Prepare for 3.49.0

.github/workflows/docker.yml

@@ -0,0 +1,21 @@
+on:
+  pull_request:
+    paths:
+      - "Dockerfile"
+
+jobs:
+  test:
+    name: Build Dockerfile
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout panther-analysis
+        uses: actions/checkout@v4
+      - uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Build Image
+        run: docker buildx build --load -f Dockerfile -t panther-analysis:latest .
+      - name: Test Image
+        run: |
+          docker run --rm -t panther-analysis:latest pipenv run panther_analysis_tool --version

.github/workflows/lint.yml

@@ -9,6 +9,8 @@ jobs:
     steps:
       - name: Checkout panther-analysis
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Set python version
         uses: actions/setup-python@v4
@@ -18,9 +20,6 @@ jobs:
       - name: Install pipenv
         run: pip install pipenv
 
-      - name: Install
-        run: make install
-
       - name: Setup venv
         run: make venv
 

.github/workflows/test.yml

@@ -18,9 +18,6 @@ jobs:
       - name: Install pipenv
         run: pip install pipenv
 
-      - name: Install
-        run: make install
-
       - name: Setup venv
         run: make venv
 

.github/workflows/upload.yml

@@ -28,9 +28,6 @@ jobs:
       - name: Install pipenv
         run: pip install pipenv
 
-      - name: Install
-        run: make install
-
       - name: Setup venv
         run: make venv
 

.husky/pre-commit

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+make fmt

Dockerfile

@@ -57,5 +57,3 @@ ENV PATH="/home/panther-analysis/node_modules/.bin:$PATH"
 # Remove pipfile so it doesn't interfere with local files after install
 RUN rm Pipfile 
 RUN rm Pipfile.lock
-
-ENTRYPOINT [ "/bin/bash" ]

Makefile

@@ -37,10 +37,12 @@ lint: lint-pylint lint-fmt
 lint-pylint:
 	pipenv run bandit -r $(dirs)
 	pipenv run pylint $(dirs)
+	pipenv run isort --profile=black --check-only $(dirs)
 
 lint-fmt:
 	@echo Checking python file formatting with the black code style checker
 	pipenv run black --line-length=100 --check $(dirs)
+	npx prettier . --check
 
 venv:
 	pipenv sync --dev
@@ -51,7 +53,7 @@ pat-update:
 fmt:
 	pipenv run isort --profile=black $(dirs)
 	pipenv run black --line-length=100 $(dirs)
-	npx prettier . --write
+	npx prettier . --write --list-different
 
 install:
 	pipenv sync --dev
@@ -62,10 +64,10 @@ test: global-helpers-unit-test
 	pipenv run panther_analysis_tool test $(TEST_ARGS)
 
 docker-build:
-	docker build -t panther-analysis .
+	docker build -t panther-analysis:latest .
 
 docker-test:
-	docker run --mount "type=bind,source=${CURDIR},target=/home/panther-analysis" panther-analysis make test TEST_ARGS="$(TEST_ARGS)"
+	docker run --mount "type=bind,source=${CURDIR},target=/home/panther-analysis" panther-analysis:latest make test TEST_ARGS="$(TEST_ARGS)"
 
 docker-lint:
-	docker run --mount "type=bind,source=${CURDIR},target=/home/panther-analysis" panther-analysis make lint
+	docker run --mount "type=bind,source=${CURDIR},target=/home/panther-analysis" panther-analysis:latest make lint

Pipfile

@@ -5,7 +5,7 @@ verify_ssl = true
 
 [dev-packages]
 bandit = "~=1.7"
-black = "~=22.8"
+black = "~=24.3.0"
 click = "~=8.1"
 decorator = "~=5.1"
 dill = "~=0.3"
@@ -19,7 +19,7 @@ wrapt = "~=1.15"
 [packages]
 policyuniverse = "==1.5.1.20230817"
 requests = "==2.31.0"
-panther-analysis-tool = "~=0.44"
+panther-analysis-tool = "~=0.45"
 panther-detection-helpers = "==0.3.0"
 
 [requires]

global_helpers/global_helpers_test.py

@@ -1334,12 +1334,14 @@ def random_kv_pair() -> dict:
             "".join(
                 secrets.choice(string.hexdigits)
                 for _ in range(secrets.SystemRandom().randrange(1, 6))
-            ): "".join(
-                secrets.choice(string.hexdigits)
-                for _ in range(secrets.SystemRandom().randrange(1, 6))
+            ): (
+                "".join(
+                    secrets.choice(string.hexdigits)
+                    for _ in range(secrets.SystemRandom().randrange(1, 6))
+                )
+                if secrets.choice([True, False])
+                else secrets.randbelow(secrets.SystemRandom().randrange(1, 11) ** 10)
             )
-            if secrets.choice([True, False])
-            else secrets.randbelow(secrets.SystemRandom().randrange(1, 11) ** 10)
             for _ in range(secrets.SystemRandom().randrange(1, 6))
         }
 

global_helpers/panther_base_helpers.py

@@ -40,13 +40,17 @@ def in_pci_scope_tags(resource):
 
 
 PCI_NETWORKS = config.PCI_NETWORKS
+
+
 # Expects a string in cidr notation (e.g. '10.0.0.0/24') indicating the ip range being checked
 # Returns True if any ip in the range is marked as in scope
 def is_pci_scope_cidr(ip_range):
     return any(ip_network(ip_range).overlaps(pci_network) for pci_network in PCI_NETWORKS)
 
 
 DMZ_NETWORKS = config.DMZ_NETWORKS
+
+
 # Expects a string in cidr notation (e.g. '10.0.0.0/24') indicating the ip range being checked
 # Returns True if any ip in the range is marked as DMZ space.
 def is_dmz_cidr(ip_range):

global_helpers/panther_iocs.py

@@ -605,6 +605,7 @@
     "ami-083bb1ae22e9bf463",  # fedora-coreos-40.20240329.10.0-aarch64 us-west-2
 }
 
+
 # IOC Helper functions:
 def ioc_match(indicators: list, known_iocs: set) -> list:
     """Matches a set of indicators against known Indicators of Compromise

global_helpers/panther_ipinfo_helpers.py

@@ -8,8 +8,8 @@
 IPINFO_PRIVACY_LUT_NAME = "ipinfo_privacy"
 
 
-class PantherIPInfoException(Exception):
-    ...
+# pylint: disable=multiple-statements
+class PantherIPInfoException(Exception): ...
 
 
 class IPInfoLocation(LookupTableMatches):
@@ -95,19 +95,19 @@ def __init__(self, event):
         super().__init__()
         super()._register(event, IPINFO_PRIVACY_LUT_NAME)
 
-    def hosting(self, match_field: str) -> bool or list:
+    def hosting(self, match_field: str) -> Union[bool, list]:
         return self._lookup(match_field, "hosting")
 
-    def proxy(self, match_field: str) -> bool or list:
+    def proxy(self, match_field: str) -> Union[bool, list]:
         return self._lookup(match_field, "proxy")
 
-    def tor(self, match_field: str) -> bool or list:
+    def tor(self, match_field: str) -> Union[bool, list]:
         return self._lookup(match_field, "tor")
 
-    def vpn(self, match_field: str) -> bool or list:
+    def vpn(self, match_field: str) -> Union[bool, list]:
         return self._lookup(match_field, "vpn")
 
-    def relay(self, match_field: str) -> bool or list:
+    def relay(self, match_field: str) -> Union[bool, list]:
         return self._lookup(match_field, "relay")
 
     def service(self, match_field: str) -> Union[list[str], str]: