diff --git a/rego-templates/incident-html.rego b/rego-templates/incident-html.rego new file mode 100644 index 00000000..4964f963 --- /dev/null +++ b/rego-templates/incident-html.rego @@ -0,0 +1,242 @@ +package postee.incident.html + +import data.postee.with_default + +############################################## Templates ################################################ + +# Main template to render message +tpl := ` + + + + + %s + Incident Report + + +
+ +
+ + +
+ %s
%s Severity +
+ + + + + +
+

Incident Overview

+
+

Category: %s

+

Host Name: %s

+
+
+

Type: %s

+

Host ID: %s

+
+
+

Name: %s

+

URL: %s

+

Result: %s

+
+
+ + +
+

Malware Detection

+
+

Malware Name: %s

+

Host IP: %s

+
+
+

Malware Type: %s

+

Action: %s

+
+
+

Scan Type: %s

+

Level: %s

+
+
+

Resource: %s

+

Cluster: %s

+
+
+ + +
+

Attack Details

+

Tactics: %s

+

Techniques: %s

+

Rule Type: %s

+
+ + +
+

Response Policy Name: %s

+

Application Scope: %s

+
+ +
+ Copyright (C) 2022 Aqua Security Software Ltd. +
+
+ + +` + +# Style definition with dynamic colors based on severity_score +style := sprintf(` + +`, [severity_color, severity_color]) + +logo := `` + + +# Determine colors based on input.severity_score +severity_color = "#FF0036" { + input.severity_score == 3 +} else = "#BB0505" + +title:="Incident Detection" + +parsed_data := json.unmarshal(input.data) + +result = msg { + msg := sprintf(tpl, [ + style, + sprintf("%v", [input.severity_score]), + input.severity, + logo, + input.category, + input.host, + input.type, + input.hostid, + input.name, + input.url, + input.url, + sprintf("%v", [parsed_data.result]), + parsed_data.malware, + parsed_data.hostip, + parsed_data.malware_type, + parsed_data.action, + parsed_data.malware_scan_type, + parsed_data.level, + parsed_data.resource, + input.cluster, + parsed_data.tactic, + parsed_data.technique, + parsed_data.rule_type, + input.response_policy_name, + concat(", ", with_default(input, "application_scope", [])) + ]) +} \ No newline at end of file