"same_run_closure_candidate_ready_count"
)
)
> 0
)
if runtime_closed:
registry_gate = "wazuh_detection_response_runtime_closed_monitor_recurrence"
wazuh_next_action = "monitor_recurrence_and_control_freshness_slo"
elif same_run_candidate_ready:
registry_gate = "wazuh_same_run_closure_candidate_ready_runtime_open"
wazuh_next_action = (
"submit_redacted_same_run_wazuh_incident_response_closure_packet"
)
elif source_verifier_ready:
registry_gate = "wazuh_source_verifier_ready_runtime_closure_open"
wazuh_next_action = (
@@ -558,6 +614,26 @@ def _next_executable_queue(
0,
),
"required_verifier": "wazuh_registry_fim_vulnerability_alert_receipt_post_verifier",
"same_run_required_stage_count": _int(
wazuh_incident_response_closure.get("same_run_required_stage_count")
),
"same_run_source_stage_ready_count": _int(
wazuh_incident_response_closure.get(
"same_run_source_stage_ready_count"
)
),
"same_run_closure_candidate_ready_count": _int(
wazuh_incident_response_closure.get(
"same_run_closure_candidate_ready_count"
)
),
"incident_response_packet_validation_endpoint": (
"/api/v1/iwooos/wazuh-incident-response-closure/"
"validate-incident-response-packet"
),
"next_gate_after_packet_acceptance": (
"route_to_iwooos_controlled_executor_for_bounded_execution_and_post_verifier_writeback"
),
"controlled_apply_policy_allowed": True,
},
{