☰

BTAS

Blue Team Auxiliary Script

  1. // ==UserScript==
  2. // @name         BTAS
  3. // @namespace    https://github.com/Mr-Tree-S/BTAS
  4. // @homepageURL  https://github.com/Mr-Tree-S/BTAS
  5. // @version      3.8.6
  6. // @description  Blue Team Auxiliary Script
  7. // @author       Barry, Jack, Xingyu, Mike
  8. // @license      Apache-2.0
  9. // @match        https://login.microsoftonline.com/*
  10. // @match        https://security.microsoft.com/*
  11. // @include        https://caas*.com/*
  12. // @include        https://mss*mss.com/*
  13. // @icon         https://avatars.githubusercontent.com/u/42169240?v=4
  14. // @require      https://code.jquery.com/jquery-3.6.4.min.js
  15. // @require      https://cdn.jsdelivr.net/npm/clipboard@2.0.11/dist/clipboard.min.js
  16. // @require      https://unpkg.com/@popperjs/core@2/dist/umd/popper.min.js
  17. // @require      https://unpkg.com/tippy.js@6/dist/tippy-bundle.umd.js
  18. // @require      https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.0.6/purify.min.js
  19. // @grant        GM_registerMenuCommand
  20. // @grant        GM_unregisterMenuCommand
  21. // @grant        GM_xmlhttpRequest
  22. // @grant        GM_openInTab
  23. // @grant        GM_getValue
  24. // @grant        GM_setValue
  25. // @connect      raw.githubusercontent.com
  26. // @connect      myqcloud.com
  27. // @connect      172.18.4.200
  28. // @run-at       document-idle
  29. // @grant        GM_addStyle
  30. // ==/UserScript==
  31.  
  32. var $ = window.jQuery;
  33.  
  34. /**
  35.  * This function creates and displays a flag using AJS.flag function
  36.  * @param {string} type - The type of flag, can be one of the following: "success", "info", "warning", "error"
  37.  * @param {string} title - The title of the flag
  38.  * @param {string} body - The body of the flag
  39.  * @param {string} close - The close of flag, can be one of the following: "auto", "manual", "never"
  40.  */
  41. function security_microsoft() {
  42.     var queryString = window.location.search;
  43.     var urlParams = new URLSearchParams(queryString);
  44.     var current_domain = urlParams.get('current');
  45.     var customers = {};
  46.     const cachedWebsiteContent = GM_getValue('cachedWebsiteContent', null);
  47.     console.log(cachedWebsiteContent);
  48.     cachedWebsiteContent.forEach((item, index) => {
  49.         if (item && item['category'] == 'mde' && item['url']) {
  50.             customers[item['name']] = item['url'];
  51.         }
  52.     });
  53.     var customer = customers[current_domain];
  54.     if (customer) {
  55.         console.log('account11', customer);
  56.     } else {
  57.         customer = current_domain;
  58.     }
  59.     if (current_domain == 'none') {
  60.         let urls = localStorage.getItem('urls').toString().split(',');
  61.         for (var i = 0; i < urls.length; i++) {
  62.             if (i == 0) {
  63.                 window.location.href = urls[i];
  64.             } else {
  65.                 GM_openInTab(urls[i], {
  66.                     active: false, // 设置为 false，以在后台打开，不激活新标签页
  67.                     insert: true // 设置为 true，将新标签页插入到当前标签页之后
  68.                 });
  69.             }
  70.         }
  71.         localStorage.removeItem('urls');
  72.     }
  73.     setTimeout(() => {
  74.         document.getElementById('O365_MainLink_Me').click();
  75.         console.log('account1');
  76.     }, 9000);
  77.     setTimeout(() => {
  78.         var account = document.getElementById('mectrl_currentAccount_secondary').textContent;
  79.         console.log(account, customer);
  80.         if (
  81.             !account.includes(customer) &&
  82.             !customer.includes(account.split('@')[1].split('.')[0]) &&
  83.             current_domain != 'none'
  84.         ) {
  85.             let urls = [];
  86.             urlParams.forEach(function (value, key) {
  87.                 if (key.includes('url')) {
  88.                     urls.push(value);
  89.                 }
  90.             });
  91.             localStorage.setItem('urls', urls);
  92.             document.getElementById('mectrl_body_signOut').click();
  93.         } else {
  94.             urlParams.forEach(function (value, key) {
  95.                 if (key.includes('url')) {
  96.                     GM_openInTab(value, {
  97.                         active: false, // 设置为 false，以在后台打开，不激活新标签页
  98.                         insert: true // 设置为 true，将新标签页插入到当前标签页之后
  99.                     });
  100.                 }
  101.             });
  102.             window.close();
  103.         }
  104.     }, 9900);
  105. }
  106.  
  107. function switch_user_microsoft() {
  108.     console.log('login.microsoft', $('#idDiv_SAOTCC_Title').text().trim());
  109.     if ($('#login_workload_logo_text').text().trim() == '您已注销帐户') {
  110.         window.location.href = 'https://security.microsoft.com/homepage?&current=none';
  111.     }
  112.     if (document.title == '登录到您的帐户' && $('#idDiv_SAOTCC_Title').text().trim() != '输入验证码') {
  113.         setTimeout(() => {
  114.             var inputElement = document.querySelectorAll('.form-control')[0];
  115.             inputElement.addEventListener('input', function (event) {
  116.                 var inputValue = inputElement.value;
  117.                 if (inputValue.includes('@')) {
  118.                     $('#idSIButton9').click();
  119.                     setTimeout(() => {
  120.                         $('#idSIButton9').click();
  121.                     }, 1500);
  122.                 }
  123.             });
  124.         }, 1600);
  125.     } else {
  126.         setTimeout(() => {
  127.             var inputElement = document.querySelectorAll('.form-control')[0];
  128.             inputElement.addEventListener('keyup', function (event) {
  129.                 var inputValue = inputElement.value;
  130.                 console.log(inputValue); // 打印当输入框的内容在元素失去焦点时的值
  131.                 if (inputValue.length == 6) {
  132.                     $('#idSubmit_SAOTCC_Continue').click();
  133.                 }
  134.             });
  135.         }, 800);
  136.     }
  137. }
  138.  
  139. function addCss() {
  140.     const ss = $(`
  141. 	    <style> 
  142.             .red_highlight{
  143.                 color:red;
  144.                 font-weight: bold;
  145.             }
  146.             .black_highlight{
  147.                 color:black;
  148.                 font-weight: bold;
  149.             }
  150.             .aui-dropdown2{
  151.                 max-width: 550px !important;
  152.             }
  153.             .aui-dropdown2 .aui-dropdown2-checkbox, .aui-dropdown2 .aui-dropdown2-radio, .aui-dropdown2 .aui-icon-container {
  154.                 padding-top: 10px;
  155.                 padding-left: 35px;
  156.             }
  157.             #reply{
  158.                 column-count: 2;
  159.             }
  160.             .aui-flag{
  161.                   border: 4px solid rgb(222,184,135) ;
  162.             }
  163.             .fix-button{
  164.                 background-color: rgb(222,184,135);
  165.                 color:white;
  166. 				z-index: 100;
  167.                 margin-right: 12px;
  168. 			}
  169.          
  170. 	    </style>
  171. 	    `);
  172.     $('head').append(ss);
  173.  
  174.     function hideAllFlag() {
  175.         $('.aui-flag').toggle();
  176.     }
  177.     const button = $('<div>')
  178.         .attr('id', 'hide-reminder')
  179.         .addClass('aui-button toolbar-trigger  fix-button aui-button-primary')
  180.         .append($('<span>').addClass('trigger-label').text('NOTICE'))
  181.         .click(hideAllFlag);
  182.  
  183.     const checkExist = setInterval(function () {
  184.         const targetDiv = document.getElementById('aui-flag-container');
  185.         const toolbar = $('.aui-header-secondary');
  186.  
  187.         if (targetDiv) {
  188.             toolbar.prepend(button);
  189.             clearInterval(checkExist); // 停止检查
  190.         }
  191.     }, 100); // 每100毫秒检查一次
  192. }
  193.  
  194. function showFlag(type, title, body, close) {
  195.     AJS.flag({
  196.         type: type,
  197.         title: DOMPurify.sanitize(title),
  198.         body: DOMPurify.sanitize(body),
  199.         close: close
  200.     });
  201.  
  202.     // addButton('hide-reminder', 'Hide Reminder', hideAllFlag);
  203.  
  204.     // 为 flag 的内容区域添加滚动条样式
  205.     const flagBody = $('#aui-flag-container > div > div');
  206.     flagBody.css({
  207.         'overflow': 'auto',
  208.         'max-height': '150px' // 添加最大高度，超出部分将出现滚动条
  209.     });
  210.  
  211.     // 为 flag 的container区域添加滚动条样式
  212.     const flagContainer = $('#aui-flag-container');
  213.     flagContainer.css({
  214.         'overflow': 'auto',
  215.         'overflow-x': 'hidden', //隐藏水平滚动条
  216.         'max-height': '90%' // 添加最大高度，超出部分将出现滚动条
  217.     });
  218. }
  219.  
  220. /**
  221.  * This function shows alert message in dialog and create a copy button
  222.  * @param {string} body - Alert Message String
  223.  */
  224. function showDialog(body) {
  225.     // avoid editor treat double backslash as breakline and avoid xss attack
  226.     body = DOMPurify.sanitize(body.replace(/\\\\/g, '\\'));
  227.  
  228.     // Create custom dialog style
  229.     const customDialogContent = AJS.$(`<section
  230.             id="custom-dialog"
  231.             class="aui-dialog2 aui-dialog2-large aui-layer"
  232.             role="dialog"
  233.             tabindex="-1"
  234.             data-aui-modal="true"
  235.             data-aui-remove-on-hide="true"
  236.             aria-labelledby="dialog-show-button--heading"
  237.             aria-describedby="dialog-show-button--description"
  238.             hidden
  239.         >
  240.             <header class="aui-dialog2-header">
  241.                 <h2 class="aui-dialog2-header-main" id="dialog-show-button--heading">Description</h2>
  242.             </header>
  243.             <div class="aui-dialog2-content" id="dialog-show-button--description">
  244.                 <p style="word-wrap: break-word; white-space: pre-line">${body}</p>
  245.             </div>
  246.             <footer class="aui-dialog2-footer">
  247.                 <div class="aui-dialog2-footer-actions">
  248.                     <button id="dialog-copy-button" class="aui-button aui-button-primary">Copy</button>
  249.                     <button id="dialog-close-button" class="aui-button aui-button-link">Close</button>
  250.                 </div>
  251.             </footer>
  252.         </section>`);
  253.  
  254.     // Show the dialog
  255.     AJS.dialog2(customDialogContent).show();
  256.  
  257.     // Close the dialog
  258.     AJS.$('#dialog-close-button').on('click', function (e) {
  259.         e.preventDefault();
  260.         AJS.dialog2(customDialogContent).hide();
  261.         //tippy.destroy();
  262.     });
  263.  
  264.     // Init tippy instance
  265.     tippy('#dialog-copy-button', {
  266.         content: 'Copy Success',
  267.         placement: 'bottom',
  268.         trigger: 'click'
  269.     });
  270.  
  271.     // Copy description text
  272.     AJS.$('#dialog-copy-button').on('click', function () {
  273.         const textToCopy = customDialogContent.find('#dialog-show-button--description').text().trim();
  274.  
  275.         // Create Clipboard instance
  276.         const clipboard = new ClipboardJS('#dialog-copy-button', {
  277.             text: function () {
  278.                 return textToCopy;
  279.             }
  280.         });
  281.  
  282.         // Copy success
  283.         clipboard.on('success', function (e) {
  284.             clipboard.destroy();
  285.             e.clearSelection();
  286.         });
  287.     });
  288. }
  289.  
  290. /**
  291.  * This function registers a Tampermonkey search menu command
  292.  * @param {Array} searchEngines - Search engines array containing the Jira, VT, AbuseIPDB
  293.  */
  294. function registerSearchMenu() {
  295.     console.log('#### Code registerSearchMenu run ####');
  296.     const LogSourceDomain = $('#customfield_10223-val').text().trim() || '*';
  297.     const Host = function () {
  298.         let search = {
  299.             'Source IP(s) and Hostname(s)': $('#customfield_10206-val').text().trim(),
  300.             'Destination IP(s) and Hostname(s)': $('#customfield_10208-val').text().trim()
  301.         };
  302.         if (search['Source IP(s) and Hostname(s)']) {
  303.             return `AND 'Source IP(s) and Hostname(s)' ~ '${search['Source IP(s) and Hostname(s)']}'`;
  304.         } else if (search['Destination IP(s) and Hostname(s)']) {
  305.             return `AND 'Destination IP(s) and Hostname(s)' ~ '${search['Destination IP(s) and Hostname(s)']}'`;
  306.         } else {
  307.             return '';
  308.         }
  309.     };
  310.     let cachedEntry = GM_getValue('cachedEntry', null);
  311.  
  312.     let url = `${
  313.         cachedEntry['hk']
  314.     }/issues/?jql=text ~ "%s" AND "Log Source Domain" ~ "%D" ${Host()} ORDER BY created DESC`;
  315.     if (window.location.href.includes(cachedEntry['macao'].split('//')[1])) {
  316.         url = `${cachedEntry['macao']}/issues/?jql=text ~ "%s" ORDER BY created DESC`;
  317.     }
  318.     console.log('===url', url);
  319.  
  320.     const searchEngines = [
  321.         {
  322.             name: 'Jira',
  323.             url: url
  324.         },
  325.         { name: 'VT', url: 'https://www.virustotal.com/gui/search/%s' },
  326.         { name: 'AbuseIPDB', url: 'https://www.abuseipdb.com/check/%s' },
  327.         {
  328.             name: 'Base64 Decode',
  329.             url: `https://icyberchef.com/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)&input=%b`
  330.         }
  331.     ];
  332.     searchEngines.forEach((engine) => {
  333.         GM_registerMenuCommand(engine.name, () => {
  334.             const selectedText = window.getSelection().toString();
  335.             const searchURL = engine.url
  336.                 .replace('%s', selectedText)
  337.                 .replace('%D', LogSourceDomain)
  338.                 .replace('%b', btoa(selectedText));
  339.             if (selectedText.length === 0) {
  340.                 showFlag('error', 'No text selected', 'Please select some text and try again', 'auto');
  341.             } else {
  342.                 window.open(searchURL, '_blank');
  343.             }
  344.         });
  345.     });
  346. }
  347.  
  348. /**
  349.  * This function registers custom add/remove quick reply menus in Tampermonkey
  350.  * Add custom reply: input custom reply and store in local
  351.  * Remove quick reply: remove all local storage custom replies
  352.  */
  353. function registerCustomQuickReplyMenu() {
  354.     GM_registerMenuCommand('Add Custom Quick Reply', () => {
  355.         const userInput_name = prompt('Enter saved quick reply name (the name should be unique)').toString();
  356.         const userInput_reply = prompt('Enter a custom quick reply (<br> is used for line break)').toString();
  357.         if (userInput_name !== null && userInput_reply !== null) {
  358.             const key = `customReply_${userInput_name}`;
  359.             // local save
  360.             localStorage.setItem(key, userInput_reply);
  361.         }
  362.     });
  363.  
  364.     GM_registerMenuCommand('Remove Custom Quick Reply', () => {
  365.         for (let i = 0; i < localStorage.length; i++) {
  366.             const key = localStorage.key(i);
  367.             if (key.startsWith('customReply_')) {
  368.                 localStorage.removeItem(key);
  369.             }
  370.         }
  371.         showFlag('success', 'Cleared All Custom Replies', '', 'auto');
  372.     });
  373.     GM_registerMenuCommand('MDE Assist', () => {
  374.         let MDE_Assist_ = localStorage.getItem('MDE_Assist');
  375.         const MDE_Assist = prompt(
  376.             'Whether MDE Assist is enabled(Example:enable  1, disable   0)',
  377.             MDE_Assist_
  378.         ).toString();
  379.         localStorage.setItem('MDE_Assist', MDE_Assist);
  380.     });
  381. }
  382.  
  383. /**
  384.  * This function create a Quick Reply button in editor
  385.  */
  386. function QuickReply() {
  387.     const replyButton = `<button class="aui-button aui-dropdown2-trigger" aria-controls="is-radio-checked">Quick Reply</button>
  388.     <aui-dropdown-menu id="is-radio-checked">
  389.     <aui-section id="reply">
  390.        <aui-item-radio interactive>Close ticket</aui-item-radio>
  391.         <aui-item-radio interactive>Monitor ticket</aui-item-radio>
  392.         <aui-item-radio interactive>Waiting ticket</aui-item-radio>
  393.         <aui-item-radio interactive>Waiting Full Scan</aui-item-radio>
  394.         <aui-item-radio interactive>Ask for Whitelist</aui-item-radio>
  395.         <aui-item-radio interactive>Whitelist Done</aui-item-radio>
  396. 		<aui-item-radio interactive>Agent recover</aui-item-radio>
  397.         <aui-item-radio interactive>Leaked Credentials</aui-item-radio>
  398. 		<aui-item-radio interactive>Compromised Accounts</aui-item-radio>
  399. 		<aui-item-radio interactive>Log resume</aui-item-radio>
  400. 		<aui-item-radio interactive>关闭工单</aui-item-radio> 
  401. 		<aui-item-radio interactive>Haeco high severity</aui-item-radio>
  402.         <aui-item-radio interactive>Haeco medium severity</aui-item-radio>
  403.         <aui-item-radio interactive>Haeco low severity</aui-item-radio>
  404.     </aui-section>
  405.     </aui-dropdown-menu>`;
  406.     const commentBar = $($('.aui-toolbar2-primary')[1]);
  407.     commentBar.append(replyButton);
  408.  
  409.     const commentBarSection = document.querySelector('aui-section#reply');
  410.     const replyComment = {
  411.         'Close ticket': 'Dear Customer,<br>Thanks for your reply, we will close this ticket.<br>Best Regards.',
  412.         'Monitor ticket': 'Dear Customer,<br>Thanks for your reply, we will keep monitor.<br>Best Regards.',
  413.         'Waiting ticket': 'Dear Customer,<br>Thanks, we look forward to hearing from you.',
  414.         'Waiting Full Scan':
  415.             'Dear Customer,<br>Full scan have been triggered , if suspicious files detected new MDE alert/ticket will be created.',
  416.         'Ask for Whitelist': 'Dear Customer,<br>Can we add the ticket to white list?<br>Best Regards.',
  417.         'Whitelist Done':
  418.             'Dear Customer,<br>We have informed the relevant parties to add this ticket to the white list and will close this ticket<br>Best Regards.',
  419.         'Haeco high severity':
  420.             '<h2><strong><span style="color: red;" data-mce-style="color: red;"><samp>[The ticket is escalated to High Severity]</samp></span></strong></h2><br>',
  421.         'Haeco medium severity':
  422.             '<h2><span style="color: rgb(255, 171, 0);" data-mce-style="color: #ffab00;"><strong><samp>[The ticket is escalated to Medium Severity]</samp></strong></span></h2><br>',
  423.         'Haeco low severity':
  424.             '<h2><span style="color: rgb(76, 154, 255);" data-mce-style="color: #4c9aff;"><strong><samp>[The ticket is de-escalated to Low Severity]</samp></strong></span></h2><br>',
  425.         'Leaked Credentials':
  426.             '<p>Dear Client,</p><p>Our Cyber Threat Intelligence investigated the incident and found &lt;Number&gt; leaked credentials related to your organization exposed in dark web. The credentials are listed below:</p><table width="962" class="mce-item-table"><tbody><tr><td width="137"><div><p><strong>EMAIL/USERNAME</strong></p></div></td><td width="137"><div><p><strong>PASSWORD TYPE</strong></p></div></td><td width="137"><div><p><strong>PASSWORD</strong></p></div></td><td width="137"><div><p><strong>SOURCE</strong></p></div></td><td width="137"><div><p><strong>PRICE</strong></p></div></td><td width="137"><div><p><strong>POSTED DATE</strong></p></div></td><td width="137"><div><p><strong>SERVICE</strong></p></div></td></tr><tr><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td></tr></tbody></table><p>[Source Detail from Kela]</p><p>&lt;SOURCE Details/Description&gt;</p><p>[Service if disclose need check]</p><p>As per our open-source investigation through passive means, we observe that:</p><p>&lt; SERVICE&gt; appear to be &lt;SERVICE USAGE&gt;</p><p>[Recommendation]</p><p>We recommend confirming that the service coverage is to customers only, or whether it also includes staff and/or third-party, and evaluate if accounts with administrative privileges require a password change. &nbsp;We also recommend to heighten monitoring of customer login to indicate anomalies in location or timing, and review password policies and evaluate if there is a need to strengthen (e.g., mandate password rotation regularly). A further recommendation is to reach out to these account holders if the accounts are still active, and request that they change their passwords.</p><p>Please do not hesitate to reach out to us if you have any queries. Thank you.</p><p>Best Regards,<br>Cyber Threat Intelligence Team</p>',
  427.         'Compromised Accounts':
  428.             '<p>Dear Client,</p><p>Our Cyber Threat Intelligence investigated the incident and found&nbsp;&lt;Number&gt; compromised accounts related to your organisation exposed in dark web. The credentials are listed below:</p><table width="962" class="mce-item-table"><tbody><tr><td width="137"><div><p><strong>EMAIL/USERNAME</strong></p></div></td><td width="137"><div><p><strong>PASSWORD TYPE</strong></p></div></td><td width="137"><div><p><strong>PASSWORD</strong></p></div></td><td width="137"><div><p><strong>SOURCE</strong></p></div></td><td width="137"><div><p><strong>PRICE</strong></p></div></td><td width="137"><div><p><strong>POSTED DATE</strong></p></div></td><td width="137"><div><p><strong>SERVICE</strong></p></div></td></tr><tr><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td><td width="137"><br data-mce-bogus="1"></td></tr></tbody></table><p>[Source Detail from Kela]</p><p>&lt;SOURCE Details/Description&gt;</p><p>[Service if disclose need check]</p><p>As per our open-source investigation through passive means, we observe that:</p><p>&lt; SERVICE&gt; appear to be &lt;SERVICE USAGE&gt;&nbsp;</p><p>[Recommendation]</p><p>We recommend confirming that the service coverage is to customers only, or whether it also includes staff and/or third-party, and evaluate if accounts with administrative privileges require a password change. &nbsp;We also recommend to heighten monitoring of customer login to indicate anomalies in location or timing, and review password policies and evaluate if there is a need to strengthen (e.g., mandate password rotation regularly). A further recommendation is to reach out to these account holders if the accounts are still active, and request that they change their passwords.</p><p>Please do not hesitate to reach out to us if you have any queries. Thank you.</p><p>Best Regards,<br>Cyber Threat Intelligence Team</p>',
  429.         'Log resume':
  430.             'Dear Customer,<br>Thanks for your reply, <br>Log resumed, we will close this ticket.<br>Best Regards.',
  431.         'Agent recover':
  432.             'Dear Customer,<br>Thanks for your reply,<br>The agent is now active and we will close this case<br>Best Regards.',
  433.         '关闭工单': '尊敬的客户，<br>感谢您的回复，我们将关闭此工单。 <br>祝您生活愉快。<br>'
  434.     };
  435.  
  436.     // Check local storage at initialization time
  437.     function getAllCustomReply() {
  438.         for (let i = 0; i < localStorage.length; i++) {
  439.             const key = localStorage.key(i);
  440.             if (key.startsWith('customReply_')) {
  441.                 const storedReply = localStorage.getItem(key).toString();
  442.                 const storeReplyName = key.split('_')[1].toString();
  443.                 replyComment[storeReplyName] = storedReply;
  444.                 $('#reply').append(`<aui-item-radio interactive>${storeReplyName}</aui-item-radio>`);
  445.             }
  446.         }
  447.     }
  448.     getAllCustomReply();
  449.  
  450.     try {
  451.         if (commentBarSection !== null) {
  452.             commentBarSection.addEventListener('change', function (e) {
  453.                 if (e.target.hasAttribute('checked')) {
  454.                     tinymce.activeEditor.setContent('');
  455.                     let replyValue = replyComment[e.target.textContent];
  456.                     tinymce.activeEditor.execCommand('mceInsertContent', false, replyValue);
  457.                 }
  458.             });
  459.         }
  460.     } catch (error) {
  461.         console.error(error);
  462.     }
  463. }
  464.  
  465. /**jsonView */
  466. function jsonToTree(data) {
  467.     let flag = false;
  468.     let html = '<ul class="code-java" style="list-style-type: none;margin-top: 0px;padding-left: 20px;">';
  469.     if (Array.isArray(data)) {
  470.         let temp = '[';
  471.         data.forEach((element) => {
  472.             temp += jsonToTree(element);
  473.         });
  474.         html += temp + '],';
  475.     } else if (data != null && typeof data === 'object' && Object.keys(data).length !== 0) {
  476.         flag = true;
  477.         for (let key in data) {
  478.             if (data.hasOwnProperty(key)) {
  479.                 html += '<li class="code-quote">"' + key + '": ';
  480.                 if (Array.isArray(data[key])) {
  481.                     let temp = '[';
  482.                     data[key].forEach((element) => {
  483.                         temp += jsonToTree(element);
  484.                     });
  485.                     html += temp + '],';
  486.                 } else if (typeof data[key] === 'object') {
  487.                     try {
  488.                         if (Object.keys(data[key]).length == 0) {
  489.                             html += '{},';
  490.                         } else {
  491.                             const str = jsonToTree(data[key]);
  492.                             html += str;
  493.                         }
  494.                     } catch (TypeError) {
  495.                         html += '"",';
  496.                     }
  497.                 } else {
  498.                     html += '"' + data[key].toString() + '",';
  499.                 }
  500.                 html += '</li>';
  501.             }
  502.         }
  503.     } else {
  504.         html += '"' + data.toString() + '",';
  505.     }
  506.     if (flag === true) {
  507.         html = '{' + html + '},';
  508.     }
  509.     html += '</ul>';
  510.     return html;
  511. }
  512.  
  513. function ToWhitelist() {
  514.     const summary = $('#summary-val').text().trim();
  515.     var LogSourceDomain = $('#customfield_10223-val').text().trim();
  516.     let DecoderName = $('#customfield_10807-val').text().trim().toLowerCase();
  517.     let Component = 'Wazuh';
  518.     if (DecoderName.includes('mde') || DecoderName.includes('m365')) {
  519.         Component = 'MDE';
  520.     }
  521.     if (DecoderName.includes('cortex')) {
  522.         Component = 'Cortex';
  523.     }
  524.     let whitelist = {
  525.         summary: summary,
  526.         LogSourceDomain: LogSourceDomain,
  527.         Component: Component,
  528.         MSS: window.location.href
  529.     };
  530.     localStorage.setItem('whitelist', JSON.stringify(whitelist));
  531.     let cachedEntry = GM_getValue('cachedEntry', null);
  532.     window.open(`${cachedEntry['hk']}/plugins/servlet/desk/portal/2/create/100`, '_blank');
  533. }
  534.  
  535. /**
  536.  * This function registers two Tampermonkey exception menu command
  537.  * Add Exception: adds the currently selected text to an exception list stored in local storage
  538.  * Clear Exception: clears the exception list from local storage
  539.  */
  540. let exceptionKey = localStorage.getItem('exceptionKey')?.split(',') || [];
  541. let notifyKey = [...exceptionKey];
  542. function registerExceptionMenu() {
  543.     console.log('#### Code registerExceptionMenu run ####');
  544.     GM_registerMenuCommand('Add Exception', () => {
  545.         const selection = window.getSelection().toString().trim();
  546.         if (!selection) {
  547.             showFlag('error', 'No Issue Key selected', '', 'auto');
  548.             return;
  549.         }
  550.         exceptionKey.push(selection);
  551.         localStorage.setItem('exceptionKey', exceptionKey.toString());
  552.         showFlag('success', '', `Added <strong>${selection}</strong> successfully`, 'auto');
  553.     });
  554.  
  555.     GM_registerMenuCommand('Clear Exception', () => {
  556.         localStorage.setItem('exceptionKey', '');
  557.         exceptionKey = notifyKey = [];
  558.         showFlag('success', 'Cleared All Issue Key', '', 'auto');
  559.     });
  560.  
  561.     GM_registerMenuCommand('JsonViewer', () => {
  562.         var isJson = function (str) {
  563.             try {
  564.                 JSON.parse(str);
  565.             } catch (e) {
  566.                 showFlag('error', 'Please select json format data', '', 'auto');
  567.                 return false;
  568.             }
  569.             return true;
  570.         };
  571.         let selection = window.getSelection().toString().trim();
  572.         if (!selection) {
  573.             showFlag('error', 'No Issue Key selected', '', 'auto');
  574.             return;
  575.         } else if (isJson(selection)) {
  576.             var jsonData = jsonToTree(JSON.parse(selection));
  577.             /**  var jsonView = document.createElement('pre');
  578.             jsonView.textContent = JSON.stringify(jsonData,null,2);
  579.             **/
  580.             showDialog(jsonData, 'Json Format');
  581.         }
  582.     });
  583. }
  584.  
  585. /**
  586.  * This function creates audio and checkbox controls and adds them to the Jira share button's parent node
  587.  * @returns {Object} Object containing references to the audio control and audio checkbox, keep checkbox, prompt checkbox
  588.  */
  589. // ## In the future, the alert sound will be migrated to another server, and more fun music will be added.
  590. function createNotifyControls() {
  591.     console.log('#### Code createNotifyControls run ####');
  592.     const operationsBar = $('div.saved-search-operations.operations');
  593.     const audioControl = $('<span></span>');
  594.  
  595.     function createAudioControl(parentNode) {
  596.         const currentDate = new Date();
  597.         const audioURL =
  598.             currentDate.getHours() >= 9 && currentDate.getHours() < 21
  599.                 ? 'https://gitee.com/aspirepig/aspirepig/raw/master/12221.wav'
  600.                 : 'https://gitee.com/aspirepig/aspirepig/raw/master/alerts.wav';
  601.         audioControl.html(`<audio id="myAudio" src="${audioURL}" type="audio/mpeg" controls></audio>`);
  602.         parentNode.prepend(audioControl);
  603.     }
  604.  
  605.     function createCheckbox(parentNode, localStorageKey, checkStatus) {
  606.         const checkbox = $('<span></span>');
  607.         const value = localStorage.getItem(localStorageKey);
  608.         checkbox.html(
  609.             `<input type="checkbox" name="${localStorageKey}" ${
  610.                 value == 'true' ? 'checked' : checkStatus ? 'checked' : ''
  611.             }>${localStorageKey}`
  612.         );
  613.         checkbox.find('input').on('click', () => {
  614.             localStorage.setItem(localStorageKey, checkbox.find('input').prop('checked'));
  615.         });
  616.         parentNode.prepend(checkbox);
  617.         return checkbox;
  618.     }
  619.     createAudioControl(operationsBar);
  620.     const audioCheckbox = createCheckbox(operationsBar, 'audioNotify', false);
  621.     const keepCheckbox = createCheckbox(operationsBar, 'keepAudio', false);
  622.     const promptCheckbox = createCheckbox(operationsBar, 'prompt', true);
  623.  
  624.     return { audioControl, audioCheckbox, keepCheckbox, promptCheckbox };
  625. }
  626.  
  627. /**
  628.  * Check for updates in the issues list and play a sound if new issues are found
  629.  * @param {Object} NotifyControls - Object containing the audio control, audio checkbox, keep checkbox, prompt checkbox
  630.  */
  631. function checkupdate(NotifyControls) {
  632.     console.log('#### Code checkupdate run ####');
  633.     const { audioControl, audioCheckbox, keepCheckbox, promptCheckbox } = NotifyControls;
  634.     const table = $('tbody');
  635.     if (!table.length) return;
  636.     let cachedEntry = GM_getValue('cachedEntry', null);
  637.  
  638.     let Tickets = '';
  639.     table.find('tr').each(function () {
  640.         const summary = $(this).find('.summary p').text().trim();
  641.         const issuekey = $(this).find('.issuekey a.issue-link').attr('data-issue-key');
  642.         if (!notifyKey.includes(issuekey)) {
  643.             notifyKey.push(issuekey);
  644.             Tickets += `${summary}==${issuekey}\n`;
  645.         }
  646.     });
  647.     if (Tickets || keepCheckbox.find('input').prop('checked')) {
  648.         if (audioCheckbox.find('input').prop('checked')) {
  649.             audioControl.find('audio').get(0).currentTime = 0;
  650.             audioControl.find('audio').get(0).play();
  651.         }
  652.     }
  653.  
  654.     $('.aui-banner').remove();
  655.     let overdueTickets = '';
  656.     table.find('tr').each(function () {
  657.         const issuekey = $(this).find('.issuekey a.issue-link').attr('data-issue-key');
  658.         const datetime = new Date($(this).find('.updated time').attr('datetime'));
  659.         const currentTime = new Date();
  660.         const diffMs = currentTime - datetime;
  661.         const diffMinutes = Math.floor(diffMs / 60000);
  662.         if (diffMinutes > 30 && diffMinutes < 120) {
  663.             overdueTickets += `<a href="${cachedEntry['hk']}/browse/${issuekey}" target="_blank">${issuekey}</a>, `;
  664.         }
  665.     });
  666.     if (overdueTickets && promptCheckbox.find('input').prop('checked')) {
  667.         GM_addStyle(`
  668.         .aui-banner.aui-banner-warning {
  669.             background-color: #ffab00 !important;
  670.             color: black !important;
  671.         }
  672.     `);
  673.         AJS.banner({
  674.             body: `Ticket: ${overdueTickets}<br>30 minutes have passed since the ticket's status changed, please handle it as soon as possible`,
  675.             type: 'warning'
  676.         });
  677.     }
  678. }
  679.  
  680. /**
  681.  * This function checks for specific keywords within a string
  682.  * Advises the user to double-check and contact L2 or TL if suspicious.
  683.  */
  684. function checkKeywords() {
  685.     console.log('#### Code checkKeywords run ####');
  686.     function check(keywords) {
  687.         const rawLog = $('#customfield_10219-val').text().trim().toLowerCase();
  688.         const summary = $('#summary-val').text().trim().toLowerCase();
  689.         let Raw_Crotex_alert = $('.code-java').text().trim().toLowerCase();
  690.  
  691.         for (const keyword of keywords) {
  692.             if (
  693.                 rawLog.includes(keyword['keyword'].toLowerCase()) ||
  694.                 Raw_Crotex_alert.includes(keyword['keyword'].toLowerCase()) ||
  695.                 summary.includes(keyword['keyword'].toLowerCase())
  696.             ) {
  697.                 AJS.banner({
  698.                     body: `\"${keyword['keyword']}\" was found in the ticket, it is maybe used for "${keyword['remark']}", please double-check and contact L2 or TL if suspicious.`
  699.                 });
  700.             }
  701.         }
  702.     }
  703.     function fetchData(url, apiKey) {
  704.         const cachedKeywordsContent = GM_getValue('cachedKeywordsContent', null);
  705.         const cachedWebsiteContent = GM_getValue('cachedWebsiteContent', null);
  706.         const cachedWhitehashContent = GM_getValue('cachedWhitehashContent', null);
  707.         GM_xmlhttpRequest({
  708.             method: 'GET',
  709.             url: url,
  710.             headers: {
  711.                 'api-key': apiKey
  712.             },
  713.             timeout: 4000, // 超过4秒未获取到文件则使用缓存文件
  714.             onload: function (response) {
  715.                 if (response.status === 200) {
  716.                     const data = JSON.parse(response.responseText)['data'];
  717.  
  718.                     console.log(data);
  719.                     if (cachedKeywordsContent == null) {
  720.                         GM_setValue('cachedKeywordsContent', data['keywords']);
  721.                     }
  722.                     if (cachedWebsiteContent == null) {
  723.                         GM_setValue('cachedWebsiteContent', data['website']);
  724.                         let cachedEntry = {};
  725.                         data['website'].forEach((item, index) => {
  726.                             if (item && item['name'] == 'hk' && item['url']) {
  727.                                 cachedEntry['hk'] = item['url'];
  728.                             }
  729.                             if (item && item['name'] == 'macao' && item['url']) {
  730.                                 cachedEntry['macao'] = item['url'];
  731.                             }
  732.                             GM_setValue('cachedEntry', cachedEntry);
  733.                         });
  734.                     }
  735.                     if (cachedWhitehashContent == null) {
  736.                         GM_setValue('cachedWhitehashContent', data['whitehash']);
  737.                     }
  738.                 } else {
  739.                     console.error('Error fetching cachedContent:', response.status);
  740.                 }
  741.             },
  742.             ontimeout: function () {
  743.                 if (cachedKeywordsContent == null || cachedWebsiteContent == null || cachedWhitehashContent == null) {
  744.                     showFlag('Error', 'BTAS缓存数据获取失败', '未连接到 VPN，请连接后刷新页面', 'auto');
  745.                 }
  746.             },
  747.             onerror: function (error) {
  748.                 console.error('Error:', error);
  749.             }
  750.         });
  751.     }
  752.  
  753.     const url = 'https://172.18.4.200/api/7vVKD9hF/message/';
  754.     const apiKey = 'Tnznjha3yhJgA7YG';
  755.     const cachedKeywordsContent = GM_getValue('cachedKeywordsContent', null);
  756.     if (cachedKeywordsContent == null) {
  757.         fetchData(url, apiKey);
  758.     }
  759.     check(cachedKeywordsContent);
  760. }
  761.  
  762. /**
  763.  * This function is used for checking ATT&CK field
  764.  */
  765. function checkATTCK() {
  766.     const status = $('#opsbar-transitions_more > span').text().trim();
  767.     const attck = $('#rowForcustomfield_10220 > div > strong > label').text();
  768.     if (status == 'Waiting for customer' && attck == '') {
  769.         AJS.banner({ body: `The ATT&CK field is not filled in` });
  770.     }
  771. }
  772.  
  773. /**
  774.  * This function is used for popping up MSS ticket considerations when clicked "Edit" and "Resolved" button or page loading.
  775.  * Ticket Considerations file is store in cloud server
  776.  * @param {Object} pageData - Gets the specified fields from the jira page
  777.  */
  778. function ticketNotify(pageData) {
  779.     console.log('#### Code ticketNotify run ####');
  780.  
  781.     function fetchOrgNotifydict() {
  782.         // 从本地存储获取缓存的文件内容和上次更新时间
  783.         const cachedContent = GM_getValue('cachedFileContent', null);
  784.  
  785.         GM_xmlhttpRequest({
  786.             method: 'GET',
  787.             url: 'https://172.18.4.200/api/7vVKD9hF/notifys/',
  788.             headers: {
  789.                 'api-key': 'Tnznjha3yhJgA7YG'
  790.             },
  791.             timeout: 4000, // 超过4秒未获取到文件则使用缓存文件
  792.             onload: function (response) {
  793.                 if (response.status === 200) {
  794.                     const data = JSON.parse(response.responseText)['data'];
  795.  
  796.                     // 本地无缓存，第一次获取文件保存到本地
  797.                     if (cachedContent == null) {
  798.                         // 更新本地存储中的文件内容和更新时间
  799.                         GM_setValue('cachedFileContent', data);
  800.  
  801.                         checkNotify(data.items, pageData);
  802.                     }
  803.  
  804.                     // 如果本地存储中有缓存，并且文件内容有变化
  805.                     if (cachedContent !== null && JSON.stringify(cachedContent) !== JSON.stringify(data)) {
  806.                         // 更新本地存储中的文件内容
  807.                         GM_setValue('cachedFileContent', data);
  808.  
  809.                         // 使用最新文件
  810.                         checkNotify(data.items, pageData);
  811.                     }
  812.  
  813.                     // 本地存在缓存，且内容相同则使用缓存文件
  814.                     if (cachedContent !== null && JSON.stringify(cachedContent) == JSON.stringify(data)) {
  815.                         checkNotify(cachedContent.items, pageData);
  816.                     }
  817.                 } else {
  818.                     console.error('Error fetching orgNotifydict:', response.status);
  819.                 }
  820.             },
  821.             ontimeout: function () {
  822.                 if (cachedContent !== null) {
  823.                     checkNotify(cachedContent.items, pageData);
  824.                 } else {
  825.                     showFlag('Error', '文件获取失败', '未连接到 VPN，请连接后刷新页面', 'auto');
  826.                 }
  827.             },
  828.             onerror: function (error) {
  829.                 console.error('Error:', error);
  830.             }
  831.         });
  832.     }
  833.     fetchOrgNotifydict();
  834.  
  835.     function checkNotify(Notifydict, pageData) {
  836.         // get button path
  837.         const buttonMap = {
  838.             Edit: '#edit-issue',
  839.             Resolve: '#action_id_761',
  840.             None: ''
  841.         };
  842.         const searchStrings = [];
  843.  
  844.         // 查找并高亮指定字符串的函数
  845.         function highlightTextInElement(selector, searchStrings) {
  846.             const element = $(selector);
  847.             if (element.length === 0) {
  848.                 console.error('未找到指定的元素');
  849.                 return;
  850.             }
  851.  
  852.             // 获取元素文本内容
  853.             let text = element.text().trim();
  854.  
  855.             // 对每个字符串进行高亮处理
  856.             searchStrings.forEach((searchString) => {
  857.                 // 在文本中查找并替换匹配的字符串
  858.                 text = text.replace(
  859.                     new RegExp(searchString, 'gi'),
  860.                     (match) => `<span style="background-color: yellow;">${match}</span>`
  861.                 );
  862.             });
  863.  
  864.             // 将替换后的文本重新设置为元素的 HTML 内容
  865.             element.html(text);
  866.         }
  867.  
  868.         function checkProperties(properties, pageData, ticketname) {
  869.             const condition = (property) => {
  870.                 const propertyArray = property.propertiesVal.split(',');
  871.                 let isAllConditionsMet = false;
  872.                 for (const val of propertyArray) {
  873.                     try {
  874.                         if (!property.conditionOptions) {
  875.                             let isTrue = pageData[property.propertiesKey]
  876.                                 .toLowerCase()
  877.                                 .includes(val.trim().toLowerCase().replace('!', ''));
  878.                             if (val.trim().toLowerCase().includes('!')) {
  879.                                 isTrue = !isTrue;
  880.                             }
  881.                             if (isTrue) {
  882.                                 if (property.propertiesKey == 'RawLog') {
  883.                                     searchStrings.push(val.trim());
  884.                                 }
  885.                                 isAllConditionsMet = true; // 如果任何一个属性满足条件，返回 true
  886.                             }
  887.                         }
  888.                         switch (property.conditionOptions) {
  889.                             case 'contain':
  890.                                 if (pageData[property.propertiesKey].toLowerCase().includes(val.trim().toLowerCase())) {
  891.                                     isAllConditionsMet = true;
  892.                                 }
  893.                                 break;
  894.                             case 'not contain':
  895.                                 if (
  896.                                     !pageData[property.propertiesKey].toLowerCase().includes(val.trim().toLowerCase())
  897.                                 ) {
  898.                                     isAllConditionsMet = true;
  899.                                 }
  900.                                 break;
  901.                             case 'equal':
  902.                                 if (pageData[property.propertiesKey].toLowerCase() === val.trim().toLowerCase()) {
  903.                                     isAllConditionsMet = true;
  904.                                 }
  905.                                 break;
  906.                             case 'not equal':
  907.                                 if (pageData[property.propertiesKey].toLowerCase() !== val.trim().toLowerCase()) {
  908.                                     isAllConditionsMet = true;
  909.                                 }
  910.                                 break;
  911.                             default:
  912.                                 console.log('Unknown.');
  913.                         }
  914.                     } catch (error) {
  915.                         if (
  916.                             error.name === 'TypeError' &&
  917.                             error.message == "Cannot read properties of undefined (reading 'includes')"
  918.                         ) {
  919.                             console.warn(`${ticketname} 提醒未加条件，请检查配置`);
  920.                         }
  921.                     }
  922.                 }
  923.                 return isAllConditionsMet; // 如果所有属性都不满足条件，则返回 false
  924.             };
  925.             properties = JSON.parse(properties);
  926.             return properties.reduce((acc, property) => {
  927.                 return acc && condition(property);
  928.             }, true);
  929.         }
  930.         let cachedEntry = GM_getValue('cachedEntry', null);
  931.         let projectMap = {};
  932.         projectMap[cachedEntry['hk'].split('//')[1]] = 'HK';
  933.         projectMap[cachedEntry['macao'].split('//')[1]] = 'MO';
  934.  
  935.         for (const notify of Notifydict) {
  936.             const { ticketname, starttime, endtime, message, properties, button, status, project } = notify;
  937.             const isInTimeRange =
  938.                 (!starttime || new Date() >= new Date(starttime)) && (!endtime || new Date() <= new Date(endtime));
  939.             const clickButton = buttonMap[button];
  940.  
  941.             if (status == 'Disable' || !isInTimeRange || projectMap[window.location.host] !== project) {
  942.                 continue;
  943.             }
  944.  
  945.             if (checkProperties(properties, pageData, ticketname)) {
  946.                 if (clickButton == '') {
  947.                     showFlag('warning', `${ticketname}`, `${message.replace(/\r?\n/g, '<br>')}`, 'manual');
  948.                 } else {
  949.                     $(clickButton).on('click', () => {
  950.                         showFlag('warning', `${ticketname}`, `${message.replace(/\r?\n/g, '<br>')}`, 'manual');
  951.                     });
  952.                 }
  953.  
  954.                 let selector;
  955.                 if (project == 'HK') {
  956.                     selector = '#field-customfield_10219 > div:first-child > div:nth-child(2)';
  957.                 } else if (project == 'MO') {
  958.                     selector = '#field-customfield_10904 > div.twixi-wrap.verbose > div';
  959.                 }
  960.                 highlightTextInElement(selector, searchStrings);
  961.             }
  962.         }
  963.     }
  964. }
  965. /**
  966.  * Creates a new button and adds it to the DOM.
  967.  * @param {string} id - The ID attribute for the new button element.
  968.  * @param {string} text - The text content to display on the new button.
  969.  * @param {string} onClick - The function to call when the button is clicked.
  970.  */
  971. function addButton(id, text, onClick) {
  972.     console.log(`#### Add Button: ${text}  ####`);
  973.     const toolbar = $('.aui-toolbar2-primary');
  974.     // 重复添加的按钮不会被显示
  975.     if ($('#' + id).length === 0) {
  976.         const button = $('<a>')
  977.             .attr('id', id)
  978.             .addClass('aui-button toolbar-trigger')
  979.             .append($('<span>').addClass('trigger-label').text(text))
  980.             .click(onClick);
  981.         toolbar.append($('<div>').addClass('aui-buttons pluggable-ops').append(button));
  982.     }
  983. }
  984.  
  985. function monitorList() {
  986.     var summaryElements = document.querySelectorAll('.summary');
  987.     summaryElements.forEach(function (element) {
  988.         if (
  989.             element.textContent.includes('WebAvailability') ||
  990.             element.textContent.includes('SWIFT login activity and select activity detected')
  991.         ) {
  992.             var audio = document.getElementById('myAudio');
  993.             audio.play();
  994.         }
  995.     });
  996.     var time_to_first_response = document.querySelectorAll('.sla-tag.sla-tag-ongoing');
  997.     time_to_first_response.forEach(function (element) {
  998.         console.log(element.outerText.replace('min', ''), element.outerText.replace('min', '') < 30);
  999.         if (element.outerText.includes('min') && element.outerText.replace('min', '') < 30) {
  1000.             var audio = document.getElementById('myAudio');
  1001.             audio.play();
  1002.             console.log('出现特殊情况');
  1003.         }
  1004.     });
  1005. }
  1006.  
  1007. /**
  1008.  * Creates three buttons on a JIRA issue page to handle Cortex XDR alerts
  1009.  * The buttons allow users to generate a description of the alerts, open the alert card page and timeline page
  1010.  */
  1011. function cortexAlertHandler(...kwargs) {
  1012.     console.log('#### Code cortexAlertHandler run ####');
  1013.     const { LogSourceDomain, summary } = kwargs[0];
  1014.     const rawLog = $('#field-customfield_10232 > div.twixi-wrap.verbose > div > div > div > pre').text();
  1015.     /**
  1016.      * Extracts the log information and organization name from the current JIRA issue page
  1017.      * @param {Object} orgDict - A dictionary that maps organization name to navigator name
  1018.      * @returns {Object} An object that contains the organization's name, organization's navigator URL, raw log information
  1019.      */
  1020.     let orgDict = {};
  1021.     const cachedWebsiteContent = GM_getValue('cachedWebsiteContent', null);
  1022.     console.log(cachedWebsiteContent);
  1023.     if (cachedWebsiteContent != null) {
  1024.         cachedWebsiteContent.forEach((item, index) => {
  1025.             if (item && item['category'] == 'cortex' && item['url']) {
  1026.                 orgDict[item['name']] = item['url'];
  1027.             }
  1028.         });
  1029.         console.log('===orgDict', orgDict);
  1030.     } else {
  1031.         alert('cachedWebsiteContent is empty,please connect VPN get information');
  1032.     }
  1033.     const orgNavigator = orgDict[LogSourceDomain];
  1034.  
  1035.     /**
  1036.      * Parse the relevant information from the raw log data
  1037.      * @param {Array} rawLog - An array of JSON strings representing the raw log data
  1038.      * @returns {Array} An array of objects containing the alert relevant information
  1039.      */
  1040.     function parseLog(rawLog) {
  1041.         let alertInfo = [];
  1042.         try {
  1043.             const { timestamp, data, rule } = JSON.parse(rawLog);
  1044.             let rule_description = rule['description'].split(':')[-1];
  1045.             const { cortex_xdr } = data;
  1046.             const { source, alert_id, name, description } = cortex_xdr;
  1047.             const isPANNGFW = source === 'PAN NGFW';
  1048.             let dotIndex = timestamp.lastIndexOf('.');
  1049.  
  1050.             dateTimeStr = timestamp.slice(0, dotIndex) + '+0800';
  1051.             const alert = { source, alert_id, name, description, dateTimeStr, rule_description };
  1052.             if (isPANNGFW) {
  1053.                 const {
  1054.                     action_local_ip,
  1055.                     action_local_port,
  1056.                     action_remote_ip,
  1057.                     action_remote_port,
  1058.                     action_pretty,
  1059.                     alert_link
  1060.                 } = cortex_xdr;
  1061.                 alertInfo.push({
  1062.                     ...alert,
  1063.                     action_local_ip,
  1064.                     action_local_port,
  1065.                     action_remote_ip,
  1066.                     action_remote_port,
  1067.                     action_pretty,
  1068.                     alert_link
  1069.                 });
  1070.             } else {
  1071.                 const {
  1072.                     action_local_ip,
  1073.                     action_file_macro_sha256,
  1074.                     action_file_name,
  1075.                     action_file_path,
  1076.                     action_file_sha256,
  1077.                     action_process_image_name,
  1078.                     action_process_image_sha256,
  1079.                     action_process_image_command_line,
  1080.                     action_external_hostname,
  1081.                     actor_process_image_name,
  1082.                     actor_process_image_path,
  1083.                     actor_process_image_sha256,
  1084.                     actor_process_command_line,
  1085.                     causality_actor_process_image_name,
  1086.                     causality_actor_process_command_line,
  1087.                     causality_actor_process_image_path,
  1088.                     causality_actor_process_image_sha256,
  1089.                     os_actor_process_image_name,
  1090.                     os_actor_process_image_path,
  1091.                     os_actor_process_command_line,
  1092.                     os_actor_process_image_sha256,
  1093.                     action_pretty,
  1094.                     host_name,
  1095.                     host_ip,
  1096.                     user_name,
  1097.                     alert_link
  1098.                 } = cortex_xdr;
  1099.                 const action_list = {
  1100.                     action_file_name,
  1101.                     action_file_path,
  1102.                     action_file_sha256,
  1103.                     action_process_image_name,
  1104.                     action_process_image_sha256,
  1105.                     action_process_image_command_line
  1106.                 };
  1107.                 const actor_list = {
  1108.                     actor_process_image_name,
  1109.                     actor_process_image_path,
  1110.                     actor_process_image_sha256,
  1111.                     actor_process_command_line
  1112.                 };
  1113.                 const causality_actor_list = {
  1114.                     causality_actor_process_image_name,
  1115.                     causality_actor_process_command_line,
  1116.                     causality_actor_process_image_path,
  1117.                     causality_actor_process_image_sha256
  1118.                 };
  1119.                 const os_actor_list = {
  1120.                     os_actor_process_image_name,
  1121.                     os_actor_process_image_path,
  1122.                     os_actor_process_command_line,
  1123.                     os_actor_process_image_sha256
  1124.                 };
  1125.  
  1126.                 function countValidProperties(obj) {
  1127.                     const validPropsCount = Object.keys(obj).reduce((count, key) => {
  1128.                         if (obj[key] !== undefined) {
  1129.                             count++;
  1130.                         }
  1131.                         return count;
  1132.                     }, 0);
  1133.                     return validPropsCount;
  1134.                 }
  1135.  
  1136.                 const actionPropsCount = countValidProperties(action_list) ? countValidProperties(action_list) + 1 : 0;
  1137.                 const actorPropsCount = countValidProperties(actor_list);
  1138.                 const causalityPropsCount = countValidProperties(causality_actor_list);
  1139.                 const osPropsCount = countValidProperties(os_actor_list);
  1140.                 const maxCount = Math.max(actionPropsCount, actorPropsCount, causalityPropsCount, osPropsCount);
  1141.  
  1142.                 const action_cmd_length = action_process_image_command_line
  1143.                     ? action_process_image_command_line.length
  1144.                     : 0;
  1145.                 const actor_cmd_length = actor_process_command_line ? actor_process_command_line.length : 0;
  1146.                 const causality_cmd_length = causality_actor_process_command_line
  1147.                     ? causality_actor_process_command_line.length
  1148.                     : 0;
  1149.                 const os_cmd_length = os_actor_process_command_line ? os_actor_process_command_line.length : 0;
  1150.                 const lengths = [action_cmd_length, actor_cmd_length, causality_cmd_length, os_cmd_length];
  1151.                 const maxLength = Math.max(...lengths);
  1152.  
  1153.                 let filename;
  1154.                 let filepath;
  1155.                 let sha256;
  1156.                 let cmd;
  1157.  
  1158.                 if (action_cmd_length === maxLength && actionPropsCount === maxCount) {
  1159.                     if (!WhiteFilehash(action_file_sha256 || action_process_image_sha256)) {
  1160.                         sha256 = action_file_sha256 || action_process_image_sha256;
  1161.                     }
  1162.                     filename = action_file_name || action_process_image_name;
  1163.                     filepath = action_file_path;
  1164.                     cmd = action_process_image_command_line;
  1165.                 } else if (actor_cmd_length === maxLength && actorPropsCount === maxCount) {
  1166.                     if (!WhiteFilehash(actor_process_image_sha256)) {
  1167.                         sha256 = actor_process_image_sha256;
  1168.                     }
  1169.                     filename = actor_process_image_name;
  1170.                     filepath = actor_process_image_path;
  1171.                     cmd = actor_process_command_line;
  1172.                 } else if (causality_cmd_length === maxLength && causalityPropsCount === maxCount) {
  1173.                     if (!WhiteFilehash(causality_actor_process_image_sha256)) {
  1174.                         sha256 = causality_actor_process_image_sha256;
  1175.                     }
  1176.                     filename = causality_actor_process_image_name;
  1177.                     filepath = causality_actor_process_image_path;
  1178.                     cmd = causality_actor_process_command_line;
  1179.                 } else if (os_actor_process_image_name && osPropsCount === maxCount) {
  1180.                     if (!WhiteFilehash(os_actor_process_image_sha256)) {
  1181.                         sha256 = os_actor_process_image_sha256;
  1182.                     }
  1183.                     filename = os_actor_process_image_name;
  1184.                     filepath = os_actor_process_image_path;
  1185.                     cmd = os_actor_process_command_line;
  1186.                 }
  1187.  
  1188.                 alertInfo.push({
  1189.                     ...alert,
  1190.                     host_name,
  1191.                     host_ip,
  1192.                     alert_link,
  1193.                     user_name,
  1194.                     filename,
  1195.                     filepath,
  1196.                     cmd,
  1197.                     sha256,
  1198.                     action_pretty,
  1199.                     action_local_ip,
  1200.                     action_file_macro_sha256,
  1201.                     action_external_hostname
  1202.                 });
  1203.             }
  1204.         } catch (error) {
  1205.             console.error(`Error: ${error.message}`);
  1206.         }
  1207.  
  1208.         return alertInfo;
  1209.     }
  1210.     const alertInfo = parseLog(rawLog);
  1211.  
  1212.     /**
  1213.      * Define three functions for handling alert information:
  1214.      * generateDescription creates a description for each alert, and displays the combined description in an alert box
  1215.      * openCard opens a new window to display the alert card page for each alert
  1216.      * openTimeline opens a new window to display the timeline page for each alert
  1217.      */
  1218.     function generateDescription() {
  1219.         const alertDescriptions = [];
  1220.         for (const info of alertInfo) {
  1221.             let {
  1222.                 source,
  1223.                 name,
  1224.                 action_local_ip,
  1225.                 action_local_port,
  1226.                 action_remote_ip,
  1227.                 action_remote_port,
  1228.                 action_pretty,
  1229.                 description,
  1230.                 alert_link,
  1231.                 rule_description,
  1232.                 action_external_hostname
  1233.             } = info;
  1234.             let unPanNgfw = [
  1235.                 'host_name',
  1236.                 'host_ip',
  1237.                 'sha256',
  1238.                 'action_file_macro_sha256',
  1239.                 'filepath',
  1240.                 'filename',
  1241.                 'cmd',
  1242.                 'user_name',
  1243.                 'action_local_ip'
  1244.             ];
  1245.             if (description && description.includes('xdr_data')) {
  1246.                 console.log(rule_description);
  1247.                 description = rule_description;
  1248.             }
  1249.             if (source === 'PAN NGFW') {
  1250.                 const desc = `Observed ${name}\ntimestamp: ${dateTimeStr}\nSrcip: ${action_local_ip}   Srcport: ${action_local_port}\nDstip: ${action_remote_ip}   Dstport: ${action_remote_port}\nAction: ${action_pretty}\n${
  1251.                     LogSourceDomain === 'cityu' ? 'Cortex Portal: ' + alert_link + '\n' : ''
  1252.                 }\n\nPlease help to verify if this activity is legitimate.\n`;
  1253.                 alertDescriptions.push(desc);
  1254.             } else {
  1255.                 let comment = '\nPlease help to verify if this activity is legitimate.\n';
  1256.                 if (
  1257.                     summary.toLowerCase().includes('wildfire malware') ||
  1258.                     summary.toLowerCase().includes('local analysis malware')
  1259.                 ) {
  1260.                     comment = '\nPlease verify if the File is legitimate.   IF NOT, please Remove the File.\n';
  1261.                 }
  1262.                 let desc = `Observed ${
  1263.                     description || name
  1264.                 }\ntimestamp: ${dateTimeStr} \n<span class="red_highlight">action_external_hostname: ${action_external_hostname}\n</span>action: ${action_pretty}\n`;
  1265.                 for (const key of unPanNgfw) {
  1266.                     console.log(key);
  1267.                     if (Object.hasOwnProperty.call(info, key)) {
  1268.                         const value = info[key];
  1269.                         console.log(key, value);
  1270.                         if (value !== undefined) {
  1271.                             if (key == 'event_evidence') {
  1272.                                 desc += `${key}: ${value.replace(/</g, '&lt;').replace(/>/g, '&gt;')}\n`;
  1273.                             } else {
  1274.                                 desc += `${key}: ${value}\n`;
  1275.                             }
  1276.                         }
  1277.                     }
  1278.                 }
  1279.                 if (info['action_file_macro_sha256'] || info['sha256']) {
  1280.                     desc += `<a href="https://www.virustotal.com/gui/file/${
  1281.                         info['action_file_macro_sha256'] || info['sha256']
  1282.                     }">https://www.virustotal.com/gui/file/${info['action_file_macro_sha256'] || info['sha256']}</a>\n`;
  1283.                 }
  1284.                 alertDescriptions.push(desc + comment);
  1285.             }
  1286.         }
  1287.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  1288.         showDialog(alertMsg);
  1289.     }
  1290.  
  1291.     function openCard() {
  1292.         for (const info of alertInfo) {
  1293.             const { source, alert_id } = info;
  1294.             if (orgNavigator) {
  1295.                 let cardURL;
  1296.                 switch (source) {
  1297.                     case 'XDR Analytics':
  1298.                         cardURL = `${orgNavigator}card/analytics2/${alert_id}`;
  1299.                         break;
  1300.                     case 'Correlation':
  1301.                         cardURL = `${orgNavigator}alerts/${alert_id}`;
  1302.                         break;
  1303.                     default:
  1304.                         cardURL = `${orgNavigator}card/alert/${alert_id}`;
  1305.                         break;
  1306.                 }
  1307.                 window.open(cardURL, '_blank');
  1308.             } else {
  1309.                 showFlag('error', '', `There is no <strong>${LogSourceDomain}</strong> Navigator on Cortex`, 'auto');
  1310.             }
  1311.         }
  1312.     }
  1313.     function openTimeline() {
  1314.         for (const info of alertInfo) {
  1315.             const { source, alert_id } = info;
  1316.             if (orgNavigator) {
  1317.                 let timelineURL;
  1318.                 switch (source) {
  1319.                     case 'Correlation':
  1320.                         showFlag(
  1321.                             'error',
  1322.                             '',
  1323.                             `Source of the Alert is <strong>${source}</strong>, There is no Timeline on Cortex`,
  1324.                             'auto'
  1325.                         );
  1326.                         break;
  1327.                     default:
  1328.                         timelineURL = `${orgNavigator}forensic-timeline/alert_id/${alert_id}`;
  1329.                         break;
  1330.                 }
  1331.                 timelineURL && window.open(timelineURL, '_blank');
  1332.             } else {
  1333.                 showFlag('error', '', `There is no <strong>${LogSourceDomain}</strong> Navigator on Cortex`, 'auto');
  1334.             }
  1335.         }
  1336.     }
  1337.     addButton('generateDescription', 'Description', generateDescription);
  1338.     addButton('openCard', 'Card', openCard);
  1339.     addButton('openTimeline', 'Timeline', openTimeline);
  1340. }
  1341.  
  1342. function HTSCAlertHandler(...kwargs) {
  1343.     console.log('#### Code HTSCAlertHandler run ####');
  1344.     const { rawLog } = kwargs[0];
  1345.     function decodeHtml(encodedString) {
  1346.         const tmpElement = document.createElement('span');
  1347.         tmpElement.innerHTML = encodedString;
  1348.         return tmpElement.innerText;
  1349.     }
  1350.  
  1351.     const parseLog = (rawLog) => {
  1352.         const alertInfo = rawLog.reduce((acc, log) => {
  1353.             try {
  1354.                 const formatJson = log.substring(log.indexOf('{')).trim();
  1355.                 // const logObj = JSON.parse(formatJson);
  1356.                 const logObj = JSON.parse(formatJson.replace(/\\\(n/g, '\\n('));
  1357.                 const eventEvidence = decodeHtml(logObj.event_evidence).split('End time')[0];
  1358.                 const alert = {
  1359.                     attackType: logObj.tag,
  1360.                     hostRisk: logObj.hostRisk,
  1361.                     srcIP: logObj.src_ip,
  1362.                     eventEvidence,
  1363.                     hostName: logObj.hostName,
  1364.                     dstIP: logObj.dst_ip
  1365.                 };
  1366.                 acc.push(alert);
  1367.             } catch (error) {
  1368.                 console.error(`Error: ${error.message}`);
  1369.             }
  1370.             return acc;
  1371.         }, []);
  1372.         return alertInfo;
  1373.     };
  1374.     const alertInfo = parseLog(rawLog);
  1375.     // console.info(`alertInfo: ${alertInfo}`);
  1376.  
  1377.     function generateDescription() {
  1378.         const alertDescriptions = [];
  1379.         for (const info of alertInfo) {
  1380.             const { attackType, hostRisk, srcIP, hostName, dstIP, eventEvidence } = info;
  1381.             const desc = `Observed ${attackType} Attack\nhostRisk: ${hostRisk}\nSrc_IP: ${srcIP}\nhostname: ${hostName}\nDst_IP: ${dstIP}\nevent_evidence: ${eventEvidence}\n\nPlease help to verify if this activity is legitimate.\n`;
  1382.             alertDescriptions.push(desc);
  1383.         }
  1384.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  1385.         showDialog(alertMsg);
  1386.     }
  1387.     addButton('generateDescription', 'Description', generateDescription);
  1388. }
  1389.  
  1390. function VMCEFAlertHandler(...kwargs) {
  1391.     const { rawLog } = kwargs[0];
  1392.  
  1393.     function parseCefLog(rawLog) {
  1394.         function cefToJson(cefLog) {
  1395.             let json = {};
  1396.             let fields = cefLog.split(' ');
  1397.  
  1398.             for (let i = 0; i < fields.length; i++) {
  1399.                 let field = fields[i].split('=');
  1400.                 let key = field[0];
  1401.                 let value = field.slice(1).join('=');
  1402.  
  1403.                 if (value) {
  1404.                     if (key === 'filePath' || key === 'msg' || key === 'start' || key === 'rt') {
  1405.                         let nextFieldIndex = i + 1;
  1406.                         while (nextFieldIndex < fields.length && !fields[nextFieldIndex].includes('=')) {
  1407.                             value += ' ' + fields[nextFieldIndex];
  1408.                             nextFieldIndex++;
  1409.                         }
  1410.                     }
  1411.                     json[key] = value;
  1412.                 }
  1413.             }
  1414.             return json;
  1415.         }
  1416.  
  1417.         const alertInfo = rawLog.reduce((acc, log) => {
  1418.             try {
  1419.                 // Determine whether the log is empty
  1420.                 if (Object.keys(log).length !== 0) {
  1421.                     // Split CEF log
  1422.                     let cef_log = log.split('|');
  1423.                     // Parsing CEF Header
  1424.                     const cef_log_header = cef_log.slice(1, 7);
  1425.                     // Parsing CEF Extends
  1426.                     const cef_log_extends = cefToJson(cef_log[7]);
  1427.  
  1428.                     acc.push({
  1429.                         Summary: cef_log_header[4],
  1430.                         // for some like "server error" tickets
  1431.                         HostName: cef_log_extends.dhost ? cef_log_extends.dhost : cef_log_extends.dvchost,
  1432.                         HostIp: cef_log_extends.dst,
  1433.                         UserName: cef_log_extends.duser,
  1434.                         FileName: cef_log_extends.fname,
  1435.                         FilePath: cef_log_extends.filePath,
  1436.                         Sha256: cef_log_extends.fileHash,
  1437.                         Msg: cef_log_extends.msg
  1438.                     });
  1439.                 }
  1440.                 return acc;
  1441.             } catch (error) {
  1442.                 console.error(`Error: ${error.message}`);
  1443.             }
  1444.         }, []);
  1445.         return alertInfo;
  1446.     }
  1447.     const alertInfo = parseCefLog(rawLog);
  1448.  
  1449.     function generateDescription() {
  1450.         const alertDescriptions = [];
  1451.         for (const info of alertInfo) {
  1452.             const { Summary } = info;
  1453.             let desc = `Observed ${Summary}\n`;
  1454.             Object.entries(info).forEach(([index, value]) => {
  1455.                 if (value !== undefined && index != 'Summary' && index != 'CBlink') {
  1456.                     desc += `${index}: ${value}\n`;
  1457.                 }
  1458.             });
  1459.             desc += `\nPlease verify if the activity is legitimate.\n`;
  1460.             alertDescriptions.push(desc);
  1461.         }
  1462.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  1463.         showDialog(alertMsg);
  1464.     }
  1465.  
  1466.     addButton('generateDescription', 'Description', generateDescription);
  1467. }
  1468.  
  1469. function CBAlertHandler(...kwargs) {
  1470.     console.log('#### Code CBAlertHandler run ####');
  1471.     const { rawLog } = kwargs[0];
  1472.  
  1473.     function parseLeefLog(rawLog) {
  1474.         const alertInfo = rawLog.reduce((acc, log) => {
  1475.             const cb_log = {};
  1476.             try {
  1477.                 const log_obj = log.split('\t');
  1478.                 log_obj.forEach((log_item) => {
  1479.                     try {
  1480.                         const [key, value] = log_item.split('=');
  1481.                         cb_log[key] = value;
  1482.                     } catch (error) {
  1483.                         console.error(`Error: ${error.message}`);
  1484.                     }
  1485.                 });
  1486.                 if (log.trim() !== '') {
  1487.                     acc.push({
  1488.                         Summary: cb_log.watchlist_name,
  1489.                         HostName: cb_log.computer_name,
  1490.                         HostIp: cb_log.interface_ip,
  1491.                         UserName: cb_log.username,
  1492.                         CmdLine: cb_log.cmdline,
  1493.                         CBlink: cb_log.link_process,
  1494.                         Filepath: cb_log.path,
  1495.                         Sha256: cb_log.process_sha256
  1496.                     });
  1497.                 }
  1498.             } catch (error) {
  1499.                 console.error(`Error: ${error.message}`);
  1500.             }
  1501.             return acc;
  1502.         }, []);
  1503.         return alertInfo;
  1504.     }
  1505.  
  1506.     const alertInfo = parseLeefLog(rawLog);
  1507.  
  1508.     function generateDescription() {
  1509.         const alertDescriptions = [];
  1510.         for (const info of alertInfo) {
  1511.             const { Summary } = info;
  1512.             let desc = `Observed ${Summary}\n`;
  1513.             Object.entries(info).forEach(([index, value]) => {
  1514.                 if (value !== undefined && index != 'Summary' && index != 'CBlink') {
  1515.                     desc += `${index}: ${value}\n`;
  1516.                 }
  1517.             });
  1518.             desc += `\nPlease verify if the activity is legitimate.\n`;
  1519.             alertDescriptions.push(desc);
  1520.         }
  1521.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  1522.         showDialog(alertMsg);
  1523.     }
  1524.  
  1525.     function openCB() {
  1526.         let CBURL = '';
  1527.         for (const info of alertInfo) {
  1528.             const { CBlink } = info;
  1529.             if (CBlink) {
  1530.                 CBURL += `${CBlink}\n`;
  1531.             }
  1532.         }
  1533.         showFlag('info', 'CB URL:', `${CBURL}`, 'manual');
  1534.     }
  1535.  
  1536.     addButton('generateDescription', 'Description', generateDescription);
  1537.     addButton('openCB', 'CB', openCB);
  1538. }
  1539.  
  1540. function WineventAlertHandler(...kwargs) {
  1541.     console.log('#### Code WineventAlertHandler run ####');
  1542.     let { rawLog, summary } = kwargs[0];
  1543.     var raw_alert = 0;
  1544.     const num_alert = $('#customfield_10300-val').text().trim();
  1545.     summary = summary.replace(/[\[(].*?[\])]/g, '');
  1546.     function parseLog(rawLog) {
  1547.         const alertInfo = rawLog.reduce((acc, log) => {
  1548.             try {
  1549.                 const { win } = JSON.parse(log);
  1550.                 raw_alert += 1;
  1551.                 const { eventdata, system } = win;
  1552.                 const alertHost = system.computer;
  1553.                 const systemTime = system.systemTime;
  1554.                 acc.push({ systemTime, summary, alertHost, eventdata });
  1555.             } catch (error) {
  1556.                 console.error(`Error: ${error.message}`);
  1557.             }
  1558.             return acc;
  1559.         }, []);
  1560.         return alertInfo;
  1561.     }
  1562.     const alertInfo = parseLog(rawLog);
  1563.  
  1564.     function generateDescription() {
  1565.         const alertDescriptions = [];
  1566.         if (raw_alert < num_alert) {
  1567.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  1568.             alertDescriptions.push(extra_message);
  1569.         }
  1570.         for (const info of alertInfo) {
  1571.             let desc = `Observed${info.summary}\nHost: ${info.alertHost}\n`;
  1572.             const date = new Date(info.systemTime.split('.')[0]);
  1573.             date.setHours(date.getHours() + 16);
  1574.             desc += `systemTime(<span class="red_highlight">UTC+8</span>): ${date.toISOString().split('.')[0]}\n`;
  1575.             for (const key in info.eventdata) {
  1576.                 if (Object.hasOwnProperty.call(info.eventdata, key)) {
  1577.                     const value = info.eventdata[key];
  1578.                     if (value !== undefined) {
  1579.                         desc += `${key}: ${value}\n`;
  1580.                     }
  1581.                 }
  1582.             }
  1583.             desc += '\n' + 'Please help to verify if this activity is legitimate.' + '\n';
  1584.             alertDescriptions.push(desc);
  1585.         }
  1586.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  1587.         showDialog(alertMsg);
  1588.     }
  1589.  
  1590.     addButton('generateDescription', 'Description', generateDescription);
  1591. }
  1592.  
  1593. function FortigateAlertHandler(...kwargs) {
  1594.     let { rawLog, summary, LogSourceDomain } = kwargs[0];
  1595.     var raw_alert = 0;
  1596.     const num_alert = $('#customfield_10300-val').text().trim();
  1597.     summary = summary.split(']')[1].trim();
  1598.     function ParseFortigateLog(rawLog) {
  1599.         const alertInfos = rawLog.reduce((acc, log) => {
  1600.             if (log == '') {
  1601.                 return acc;
  1602.             }
  1603.             let jsonData = {};
  1604.             const regex = /(\w+)=(["'].*?["']|\S+)/g;
  1605.             let matchresult;
  1606.             raw_alert += 1;
  1607.             while ((matchresult = regex.exec(log)) !== null) {
  1608.                 let key = matchresult[1];
  1609.                 let value = matchresult[2];
  1610.                 if (value.startsWith('"') && value.endsWith('"')) {
  1611.                     value = value.slice(1, -1);
  1612.                 } else if (value.startsWith("'") && value.endsWith("'")) {
  1613.                     value = value.slice(1, -1);
  1614.                 }
  1615.                 jsonData[key] = value;
  1616.             }
  1617.             acc.push(jsonData);
  1618.             return acc;
  1619.         }, []);
  1620.         return [...new Set(alertInfos)];
  1621.     }
  1622.  
  1623.     const alertInfos = ParseFortigateLog(rawLog);
  1624.     function ExtractAlertInfo(ExtractAlertInfo) {
  1625.         const extract_alert_infos = alertInfos.reduce((acc, alertInfo) => {
  1626.             const {
  1627.                 date,
  1628.                 time,
  1629.                 srcip,
  1630.                 srcport,
  1631.                 srccountry,
  1632.                 dstip,
  1633.                 dstport,
  1634.                 dstcountry,
  1635.                 hostname,
  1636.                 url,
  1637.                 referralurl,
  1638.                 action,
  1639.                 devname,
  1640.                 user,
  1641.                 cfgattr,
  1642.                 msg,
  1643.                 forwardedfor,
  1644.                 analyticscksum,
  1645.                 from,
  1646.                 to,
  1647.                 remip
  1648.             } = alertInfo;
  1649.             let arr = [];
  1650.             if (summary.toLowerCase().includes('infected file detected in fortigate')) {
  1651.                 let vt_url;
  1652.                 if (url) {
  1653.                     vt_url = 'https://www.virustotal.com/gui/domain/' + url.split('/')[2];
  1654.                 } else {
  1655.                     vt_url = 'https://www.virustotal.com/gui/ip-address/' + srcip;
  1656.                 }
  1657.                 let sum = 'https://www.virustotal.com/gui/search/' + analyticscksum;
  1658.                 arr.push(`<a href="${vt_url}">${vt_url}</a>`);
  1659.                 arr.push(`<a href="${sum}">${sum}</a>`);
  1660.             } else if (summary.toLowerCase().includes('connection attempt')) {
  1661.                 let vt_url = 'https://www.virustotal.com/gui/ip-address/' + dstip;
  1662.                 arr.push(`<a href="${vt_url}">${vt_url}</a>`);
  1663.             } else if (summary.toLowerCase().includes('connection to newly registered domain')) {
  1664.                 let vt_url = 'https://www.virustotal.com/gui/domain/' + hostname;
  1665.                 arr.push(`<a href="${vt_url}">${vt_url}</a>`);
  1666.             } else if (summary.toLowerCase().includes('non-office hour successful vpn login')) {
  1667.                 let vt_url = 'https://www.virustotal.com/gui/ip-address/' + remip;
  1668.                 arr.push(`<a href="${vt_url}">${vt_url}</a>`);
  1669.             }
  1670.  
  1671.             const extract_alert_info = {
  1672.                 datetime: `${date} ${time}`,
  1673.                 srcip: srcip ? `${srcip}:${srcport}[${srccountry}]` : undefined,
  1674.                 dstip: dstip ? `${dstip}:${dstport}[${dstcountry}]` : undefined,
  1675.                 hostname: hostname,
  1676.                 devname: devname,
  1677.                 user: user,
  1678.                 url: url,
  1679.                 action: action,
  1680.                 cfgattr: cfgattr,
  1681.                 msg: msg,
  1682.                 referralurl: referralurl,
  1683.                 forwardedfor: forwardedfor || undefined,
  1684.                 analyticscksum: analyticscksum,
  1685.                 from: from,
  1686.                 to,
  1687.                 remip: remip,
  1688.                 VT: arr.length > 0 ? arr : undefined
  1689.             };
  1690.             acc.push(extract_alert_info);
  1691.             return acc;
  1692.         }, []);
  1693.         return extract_alert_infos;
  1694.     }
  1695.     function ExtractAlertInfo_sonicwall(ExtractAlertInfo) {
  1696.         const extract_alert_infos = alertInfos.reduce((acc, alertInfo) => {
  1697.             acc.push({
  1698.                 time: alertInfo.time,
  1699.                 msg: alertInfo.msg,
  1700.                 src: alertInfo.src,
  1701.                 srcZone: alertInfo.srcZone,
  1702.                 natSrc: alertInfo.natSrc,
  1703.                 dst: alertInfo.dst,
  1704.                 dstZone: alertInfo.dstZone,
  1705.                 natDst: alertInfo.natDst,
  1706.                 proto: alertInfo.proto
  1707.             });
  1708.             return acc;
  1709.         }, []);
  1710.         return extract_alert_infos;
  1711.     }
  1712.     let extract_alert_infos = '';
  1713.     if (LogSourceDomain == 'miramar') {
  1714.         console.log('===miramar');
  1715.         extract_alert_infos = ExtractAlertInfo_sonicwall(alertInfos);
  1716.     } else {
  1717.         extract_alert_infos = ExtractAlertInfo(alertInfos);
  1718.     }
  1719.  
  1720.     function generateDescription() {
  1721.         const alertDescriptions = [];
  1722.         if (raw_alert < num_alert) {
  1723.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  1724.             alertDescriptions.push(extra_message);
  1725.         }
  1726.         for (const info of extract_alert_infos) {
  1727.             let desc = `Observed ${summary}\n`;
  1728.             Object.entries(info).forEach(([index, value]) => {
  1729.                 if (value !== undefined) {
  1730.                     desc += `${index}: ${value}\n`;
  1731.                 }
  1732.             });
  1733.             let comment = '\nPlease help to verify if this activity is legitimate.\n';
  1734.             if (summary.toLowerCase().includes('to malware ip(s)') || summary.toLowerCase().includes('to tor ip(s)')) {
  1735.                 comment = '\nPlease verify if the IP is legitimate.   If NOT, please block the dst ip\n';
  1736.             }
  1737.             desc += comment;
  1738.             alertDescriptions.push(desc);
  1739.         }
  1740.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  1741.         showDialog(alertMsg);
  1742.     }
  1743.  
  1744.     addButton('generateDescription', 'Description', generateDescription);
  1745. }
  1746.  
  1747. function CSAlertHandler(...kwargs) {
  1748.     let { rawLog } = kwargs[0];
  1749.     var raw_alert = 0;
  1750.     const num_alert = $('#customfield_10300-val').text().trim();
  1751.     function parseCefLog(rawLog) {
  1752.         function cefToJson(cefLog) {
  1753.             let json = {};
  1754.             let fields = cefLog.split(' ');
  1755.  
  1756.             for (let i = 0; i < fields.length; i++) {
  1757.                 let field = fields[i].split('=');
  1758.                 let key = field[0];
  1759.                 let value = field.slice(1).join('=');
  1760.  
  1761.                 if (value) {
  1762.                     if (key === 'filePath' || key === 'msg' || key === 'cs5' || key === 'start' || key === 'rt') {
  1763.                         let nextFieldIndex = i + 1;
  1764.                         while (nextFieldIndex < fields.length && !fields[nextFieldIndex].includes('=')) {
  1765.                             value += ' ' + fields[nextFieldIndex];
  1766.                             nextFieldIndex++;
  1767.                         }
  1768.                     }
  1769.                     json[key] = value;
  1770.                 }
  1771.             }
  1772.             return json;
  1773.         }
  1774.  
  1775.         const alertInfo = rawLog.reduce((acc, log) => {
  1776.             try {
  1777.                 // Determine whether the log is empty
  1778.                 if (Object.keys(log).length !== 0) {
  1779.                     // Split CEF log
  1780.                     let cef_log = log.split('|');
  1781.                     // Parsing CEF Header
  1782.                     const cef_log_header = cef_log.slice(1, 7);
  1783.                     // Parsing CEF Extends
  1784.                     const cef_log_extends = cefToJson(cef_log[7]);
  1785.                     raw_alert += 1;
  1786.                     acc.push({
  1787.                         CreateTime: cef_log[0].split(' localhost ')[0],
  1788.                         Summary: cef_log_header[4],
  1789.                         // for some like "server error" tickets
  1790.                         HostName: cef_log_extends.dhost ? cef_log_extends.dhost : cef_log_extends.dvchost,
  1791.                         HostIp: cef_log_extends.dst,
  1792.                         UserName: cef_log_extends.duser,
  1793.                         FileName: cef_log_extends.fname,
  1794.                         FilePath: cef_log_extends.filePath,
  1795.                         Command: cef_log_extends.cs5,
  1796.                         Sha256: cef_log_extends.fileHash,
  1797.                         Msg: cef_log_extends.msg,
  1798.                         CSLink: cef_log_extends.cs6 ? cef_log_extends.cs6 : cef_log_extends.cs1
  1799.                     });
  1800.                 }
  1801.                 return acc;
  1802.             } catch (error) {
  1803.                 console.error(`Error: ${error.message}`);
  1804.             }
  1805.         }, []);
  1806.         return alertInfo;
  1807.     }
  1808.  
  1809.     const alertInfo = parseCefLog(rawLog);
  1810.  
  1811.     function generateDescription() {
  1812.         const alertDescriptions = [];
  1813.         if (raw_alert < num_alert) {
  1814.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  1815.             alertDescriptions.push(extra_message);
  1816.         }
  1817.         for (const info of alertInfo) {
  1818.             const { Summary } = info;
  1819.             let desc = `Observed ${Summary}\n`;
  1820.             Object.entries(info).forEach(([index, value]) => {
  1821.                 if (value !== undefined && index != 'Summary' && index != 'CSLink') {
  1822.                     desc += `${index}: ${value}\n`;
  1823.                 }
  1824.             });
  1825.             desc += `\nPlease verify if the activity is legitimate.\n`;
  1826.             alertDescriptions.push(desc);
  1827.         }
  1828.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  1829.         showDialog(alertMsg);
  1830.     }
  1831.     function openCS() {
  1832.         let CSURL = '';
  1833.         let cs_url = [];
  1834.         for (const info of alertInfo) {
  1835.             const { CSLink } = info;
  1836.             if (CSLink && !cs_url.includes(CSLink)) {
  1837.                 CSURL += `${CSLink.replace('hXXps', 'https').replace(/[\[\]]/g, '')}<br><br>`;
  1838.             }
  1839.             cs_url.push(CSLink);
  1840.         }
  1841.         showFlag('info', 'CS URL:', `${CSURL}`, 'manual');
  1842.     }
  1843.     addButton('generateDescription', 'Description', generateDescription);
  1844.     addButton('openCS', 'CS', openCS);
  1845. }
  1846.  
  1847. function SophosAlertHandler(...kwargs) {
  1848.     let { rawLog } = kwargs[0];
  1849.     var raw_alert = 0;
  1850.     const num_alert = $('#customfield_10300-val').text().trim();
  1851.     function parseLog(rawLog) {
  1852.         const alertInfo = rawLog.reduce((acc, log) => {
  1853.             try {
  1854.                 log.replace(/[\[(].*?[\])]/g, '');
  1855.                 const { sophos, logsource } = JSON.parse(log);
  1856.                 raw_alert += 1;
  1857.                 const summary = sophos.name;
  1858.                 const createtime = sophos.rt.split('.')[0] + 'Z';
  1859.                 const alertHost = sophos.dhost;
  1860.                 const alertUser = sophos.suser;
  1861.                 const alertID = sophos.id;
  1862.                 const alertIP = sophos?.source_info?.ip || sophos?.data?.source_info?.ip || '';
  1863.                 const alertExtraInfo = {
  1864.                     'Sha256': sophos.appSha256,
  1865.                     'Filename': sophos?.data?.fileName ? sophos.data.fileName : undefined,
  1866.                     'Processname': sophos?.data?.processName ? sophos.data.processName : undefined,
  1867.                     'Process': sophos?.data?.process ? sophos.data.process : undefined,
  1868.                     'Clean Up Result': sophos?.core_remedy_items?.items[0]?.result
  1869.                 };
  1870.                 acc.push({ summary, createtime, alertHost, alertIP, alertUser, alertID, logsource, alertExtraInfo });
  1871.             } catch (error) {
  1872.                 console.log(`Error: ${error.message}`);
  1873.             }
  1874.             return acc;
  1875.         }, []);
  1876.         return alertInfo;
  1877.     }
  1878.     const alertInfo = parseLog(rawLog);
  1879.  
  1880.     function generateDescription() {
  1881.         const alertDescriptions = [];
  1882.         if (raw_alert < num_alert) {
  1883.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  1884.             alertDescriptions.push(extra_message);
  1885.         }
  1886.         for (const info of alertInfo) {
  1887.             let desc = `Observed ${info.summary}\nHost: ${info.alertHost} IP: ${info.alertIP || 'N/A'}\nUser: ${
  1888.                 info.alertUser
  1889.             }\ncreatetime:(<span class="red_highlight">GMT</span>)${info.createtime}\n`;
  1890.             for (const key in info.alertExtraInfo) {
  1891.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  1892.                     const value = info.alertExtraInfo[key];
  1893.                     if (value !== undefined) {
  1894.                         desc += `${key}: ${value}\n`;
  1895.                     }
  1896.                 }
  1897.             }
  1898.             if (!info.summary.includes('Failed to protect computer')) {
  1899.                 desc += '\n' + 'Please help to verify if this activity is legitimate.' + '\n';
  1900.             }
  1901.             alertDescriptions.push(desc);
  1902.         }
  1903.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  1904.         showDialog(alertMsg);
  1905.     }
  1906.  
  1907.     function openSophos() {
  1908.         let searchID = '';
  1909.         for (const info of alertInfo) {
  1910.             const { alertHost, alertID, logsource } = info;
  1911.             if (alertID || alertHost) {
  1912.                 searchID += `<strong>[${logsource}] ${alertHost}</strong>:<br>${alertID}<br><br>`;
  1913.             }
  1914.         }
  1915.         showFlag('info', 'Host and Alert ID', `${searchID}`, 'manual');
  1916.         GM_openInTab('https://cloud.sophos.com/manage/enterprise/alerts-list', {
  1917.             active: false, // 设置为 false，以在后台打开，不激活新标签页
  1918.             insert: true // 设置为 true，将新标签页插入到当前标签页之后
  1919.         });
  1920.     }
  1921.  
  1922.     addButton('generateDescription', 'Description', generateDescription);
  1923.     addButton('openSophos', 'Open Sophos', openSophos);
  1924. }
  1925.  
  1926. function SpemAlertHandler(...kwargs) {
  1927.     const { rawLog, summary } = kwargs[0];
  1928.  
  1929.     function parseLog(rawLog) {
  1930.         let logObject = {};
  1931.         const alertInfo = rawLog.reduce((acc, log) => {
  1932.             try {
  1933.                 logArray = log.split(',');
  1934.                 logArray[10] = 'Action:' + logArray[10];
  1935.                 for (const index of logArray) {
  1936.                     const [key, value] = index.split(/:(.+)/, 2);
  1937.                     logObject[key] = value;
  1938.                 }
  1939.                 acc.push({
  1940.                     'Summary': logObject['Event Description'] !== undefined ? logObject['Event Description'] : summary,
  1941.                     'User Name': logObject['User Name'],
  1942.                     'Local Host IP': logObject['Local Host IP'],
  1943.                     'Local Port': logObject['Local Port'],
  1944.                     'Remote Host IP': logObject['Remote Host IP'],
  1945.                     'Remote Port': logObject['Remote Port'],
  1946.                     'Application': logObject['Application'],
  1947.                     'SHA-256': logObject['SHA-256'],
  1948.                     'Intrusion URL': logObject['Intrusion URL'],
  1949.                     'Action': logObject['Action']
  1950.                 });
  1951.             } catch (error) {
  1952.                 console.log(`Error: ${error}`);
  1953.             }
  1954.             return acc;
  1955.         }, []);
  1956.         return alertInfo;
  1957.     }
  1958.  
  1959.     const alertInfo = parseLog(rawLog);
  1960.  
  1961.     function generateDescription() {
  1962.         const alertDescriptions = [];
  1963.         for (const info of alertInfo) {
  1964.             let desc = `Observed ${info['Summary']}\n`;
  1965.             Object.entries(info).forEach(([index, value]) => {
  1966.                 if (value !== undefined && value !== ' ' && index != 'Summary') {
  1967.                     desc += `${index}: ${value}\n`;
  1968.                 }
  1969.             });
  1970.             desc += `\nPlease verify if the activity is legitimate.\n`;
  1971.             alertDescriptions.push(desc);
  1972.         }
  1973.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  1974.         showDialog(alertMsg);
  1975.     }
  1976.  
  1977.     addButton('generateDescription', 'Description', generateDescription);
  1978. }
  1979.  
  1980. function AwsAlertHandler(...kwargs) {
  1981.     const { rawLog, summary } = kwargs[0];
  1982.     var raw_alert = 0;
  1983.     const DecoderName = $('#customfield_10807-val').text().trim().toLowerCase();
  1984.     function parseLog(rawLog) {
  1985.         const alertInfo = rawLog.reduce((acc, log) => {
  1986.             try {
  1987.                 const { aws } = JSON.parse(log);
  1988.                 if (DecoderName == 'aws-guardduty') {
  1989.                     let EventTime = aws.service.eventFirstSeen.split('.')[0] + 'Z';
  1990.                     const action = aws.service.action;
  1991.                     if (action.actionType == 'AWS_API_CALL') {
  1992.                         acc.push({
  1993.                             EventTime: EventTime,
  1994.                             actionType: action.actionType,
  1995.                             Api_Name: action?.awsApiCallAction?.api,
  1996.                             userName: aws?.resource?.accessKeyDetails?.userName,
  1997.                             RemoteIP: action?.awsApiCallAction?.remoteIpDetails?.ipAddressV4,
  1998.                             RemoteIP_country: action?.awsApiCallAction?.remoteIpDetails?.country.countryName
  1999.                         });
  2000.                     } else if (action.actionType == 'KUBERNETES_API_CALL') {
  2001.                         acc.push({
  2002.                             EventTime: EventTime,
  2003.                             actionType: action.actionType,
  2004.                             userName: aws?.resource?.accessKeyDetails?.userName,
  2005.                             sourceIPs: action?.kubernetesApiCallAction?.sourceIPs,
  2006.                             requestUri: action?.kubernetesApiCallAction?.requestUri
  2007.                         });
  2008.                     } else if (action.actionType == 'PORT_PROBE') {
  2009.                         acc.push({
  2010.                             EventTime: EventTime,
  2011.                             actionType: action.actionType,
  2012.                             localPort: action?.portProbeAction?.portProbeDetails.localPortDetails.port,
  2013.                             RemoteIP: action?.portProbeAction?.portProbeDetails.remoteIpDetails.ipAddressV4,
  2014.                             RemoteIP_country:
  2015.                                 action?.portProbeAction?.portProbeDetails.remoteIpDetails.country.countryName
  2016.                         });
  2017.                     } else if (action.actionType == 'NETWORK_CONNECTION') {
  2018.                         console.log('===', action);
  2019.                         acc.push({
  2020.                             EventTime: EventTime,
  2021.                             actionType: action.actionType,
  2022.                             localIp: action?.networkConnectionAction?.localIpDetails.ipAddressV4,
  2023.                             localPortDetails: action?.networkConnectionAction?.localPortDetails.port,
  2024.                             remoteIp: action?.networkConnectionAction?.remoteIpDetails.ipAddressV4,
  2025.                             remotePortDetails: action?.networkConnectionAction?.remotePortDetails.port,
  2026.                             instanceId: aws?.resource?.instanceDetails?.instanceId,
  2027.                             platform: aws?.resource?.instanceDetails?.platform,
  2028.                             remoteIpcountryName: action?.networkConnectionAction?.remoteIpDetails?.country?.countryName
  2029.                         });
  2030.                     }
  2031.                 } else if (summary.toLowerCase().includes('multiple sms request for same source ip')) {
  2032.                     let headers = aws.logEvents.message.httpRequest.headers;
  2033.                     let host, content;
  2034.                     headers.forEach((item) => {
  2035.                         if (item.name === 'host') {
  2036.                             host = item.value;
  2037.                         }
  2038.                         if (item.name == 'content-type') {
  2039.                             content = item.value;
  2040.                         }
  2041.                     });
  2042.                     acc.push({
  2043.                         log_file: aws.log_info.log_file,
  2044.                         clientIp: aws.logEvents.message.httpRequest.clientIp,
  2045.                         httpMethod: aws.logEvents.message.httpRequest.httpMethod,
  2046.                         uri: aws.logEvents.message.httpRequest.uri,
  2047.                         host: host,
  2048.                         content_type: content
  2049.                     });
  2050.                 } else {
  2051.                     acc.push({
  2052.                         EventTime: aws?.eventTime,
  2053.                         EventName: aws?.eventName,
  2054.                         SourceIP: aws?.sourceIPAddress || aws?.internal_ip,
  2055.                         ExternalIP: aws?.external_ip,
  2056.                         Domain: aws?.domain,
  2057.                         User: aws?.userIdentity?.arn,
  2058.                         UserAgent: aws?.userAgent,
  2059.                         PrincipalId: aws?.userIdentity?.principalId,
  2060.                         Result: aws?.errorCode,
  2061.                         QueryType: aws?.query_type,
  2062.                         Action: aws?.action,
  2063.                         requestParameters: JSON.stringify(aws?.requestParameters),
  2064.                         responseElements: JSON.stringify(aws?.responseElements)
  2065.                     });
  2066.                 }
  2067.                 raw_alert += 1;
  2068.             } catch (error) {
  2069.                 console.log(`Error: ${error}`);
  2070.             }
  2071.             return acc;
  2072.         }, []);
  2073.         return alertInfo;
  2074.     }
  2075.  
  2076.     const alertInfo = parseLog(rawLog);
  2077.     const num_alert = $('#customfield_10300-val').text().trim();
  2078.     function generateDescription() {
  2079.         const alertDescriptions = [];
  2080.         if (raw_alert < num_alert) {
  2081.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  2082.             alertDescriptions.push(extra_message);
  2083.         }
  2084.         for (const info of alertInfo) {
  2085.             let desc = `Observed ${summary.split(']')[1]}\n`;
  2086.             Object.entries(info).forEach(([index, value]) => {
  2087.                 if (value !== undefined && value !== ' ' && index != 'Summary') {
  2088.                     if (index == 'EventTime') {
  2089.                         desc += `EventTime(<span class="red_highlight">GMT</span>): ${value}\n`;
  2090.                     } else {
  2091.                         desc += `${index}: ${value}\n`;
  2092.                     }
  2093.                 }
  2094.             });
  2095.             desc += `\nPlease verify if the activity is legitimate.\n`;
  2096.             alertDescriptions.push(desc);
  2097.         }
  2098.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  2099.         showDialog(alertMsg);
  2100.     }
  2101.  
  2102.     addButton('generateDescription', 'Description', generateDescription);
  2103. }
  2104.  
  2105. function AzureAlertHandler(...kwargs) {
  2106.     const { rawLog } = kwargs[0];
  2107.  
  2108.     function parseLog(rawLog) {
  2109.         const alertInfo = rawLog.reduce((acc, log) => {
  2110.             try {
  2111.                 const { eventhub, azure } = JSON.parse(log);
  2112.                 const { ExtendedProperties, Entities } = eventhub;
  2113.                 let entities = {};
  2114.                 if (Entities) {
  2115.                     Entities.forEach(function (entity) {
  2116.                         if (entity.Type === 'host') {
  2117.                             entities['host'] = entity['HostName'];
  2118.                         }
  2119.                         if (entity.Type === 'network-connection') {
  2120.                             entities['SourceIP'] = entity['SourceAddress']['Address'];
  2121.                         }
  2122.                     });
  2123.                 }
  2124.                 acc.push({
  2125.                     AlertType: eventhub['AlertType'],
  2126.                     StartTimeUtc: eventhub['StartTimeUtc'],
  2127.                     Severity: eventhub['Severity'],
  2128.                     Intent: eventhub['Intent'],
  2129.                     Description: eventhub['Description'],
  2130.                     summary: azure['ThreatDescription'] || eventhub['AlertDisplayName'],
  2131.                     Protocol: azure['Protocol'],
  2132.                     SourceIP: azure['SourceIp'],
  2133.                     SourcePort: azure['SourcePort'],
  2134.                     DestinationIp: azure['DestinationIp'],
  2135.                     DestinationPort: azure['DestinationPort'],
  2136.                     URL: azure['Url'],
  2137.                     Action: azure['Action'],
  2138.                     ExtendedProperties: JSON.stringify(ExtendedProperties, null, 4),
  2139.                     ...entities,
  2140.                     alerturi: eventhub['AlertUri']
  2141.                 });
  2142.             } catch (error) {
  2143.                 console.log(`Error: ${error}`);
  2144.             }
  2145.             return acc;
  2146.         }, []);
  2147.         return alertInfo;
  2148.     }
  2149.  
  2150.     const alertInfo = parseLog(rawLog);
  2151.  
  2152.     function generateDescription() {
  2153.         const alertDescriptions = [];
  2154.         for (const info of alertInfo) {
  2155.             let desc = `Observed ${info.summary}\n`;
  2156.             Object.entries(info).forEach(([index, value]) => {
  2157.                 if (value !== undefined && value !== '' && index !== 'summary') {
  2158.                     if (index == 'StartTimeUtc') {
  2159.                         desc += `StartTimeUtc(<span class="red_highlight">GMT</span>): ${value.split('.')[0]}\n`;
  2160.                     } else {
  2161.                         desc += `${index}: ${value}\n`;
  2162.                     }
  2163.                 }
  2164.             });
  2165.             desc += `\nPlease verify if the activity is legitimate.\n`;
  2166.             alertDescriptions.push(desc);
  2167.         }
  2168.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  2169.         showDialog(alertMsg);
  2170.     }
  2171.  
  2172.     function openAzure() {
  2173.         let AzureURL = '';
  2174.         for (const info of alertInfo) {
  2175.             const { alerturi } = info;
  2176.             if (alerturi) {
  2177.                 AzureURL += `${alerturi.replace('hXXps', 'https').replace(/\[|\]/g, '')}<br><br>`;
  2178.             }
  2179.         }
  2180.         showFlag('info', 'Azure URL:', `${AzureURL}`, 'manual');
  2181.     }
  2182.  
  2183.     addButton('generateDescription', 'Description', generateDescription);
  2184.     addButton('openAzure', 'Azure', openAzure);
  2185. }
  2186.  
  2187. function paloaltoAlertHandler(...kwargs) {
  2188.     const { rawLog, summary } = kwargs[0];
  2189.     var raw_alert = 0;
  2190.     const num_alert = $('#customfield_10300-val').text().trim();
  2191.     function parseLog(rawLog) {
  2192.         const alertInfo = rawLog.reduce((acc, log) => {
  2193.             try {
  2194.                 let logArray = log.split(',');
  2195.                 let logType = logArray[3];
  2196.                 if (logType == 'GLOBALPROTECT') {
  2197.                     acc.push({
  2198.                         'Createtime': logArray[1],
  2199.                         'src ip': logArray[15],
  2200.                         'user': logArray[12]
  2201.                     });
  2202.                 }
  2203.                 if (logType == 'TRAFFIC') {
  2204.                     acc.push({
  2205.                         'Createtime': logArray[1],
  2206.                         'Summary': summary.split(']')[1],
  2207.                         'Source IP': logArray[7],
  2208.                         'Destination IP': logArray[8],
  2209.                         'Destination Port': logArray[25],
  2210.                         'Destination Location': logArray[42] != 0 ? logArray[42] : logArray[39]
  2211.                     });
  2212.                 }
  2213.                 if (logType == 'THREAT') {
  2214.                     let really = false,
  2215.                         malware_potential = [];
  2216.                     for (let i = 0; i < logArray.length; i++) {
  2217.                         if (logArray[i].includes('"') && i > 100) {
  2218.                             if (really) {
  2219.                                 malware_potential.push(logArray[i]);
  2220.                             }
  2221.                             really = !really;
  2222.                         }
  2223.                         if (really) {
  2224.                             malware_potential.push(logArray[i]);
  2225.                         }
  2226.                     }
  2227.                     let vt_url = 'https://www.virustotal.com/gui/search/' + logArray[31].replace('"', '').split('/')[0];
  2228.                     let description = `</br>Timestamp: ${logArray[0].split(' ').slice(0, 3).join(' ')}</br>
  2229. Device: ${logArray[0].split(' ').slice(3, 5).join(' ')}</br>
  2230. Log Details:
  2231.     <ul><li>Event Time: ${logArray[1]}</li>
  2232.     <li>Log ID: ${logArray[2]}</li>
  2233.     <li>Type: ${logArray[3]}(${logArray[4]})</li>
  2234.     <li>Severity: ${logArray[34]}</li>
  2235.     <li>Rule Triggered: ${logArray[11]}</li>
  2236.     <li>Vulnerability: ${logArray[32]}</li>
  2237.     <li>Threat ID: ${logArray[34]}</li></ul>
  2238. Network Information:
  2239.     <ul><li>Source IP: ${logArray[7]}</li>
  2240.     <li>Destination IP: ${logArray[8]}</li>
  2241.     <li>URL/filename : ${logArray[31]}</li>
  2242.     <li>VT : <a href="${vt_url}">${vt_url}</a></li>
  2243.     <li>Source Zone: ${logArray[16]}</li>
  2244.     <li>Destination Zone: ${logArray[17]}</li>
  2245.     <li>Ingress Interface: ${logArray[18]}</li>
  2246.     <li>Egress Interface: ${logArray[19]}</li></ul>
  2247. Traffic Details:
  2248.     <ul><li>Protocol: ${logArray[29]}</li>
  2249.     <li>Application: ${logArray[14]}</li>
  2250.     <li>Direction: ${logArray[35]}</li>
  2251.     <li>Session ID: ${logArray[36]}</li></ul>
  2252. Vulnerability Information:</br>
  2253.     <ul><li>Exploit Type: ${logArray[69]}</li>
  2254.     <li>Attack Vector: ${logArray[111]}</li>
  2255.     <li>Affected Technology: ${logArray[112]},${logArray[113]}</li>
  2256.     <li>Malware Potential:${malware_potential}</li>
  2257.                                                     </ul>`;
  2258.                     raw_alert += 1;
  2259.                     acc.push(description);
  2260.                 }
  2261.             } catch (error) {
  2262.                 console.error(`Error:${error}`);
  2263.             }
  2264.             return acc;
  2265.         }, []);
  2266.         return alertInfo;
  2267.     }
  2268.  
  2269.     const alertInfo = parseLog(rawLog);
  2270.  
  2271.     function generateDescription() {
  2272.         const alertDescriptions = [];
  2273.         if (raw_alert < num_alert) {
  2274.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  2275.             alertDescriptions.push(extra_message);
  2276.         }
  2277.         for (const info of alertInfo) {
  2278.             let arr = summary.split(']');
  2279.             let desc = `Observed ${arr[arr.length - 1]}\n`;
  2280.             if (typeof info == 'string') {
  2281.                 desc += info;
  2282.             } else {
  2283.                 Object.entries(info).forEach(([index, value]) => {
  2284.                     if (value !== undefined && value !== '' && index !== 'Summary') {
  2285.                         desc += `${index}: ${value}\n`;
  2286.                     }
  2287.                 });
  2288.             }
  2289.             let comment = '\nPlease help to verify if this activity is legitimate.\n</br>';
  2290.             if (summary.toLowerCase().includes('to malware ip(s)') || summary.toLowerCase().includes('to tor ip(s)')) {
  2291.                 comment = '\nPlease verify if the IP is legitimate.   If NOT, please block the dst ip\n';
  2292.             }
  2293.             desc += comment;
  2294.             alertDescriptions.push(desc);
  2295.         }
  2296.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  2297.         showDialog(alertMsg);
  2298.     }
  2299.  
  2300.     addButton('generateDescription', 'Description', generateDescription);
  2301. }
  2302.  
  2303. function ImpervaincCEFAlertHandler(...kwargs) {
  2304.     const { rawLog } = kwargs[0];
  2305.  
  2306.     function parseCefLog(rawLog) {
  2307.         function cefToJson(cefLog) {
  2308.             let json = {};
  2309.             let fields = cefLog.split(' ');
  2310.  
  2311.             for (let i = 0; i < fields.length; i++) {
  2312.                 let field = fields[i].split('=');
  2313.                 let key = field[0];
  2314.                 let value = field.slice(1).join('=');
  2315.  
  2316.                 if (value) {
  2317.                     if (key === 'filePath' || key === 'msg' || key === 'start' || key === 'rt' || key === 'cs1') {
  2318.                         let nextFieldIndex = i + 1;
  2319.                         while (nextFieldIndex < fields.length && !fields[nextFieldIndex].includes('=')) {
  2320.                             value += ' ' + fields[nextFieldIndex];
  2321.                             nextFieldIndex++;
  2322.                         }
  2323.                     }
  2324.                     if (value == 'n/a') {
  2325.                         json[key] = undefined;
  2326.                     } else {
  2327.                         json[key] = value;
  2328.                     }
  2329.                 }
  2330.             }
  2331.             return json;
  2332.         }
  2333.  
  2334.         const alertInfo = rawLog.reduce((acc, log) => {
  2335.             try {
  2336.                 // Determine whether the log is empty
  2337.                 if (Object.keys(log).length !== 0) {
  2338.                     // Split CEF log
  2339.                     let cef_log = log.split('|');
  2340.                     let createtime = cef_log[0].split('CEF:')[0];
  2341.                     // Parsing CEF Header
  2342.                     const cef_log_header = cef_log.slice(1, 7);
  2343.                     // Parsing CEF Extends
  2344.                     const cef_log_extends = cefToJson(cef_log[7]);
  2345.  
  2346.                     acc.push({
  2347.                         summary: cef_log_extends.cs1,
  2348.                         // for some like "server error" tickets
  2349.                         createtime: createtime,
  2350.                         username: cef_log_extends.duser,
  2351.                         srcIP: cef_log_extends.src,
  2352.                         dstIP: cef_log_extends.dst,
  2353.                         dstPort: cef_log_extends.dpt,
  2354.                         protocol: cef_log_extends.proto
  2355.                     });
  2356.                 }
  2357.                 return acc;
  2358.             } catch (error) {
  2359.                 console.error(`Error: ${error.message}`);
  2360.             }
  2361.         }, []);
  2362.         return alertInfo;
  2363.     }
  2364.     const alertInfo = parseCefLog(rawLog);
  2365.  
  2366.     function generateDescription() {
  2367.         const alertDescriptions = [];
  2368.         for (const info of alertInfo) {
  2369.             const { summary } = info;
  2370.             let desc = `Observed ${summary}\n`;
  2371.             Object.entries(info).forEach(([index, value]) => {
  2372.                 if (value !== undefined && index != 'summary' && index != 'CBlink') {
  2373.                     desc += `${index}: ${value}\n`;
  2374.                 }
  2375.             });
  2376.             desc += `\nPlease verify if the activity is legitimate.\n`;
  2377.             alertDescriptions.push(desc);
  2378.         }
  2379.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  2380.         showDialog(alertMsg);
  2381.     }
  2382.  
  2383.     addButton('generateDescription', 'Description', generateDescription);
  2384. }
  2385.  
  2386. function AzureGraphAlertHandler(...kwargs) {
  2387.     const { summary, rawLog } = kwargs[0];
  2388.     var raw_alert = 0;
  2389.     if (summary.toLowerCase().includes('successful azure/o365 login from malware-ip')) {
  2390.         return;
  2391.     }
  2392.     function parseLog(rawLog) {
  2393.         const alertInfo = rawLog.reduce((acc, log) => {
  2394.             try {
  2395.                 const { azure } = JSON.parse(log);
  2396.                 let properties = {};
  2397.                 raw_alert += 1;
  2398.                 if (azure.targetResources) {
  2399.                     for (const resource of azure.targetResources) {
  2400.                         if (summary.toLowerCase().includes('conditional access policy updated')) {
  2401.                             const { initiatedBy, targetResources, activityDateTime, activityDisplayName, result } =
  2402.                                 azure;
  2403.  
  2404.                             const alertExtraInfo = {
  2405.                                 userPrincipalName: initiatedBy?.user?.userPrincipalName
  2406.                                     ? initiatedBy?.user?.userPrincipalName
  2407.                                     : undefined,
  2408.                                 displayName: targetResources[0]?.displayName
  2409.                                     ? targetResources[0]?.displayName
  2410.                                     : undefined,
  2411.                                 activityDateTime: activityDateTime ? activityDateTime : undefined,
  2412.                                 activityDisplayName: activityDisplayName ? activityDisplayName : undefined,
  2413.                                 result: result ? result : undefined
  2414.                             };
  2415.                             acc.push({ alertExtraInfo });
  2416.                         } else {
  2417.                             if (resource.type == 'User') {
  2418.                                 const resourceProperties = { TargetUser: resource.userPrincipalName };
  2419.                                 properties = { ...properties, ...resourceProperties };
  2420.                             }
  2421.                             for (const prop of resource.modifiedProperties) {
  2422.                                 properties = { ...properties, [prop['displayName']]: prop['newValue'] };
  2423.                             }
  2424.                             const activityDateTime = azure.activityDateTime.split('.')[0] + 'Z';
  2425.                             acc.push({
  2426.                                 activityDateTime: activityDateTime,
  2427.                                 AppDisplayName: azure?.appDisplayName || azure?.initiatedBy?.app?.displayName,
  2428.                                 SourceUser: azure?.userPrincipalName || azure?.initiatedBy?.user?.userPrincipalName,
  2429.                                 IpAddress: azure?.ipAddress || azure?.initiatedBy?.user?.ipAddress,
  2430.                                 Location:
  2431.                                     azure?.location?.countryOrRegion && azure?.location?.state && azure?.location?.city
  2432.                                         ? `${azure?.location?.countryOrRegion}\\${azure?.location?.state}\\${azure?.location?.city}`
  2433.                                         : undefined,
  2434.                                 ...properties,
  2435.                                 Result: azure?.status?.failureReason || azure.result,
  2436.                                 AdditionalInfo: azure?.additionalDetails[0]?.value
  2437.                                     ? azure?.additionalDetails[0]?.value
  2438.                                     : undefined
  2439.                             });
  2440.                         }
  2441.                     }
  2442.                 } else {
  2443.                     const activityDateTime = azure.createdDateTime;
  2444.                     acc.push({
  2445.                         activityDateTime: activityDateTime,
  2446.                         AppDisplayName: azure?.appDisplayName || azure?.initiatedBy?.app?.displayName,
  2447.                         SourceUser: azure?.userPrincipalName || azure?.initiatedBy?.user?.userPrincipalName,
  2448.                         IpAddress: azure?.ipAddress || azure?.initiatedBy?.user?.ipAddress,
  2449.                         Location:
  2450.                             azure?.location?.countryOrRegion && azure?.location?.state && azure?.location?.city
  2451.                                 ? `${azure?.location?.countryOrRegion}\\${azure?.location?.state}\\${azure?.location?.city}`
  2452.                                 : undefined,
  2453.                         ...properties,
  2454.                         DeviceName: azure.deviceDetail.displayName || 'N/A',
  2455.                         failureReason: azure?.status?.failureReason || azure.result
  2456.                     });
  2457.                 }
  2458.             } catch (error) {
  2459.                 console.log(`Error: ${error}`);
  2460.             }
  2461.             return acc;
  2462.         }, []);
  2463.         return alertInfo;
  2464.     }
  2465.  
  2466.     const alertInfo = parseLog(rawLog);
  2467.     const num_alert = $('#customfield_10300-val').text().trim();
  2468.     function generateDescription() {
  2469.         const alertDescriptions = [];
  2470.         if (raw_alert < num_alert) {
  2471.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  2472.             alertDescriptions.push(extra_message);
  2473.         }
  2474.         if (summary.toLowerCase().includes('conditional access policy updated')) {
  2475.             for (const info of alertInfo) {
  2476.                 console.log(info['alertExtraInfo']['userPrincipalName']);
  2477.                 let desc = `Observed  the user "${
  2478.                     info['alertExtraInfo']['userPrincipalName']
  2479.                 }" was on (<span class="red_highlight">GMT</span>)${
  2480.                     info['alertExtraInfo']['activityDateTime'].split('.')[0]
  2481.                 }ZS Updated the conditional access policy "${info['alertExtraInfo']['displayName']}"\n\n`;
  2482.                 for (const key in info.alertExtraInfo) {
  2483.                     if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  2484.                         const value = info.alertExtraInfo[key];
  2485.                         if (
  2486.                             value !== undefined &&
  2487.                             key != 'userPrincipalName' &&
  2488.                             key != 'displayName' &&
  2489.                             key != 'activityDateTime'
  2490.                         ) {
  2491.                             desc += `${key}: ${value}\n`;
  2492.                         }
  2493.                     }
  2494.                 }
  2495.                 desc += `\nIt is recommended that you verify that the user has permission to change the conditional access policy and that the action is a legitimate update known to the user. Thanks!\n`;
  2496.                 alertDescriptions.push(desc);
  2497.             }
  2498.         } else {
  2499.             for (const info of alertInfo) {
  2500.                 let desc = `Observed ${summary.split(']')[1]}\n`;
  2501.                 console.log(info);
  2502.                 for (const key in info) {
  2503.                     if (Object.hasOwnProperty.call(info, key)) {
  2504.                         const value = info[key];
  2505.                         if (value !== undefined && value !== '' && key != 'summary' && key != 'alerturi') {
  2506.                             if (key == 'activityDateTime') {
  2507.                                 desc += `activityDateTime(<span class="red_highlight">GMT</span>): ${value}\n`;
  2508.                             } else {
  2509.                                 desc += `${key}: ${value}\n`;
  2510.                             }
  2511.                         }
  2512.                     }
  2513.                 }
  2514.                 desc += `\nPlease verify if the activity is legitimate.\n`;
  2515.                 alertDescriptions.push(desc);
  2516.             }
  2517.         }
  2518.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  2519.         showDialog(alertMsg);
  2520.     }
  2521.  
  2522.     addButton('generateDescription', 'Description', generateDescription);
  2523. }
  2524.  
  2525. function ProofpointAlertHandler(...kwargs) {
  2526.     const { summary, rawLog } = kwargs[0];
  2527.     var raw_alert = 0;
  2528.     function parseLog(rawLog) {
  2529.         const alertInfo = rawLog.reduce((acc, log) => {
  2530.             try {
  2531.                 const BraceIndex = log.toString().indexOf('{');
  2532.                 const lastBraceIndex = log.toString().lastIndexOf('}');
  2533.                 // If the braces are found
  2534.                 if (BraceIndex !== -1) {
  2535.                     raw_alert += 1;
  2536.                     console.log(`${raw_alert} iteration 'is being processed`);
  2537.                     // Intercepts a substring from the beginning of the brace to the end of the string
  2538.                     json_text = log.toString().substr(BraceIndex, lastBraceIndex);
  2539.                     try {
  2540.                         let json_alert = JSON.parse(json_text);
  2541.                         if (json_alert.hasOwnProperty('messagesDelivered')) {
  2542.                             for (const message of json_alert['messagesDelivered']) {
  2543.                                 const { subject, sender, senderIP, recipient } = message;
  2544.                                 const alertExtraInfo = {
  2545.                                     subject: subject ? subject : undefined,
  2546.                                     sender: sender ? sender : undefined,
  2547.                                     recipient: recipient ? recipient : undefined,
  2548.                                     senderIP: senderIP ? senderIP : undefined
  2549.                                 };
  2550.                                 acc.push({ alertExtraInfo });
  2551.                             }
  2552.                         } else if (json_alert['sourcetype'].includes('clicksPermitted')) {
  2553.                             json_alert['clickTime'] = json_alert['clickTime'].split('.')[0];
  2554.                             json_alert['threatTime'] = json_alert['threatTime'].split('.')[0];
  2555.                             acc.push({ alertExtraInfo: json_alert });
  2556.                             console.log('hellO');
  2557.                         } else {
  2558.                             const {
  2559.                                 subject,
  2560.                                 sender,
  2561.                                 senderIP,
  2562.                                 recipient,
  2563.                                 headerFrom,
  2564.                                 messageTime,
  2565.                                 threatsInfoMap,
  2566.                                 sourcetype,
  2567.                                 spamScore,
  2568.                                 phishScore,
  2569.                                 cluster,
  2570.                                 completelyRewritten,
  2571.                                 id,
  2572.                                 QID,
  2573.                                 GUID
  2574.                             } = json_alert;
  2575.                             let alertExtraInfo = {
  2576.                                 sourcetype: sourcetype ? sourcetype : undefined,
  2577.                                 messageTime: messageTime ? messageTime : undefined,
  2578.                                 subject: subject ? subject : undefined,
  2579.                                 senderIP: senderIP ? senderIP : undefined,
  2580.                                 sender: sender ? sender : undefined,
  2581.                                 recipient: recipient ? recipient : undefined,
  2582.                                 headerFrom: headerFrom ? headerFrom : undefined,
  2583.                                 spamScore: spamScore ? spamScore : undefined,
  2584.                                 phishScore: phishScore ? phishScore : undefined,
  2585.                                 cluster: cluster ? cluster : undefined,
  2586.                                 completelyRewritten: completelyRewritten ? completelyRewritten : undefined,
  2587.                                 id: id ? id : undefined,
  2588.                                 QID: QID ? QID : undefined,
  2589.                                 GUID: GUID ? GUID : undefined
  2590.                             };
  2591.                             alertExtraInfo = Object.assign({}, alertExtraInfo, threatsInfoMap[0]);
  2592.                             acc.push({ alertExtraInfo });
  2593.                         }
  2594.                     } catch (error) {
  2595.                         console.log('Unable to parse JSON data, handling exception: ' + error);
  2596.                         var split_str = json_text
  2597.                             .split('"messagesDelivered" :')[1]
  2598.                             .split('"messagesBlocked" :')[0]
  2599.                             .slice(1, -2);
  2600.                         const json_alerts = JSON.parse(split_str);
  2601.                         for (const alert of json_alerts) {
  2602.                             const { subject, sender, senderIP, recipient } = alert;
  2603.                             console.log(subject, recipient);
  2604.                             const alertExtraInfo = {
  2605.                                 subject: subject ? subject : undefined,
  2606.                                 sender: sender ? sender : undefined,
  2607.                                 recipient: recipient ? recipient : undefined,
  2608.                                 senderIP: senderIP ? senderIP : undefined
  2609.                             };
  2610.                             acc.push({ alertExtraInfo });
  2611.                         }
  2612.                     }
  2613.                 }
  2614.             } catch (error) {
  2615.                 console.log(`Error: ${error.message}`);
  2616.             }
  2617.             return acc;
  2618.         }, []);
  2619.         return alertInfo;
  2620.     }
  2621.  
  2622.     const alertInfo = parseLog(rawLog);
  2623.     const num_alert = $('#customfield_10300-val').text().trim();
  2624.     console.log('reduce the methods iterated altogether' + num_alert + ' times');
  2625.     function generateDescription() {
  2626.         const alertDescriptions = [];
  2627.         if (raw_alert < num_alert) {
  2628.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  2629.             alertDescriptions.push(extra_message);
  2630.         }
  2631.         for (const info of alertInfo) {
  2632.             let desc = `Observed ${summary.split(']')[1]}\n`;
  2633.             for (const key in info.alertExtraInfo) {
  2634.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  2635.                     const value = info.alertExtraInfo[key];
  2636.                     if (value !== undefined) {
  2637.                         if (key == 'messageTime' || key == 'clickTime' || key == 'threatTime') {
  2638.                             desc += `${key}(<span class="red_highlight">GMT</span>): ${value.split('.')[0]}\n`;
  2639.                         } else {
  2640.                             desc += `${key}: ${value}\n`;
  2641.                         }
  2642.                     }
  2643.                 }
  2644.             }
  2645.             desc += `\nPlease verify if the activity is legitimate.\n`;
  2646.             alertDescriptions.push(desc);
  2647.         }
  2648.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  2649.         showDialog(alertMsg);
  2650.     }
  2651.  
  2652.     addButton('generateDescription', 'Description', generateDescription);
  2653. }
  2654.  
  2655. function ZscalerAlertHandler(...kwargs) {
  2656.     const { summary, rawLog } = kwargs[0];
  2657.     var raw_alert = 0;
  2658.     function parseLog(rawLog) {
  2659.         const alertInfo = rawLog.reduce((acc, log) => {
  2660.             try {
  2661.                 const BraceIndex = log.toString().indexOf('{');
  2662.                 const lastBraceIndex = log.toString().lastIndexOf('}');
  2663.  
  2664.                 // If the braces are found
  2665.                 if (BraceIndex !== -1) {
  2666.                     raw_alert += 1;
  2667.                     // Intercepts a substring from the beginning of the brace to the end of the string
  2668.                     json_text = log.toString().substr(BraceIndex, lastBraceIndex);
  2669.                     const json_alert = JSON.parse(json_text);
  2670.                     const { PrivateIP, PublicIP, Username, Customer, Hostname } = json_alert;
  2671.                     const alertExtraInfo = {
  2672.                         Hostname: Hostname ? Hostname : undefined,
  2673.                         PublicIP: PublicIP ? PublicIP : undefined,
  2674.                         PrivateIP: PrivateIP ? PrivateIP : undefined,
  2675.                         Username: Username ? Username : undefined,
  2676.                         Customer: Customer ? Customer : undefined
  2677.                     };
  2678.                     acc.push({ alertExtraInfo });
  2679.                 }
  2680.             } catch (error) {
  2681.                 console.log(`Error: ${error.message}`);
  2682.             }
  2683.             return acc;
  2684.         }, []);
  2685.         return alertInfo;
  2686.     }
  2687.  
  2688.     const alertInfo = parseLog(rawLog);
  2689.     const num_alert = $('#customfield_10300-val').text().trim();
  2690.     function generateDescription() {
  2691.         const alertDescriptions = [];
  2692.         if (raw_alert < num_alert) {
  2693.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  2694.             alertDescriptions.push(extra_message);
  2695.         }
  2696.         for (const info of alertInfo) {
  2697.             let desc = `Observed ${summary.split(']')[1]}\n`;
  2698.             for (const key in info.alertExtraInfo) {
  2699.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  2700.                     const value = info.alertExtraInfo[key];
  2701.                     if (value !== undefined) {
  2702.                         desc += `${key}: ${value}\n`;
  2703.                     }
  2704.                 }
  2705.             }
  2706.             desc += `\nPlease verify if the ip is legitimate.\n`;
  2707.             alertDescriptions.push(desc);
  2708.         }
  2709.         const alertMsg = [...new Set(alertDescriptions)].join('\n'); //Can achieve automatic deduplication
  2710.         showDialog(alertMsg);
  2711.     }
  2712.     addButton('generateDescription', 'Description', generateDescription);
  2713. }
  2714.  
  2715. function PulseAlertHandler(...kwargs) {
  2716.     var { summary, rawLog } = kwargs[0];
  2717.     var raw_alert = 0;
  2718.     if (rawLog == '') {
  2719.         var rawLog = $('#customfield_10219-val').text().trim().split('\n');
  2720.     }
  2721.     function parseLog(rawLog) {
  2722.         const alertInfo = rawLog.reduce((acc, log) => {
  2723.             try {
  2724.                 if (log.includes('PulseSecure')) {
  2725.                     var firstIndex = log.indexOf('PulseSecure:');
  2726.                     let time_text = '';
  2727.                     if (summary.toLowerCase().includes('suspicious geolocation ip login success')) {
  2728.                         time_text = log.toString().substr(0, firstIndex);
  2729.                     } else {
  2730.                         time_text = log.toString().substr(firstIndex + 13);
  2731.                         const first_bar = time_text.indexOf(':');
  2732.                         time_text = time_text.toString().substr(0, first_bar + 6);
  2733.                     }
  2734.                     const lastIndex = log.toString().lastIndexOf('Vendor)');
  2735.                     let alert_text = log
  2736.                         .toString()
  2737.                         .substr(lastIndex + 7)
  2738.                         .replace('[][] -', '');
  2739.                     const lastIndex_ = alert_text.toString().lastIndexOf(' - ');
  2740.                     alert_text = alert_text.substr(lastIndex_ + 2);
  2741.                     let first = log.indexOf('- ');
  2742.                     let second = log.indexOf(' - [');
  2743.                     let vpn_name = log.toString().substring(first + 2, second) + ' ';
  2744.                     const alert_content = '\n' + vpn_name + alert_text + ' On ' + time_text + '\n';
  2745.                     acc.push(alert_content);
  2746.                     raw_alert += 1;
  2747.                 }
  2748.             } catch (error) {
  2749.                 console.log(`Error: ${error.message}`);
  2750.             }
  2751.             return acc;
  2752.         }, []);
  2753.         return alertInfo;
  2754.     }
  2755.     const alertInfo = parseLog(rawLog);
  2756.     const num_alert = $('#customfield_10300-val').text().trim();
  2757.     function generateDescription() {
  2758.         const alertDescriptions = [];
  2759.         if (raw_alert < num_alert) {
  2760.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  2761.             alertDescriptions.push(extra_message);
  2762.         }
  2763.         let desc = `Observed ${summary.split(']')[1]}\n`;
  2764.         desc += alertInfo;
  2765.         desc += `\n\nPlease verify if the login is legitimate.\n`;
  2766.         alertDescriptions.push(desc);
  2767.         const alertMsg = [...new Set(alertDescriptions)].join('\n'); //Can achieve automatic deduplication
  2768.         showDialog(alertMsg);
  2769.     }
  2770.     addButton('generateDescription', 'Description', generateDescription);
  2771. }
  2772.  
  2773. function Risky_Countries_AlertHandler(...kwargs) {
  2774.     var { summary, rawLog } = kwargs[0];
  2775.     function parseLog(rawLog) {
  2776.         const alertInfo = rawLog.reduce((acc, log) => {
  2777.             try {
  2778.                 const json_alert = JSON.parse(log);
  2779.                 if (json_alert.hasOwnProperty('azure')) {
  2780.                     const {
  2781.                         createdDateTime,
  2782.                         userDisplayName,
  2783.                         userPrincipalName,
  2784.                         ipAddress,
  2785.                         appDisplayName,
  2786.                         deviceDetail,
  2787.                         status
  2788.                     } = json_alert['azure'];
  2789.                     const { failureReason, additionalDetails } = status;
  2790.                     const { displayName, operatingSystem } = deviceDetail;
  2791.  
  2792.                     const alertExtraInfo = {
  2793.                         createdEventDateTime: createdDateTime ? createdDateTime : undefined,
  2794.                         userDisplayName: userDisplayName ? userDisplayName : undefined,
  2795.                         userPrincipalName: userPrincipalName ? userPrincipalName : undefined,
  2796.                         appDisplayName: appDisplayName ? appDisplayName : undefined,
  2797.                         ipAddress: ipAddress ? ipAddress : undefined,
  2798.                         operatingSystem: operatingSystem ? operatingSystem : undefined,
  2799.                         DeviceName: displayName ? displayName : 'N/A',
  2800.                         failureReason: failureReason ? failureReason : undefined,
  2801.                         additionalDetails: additionalDetails ? additionalDetails : undefined
  2802.                     };
  2803.                     acc.push({ alertExtraInfo });
  2804.                 }
  2805.                 if (json_alert.hasOwnProperty('office_365')) {
  2806.                     let alertExtraInfo;
  2807.                     if (json_alert['office_365'].hasOwnProperty('Data')) {
  2808.                         console.log(JSON.parse(json_alert['office_365']['Data']));
  2809.                         let data = JSON.parse(json_alert['office_365']['Data']);
  2810.                         alertExtraInfo = {
  2811.                             CreationEventTime: data['wsrt'] ? data['wsrt'] : undefined,
  2812.                             Username: data['f3u'] ? data['f3u'] : undefined,
  2813.                             Workload: data['wl'] ? data['wl'] : undefined,
  2814.                             Reason: data['ad'] ? data['ad'] : undefined
  2815.                         };
  2816.                     } else if (!json_alert['office_365'].hasOwnProperty('ClientIP')) {
  2817.                         let data = json_alert['office_365'];
  2818.                         alertExtraInfo = {
  2819.                             CreationEventTime: data['CreationTime'] ? data['CreationTime'] : undefined,
  2820.                             Operation: data['Operation'] ? data['Operation'] : undefined,
  2821.                             ResultStatus: data['ResultStatus'] ? data['ResultStatus'] : undefined,
  2822.                             UserId: data['UserId'] ? data['UserId'] : undefined,
  2823.                             ObjectId: data['ObjectId'] ? data['ObjectId'] : undefined,
  2824.                             UserKey: data['UserKey'] ? data['UserKey'] : undefined
  2825.                         };
  2826.                     } else {
  2827.                         const {
  2828.                             CreationTime,
  2829.                             Operation,
  2830.                             Workload,
  2831.                             ClientIP,
  2832.                             UserId,
  2833.                             ResultStatusDetail,
  2834.                             UserAgent,
  2835.                             ActorIpAddress,
  2836.                             DeviceProperties,
  2837.                             UserKey
  2838.                         } = json_alert['office_365'];
  2839.  
  2840.                         let devicename = '';
  2841.                         DeviceProperties.forEach((item) => {
  2842.                             if (item.Name === 'DisplayName') {
  2843.                                 devicename = item.Value;
  2844.                             }
  2845.                         });
  2846.                         alertExtraInfo = {
  2847.                             CreationEventTime: CreationTime ? CreationTime : undefined,
  2848.                             Operation: Operation ? Operation : undefined,
  2849.                             Workload: Workload ? Workload : undefined,
  2850.                             UserId: UserId ? UserId : undefined,
  2851.                             ClientIP: ClientIP ? ClientIP : undefined,
  2852.                             ActorIpAddress: ActorIpAddress ? ActorIpAddress : undefined,
  2853.                             UserAgent: UserAgent ? UserAgent : undefined,
  2854.                             DeviceName: devicename ? devicename : 'N/A',
  2855.                             UserKey: UserKey ? UserKey : undefined,
  2856.                             ResultStatusDetail: ResultStatusDetail ? ResultStatusDetail : undefined
  2857.                         };
  2858.                     }
  2859.  
  2860.                     acc.push({ alertExtraInfo });
  2861.                 }
  2862.             } catch (error) {
  2863.                 console.log(`Error: ${error.message}`);
  2864.             }
  2865.             return acc;
  2866.         }, []);
  2867.         return alertInfo;
  2868.     }
  2869.     const alertInfo = parseLog(rawLog);
  2870.     function generateDescription() {
  2871.         const alertDescriptions = [];
  2872.         console.log(alertInfo);
  2873.         for (const info of alertInfo) {
  2874.             const lastindex = summary.lastIndexOf(']');
  2875.  
  2876.             let desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  2877.             for (const key in info.alertExtraInfo) {
  2878.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  2879.                     const value = info.alertExtraInfo[key];
  2880.                     if (value !== undefined) {
  2881.                         if (key == 'CreationEventTime') {
  2882.                             desc += `CreationEventTime(<span class="red_highlight">GMT</span>): ${value}\n`;
  2883.                         } else {
  2884.                             desc += `${key}: ${value}\n`;
  2885.                         }
  2886.                     }
  2887.                 }
  2888.             }
  2889.             desc += `\nPlease verify if the activity is legitimate.\n`;
  2890.             alertDescriptions.push(desc);
  2891.         }
  2892.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  2893.         showDialog(alertMsg);
  2894.     }
  2895.  
  2896.     addButton('generateDescription', 'Description', generateDescription);
  2897. }
  2898.  
  2899. function Agent_Disconnect_AlertHandler(...kwargs) {
  2900.     var { summary, rawLog } = kwargs[0];
  2901.     const LogSource = $('#customfield_10204-val').text().trim().split('\n');
  2902.     function parseLog(LogSource) {
  2903.         const alertInfo = LogSource.reduce((acc, log) => {
  2904.             try {
  2905.                 log = log.replace(/\s/g, '');
  2906.                 if (log == 'Show' || log == 'Hide' || log.length == 0) {
  2907.                     console.log('ss');
  2908.                 } else {
  2909.                     acc.push(log);
  2910.                     console.log(log);
  2911.                 }
  2912.             } catch (error) {
  2913.                 console.log(`Error: ${error.message}`);
  2914.             }
  2915.             return acc;
  2916.         }, []);
  2917.         return alertInfo;
  2918.     }
  2919.     let alertInfo = [...new Set(parseLog(LogSource))];
  2920.     function generateDescription() {
  2921.         const alertDescriptions = [];
  2922.  
  2923.         const lastindex = summary.lastIndexOf(']');
  2924.         let desc = `Observed ${summary.substr(lastindex + 1)}, kindly please help to check it.\n`;
  2925.         desc += `\nagent name:  ${alertInfo.join(',')}`;
  2926.         alertDescriptions.push(desc);
  2927.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  2928.         showDialog(alertMsg);
  2929.     }
  2930.     function openMDE() {
  2931.         let KQL = '';
  2932.         KQL += `name=${alertInfo.join(' or name=')} \n`;
  2933.         showFlag('info', 'KQL:', `${KQL}`, 'manual');
  2934.     }
  2935.     addButton('generateDescription', 'Description', generateDescription);
  2936.     addButton('openKQL', 'KQL', openMDE);
  2937. }
  2938.  
  2939. function MdbAlertHandler(...kwargs) {
  2940.     var { summary, rawLog } = kwargs[0];
  2941.     if (rawLog.length == 0 || rawLog.length == 1) {
  2942.         rawLog = $('#customfield_10219-val').text().trim().split('\n');
  2943.     }
  2944.     function parseLog(rawLog) {
  2945.         const alertInfo = rawLog.reduce((acc, log) => {
  2946.             try {
  2947.                 if (log.length == 0) {
  2948.                     return acc;
  2949.                 }
  2950.                 if (summary.toLowerCase().includes('syslog: user missed the password more than one time')) {
  2951.                     let log_ = log.split(';')[1].split(' ');
  2952.                     let time_host = log.split(' sshd')[0].split(' ');
  2953.                     let user = '';
  2954.                     if (log_.length > 7) {
  2955.                         user = log_[8].split('=')[1];
  2956.                     }
  2957.                     let description = `Observed user<span class='black_highlight'> ${user}</span> multiple ssh login failed from ${
  2958.                         log_[6].split('=')[1]
  2959.                     }\nCreateTime: ${time_host
  2960.                         .slice(0, time_host.length - 1)
  2961.                         .join(' ')}\nHostname: <span class='black_highlight'> ${
  2962.                         time_host[time_host.length - 1]
  2963.                     }</span>\n`;
  2964.  
  2965.                     acc.push(description);
  2966.                 }
  2967.                 if (summary.toLowerCase().includes('sshd: insecure connection attempt')) {
  2968.                     let log_ = log.split(' ');
  2969.                     console.log('log', log_);
  2970.                     let description = `Observed insecure connection attempt from ${
  2971.                         log_[log_.length - 3]
  2972.                     }\nCreateTime: ${log_.slice(0, log_.length - 11).join(' ')}\n`;
  2973.                     acc.push(description);
  2974.                 }
  2975.                 if (
  2976.                     summary
  2977.                         .toLowerCase()
  2978.                         .includes('anomaly: suspected lateral movement - linux containing session opened')
  2979.                 ) {
  2980.                     let log_ = log.split('>')[1] + '\n';
  2981.                     console.log('log', log_);
  2982.                     acc.push(log_);
  2983.                 }
  2984.             } catch (error) {
  2985.                 console.log(`Error: ${error.message}`);
  2986.             }
  2987.             return acc;
  2988.         }, []);
  2989.         return alertInfo;
  2990.     }
  2991.     const alertInfo = parseLog(rawLog);
  2992.     function generateDescription() {
  2993.         const alertDescriptions = [];
  2994.         if (summary.toLowerCase().includes('anomaly: suspected lateral movement - linux containing session opened')) {
  2995.             const Log_source = $('#customfield_10204-val').text().trim();
  2996.             alertDescriptions.push(`Observed  session opened on <span class='black_highlight'>${Log_source}</span>\n`);
  2997.         }
  2998.         for (const info of alertInfo) {
  2999.             alertDescriptions.push(info);
  3000.         }
  3001.         if (summary.toLowerCase().includes('sshd: insecure connection attempt')) {
  3002.             alertDescriptions.push('Kindly help to verify if the connection is legitimate\n');
  3003.         }
  3004.         if (summary.toLowerCase().includes('syslog: user missed the password more than one time')) {
  3005.             alertDescriptions.push('Kindly help to verify if the login is legitimate\n');
  3006.         }
  3007.         if (summary.toLowerCase().includes('anomaly: suspected lateral movement - linux containing session opened')) {
  3008.             alertDescriptions.push('Kindly help to verify if the session is legitimate\n');
  3009.         }
  3010.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  3011.         showDialog(alertMsg);
  3012.     }
  3013.  
  3014.     addButton('generateDescription', 'Description', generateDescription);
  3015. }
  3016.  
  3017. function AlicloudAlertHandler(...kwargs) {
  3018.     var { summary, rawLog } = kwargs[0];
  3019.     var raw_alert = 0;
  3020.     function parseLog(rawLog) {
  3021.         const alertInfo = rawLog.reduce((acc, log) => {
  3022.             try {
  3023.                 const BraceIndex = log.toString().indexOf('{');
  3024.                 const lastBraceIndex = log.toString().lastIndexOf('}');
  3025.                 if (BraceIndex !== -1) {
  3026.                     raw_alert += 1;
  3027.                     // Intercepts a substring from the beginning of the brace to the end of the string
  3028.                     json_text = log.toString().substr(BraceIndex, lastBraceIndex);
  3029.                     let time_1 = log.toString().substr(0, BraceIndex).split(' ');
  3030.                     let time = time_1.slice(time_1.length - 4, time_1.length - 2).join(' ');
  3031.                     time = time_1[0] + ' ' + time;
  3032.                     try {
  3033.                         const json_alert = JSON.parse(json_text);
  3034.                         let {
  3035.                             eventId,
  3036.                             uuid,
  3037.                             eventName,
  3038.                             resourceName,
  3039.                             sourceIpAddress,
  3040.                             userIdentity,
  3041.                             intranet_ip,
  3042.                             internet_ip,
  3043.                             instance_id,
  3044.                             extend_content,
  3045.                             detail,
  3046.                             requestParameters,
  3047.                             responseElements
  3048.                         } = json_alert['alicloud'];
  3049.                         let alertExtraInfo = {
  3050.                             createTime: time,
  3051.                             eventId: eventId ? eventId : undefined,
  3052.                             uuid: uuid ? uuid : undefined,
  3053.                             eventName: eventName ? eventName : undefined,
  3054.                             InstanceId: resourceName ? resourceName : undefined,
  3055.                             sourceIpAddress: sourceIpAddress ? sourceIpAddress : undefined,
  3056.                             userName: userIdentity?.userName ? userIdentity?.userName : undefined,
  3057.                             internet_ip: internet_ip ? internet_ip : undefined,
  3058.                             intranet_ip: intranet_ip ? intranet_ip : undefined,
  3059.                             instance_id: instance_id ? instance_id : undefined,
  3060.                             extend_content: extend_content ? extend_content : undefined,
  3061.                             responseElements: responseElements ? JSON.stringify(responseElements) : undefined
  3062.                         };
  3063.                         console.log('===', requestParameters, time);
  3064.  
  3065.                         if (detail != undefined) {
  3066.                             detail = JSON.parse(detail);
  3067.                             alertExtraInfo = Object.assign({}, alertExtraInfo, detail);
  3068.                         }
  3069.                         if (requestParameters != undefined) {
  3070.                             alertExtraInfo = Object.assign({}, alertExtraInfo, requestParameters);
  3071.                         }
  3072.  
  3073.                         console.log(alertExtraInfo);
  3074.                         acc.push({ alertExtraInfo });
  3075.                     } catch (error) {
  3076.                         console.log('Unable to parse JSON data, handling exception: ' + error);
  3077.                     }
  3078.                 }
  3079.             } catch (error) {
  3080.                 console.log(`Error: ${error.message}`);
  3081.             }
  3082.             return acc;
  3083.         }, []);
  3084.         return alertInfo;
  3085.     }
  3086.  
  3087.     const alertInfo = parseLog(rawLog);
  3088.     function generateDescription() {
  3089.         const alertDescriptions = [];
  3090.         for (const info of alertInfo) {
  3091.             const lastindex = summary.lastIndexOf(']');
  3092.             let desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  3093.             for (const key in info.alertExtraInfo) {
  3094.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  3095.                     const value = info.alertExtraInfo[key];
  3096.                     if (value !== undefined) {
  3097.                         desc += `${key}: ${value}\n`;
  3098.                     }
  3099.                 }
  3100.             }
  3101.             desc += `\nPlease verify if the activity is legitimate.\n`;
  3102.             alertDescriptions.push(desc);
  3103.         }
  3104.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  3105.         showDialog(alertMsg);
  3106.     }
  3107.  
  3108.     addButton('generateDescription', 'Description', generateDescription);
  3109. }
  3110.  
  3111. function DstAlertHandler(...kwargs) {
  3112.     var rawLog = $('#field-customfield_10904').text().trim().split('\n');
  3113.     function parseLog(rawLog) {
  3114.         const alertInfo = rawLog.reduce((acc, log) => {
  3115.             try {
  3116.                 const json_alert = JSON.parse(log);
  3117.                 const { system, eventdata } = json_alert['win'];
  3118.                 const alertExtraInfo = {
  3119.                     computer: system?.computer ? system?.computer : undefined,
  3120.                     commandLine: eventdata?.commandLine ? eventdata?.commandLine : undefined
  3121.                 };
  3122.                 acc.push({ alertExtraInfo });
  3123.             } catch (error) {
  3124.                 console.log(`Error: ${error.message}`);
  3125.             }
  3126.             return acc;
  3127.         }, []);
  3128.         return alertInfo;
  3129.     }
  3130.     const alertInfo = parseLog(rawLog);
  3131.     function generateDescription() {
  3132.         const alertDescriptions = [];
  3133.         for (const info of alertInfo) {
  3134.             let desc = ``;
  3135.             for (const key in info.alertExtraInfo) {
  3136.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  3137.                     const value = info.alertExtraInfo[key];
  3138.                     if (value !== undefined) {
  3139.                         desc += `${key}: ${value}\n`;
  3140.                     }
  3141.                 }
  3142.             }
  3143.             alertDescriptions.push(desc);
  3144.         }
  3145.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  3146.         showDialog(alertMsg);
  3147.     }
  3148.  
  3149.     addButton('generateDescription', 'Description', generateDescription);
  3150. }
  3151.  
  3152. function ThreatMatrixAlertHandler(...kwargs) {
  3153.     var { summary, rawLog } = kwargs[0];
  3154.     function parseLog(rawLog) {
  3155.         const alertInfo = rawLog.reduce((acc, log) => {
  3156.             try {
  3157.                 const json_alert = JSON.parse(log);
  3158.                 console.log(json_alert['threatmatrix']);
  3159.                 const {
  3160.                     account_telephone,
  3161.                     account_login,
  3162.                     application_name,
  3163.                     customer_event_type,
  3164.                     input_ip_address,
  3165.                     event_datetime,
  3166.                     input_ip_city,
  3167.                     input_ip_geo,
  3168.                     input_ip_isp,
  3169.                     input_ip_organization,
  3170.                     policy,
  3171.                     tmx_risk_rating,
  3172.                     request_result
  3173.                 } = json_alert['threatmatrix'];
  3174.                 const alertExtraInfo = {
  3175.                     account_telephone: account_telephone ? account_telephone : undefined,
  3176.                     account_login: account_login ? account_login : undefined,
  3177.                     application_name: application_name ? application_name : undefined,
  3178.                     customer_event_type: customer_event_type ? customer_event_type : undefined,
  3179.                     input_ip_address: input_ip_address ? input_ip_address : undefined,
  3180.                     input_ip_city: input_ip_city ? input_ip_city : undefined,
  3181.                     input_ip_geo: input_ip_geo ? input_ip_geo : undefined,
  3182.                     input_ip_isp: input_ip_isp ? input_ip_isp : undefined,
  3183.                     input_ip_organization: input_ip_organization ? input_ip_organization : undefined,
  3184.                     policy: policy ? policy : undefined,
  3185.                     tmx_risk_rating: tmx_risk_rating ? tmx_risk_rating : undefined,
  3186.                     request_result: request_result ? request_result : undefined,
  3187.                     event_datetime: event_datetime ? event_datetime.split('.')[0] : undefined
  3188.                 };
  3189.                 acc.push({ alertExtraInfo });
  3190.             } catch (error) {
  3191.                 console.log(`Error: ${error.message}`);
  3192.             }
  3193.             return acc;
  3194.         }, []);
  3195.         return alertInfo;
  3196.     }
  3197.     const alertInfo = parseLog(rawLog);
  3198.     function generateDescription() {
  3199.         const alertDescriptions = [];
  3200.         for (const info of alertInfo) {
  3201.             const lastindex = summary.lastIndexOf(']');
  3202.             let desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  3203.             for (const key in info.alertExtraInfo) {
  3204.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  3205.                     const value = info.alertExtraInfo[key];
  3206.                     if (value !== undefined) {
  3207.                         desc += `${key}: ${value}\n`;
  3208.                     }
  3209.                 }
  3210.             }
  3211.             desc += `\nPlease verify if the login is legitimate.\n`;
  3212.             alertDescriptions.push(desc);
  3213.         }
  3214.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  3215.         showDialog(alertMsg);
  3216.     }
  3217.  
  3218.     addButton('generateDescription', 'Description', generateDescription);
  3219. }
  3220.  
  3221. function DarktraceAlertHandler(...kwargs) {
  3222.     var { summary, rawLog } = kwargs[0];
  3223.     var raw_alert = 0;
  3224.     var breach_Url;
  3225.     function parseLog(rawLog) {
  3226.         const alertInfo = rawLog.reduce((acc, log) => {
  3227.             try {
  3228.                 const BraceIndex = log.toString().indexOf('{');
  3229.                 const lastBraceIndex = log.toString().lastIndexOf('}');
  3230.                 const logarray = log.toString().split(' ');
  3231.                 if (BraceIndex !== -1) {
  3232.                     raw_alert += 1;
  3233.                     // Intercepts a substring from the beginning of the brace to the end of the string
  3234.                     json_text = log.toString().substr(BraceIndex, lastBraceIndex);
  3235.                     const json_alert = JSON.parse(json_text);
  3236.                     let alertExtraInfo = {},
  3237.                         Resource_paths = [];
  3238.                     breach_Url = json_alert['breachUrl'] + '<br>' + json_alert['incidentEventUrl'];
  3239.                     let year = ' 20' + $('#created-val').text().trim().split('/')[2].split(' ')[0]; //动态产生工单的年份
  3240.                     let time_str = logarray.slice(0, 3).join(' ') + year;
  3241.                     if (!time_str.includes(':')) {
  3242.                         time_str = logarray.slice(0, 4).join(' ').replace('  ', ' ') + year;
  3243.                     }
  3244.  
  3245.                     if (json_alert.hasOwnProperty('model')) {
  3246.                         const { device, triggeredComponents, model } = json_alert;
  3247.                         let User_agent = '',
  3248.                             Message;
  3249.                         alertExtraInfo = {
  3250.                             AlertTime: formatCurrentDateTime(time_str),
  3251.                             hostname: device?.hostname ? device?.hostname : undefined,
  3252.                             ip: device?.ip ? device?.ip : undefined,
  3253.                             credentials: device?.credentials ? device?.credentials : undefined,
  3254.                             subnetlabel: device?.ips ? device?.ips[0].subnetlabel : undefined,
  3255.                             typename: device?.typename ? device?.typename : undefined,
  3256.                             User_agent: User_agent ? User_agent : undefined,
  3257.                             saas_info: device?.customFields?.saasinfo
  3258.                                 ? device.customFields.saasinfo.saas_info
  3259.                                 : undefined,
  3260.                             Message: Message ? Message : undefined,
  3261.                             description: model?.description ? model?.description.replace(/\\\n/g, ' ') : undefined
  3262.                         };
  3263.                         triggeredComponents[0]['triggeredFilters'].forEach((item) => {
  3264.                             if (item['filterType'] == 'User agent' && item['id'] == 'O') {
  3265.                                 User_agent = item['arguments']['value'];
  3266.                                 console.log('value', item['arguments']['value']);
  3267.                             } else if (item['id'] == 'C') {
  3268.                                 Message = item['trigger']['value'];
  3269.                             } else if (
  3270.                                 item['filterType'].includes('IP') ||
  3271.                                 item['filterType'] == 'Resource Location' ||
  3272.                                 item['filterType'] == 'Event' ||
  3273.                                 item['filterType'] == 'Connection hostname'
  3274.                             ) {
  3275.                                 alertExtraInfo[item['filterType']] = item['trigger']['value'];
  3276.                             }
  3277.                         });
  3278.                     } else {
  3279.                         const { summary, breachDevices, details } = json_alert;
  3280.                         let values;
  3281.                         alertExtraInfo = {
  3282.                             AlertTime: formatCurrentDateTime(time_str),
  3283.                             hostname: breachDevices[0]?.hostname ? breachDevices[0]?.hostname : undefined,
  3284.                             host_ip: breachDevices[0]?.ip ? breachDevices[0]?.ip : undefined,
  3285.                             summary: summary ? summary : undefined
  3286.                         };
  3287.                         details.forEach((item) => {
  3288.                             if (item[0].header == 'Endpoint Details') {
  3289.                                 values = item[0].contents[0].values;
  3290.                                 item[0].contents.forEach((i) => {
  3291.                                     if (i.key == 'IP addresses associated with hostnames') {
  3292.                                         console.log(i);
  3293.                                         alertExtraInfo[i.type] = JSON.stringify(i.values);
  3294.                                     }
  3295.                                 });
  3296.                             }
  3297.                             item.forEach((ii) => {
  3298.                                 if (
  3299.                                     ii.header == 'Activity Details' ||
  3300.                                     ii.header == 'Details of Accessing Users' ||
  3301.                                     ii.header == 'Resource Access Details'
  3302.                                 ) {
  3303.                                     ii.contents.forEach((i) => {
  3304.                                         if (i['key'] == 'Resource paths include' || i['key'] == 'Resource path') {
  3305.                                             i['values'].forEach((iii) => {
  3306.                                                 Resource_paths.push(iii);
  3307.                                             });
  3308.                                         } else if (
  3309.                                             i['key'].includes('Source IPs') ||
  3310.                                             i['key'].includes('Actors include')
  3311.                                         ) {
  3312.                                             alertExtraInfo[i.key] = JSON.stringify(i.values);
  3313.                                         }
  3314.                                     });
  3315.                                 }
  3316.                             });
  3317.                         });
  3318.                         Resource_paths = [...new Set(Resource_paths)].join('\n');
  3319.                         alertExtraInfo['Resource_paths'] = Resource_paths ? Resource_paths : undefined;
  3320.                         alertExtraInfo['Endpoint Details'] = values ? values : undefined;
  3321.                     }
  3322.                     acc.push({ alertExtraInfo });
  3323.                 }
  3324.             } catch (error) {
  3325.                 console.log(`Error: ${error.message}`);
  3326.             }
  3327.             return acc;
  3328.         }, []);
  3329.         return alertInfo;
  3330.     }
  3331.     const alertInfo = parseLog(rawLog);
  3332.     const num_alert = $('#customfield_10300-val').text().trim();
  3333.     function generateDescription() {
  3334.         const alertDescriptions = [];
  3335.         if (raw_alert < num_alert) {
  3336.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  3337.             alertDescriptions.push(extra_message);
  3338.         }
  3339.         for (const info of alertInfo) {
  3340.             const lastindex = summary.lastIndexOf(']');
  3341.             let ss = summary.substr(lastindex + 1).split('::');
  3342.             let desc = `Observed ${ss[ss.length - 1]}\n\n`;
  3343.             for (const key in info.alertExtraInfo) {
  3344.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  3345.                     const value = info.alertExtraInfo[key];
  3346.                     if (value !== undefined) {
  3347.                         desc += `${key}: ${value}\n`;
  3348.                     }
  3349.                 }
  3350.             }
  3351.             desc += `\nPlease help to verify if this activity is legitimate.\n`;
  3352.             alertDescriptions.push(desc);
  3353.         }
  3354.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  3355.         showDialog(alertMsg);
  3356.     }
  3357.     function breachUrl() {
  3358.         showFlag('info', 'breach Url:', `${breach_Url.replace('hXXps[:]', 'https:')}`, 'manual');
  3359.     }
  3360.     addButton('generateDescription', 'Description', generateDescription);
  3361.     addButton('breachUrl', 'breachUrl', breachUrl);
  3362. }
  3363.  
  3364. function SangforAlertHandler(...kwargs) {
  3365.     var { summary, rawLog } = kwargs[0];
  3366.     function parseLog(rawLog) {
  3367.         const alertInfo = rawLog.reduce((acc, log) => {
  3368.             try {
  3369.                 if (log.length == 0) {
  3370.                     return acc;
  3371.                 }
  3372.                 const regex = /(\b\w+=)([^=\s].*?)(?=\s+\w+=|$)/g;
  3373.                 let match;
  3374.                 const matches = {};
  3375.                 while ((match = regex.exec(log)) !== null) {
  3376.                     let item = match[0].split('=');
  3377.                     matches[item[0]] = item.slice(1, item.length).join('=');
  3378.                 }
  3379.                 console.log(matches);
  3380.                 var pattern = /event_evidence.*?(?=suffer_classify1_id_name)/g;
  3381.                 console.log(log.match(pattern));
  3382.                 let logArray = log.split(' ').filter((item) => item !== ''); //Remove extra whitespace from the string
  3383.                 const DecoderName = $('#customfield_10807-val').text().trim().toLowerCase();
  3384.                 if (DecoderName == 'cyberark_cef') {
  3385.                     let data_json = {
  3386.                         'Event time': logArray.slice(0, 3).join(' '),
  3387.                         'event_desc': matches.event_desc ? matches.event_desc : undefined,
  3388.                         'dhost': matches.dhost ? matches.dhost : undefined,
  3389.                         'dst': matches.dst ? matches.dst : undefined,
  3390.                         'duser': matches.duser ? matches.duser : undefined,
  3391.                         'shost': matches.shost ? matches.shost : undefined,
  3392.                         'src': matches.src ? matches.src : undefined,
  3393.                         'suser': matches.suser ? matches.suser : undefined
  3394.                     };
  3395.                     data_json[matches.cs3Label] = matches.cs3 ? matches.cs3 : undefined;
  3396.                     acc.push(data_json);
  3397.                 } else if (DecoderName == 'trellix_cef') {
  3398.                     let data_json = {
  3399.                         filePath: matches.filePath ? matches.filePath : undefined,
  3400.                         rt: matches.rt ? matches.rt : undefined,
  3401.                         duser: matches.duser ? matches.duser : undefined,
  3402.                         msg: matches.msg ? matches.msg : undefined,
  3403.                         act: matches.act ? matches.act : undefined,
  3404.                         suser: matches.suser ? matches.suser.replace(/[<>]/g, '') : undefined,
  3405.                         fileType: matches.fileType ? matches.fileType : undefined,
  3406.                         subject: matches.subject ? matches.subject : undefined
  3407.                     };
  3408.                     data_json[matches.cs1Label] = matches.cs1 ? matches.cs1 : undefined;
  3409.                     data_json[matches.cs4Label] = matches.cs4 ? matches.cs4 : undefined;
  3410.                     data_json[matches.flexString2Label] = matches.flexString2 ? matches.flexString2 : undefined;
  3411.                     acc.push(data_json);
  3412.                 } else if (DecoderName == 'impervainc_cef') {
  3413.                     console.log('===', matches);
  3414.                     console.log('===start ', formatCurrentDateTime(parseInt(matches.start), 'impervainc_cef'));
  3415.                     let data_json = {
  3416.                         start_time: matches.start
  3417.                             ? formatCurrentDateTime(parseInt(matches.start), 'impervainc_cef')
  3418.                             : undefined,
  3419.                         end_time: matches.end
  3420.                             ? formatCurrentDateTime(parseInt(matches.end), 'impervainc_cef')
  3421.                             : undefined,
  3422.                         dhost: matches.dhost ? matches.dhost : undefined,
  3423.                         AlertTime: matches.rt ? matches.rt : undefined,
  3424.                         src: matches.src ? matches.src : undefined,
  3425.                         sptPort: matches.spt ? matches.spt : undefined,
  3426.                         dstIP: matches.dst ? matches.dst : undefined,
  3427.                         dstPort: matches.dpt ? matches.dpt : undefined,
  3428.                         protocol: matches.proto ? matches.proto : undefined,
  3429.                         request: matches.request ? matches.request : undefined,
  3430.                         requestClientApplication: matches.requestClientApplication
  3431.                             ? matches.requestClientApplication
  3432.                             : undefined,
  3433.                         msg: matches.msg ? matches.msg : undefined
  3434.                     };
  3435.                     data_json[matches.cs1Label] = matches.cs1 ? matches.cs1 : undefined;
  3436.                     data_json[matches.cs2Label] = matches.cs2 ? matches.cs2 : undefined;
  3437.                     data_json[matches.cs3Label] = matches.cs3 ? matches.cs3 : undefined;
  3438.                     data_json[matches.cs4Label] = matches.cs4 ? matches.cs4 : undefined;
  3439.                     data_json[matches.cs5Label] = matches.cs5 ? matches.cs5 : undefined;
  3440.                     data_json[matches.cs6Label] = matches.cs6 ? matches.cs6 : undefined;
  3441.                     data_json[matches.cs7Label] = matches.cs7 ? matches.cs7 : undefined;
  3442.                     data_json[matches.cs8Label] = matches.cs8 ? matches.cs8 : undefined;
  3443.                     data_json[matches.cs9Label] = matches.cs9 ? matches.cs9 : undefined;
  3444.  
  3445.                     acc.push(data_json);
  3446.                 } else if (DecoderName == 'checkpoint_cef') {
  3447.                     let data_json = {
  3448.                         Signature: matches.Signature ? matches.Signature : undefined,
  3449.                         cp_severity: matches.cp_severity ? matches.cp_severity : undefined,
  3450.                         src: matches.src ? matches.src : undefined,
  3451.                         dst: matches.dst ? matches.dst : undefined,
  3452.                         origin: matches.origin ? matches.origin : undefined
  3453.                     };
  3454.                     data_json[matches.cs2Label] = matches.cs2 ? matches.cs2 : undefined;
  3455.                     data_json[matches.cs3Label] = matches.cs3 ? matches.cs3 : undefined;
  3456.                     data_json[matches.cs4Label] = matches.cs4 ? matches.cs4 : undefined;
  3457.                     data_json[matches.flexNumber1Label] = matches.flexNumber1 ? matches.flexNumber1 : undefined;
  3458.                     data_json[matches.flexNumber2Label] = matches.flexNumber2 ? matches.flexNumber2 : undefined;
  3459.                     data_json[matches.flexString2Label] = matches.flexString2 ? matches.flexString2 : undefined;
  3460.                     acc.push(data_json);
  3461.                 } else if (DecoderName == 'incapsula_cef') {
  3462.                     let data_json = {
  3463.                         requestClientApplication: matches.requestClientApplication
  3464.                             ? matches.requestClientApplication
  3465.                             : undefined,
  3466.                         request: matches.request ? matches.request : undefined,
  3467.                         requestMethod: matches.requestMethod ? matches.requestMethod : undefined,
  3468.                         postbody: matches.postbody ? matches.postbody : undefined,
  3469.                         qstr: matches.qstr ? matches.qstr : undefined,
  3470.                         act: matches.act ? matches.act : undefined,
  3471.                         sip: matches.sip ? matches.sip : undefined,
  3472.                         spt: matches.spt ? matches.spt : undefined,
  3473.                         xff: matches.xff ? matches.xff : undefined,
  3474.                         cpt: matches.cpt ? matches.cpt : undefined,
  3475.                         src: matches.src ? matches.src : undefined
  3476.                     };
  3477.                     data_json[matches.cs9Label] = matches.cs9 ? matches.cs9 : undefined;
  3478.                     acc.push(data_json);
  3479.                 } else if (window.location.href.includes('macaumss')) {
  3480.                     acc.push({
  3481.                         'Event time': logArray.slice(0, 3).join(' '),
  3482.                         'event_desc': matches.event_desc ? matches.event_desc : undefined,
  3483.                         'dev_name': matches.dev_name ? matches.dev_name : undefined,
  3484.                         'attack_ip': matches.attack_ip ? matches.attack_ip : undefined,
  3485.                         'suffer_ip': matches.suffer_ip ? matches.suffer_ip : undefined,
  3486.                         'suffer_port': matches.suffer_port ? matches.suffer_port : undefined,
  3487.                         'status_code': matches.status_code ? matches.status_code : undefined,
  3488.                         'x_forwarded_for': matches.x_forwarded_for ? matches.x_forwarded_for : undefined,
  3489.                         'event_evidence': log.match(pattern) ? log.match(pattern)[0] : undefined,
  3490.                         'attack_type_name': matches.attack_type_name ? matches.attack_type_name : undefined
  3491.                     });
  3492.                 } else {
  3493.                     acc.push({
  3494.                         'Event time': logArray.slice(0, 3).join(' '),
  3495.                         'event_desc': matches.event_desc ? matches.event_desc : undefined,
  3496.                         'dev_name': matches.dev_name ? matches.dev_name : undefined,
  3497.                         'suffer_ip': matches.suffer_ip ? matches.suffer_ip : undefined,
  3498.                         'attack_ip': matches.attack_ip ? matches.attack_ip : undefined,
  3499.                         'event_evidence': matches.event_evidence ? matches.event_evidence : undefined,
  3500.                         'url': matches.url ? matches.url : undefined,
  3501.                         'suggest': matches.suggest ? matches.suggest : undefined
  3502.                     });
  3503.                 }
  3504.             } catch (error) {
  3505.                 console.log(`Error: ${error.message}`);
  3506.             }
  3507.             return acc;
  3508.         }, []);
  3509.         return alertInfo;
  3510.     }
  3511.     const alertInfo = parseLog(rawLog);
  3512.     function generateDescription() {
  3513.         const alertDescriptions = [];
  3514.         for (const info of alertInfo) {
  3515.             const lastindex = summary.lastIndexOf(']');
  3516.             let desc;
  3517.             if (summary.includes('-')) {
  3518.                 desc = `Observed ${summary.substr(lastindex + 1).split('-')[1]}\n`;
  3519.             } else {
  3520.                 desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  3521.             }
  3522.             for (const key in info) {
  3523.                 if (Object.hasOwnProperty.call(info, key)) {
  3524.                     const value = info[key];
  3525.                     if (value !== undefined) {
  3526.                         if (key == 'event_evidence') {
  3527.                             desc += `${key}: ${value.replace(/</g, '&lt;').replace(/>/g, '&gt;')}\n`;
  3528.                         } else if (key == 'start_time' || key == 'end_time' || key == 'AlertTime') {
  3529.                             desc += `${key}(<span class="red_highlight">GMT+8</span>): ${value.split('.')[0]}\n`;
  3530.                         } else {
  3531.                             desc += `${key}: ${value}\n`;
  3532.                         }
  3533.                     }
  3534.                 }
  3535.             }
  3536.             desc += `\nPlease verify if the activity is legitimate.\n`;
  3537.             alertDescriptions.push(desc);
  3538.         }
  3539.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  3540.         showDialog(alertMsg);
  3541.     }
  3542.     addButton('generateDescription', 'Description', generateDescription);
  3543. }
  3544.  
  3545. function RadwareAlertHandler(...kwargs) {
  3546.     var { summary, rawLog } = kwargs[0];
  3547.     function parseLog(rawLog) {
  3548.         const alertInfo = rawLog.reduce((acc, log) => {
  3549.             try {
  3550.                 const json_alert = JSON.parse(log);
  3551.                 const {
  3552.                     device_ip,
  3553.                     device_name,
  3554.                     device_abbr,
  3555.                     detected_by,
  3556.                     asset_name,
  3557.                     asset_type,
  3558.                     asset_ip,
  3559.                     account_uid,
  3560.                     account_name,
  3561.                     acc_site_name,
  3562.                     end_time,
  3563.                     start_time
  3564.                 } = json_alert['radware'];
  3565.  
  3566.                 alertExtraInfo = {
  3567.                     start_time: start_time._date_time ? start_time._date_time : undefined,
  3568.                     end_time: end_time._date_time ? end_time._date_time : undefined,
  3569.                     device_ip: device_ip ? device_ip : undefined,
  3570.                     device_name: device_name ? device_name : undefined,
  3571.                     device_abbr: device_abbr ? device_abbr : undefined,
  3572.                     detected_by: detected_by ? detected_by : undefined,
  3573.                     asset_name: asset_name ? asset_name : undefined,
  3574.                     asset_type: asset_type ? asset_type : undefined,
  3575.                     asset_ip: asset_ip ? asset_ip : undefined,
  3576.                     account_uid: account_uid ? account_uid : undefined,
  3577.                     account_name: account_name ? account_name : undefined,
  3578.                     acc_site_name: acc_site_name ? acc_site_name : undefined
  3579.                 };
  3580.                 acc.push({ alertExtraInfo });
  3581.             } catch (error) {
  3582.                 console.log(`Error: ${error.message}`);
  3583.             }
  3584.             return acc;
  3585.         }, []);
  3586.         return alertInfo;
  3587.     }
  3588.     const alertInfo = parseLog(rawLog);
  3589.     function generateDescription() {
  3590.         const alertDescriptions = [];
  3591.         for (const info of alertInfo) {
  3592.             const lastindex = summary.lastIndexOf(']');
  3593.             let desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  3594.             for (const key in info.alertExtraInfo) {
  3595.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  3596.                     const value = info.alertExtraInfo[key];
  3597.                     if (value !== undefined) {
  3598.                         if (key == 'start_time' || key == 'end_time') {
  3599.                             desc += `${key}(<span class="red_highlight">GMT</span>): ${value.split('.')[0] + 'Z'}\n`;
  3600.                         } else {
  3601.                             desc += `${key}: ${value}\n`;
  3602.                         }
  3603.                     }
  3604.                 }
  3605.             }
  3606.             desc += `\nPlease verify if the activity is legitimate.\n`;
  3607.             alertDescriptions.push(desc);
  3608.         }
  3609.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  3610.         showDialog(alertMsg);
  3611.     }
  3612.     addButton('generateDescription', 'Description', generateDescription);
  3613. }
  3614.  
  3615. function CarbonAlertHandler(...kwargs) {
  3616.     var { summary, rawLog } = kwargs[0];
  3617.     var raw_alert = 0;
  3618.     const num_alert = $('#customfield_10300-val').text().trim();
  3619.     function parseLog(rawLog) {
  3620.         const alertInfo = rawLog.reduce((acc, log) => {
  3621.             try {
  3622.                 const BraceIndex = log.toString().indexOf('{');
  3623.                 const lastBraceIndex = log.toString().lastIndexOf('}');
  3624.                 if (BraceIndex !== -1) {
  3625.                     json_text = log.toString().substr(BraceIndex, lastBraceIndex);
  3626.                     const json_alert = JSON.parse(json_text);
  3627.                     const {
  3628.                         reason,
  3629.                         device_os_version,
  3630.                         device_username,
  3631.                         device_location,
  3632.                         device_external_ip,
  3633.                         device_internal_ip,
  3634.                         device_name,
  3635.                         process_pid,
  3636.                         process_name,
  3637.                         process_sha256,
  3638.                         process_guid,
  3639.                         process_cmdline,
  3640.                         process_username,
  3641.                         netconn_remote_ip,
  3642.                         netconn_remote_port,
  3643.                         parent_guid,
  3644.                         parent_pid,
  3645.                         parent_name,
  3646.                         parent_sha256,
  3647.                         parent_username,
  3648.                         netconn_local_ip,
  3649.                         netconn_local_port,
  3650.                         first_event_timestamp
  3651.                     } = json_alert;
  3652.                     alertExtraInfo = {
  3653.                         EventTime: first_event_timestamp.split('.')[0],
  3654.                         device_name: device_name ? device_name : undefined,
  3655.                         device_os_version: device_os_version ? device_os_version : undefined,
  3656.                         device_username: device_username ? device_username : undefined,
  3657.                         device_location: device_location ? device_location : undefined,
  3658.                         device_external_ip: device_external_ip ? device_external_ip : undefined,
  3659.                         device_internal_ip: device_internal_ip ? device_internal_ip : undefined,
  3660.                         process_guid: process_guid ? process_guid : undefined,
  3661.                         process_pid: process_pid ? process_pid : undefined,
  3662.                         process_name: process_name ? process_name : undefined,
  3663.                         process_sha256: process_sha256 ? process_sha256 : undefined,
  3664.                         process_cmdline: process_cmdline ? process_cmdline : undefined,
  3665.                         process_username: process_username ? process_username : undefined,
  3666.                         parent_guid: parent_guid ? parent_guid : undefined,
  3667.                         parent_pid: parent_pid ? parent_pid : undefined,
  3668.                         parent_name: parent_name ? parent_name : undefined,
  3669.                         parent_sha256: parent_sha256 ? parent_sha256 : undefined,
  3670.                         parent_username: parent_username ? parent_username : undefined,
  3671.                         netconn_remote_ip: netconn_remote_ip ? netconn_remote_ip : undefined,
  3672.                         netconn_remote_port: netconn_remote_port ? netconn_remote_port : undefined,
  3673.                         netconn_local_ip: netconn_local_ip ? netconn_local_ip : undefined,
  3674.                         netconn_local_port: netconn_local_port ? netconn_local_port : undefined,
  3675.                         reason: reason ? reason : undefined
  3676.                     };
  3677.                     raw_alert += 1;
  3678.                     acc.push({ alertExtraInfo });
  3679.                 }
  3680.             } catch (error) {
  3681.                 console.log(`Error: ${error.message}`);
  3682.             }
  3683.             return acc;
  3684.         }, []);
  3685.         return alertInfo;
  3686.     }
  3687.     const alertInfo = parseLog(rawLog);
  3688.     function generateDescription() {
  3689.         const alertDescriptions = [];
  3690.         if (raw_alert < num_alert) {
  3691.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  3692.             alertDescriptions.push(extra_message);
  3693.         }
  3694.         for (const info of alertInfo) {
  3695.             const lastindex = summary.lastIndexOf(']');
  3696.             let desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  3697.             for (const key in info.alertExtraInfo) {
  3698.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  3699.                     const value = info.alertExtraInfo[key];
  3700.                     if (key == 'EventTime') {
  3701.                         desc += `EventTime(<span class="red_highlight">GMT</span>): ${value + 'Z'}\n`;
  3702.                     } else if (value !== undefined) {
  3703.                         desc += `${key}: ${value}\n`;
  3704.                     }
  3705.                 }
  3706.             }
  3707.             desc += `\nPlease verify if the activity is legitimate.\n`;
  3708.             alertDescriptions.push(desc);
  3709.         }
  3710.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  3711.         showDialog(alertMsg);
  3712.     }
  3713.  
  3714.     addButton('generateDescription', 'Description', generateDescription);
  3715. }
  3716.  
  3717. function MultipleAccountAlertHandler(...kwargs) {
  3718.     var { summary, rawLog } = kwargs[0];
  3719.     function parseLog(rawLog) {
  3720.         const alertInfo = rawLog.reduce((acc, log) => {
  3721.             try {
  3722.                 const json_alert = JSON.parse(log)['win'];
  3723.                 const { targetUserName, targetDomainName, subjectUserName, subjectDomainName, subjectLogonId } =
  3724.                     json_alert['eventdata'];
  3725.                 const { systemTime, computer, message } = json_alert['system'];
  3726.                 alertExtraInfo = {
  3727.                     Eventtime: systemTime ? systemTime : undefined,
  3728.                     computer: computer ? computer : undefined,
  3729.                     targetUserName: targetUserName ? targetUserName : undefined,
  3730.                     targetDomainName: targetDomainName ? targetDomainName : undefined,
  3731.                     subjectUserName: subjectUserName ? subjectUserName : undefined,
  3732.                     subjectDomainName: subjectDomainName ? subjectDomainName : undefined,
  3733.                     message: message ? message.split('\r\n\r\n')[0] : undefined
  3734.                 };
  3735.                 acc.push({ alertExtraInfo });
  3736.             } catch (error) {
  3737.                 console.log(`Error: ${error.message}`);
  3738.             }
  3739.             return acc;
  3740.         }, []);
  3741.         return alertInfo;
  3742.     }
  3743.     const alertInfo = parseLog(rawLog);
  3744.     function generateDescription() {
  3745.         const alertDescriptions = [];
  3746.         const single = [];
  3747.         const lastindex = summary.lastIndexOf(']');
  3748.         let desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  3749.         for (const info of alertInfo) {
  3750.             let desc_ = '',
  3751.                 single_ = '';
  3752.             for (const key in info.alertExtraInfo) {
  3753.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  3754.                     const value = info.alertExtraInfo[key];
  3755.                     if (value !== undefined) {
  3756.                         if (key == 'Eventtime') {
  3757.                             desc_ += `${key}(<span class="red_highlight">GMT</span>): ${value.split('.')[0] + 'Z'}\n`;
  3758.                         } else if (
  3759.                             key == 'subjectUserName' ||
  3760.                             key == 'subjectDomainName' ||
  3761.                             key == 'computer' ||
  3762.                             key == 'message' ||
  3763.                             key == 'targetDomainName'
  3764.                         ) {
  3765.                             single_ += `${key}: ${value}\n`;
  3766.                         } else {
  3767.                             desc_ += `${key}: ${value}\n`;
  3768.                         }
  3769.                     }
  3770.                 }
  3771.             }
  3772.             alertDescriptions.push(desc_);
  3773.             single.push(single_);
  3774.         }
  3775.         desc += [...new Set(single)].join('\n');
  3776.         desc += '\n';
  3777.         desc += [...new Set(alertDescriptions)].join('\n');
  3778.         desc += `Please verify if the activity is legitimate.\n`;
  3779.         showDialog(desc);
  3780.     }
  3781.     addButton('generateDescription', 'Description', generateDescription);
  3782. }
  3783.  
  3784. /**
  3785.  * Create Description and Open MDE and MDE365 button
  3786.  * @param  {...any} kwargs - Include LogSourceDomain, Labels, LogSource, TicketAutoEscalate, Status, RawLog, Summary fields
  3787.  */
  3788. function MDE365AlertHandler(...kwargs) {
  3789.     console.log('#### Code MDE365lertHandler run ####');
  3790.     const { rawLog, LogSourceDomain, summary } = kwargs[0];
  3791.     var raw_alert = 0;
  3792.     const num_alert = $('#customfield_10300-val').text().trim();
  3793.     let alertInfo_MDE = [],
  3794.         alertInfo_365 = [];
  3795.     function GMT8(params) {
  3796.         let date = new Date(params);
  3797.         date.setHours(date.getHours() + 16); // 获取当前的小时数并加上8小时
  3798.         const year = date.getUTCFullYear();
  3799.         const month = String(date.getUTCMonth() + 1).padStart(2, '0');
  3800.         const day = String(date.getUTCDate()).padStart(2, '0');
  3801.         const hours = String(date.getUTCHours()).padStart(2, '0');
  3802.         const minutes = String(date.getUTCMinutes()).padStart(2, '0');
  3803.         const seconds = String(date.getUTCSeconds()).padStart(2, '0');
  3804.  
  3805.         const formattedDate = `${year}-${month}-${day}T${hours}:${minutes}:${seconds}`;
  3806.         return formattedDate;
  3807.     }
  3808.     function parseLog(rawLog) {
  3809.         const alertInfo = rawLog.reduce((acc, log) => {
  3810.             let logObj = '';
  3811.             if (log != '') {
  3812.                 try {
  3813.                     if (log.charAt(log.length - 1) == '}') {
  3814.                         const formatJson = log.substring(log.indexOf('{')).trim();
  3815.                         logObj = JSON.parse(formatJson.replace(/\\\(n/g, '\\n('));
  3816.                     } else {
  3817.                         const formatJson = log.substring(log.indexOf('{')).trim() + '"}]}}';
  3818.                         logObj = JSON.parse(formatJson.replace(/\\\(n/g, '\\n('));
  3819.                     }
  3820.                     if (logObj['integration'] == 'Wazuh-MDE') {
  3821.                         raw_alert += 1;
  3822.                         const { mde } = logObj;
  3823.                         const { title, id, computerDnsName, relatedUser, evidence, alertCreationTime } = mde;
  3824.                         let dotIndex = alertCreationTime.lastIndexOf('.');
  3825.  
  3826.                         let dateTimeStr = GMT8(alertCreationTime.slice(0, dotIndex));
  3827.                         const alert = { title, id, computerDnsName, dateTimeStr };
  3828.                         const userName = relatedUser ? relatedUser.userName : 'N/A';
  3829.                         let extrainfo = '';
  3830.                         let processCommandLine = '';
  3831.                         if (evidence) {
  3832.                             const tmp = [];
  3833.                             for (const evidenceItem of evidence) {
  3834.                                 let description = '';
  3835.  
  3836.                                 if (evidenceItem.entityType === 'File') {
  3837.                                     console.log('===', WhiteFilehash(evidenceItem.sha1));
  3838.                                     if (WhiteFilehash(evidenceItem.sha1) || WhiteFilehash(evidenceItem.sha256)) {
  3839.                                         description = `filename: ${evidenceItem.fileName}\nfilePath: ${evidenceItem.filePath}`;
  3840.                                         tmp.push(description);
  3841.                                     } else {
  3842.                                         description = `filename: ${evidenceItem.fileName}\nfilePath: ${evidenceItem.filePath}\nsha1: ${evidenceItem.sha1}`;
  3843.                                         tmp.push(description);
  3844.                                     }
  3845.                                 }
  3846.                                 if (evidenceItem.entityType === 'Process') {
  3847.                                     if (evidenceItem.processCommandLine !== undefined) {
  3848.                                         processCommandLine = evidenceItem.processCommandLine.replace(
  3849.                                             /\r\n\r\n+/g,
  3850.                                             '\n'
  3851.                                         );
  3852.                                         console.log(processCommandLine);
  3853.                                     }
  3854.                                     if (
  3855.                                         evidenceItem.processCommandLine !== undefined &&
  3856.                                         evidenceItem.processCommandLine.includes('EncodedCommand')
  3857.                                     ) {
  3858.                                         let cmd_length = evidenceItem.processCommandLine.split(' ').length;
  3859.                                         description = `Decode_Cmd: ${atob(
  3860.                                             evidenceItem.processCommandLine
  3861.                                                 .split(' ')
  3862.                                                 [cmd_length - 1].replace(/['"]/g, '')
  3863.                                         )}`;
  3864.                                         tmp.push(description);
  3865.                                     }
  3866.                                     if (WhiteFilehash(evidenceItem.sha1) || WhiteFilehash(evidenceItem.sha256)) {
  3867.                                         description = `cmd: ${processCommandLine}\naccount: ${evidenceItem.accountName}`;
  3868.                                         tmp.push(description);
  3869.                                     } else {
  3870.                                         description = `cmd: ${processCommandLine}\naccount: ${evidenceItem.accountName}\nsha1: ${evidenceItem.sha1}`;
  3871.                                         tmp.push(description);
  3872.                                     }
  3873.                                 }
  3874.                                 if (evidenceItem.entityType === 'Url') {
  3875.                                     description += `Url: ${evidenceItem.url}`;
  3876.                                     tmp.push(description);
  3877.                                 }
  3878.                                 if (evidenceItem.entityType === 'Ip') {
  3879.                                     description += `IP: ${evidenceItem.ipAddress}`;
  3880.                                     tmp.push(description);
  3881.                                 }
  3882.                             }
  3883.                             const uniqueDescriptions = Array.from(new Set(tmp));
  3884.                             extrainfo = uniqueDescriptions.join('\n');
  3885.                         }
  3886.                         alertInfo_MDE.push({ ...alert, userName, extrainfo });
  3887.                     } else {
  3888.                         raw_alert += 1;
  3889.                         const alerts = logObj['incidents']['alerts'][0];
  3890.                         console.log(alerts);
  3891.                         let entities = {};
  3892.                         if (alerts !== undefined) {
  3893.                             alerts['entities'].forEach(function (entity) {
  3894.                                 if (entity.processCommandLine !== undefined) {
  3895.                                     processCommandLine = entity.processCommandLine.replace(/\r\n\r\n+/g, '\n');
  3896.                                     console.log(processCommandLine);
  3897.                                 }
  3898.                                 if (entity['entityType'] == 'User' || entity['entityType'] == 'Mailbox') {
  3899.                                     entities['user'] = `${entity['domainName']}\\\\${entity['accountName']}`;
  3900.                                     entities['userPrincipalName'] = entity['userPrincipalName'];
  3901.                                 }
  3902.                                 if (entity['entityType'] == 'CloudApplication') {
  3903.                                     entities['applicationId'] = entity['applicationId'];
  3904.                                     entities['applicationName'] = entity['applicationName'];
  3905.                                 }
  3906.                                 if (entity['entityType'] == 'Process') {
  3907.                                     if (!entities['process']) {
  3908.                                         entities['process'] = [];
  3909.                                     }
  3910.                                     const fileEntry = {
  3911.                                         filename: entity['fileName'],
  3912.                                         filePath: entity['filePath'],
  3913.                                         cmd: processCommandLine
  3914.                                     };
  3915.                                     if (processCommandLine.includes('EncodedCommand')) {
  3916.                                         let cmd_length = processCommandLine.split(' ').length;
  3917.                                         fileEntry['Decode_Cmd'] = atob(
  3918.                                             processCommandLine.split(' ')[cmd_length - 1].replace(/['"]/g, '')
  3919.                                         );
  3920.                                     }
  3921.                                     if (
  3922.                                         Object.keys(entity).includes('sha256') &&
  3923.                                         (WhiteFilehash(entity['sha256']) || WhiteFilehash(entity['sha1']))
  3924.                                     ) {
  3925.                                         entities['process'].push(fileEntry);
  3926.                                     } else {
  3927.                                         fileEntry['sha256'] = entity['sha256'];
  3928.                                         entities['process'].push(fileEntry);
  3929.                                     }
  3930.                                 }
  3931.  
  3932.                                 if (entity['entityType'] == 'File') {
  3933.                                     if (!entities['file']) {
  3934.                                         entities['file'] = [];
  3935.                                     }
  3936.                                     const fileEntry = {
  3937.                                         filename: entity['fileName'],
  3938.                                         filePath: entity['filePath']
  3939.                                     };
  3940.                                     if (
  3941.                                         Object.keys(entity).includes('sha256') &&
  3942.                                         (WhiteFilehash(entity['sha256']) || WhiteFilehash(entity['sha1']))
  3943.                                     ) {
  3944.                                         entities['file'].push(fileEntry);
  3945.                                     } else {
  3946.                                         fileEntry['sha256'] = entity['sha256'];
  3947.                                         entities['file'].push(fileEntry);
  3948.                                     }
  3949.                                 }
  3950.  
  3951.                                 if (entity['entityType'] == 'Ip') {
  3952.                                     if (!entities['ip']) {
  3953.                                         entities['ip'] = [];
  3954.                                     }
  3955.                                     entities['ip'].push({
  3956.                                         ip: entity['ipAddress']
  3957.                                     });
  3958.                                 }
  3959.                                 if (entity['entityType'] == 'Url') {
  3960.                                     if (!entities['url']) {
  3961.                                         entities['url'] = [];
  3962.                                     }
  3963.                                     entities['url'].push({
  3964.                                         url: entity['url']
  3965.                                     });
  3966.                                 }
  3967.                             });
  3968.                         }
  3969.                         let creationTime = GMT8(alerts.creationTime.split('.')[0]);
  3970.                         let title = alerts?.title;
  3971.                         if (summary.toLowerCase().includes(title.toLowerCase())) {
  3972.                             title = undefined;
  3973.                         }
  3974.                         alertInfo_365.push({
  3975.                             creationTime: creationTime,
  3976.                             Title: title,
  3977.                             summary: logObj['incidents'].incidentName,
  3978.                             host: alerts?.devices[0]?.deviceDnsName,
  3979.                             user: entities.user,
  3980.                             userPrincipalName: entities.userPrincipalName,
  3981.                             process: entities.process,
  3982.                             file: entities.file,
  3983.                             ip: entities.ip,
  3984.                             url: entities.url,
  3985.                             alertid: alerts?.alertId,
  3986.                             incidenturi: logObj['incidents'].incidentUri,
  3987.                             severity: logObj['incidents'].severity,
  3988.                             description: alerts['description'],
  3989.                             applicationId: entities.applicationId,
  3990.                             applicationName: entities.applicationName
  3991.                         });
  3992.                     }
  3993.                 } catch (error) {
  3994.                     console.error(`Error: ${error.message}`);
  3995.                 }
  3996.             }
  3997.             return acc;
  3998.         }, []);
  3999.         return alertInfo;
  4000.     }
  4001.     const alertDescriptions = [];
  4002.     parseLog(rawLog);
  4003.  
  4004.     function generateDescription_MDE() {
  4005.         for (const info of alertInfo_MDE) {
  4006.             const { title, computerDnsName, userName, extrainfo, dateTimeStr } = info;
  4007.             const desc = `Observed ${title}\nalertCreationTime(<span class="red_highlight">GMT+8</span>): ${dateTimeStr}\nHost: ${computerDnsName}\nusername: ${userName}\n${extrainfo}\n\nPlease help to verify if it is legitimate.\n`;
  4008.             alertDescriptions.push(desc);
  4009.         }
  4010.     }
  4011.     function generateDescription_365() {
  4012.         if (summary.includes('M365 Defender High Severity Alerts: Logon from a risky country involving one user')) {
  4013.             const ticketnumber = $('#key-val').text();
  4014.             for (const info of alertInfo) {
  4015.                 let desc = `Dear Customer,
  4016. 	 
  4017. 	            Reasons for escalating:
  4018. 	             
  4019. 	            Observed Logon from a risky country involving one user in [time]
  4020. 	             
  4021. 	            Here is information about this login:
  4022. 	
  4023. 	            creationTime(<span class="red_highlight"">GMT</span>): ${info.creationTime}
  4024. 	             
  4025. 	            source IP: ${info.ip[0].ip}
  4026. 	             
  4027. 	            user: ${info.user}
  4028. 	             
  4029. 	            active: Microsoft 365
  4030. 	             
  4031. 	            userPrincipalName: ${info.userPrincipalName}
  4032. 	             
  4033. 	            Device type:
  4034. 	             
  4035. 	            UserAgent:
  4036. 	             
  4037. 	            location:
  4038. 	             
  4039. 	            logging status:
  4040. 	             
  4041. 	            LoginStatus:
  4042. 	             
  4043. 	            MfaRequired:
  4044. 	             
  4045. 	            the user suddenly logged in from [Location1] but the user used to be logged in from [Location2], aberdeen. Please confirm whether the login behavior of the user is normal.if not, could block the ip.
  4046. 	             
  4047. 	             
  4048. 	            Suggestion: We suggest to confirm whether the behavior of this customer logging in at ${info.ip[0].ip}: is normal or not, if not, we suggest to block the IP and change the user's password and perform a full scan on the user's commonly used PCs, thank you!
  4049. 	             
  4050. 	            Severity: ${info.severity}
  4051. 	             
  4052. 	            Correlation ticket: ${ticketnumber}
  4053. 	            
  4054. 	            `;
  4055.                 alertDescriptions.push(desc);
  4056.             }
  4057.         } else {
  4058.             for (const info of alertInfo_365) {
  4059.                 let desc = `Observed ${info.summary}\n`;
  4060.                 try {
  4061.                     for (let key in info) {
  4062.                         if (info.hasOwnProperty(key)) {
  4063.                             if (Array.isArray(info[key])) {
  4064.                                 info[key].forEach((item) => {
  4065.                                     for (let subKey in item) {
  4066.                                         if (item.hasOwnProperty(subKey) && item[subKey] !== '') {
  4067.                                             desc += `${subKey}: ${item[subKey]}\n`;
  4068.                                         }
  4069.                                     }
  4070.                                 });
  4071.                             } else {
  4072.                                 if (
  4073.                                     info[key] !== undefined &&
  4074.                                     info[key] !== ' ' &&
  4075.                                     key !== 'summary' &&
  4076.                                     key !== 'alertid' &&
  4077.                                     key !== 'incidenturi' &&
  4078.                                     key !== 'severity'
  4079.                                 ) {
  4080.                                     if (key == 'creationTime') {
  4081.                                         desc += `creationTime(<span class="red_highlight">GMT+8</span>): ${info[key]}\n`;
  4082.                                     } else {
  4083.                                         desc += `${key}: ${info[key]}\n`;
  4084.                                     }
  4085.                                 }
  4086.                             }
  4087.                         }
  4088.                     }
  4089.                 } catch (error) {
  4090.                     console.error(`Error: ${error}`);
  4091.                 }
  4092.                 let MDEURL = '';
  4093.                 if (LogSourceDomain == 'wkcda') {
  4094.                     if (info.alertid && !MDEURL.includes(info.alertid)) {
  4095.                         MDEURL += `https://security.microsoft.com/alerts/${info.alertid}<br>`;
  4096.                     }
  4097.                     if (info.incidenturi) {
  4098.                         let incident_url = info.incidenturi.replace('hXXps[:]', 'https:') + '<br>';
  4099.                         MDEURL += incident_url;
  4100.                     }
  4101.                     desc += `MDE URL: \n${MDEURL}\n`;
  4102.                 }
  4103.  
  4104.                 desc += `\nPlease verify if the activity is legitimate.\n`;
  4105.                 alertDescriptions.push(desc);
  4106.             }
  4107.         }
  4108.     }
  4109.     function generateDescription() {
  4110.         if (raw_alert < num_alert) {
  4111.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  4112.             alertDescriptions.push(extra_message);
  4113.         }
  4114.         generateDescription_MDE();
  4115.         generateDescription_365();
  4116.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  4117.         showDialog(alertMsg);
  4118.     }
  4119.     function openMDE() {
  4120.         let MDEURL = '';
  4121.         for (const info of alertInfo_MDE) {
  4122.             const { id } = info;
  4123.             if (id) {
  4124.                 MDEURL += `https://security.microsoft.com/alerts/${id}<br>`;
  4125.             }
  4126.         }
  4127.         for (const info of alertInfo_365) {
  4128.             const { alertid, incidenturi } = info;
  4129.             if (alertid && !MDEURL.includes(alertid)) {
  4130.                 MDEURL += `https://security.microsoft.com/alerts/${alertid}<br>`;
  4131.             }
  4132.             if (incidenturi) {
  4133.                 let incident_url = incidenturi.replace('hXXps[:]', 'https:') + '<br>';
  4134.                 MDEURL += incident_url;
  4135.             }
  4136.         }
  4137.         showFlag('info', 'MDE URL:', `${MDEURL}`, 'manual');
  4138.         let url = 'https://security.microsoft.com/homepage?&current=';
  4139.         url += LogSourceDomain;
  4140.         for (let i = 0; i < MDEURL.length; i++) {
  4141.             let mde_url = `&url${i}=${MDEURL[i]}`;
  4142.             url += mde_url;
  4143.             console.log(MDEURL[i]);
  4144.         }
  4145.         let MDE_Assist_ = localStorage.getItem('MDE_Assist');
  4146.         if (MDE_Assist_ != 0) {
  4147.             GM_openInTab(url, {
  4148.                 active: false, // 设置为 false，以在后台打开，不激活新标签页
  4149.                 insert: true // 设置为 true，将新标签页插入到当前标签页之后
  4150.             });
  4151.         }
  4152.     }
  4153.     addButton('generateDescription', 'Description', generateDescription);
  4154.     addButton('openMDE', 'MDE', openMDE);
  4155. }
  4156.  
  4157. function WindowsSysAlertHandler(...kwargs) {
  4158.     var { summary, rawLog } = kwargs[0];
  4159.     function parseLog(rawLog) {
  4160.         const alertInfo = rawLog.reduce((acc, log) => {
  4161.             try {
  4162.                 if (log != '') {
  4163.                     let log_data = {},
  4164.                         sub = '';
  4165.                     log.split('#010').forEach((element, index) => {
  4166.                         if (element.includes('#013')) {
  4167.                             element = element.replace(/#013/g, '');
  4168.                         }
  4169.                         if (element.includes('#009')) {
  4170.                             let e = element.replace(/#009/g, '').split(':');
  4171.                             log_data[e[0]] = e[1];
  4172.                         }
  4173.                         if (element.includes('=')) {
  4174.                             let e = element.replace(/#013/g, '').split('=');
  4175.                             log_data[e[0]] = e[1];
  4176.                         }
  4177.                         if (element.includes(':#013')) {
  4178.                             sub = element.split(':')[0];
  4179.                         }
  4180.                         if (
  4181.                             element.includes(':#009') &&
  4182.                             (element.includes('Account') ||
  4183.                                 element.includes('Security ID') ||
  4184.                                 element.includes('Logon ID'))
  4185.                         ) {
  4186.                             let e = element.replace(/#009/g, ' ').replace(/#013/g, '').split(': ');
  4187.                             log_data[sub + e[0].trim()] = e[1];
  4188.                         }
  4189.                         if (element.includes(':#009')) {
  4190.                             let e = element.replace(/#009/g, ' ').replace(/#013/g, '').split(': ');
  4191.                             log_data[e[0].trim()] = e[1];
  4192.                         }
  4193.                     });
  4194.                     const regex = /(\S+\s+\S+\s+\S+\s+\S+\s+)(.*)/g;
  4195.                     alertExtraInfo = {
  4196.                         Event_time: regex.exec(log.split('#010')[0])[2],
  4197.                         ComputerName: log_data.ComputerName ? log_data.ComputerName : undefined,
  4198.                         EventCode: log_data.EventCode ? log_data.EventCode : undefined,
  4199.                         SourceName: log_data.SourceName ? log_data.SourceName : undefined,
  4200.                         CreatorAccountDomain: log_data['Creator SubjectAccount Domain']
  4201.                             ? log_data['Creator SubjectAccount Domain']
  4202.                             : undefined,
  4203.                         CreatorAccountName: log_data['Creator SubjectAccount Name']
  4204.                             ? log_data['Creator SubjectAccount Name']
  4205.                             : undefined,
  4206.                         Type: log_data.Type ? log_data.Type : undefined,
  4207.                         Keywords: log_data.Keywords ? log_data.Keywords : undefined,
  4208.                         Message: log_data.Message ? log_data.Message : undefined,
  4209.                         CreatorProcessID: log_data['Creator Process ID'] ? log_data['Creator Process ID'] : undefined,
  4210.                         CreatorProcessName: log_data['Creator Process Name']
  4211.                             ? log_data['Creator Process Name']
  4212.                             : undefined,
  4213.                         NewProcessID: log_data['New Process ID'] ? log_data['New Process ID'] : undefined,
  4214.                         NewProcessName: log_data['New Process Name'] ? log_data['New Process Name'] : undefined,
  4215.                         ProcessCommandLine: log_data['Process Command Line']
  4216.                             ? log_data['Process Command Line']
  4217.                             : undefined,
  4218.                         ProcessCommandLine: log_data['Process Command Line']
  4219.                             ? log_data['Process Command Line']
  4220.                             : undefined,
  4221.                         SecurityID: log_data['Security ID'] ? log_data['Security ID'] : undefined,
  4222.                         ServiceAccount: log_data['Service Account'] ? log_data['Service Account'] : undefined,
  4223.                         ServiceFileName: log_data['Service File Name'] ? log_data['Service File Name'] : undefined,
  4224.                         ServiceName: log_data['Service Name'] ? log_data['Service Name'] : undefined,
  4225.                         ServiceStartType: log_data['Service Start Type'] ? log_data['Service Start Type'] : undefined,
  4226.                         ServiceType: log_data['Service Type'] ? log_data['Service Type'] : undefined
  4227.                     };
  4228.                     acc.push({ alertExtraInfo });
  4229.                 }
  4230.             } catch (error) {
  4231.                 console.log(`Error: ${error.message}`);
  4232.             }
  4233.             return acc;
  4234.         }, []);
  4235.         return alertInfo;
  4236.     }
  4237.     const alertInfo = parseLog(rawLog);
  4238.     function generateDescription() {
  4239.         const alertDescriptions = [];
  4240.         for (const info of alertInfo) {
  4241.             const lastindex = summary.lastIndexOf(']');
  4242.             let desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  4243.             for (const key in info.alertExtraInfo) {
  4244.                 if (Object.hasOwnProperty.call(info.alertExtraInfo, key)) {
  4245.                     const value = info.alertExtraInfo[key];
  4246.                     if (value !== undefined) {
  4247.                         if (key == 'start_time' || key == 'end_time') {
  4248.                             desc += `${key}(<span class="red_highlight">GMT</span>): ${value.split('.')[0] + 'Z'}\n`;
  4249.                         } else {
  4250.                             desc += `${key}: ${value}\n`;
  4251.                         }
  4252.                     }
  4253.                 }
  4254.             }
  4255.             desc += `\nPlease verify if the activity is legitimate.\n`;
  4256.             alertDescriptions.push(desc);
  4257.         }
  4258.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  4259.         showDialog(alertMsg);
  4260.     }
  4261.     addButton('generateDescription', 'Description', generateDescription);
  4262. }
  4263.  
  4264. function ClarotyAlertHandler(...kwargs) {
  4265.     var { summary, rawLog } = kwargs[0];
  4266.     var raw_alert = 0;
  4267.     const num_alert = $('#customfield_10300-val').text().trim();
  4268.     function parseLog(rawLog) {
  4269.         const alertInfo = rawLog.reduce((acc, log) => {
  4270.             try {
  4271.                 if (log.length == 0) {
  4272.                     return acc;
  4273.                 }
  4274.                 const regex = /(\b\w+=)([^=\s].*?)(?=\s+\w+=|$)/g;
  4275.                 let match;
  4276.                 const matches = {};
  4277.                 while ((match = regex.exec(log)) !== null) {
  4278.                     let item = match[0].split('=');
  4279.                     matches[item[0]] = item.slice(1, item.length).join('=');
  4280.                 }
  4281.                 raw_alert += 1;
  4282.                 console.log(matches);
  4283.                 let logArray = log.split(' ').filter((item) => item !== ''); //Remove extra whitespace from the string
  4284.                 acc.push({
  4285.                     'Event time': logArray.slice(0, 3).join(' '),
  4286.                     'Extra information': logArray.slice(3, 8).join(' '),
  4287.                     'CtdSourceIp': matches.CtdSourceIp ? matches.CtdSourceIp : undefined,
  4288.                     'CtdDestinationIp': matches.CtdDestinationIp ? matches.CtdDestinationIp : undefined,
  4289.                     'CtdMessage': matches.CtdMessage ? matches.CtdMessage : undefined,
  4290.                     'CtdCategory': matches.CtdCategory ? matches.CtdCategory : undefined,
  4291.                     'CtdSourceZone': matches.CtdSourceZone ? matches.CtdSourceZone : undefined,
  4292.                     'CtdDestinationZone': matches.CtdDestinationZone ? matches.CtdDestinationZone : undefined,
  4293.                     'CtdAlertLink': matches.CtdAlertLink ? matches.CtdAlertLink : undefined
  4294.                 });
  4295.             } catch (error) {
  4296.                 console.log(`Error: ${error.message}`);
  4297.             }
  4298.             return acc;
  4299.         }, []);
  4300.         return alertInfo;
  4301.     }
  4302.     const alertInfo = parseLog(rawLog);
  4303.     function generateDescription() {
  4304.         const alertDescriptions = [];
  4305.         if (raw_alert < num_alert) {
  4306.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  4307.             alertDescriptions.push(extra_message);
  4308.         }
  4309.         for (const info of alertInfo) {
  4310.             const lastindex = summary.lastIndexOf(']');
  4311.             let desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  4312.             for (const key in info) {
  4313.                 if (Object.hasOwnProperty.call(info, key)) {
  4314.                     const value = info[key];
  4315.                     if (value !== undefined) {
  4316.                         desc += `${key}: ${value}\n`;
  4317.                     }
  4318.                 }
  4319.             }
  4320.             desc += `\nPlease verify if the activity is legitimate.\n`;
  4321.             alertDescriptions.push(desc);
  4322.         }
  4323.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  4324.         showDialog(alertMsg);
  4325.     }
  4326.     addButton('generateDescription', 'Description', generateDescription);
  4327. }
  4328.  
  4329. function FireeyeAlertHandler(...kwargs) {
  4330.     var { summary, rawLog } = kwargs[0];
  4331.     var raw_alert = 0;
  4332.     const num_alert = $('#customfield_10300-val').text().trim();
  4333.     function parseLog(rawLog) {
  4334.         const alertInfo = rawLog.reduce((acc, log) => {
  4335.             try {
  4336.                 if (log.length == 0) {
  4337.                     return acc;
  4338.                 }
  4339.                 const regex = /(\b\w+=)([^=\s].*?)(?=\s+\w+=|$)/g;
  4340.                 let match;
  4341.                 const matches = {};
  4342.                 while ((match = regex.exec(log)) !== null) {
  4343.                     let item = match[0].split('=');
  4344.                     matches[item[0]] = item.slice(1, item.length).join('=');
  4345.                 }
  4346.                 raw_alert += 1;
  4347.                 let logArray = log.split(' ').filter((item) => item !== ''); //Remove extra whitespace from the string
  4348.                 acc.push({
  4349.                     'Event time': logArray.slice(0, 3).join(' '),
  4350.                     'Vlan': matches.cn1 ? matches.cn1 : undefined,
  4351.                     'Sid': matches.cn2 ? matches.cn2 : undefined,
  4352.                     'CncHost': matches.cs5 ? matches.cs5 : undefined,
  4353.                     'CncPort': matches.cn3 ? matches.cn3 : undefined,
  4354.                     'Sname': matches.cs1 ? matches.cs1 : undefined,
  4355.                     'anomaly': matches.cs2 ? matches.cs2 : undefined,
  4356.                     'Link': matches.cs4 ? matches.cs4 : undefined,
  4357.                     'Channel': matches.cs6 ? matches.cs6 : undefined,
  4358.                     'request': matches.request ? matches.request : undefined,
  4359.                     'requestClientApplication': matches.requestClientApplication
  4360.                         ? matches.requestClientApplication
  4361.                         : undefined,
  4362.                     'requestMethod': matches.requestMethod ? matches.requestMethod : undefined,
  4363.                     'dst': matches.dst ? matches.dst : undefined,
  4364.                     'dpt': matches.dpt ? matches.dpt : undefined,
  4365.                     'src': matches.src ? matches.src : undefined,
  4366.                     'spt': matches.spt ? matches.spt : undefined,
  4367.                     'dvchost': matches.dvchost ? matches.dvchost : undefined,
  4368.                     'dvc': matches.dvc ? matches.dvc : undefined
  4369.                 });
  4370.             } catch (error) {
  4371.                 console.log(`Error: ${error.message}`);
  4372.             }
  4373.             return acc;
  4374.         }, []);
  4375.         return alertInfo;
  4376.     }
  4377.     const alertInfo = parseLog(rawLog);
  4378.     function generateDescription() {
  4379.         const alertDescriptions = [];
  4380.         if (raw_alert < num_alert) {
  4381.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  4382.             alertDescriptions.push(extra_message);
  4383.         }
  4384.         for (const info of alertInfo) {
  4385.             const lastindex = summary.lastIndexOf(']');
  4386.             let desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  4387.             for (const key in info) {
  4388.                 if (Object.hasOwnProperty.call(info, key)) {
  4389.                     const value = info[key];
  4390.                     if (value !== undefined) {
  4391.                         desc += `${key}: ${value}\n`;
  4392.                     }
  4393.                 }
  4394.             }
  4395.             desc += `\nPlease verify if the activity is legitimate.\n`;
  4396.             alertDescriptions.push(desc);
  4397.         }
  4398.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  4399.         showDialog(alertMsg);
  4400.     }
  4401.     addButton('generateDescription', 'Description', generateDescription);
  4402. }
  4403.  
  4404. function WebAccesslogAlertHandler(...kwargs) {
  4405.     var { summary, rawLog } = kwargs[0];
  4406.     var raw_alert = 0;
  4407.     function parseLog(rawLog) {
  4408.         const alertInfo = rawLog.reduce((acc, log) => {
  4409.             try {
  4410.                 if (log.length == 0) {
  4411.                     return acc;
  4412.                 }
  4413.                 const regex = /(\b\w+=)"([^"]*?)"/g;
  4414.                 const regex_ = /"(.*?)"/g;
  4415.                 let match;
  4416.                 const matches = {};
  4417.                 while ((match = regex.exec(log)) !== null) {
  4418.                     let item = match[0].split('=');
  4419.                     matches[item[0]] = item.slice(1, item.length).join('=');
  4420.                 }
  4421.                 let match_;
  4422.                 const matches_ = [];
  4423.                 while ((match_ = regex_.exec(log)) !== null) {
  4424.                     matches_.push(match_[0]);
  4425.                 }
  4426.                 console.log(matches);
  4427.                 console.log(matches_);
  4428.                 let logArray = log.split(' ').filter((item) => item !== ''); //Remove extra whitespace from the string
  4429.                 console.log(logArray);
  4430.                 acc.push({
  4431.                     'Event time': logArray.slice(3, 5).join(' '),
  4432.                     'Source_IP': logArray[0] ? logArray[0] : undefined,
  4433.                     // 'request_uri': matches.request_uri ? matches.request_uri : undefined,
  4434.                     'URL': matches_[0] ? matches_[0] : undefined,
  4435.                     'User-Agent': matches_[2] ? matches_[2] : undefined,
  4436.                     'upstream_status': logArray[8] ? logArray[8] : undefined,
  4437.                     'upstream_addr': matches.upstream_addr ? matches.upstream_addr : undefined,
  4438.                     'sn': matches.sn ? matches.sn : undefined,
  4439.                     'http_referrer': matches.http_referrer ? matches.http_referrer : undefined,
  4440.                     'http_cookie': matches.http_cookie ? matches.http_cookie : undefined,
  4441.                     'location': matches.location ? matches.location : undefined
  4442.                 });
  4443.             } catch (error) {
  4444.                 console.log(`Error: ${error.message}`);
  4445.             }
  4446.             return acc;
  4447.         }, []);
  4448.         return alertInfo;
  4449.     }
  4450.     const alertInfo = parseLog(rawLog);
  4451.     console.log(alertInfo);
  4452.     function generateDescription() {
  4453.         const alertDescriptions = [];
  4454.         for (const info of alertInfo) {
  4455.             const lastindex = summary.lastIndexOf(']');
  4456.             let desc = `Observed ${summary.substr(lastindex + 1)}\n`;
  4457.             for (const key in info) {
  4458.                 if (Object.hasOwnProperty.call(info, key)) {
  4459.                     const value = info[key];
  4460.                     if (value !== undefined && value !== '-' && value !== '"-"') {
  4461.                         desc += `${key}: ${value}\n`;
  4462.                     }
  4463.                 }
  4464.             }
  4465.             desc += `\nPlease verify if the activity is legitimate.\n`;
  4466.             alertDescriptions.push(desc);
  4467.         }
  4468.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  4469.         showDialog(alertMsg);
  4470.     }
  4471.     addButton('generateDescription', 'Description', generateDescription);
  4472. }
  4473.  
  4474. function FireeyeEtpAlertHandler(...kwargs) {
  4475.     const { rawLog, summary } = kwargs[0];
  4476.     var raw_alert = 0;
  4477.     function parseLog(rawLog) {
  4478.         const alertInfo = rawLog.reduce((acc, log) => {
  4479.             try {
  4480.                 const { meta, alert, email } = JSON.parse(log)['fireeye'];
  4481.                 acc.push({
  4482.                     timestamp: alert['timestamp'],
  4483.                     accepted: email['timestamp']['accepted'],
  4484.                     last_malware: meta['last_malware'],
  4485.                     alert_type: meta['alert_type'],
  4486.                     status: email['status'],
  4487.                     source_ip: email['source_ip'],
  4488.                     rcpt_to: email['smtp']['rcpt_to'],
  4489.                     mail_from: email['smtp']['mail_from'],
  4490.                     etp_message_id: email['etp_message_id'],
  4491.                     To: email['headers']['to'],
  4492.                     From: email['headers']['from'],
  4493.                     Subject: email['headers']['subject'],
  4494.                     attachment: email['attachment']
  4495.                 });
  4496.                 raw_alert += 1;
  4497.             } catch (error) {
  4498.                 console.log(`Error: ${error}`);
  4499.             }
  4500.             return acc;
  4501.         }, []);
  4502.         return alertInfo;
  4503.     }
  4504.  
  4505.     const alertInfo = parseLog(rawLog);
  4506.     const num_alert = $('#customfield_10300-val').text().trim();
  4507.     function generateDescription() {
  4508.         const alertDescriptions = [];
  4509.         if (raw_alert < num_alert) {
  4510.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  4511.             alertDescriptions.push(extra_message);
  4512.         }
  4513.         for (const info of alertInfo) {
  4514.             let desc = `Observed ${summary.split(']')[1]}\n`;
  4515.             Object.entries(info).forEach(([index, value]) => {
  4516.                 if (value !== undefined && value !== ' ' && index != 'Summary') {
  4517.                     if (index == 'timestamp') {
  4518.                         desc += `timestamp(<span class="red_highlight">GMT</span>): ${value.split('.')[0]}Z\n`;
  4519.                     } else if (index == 'accepted') {
  4520.                         desc += `accepted(<span class="red_highlight">GMT</span>): ${value}Z\n`;
  4521.                     } else {
  4522.                         desc += `${index}: ${value}\n`;
  4523.                     }
  4524.                 }
  4525.             });
  4526.             desc += `\nPlease verify if the activity is legitimate.\n`;
  4527.             alertDescriptions.push(desc);
  4528.         }
  4529.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  4530.         showDialog(alertMsg);
  4531.     }
  4532.     addButton('generateDescription', 'Description', generateDescription);
  4533. }
  4534.  
  4535. function SentinelOneAlertHandler(...kwargs) {
  4536.     const { rawLog, summary } = kwargs[0];
  4537.     var raw_alert = 0;
  4538.     function parseLog(rawLog) {
  4539.         const alertInfo = rawLog.reduce((acc, log) => {
  4540.             try {
  4541.                 console.log('===sentinel_one');
  4542.                 const sentinel_one = JSON.parse(log)['sentinel_one'];
  4543.                 acc.push({
  4544.                     timestamp: sentinel_one.threatInfo.createdAt.split('.')[0],
  4545.                     accountName: sentinel_one.accountName,
  4546.                     agentDomain: sentinel_one.agentDomain,
  4547.                     agentIpV4: sentinel_one.agentIpV4,
  4548.                     agentOsName: sentinel_one.agentOsName,
  4549.                     agentMitigationMode: sentinel_one.agentMitigationMode,
  4550.                     filePath: sentinel_one.threatInfo.filePath,
  4551.                     sha1: sentinel_one.threatInfo.sha1,
  4552.                     confidenceLevel: sentinel_one.threatInfo.filePath,
  4553.                     threatName: sentinel_one.threatInfo.threatName,
  4554.                     processUser: sentinel_one.threatInfo.processUser
  4555.                 });
  4556.                 raw_alert += 1;
  4557.             } catch (error) {
  4558.                 console.log(`Error: ${error}`);
  4559.             }
  4560.             return acc;
  4561.         }, []);
  4562.         return alertInfo;
  4563.     }
  4564.  
  4565.     const alertInfo = parseLog(rawLog);
  4566.     const num_alert = $('#customfield_10300-val').text().trim();
  4567.     function generateDescription() {
  4568.         const alertDescriptions = [];
  4569.         if (raw_alert < num_alert) {
  4570.             let extra_message = `<span class="red_highlight">Number Of Alert : ${num_alert}, Raw Log Alert : ${raw_alert} Raw log information is Not Complete, Please Get More Alert Information From Elastic.</span>\n`;
  4571.             alertDescriptions.push(extra_message);
  4572.         }
  4573.         for (const info of alertInfo) {
  4574.             let desc = `Observed ${summary.split(']')[1]}\n`;
  4575.             Object.entries(info).forEach(([index, value]) => {
  4576.                 if (value !== undefined && value !== ' ' && index != 'Summary') {
  4577.                     if (index == 'timestamp') {
  4578.                         desc += `timestamp(<span class="red_highlight">GMT</span>): ${value.split('.')[0]}Z\n`;
  4579.                     } else {
  4580.                         desc += `${index}: ${value}\n`;
  4581.                     }
  4582.                 }
  4583.             });
  4584.             desc += `\nPlease verify if the activity is legitimate.\n`;
  4585.             alertDescriptions.push(desc);
  4586.         }
  4587.         const alertMsg = [...new Set(alertDescriptions)].join('\n');
  4588.         showDialog(alertMsg);
  4589.     }
  4590.     addButton('generateDescription', 'Description', generateDescription);
  4591. }
  4592.  
  4593. function LHG_CS_AlertHandler(DecoderName) {
  4594.     let ORG = $('#customfield_10002-val').text().trim();
  4595.     console.log(ORG.split(' ')[ORG.split(' ').length - 1]);
  4596.     const elements = document.querySelectorAll('.user-hover.user-avatar');
  4597.     const userList = ['kitty.li', 'anson.cho', 'ray.tan', 'philip.ng'];
  4598.     console.log(elements[0].textContent.toLowerCase()); // 对每个元素执行操作
  4599.     let ClientComment = false;
  4600.     for (const dataItem of userList) {
  4601.         if (elements[0].textContent.toLowerCase().includes(dataItem.toLowerCase())) {
  4602.             ClientComment = true;
  4603.             break;
  4604.         }
  4605.     }
  4606.     //判断工单是否升级，
  4607.     if (ORG.split(' ')[ORG.split(' ').length - 1] == 'None' && DecoderName == 'crowdstrike_cef') {
  4608.         $('#opsbar-opsbar-transitions').on('click', () => {
  4609.             let userConfirmed = confirm('LHG的所有 Crowdstrike 告警均需要升级，即使是误报也需要升级');
  4610.         });
  4611.     } else {
  4612.         if (!ClientComment) {
  4613.             $('#opsbar-opsbar-transitions').on('click', () => {
  4614.                 let userConfirmed = confirm(
  4615.                     '只有这四个客户回复philip.ng,ray.tan,anson.cho,kitty.li,才可关单,若以上四个客户已允许close，可忽略此提示'
  4616.                 );
  4617.             });
  4618.         }
  4619.     }
  4620. }
  4621.  
  4622. function RealMonitorMe() {
  4623.     let ORG = $('#customfield_10002-val').text().trim();
  4624.     let status = $('#opsbar-transitions_more').text().trim();
  4625.     if ($('#customfield_10302-val').text().trim().includes('\n')) {
  4626.         let rules = $('#customfield_10302-val').text().trim().split(' \n')[1].split('\n');
  4627.         if (rules.length - 1 >= 3 && status == 'Work in progress') {
  4628.             confirm(
  4629.                 `检测到该工单的RuleName有${
  4630.                     rules.length - 1
  4631.                 }个，(如果同一张tickets出现三个告警及以上，需要往cortex群里发，如果是误报请描述原因，谢谢)`
  4632.             );
  4633.         }
  4634.     }
  4635.     const intervalId = setInterval(() => {
  4636.         var element_one = document.getElementById('opsbar-opsbar-transitions');
  4637.         var first = element_one ? element_one.textContent || element_one.innerText : null;
  4638.         if (first == 'Resolved') {
  4639.             clearInterval(intervalId);
  4640.         }
  4641.         if (first == 'Waiting for customer' && ORG.split(' ')[ORG.split(' ').length - 1] == 'None') {
  4642.             console.log('===发生了改变', first);
  4643.             confirm('请注意,该工单变为Waiting for customer,请检查该工单是否已添加ORG');
  4644.             first = 'Waiting for customer';
  4645.             clearInterval(intervalId);
  4646.         }
  4647.     }, 500);
  4648. }
  4649.  
  4650. function formatCurrentDateTime(dateStr, decoder_name) {
  4651.     if (dateStr) {
  4652.         var date = new Date(dateStr);
  4653.         var localOffset = date.getTimezoneOffset();
  4654.         if (decoder_name == 'impervainc_cef') {
  4655.             var targetDate = new Date(date.getTime() + (480 + localOffset) * 60000);
  4656.         } else {
  4657.             var targetDate = new Date(date.getTime() + (960 + localOffset) * 60000);
  4658.         }
  4659.         var year = targetDate.getFullYear();
  4660.         var month = ('0' + (targetDate.getMonth() + 1)).slice(-2);
  4661.         var day = ('0' + targetDate.getDate()).slice(-2);
  4662.         var hours = ('0' + targetDate.getHours()).slice(-2);
  4663.         var minutes = ('0' + targetDate.getMinutes()).slice(-2);
  4664.         var seconds = ('0' + targetDate.getSeconds()).slice(-2);
  4665.         return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
  4666.     }
  4667.     const pad = (num) => (num < 10 ? '0' : '') + num;
  4668.     const months = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
  4669.     const date_ = new Date();
  4670.  
  4671.     const day_ = date_.getDate();
  4672.     const month_ = months[date_.getMonth()];
  4673.     const year_ = date_.getFullYear().toString().slice(-2); // 取最后两位
  4674.     const hours_ = date_.getHours();
  4675.     const minutes_ = date_.getMinutes();
  4676.     const ampm = hours_ >= 12 ? 'PM' : 'AM';
  4677.     const hour = hours_ % 12 || 12; // Convert to 12-hour format and handle 0 case
  4678.  
  4679.     return `${pad(day_)}/${month_}/${year_} ${pad(hour)}:${pad(minutes_)} ${ampm}`;
  4680. }
  4681.  
  4682. function MonitorDev() {
  4683.     function formatDate() {
  4684.         const date = new Date();
  4685.         const day = String(date.getDate()).padStart(2, '0'); // 日期补齐两位数
  4686.         const month = date.toLocaleString('en-US', { month: 'short' }); // 获取月份缩写
  4687.         const year = String(date.getFullYear()).slice(-2); // 取年份的后两位
  4688.  
  4689.         let hours = date.getHours();
  4690.         const minutes = String(date.getMinutes()).padStart(2, '0');
  4691.         const ampm = hours >= 12 ? 'PM' : 'AM';
  4692.  
  4693.         hours = hours % 12; // 将24小时制转换为12小时制
  4694.         hours = hours ? hours : 12; // 如果是0点，将其转换为12
  4695.         hours = String(hours).padStart(2, '0'); // 补齐小时为两位数
  4696.  
  4697.         return `${day}/${month}/${year} ${hours}:${minutes} ${ampm}`;
  4698.     }
  4699.     let white = JSON.parse(localStorage.getItem('whitelist'));
  4700.  
  4701.     if (window.location.href.includes('/portal/2/create/100')) {
  4702.         const interval = setInterval(() => {
  4703.             var iframe = document.getElementById('rw_iframe');
  4704.             var iframeDocument = iframe.contentDocument || iframe.contentWindow.document;
  4705.             var element = iframeDocument.getElementById('summary');
  4706.             if (element) {
  4707.                 let summary = 'Whitelist ' + white['summary'].replace('Wazuh', white['LogSourceDomain']);
  4708.                 iframeDocument.getElementById('summary').value = summary;
  4709.                 iframeDocument.getElementById('s2id_labels').innerHTML =
  4710.                     `<ul class="select2-choices">  <li class="select2-search-choice">    <div>` +
  4711.                     white['LogSourceDomain'] +
  4712.                     `</div>    <a href="#" class="select2-search-choice-close" tabindex="-1"></a></li><li class="select2-search-field">    <input type="text" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" class="select2-input" id="s2id_autogen1" style="width: 10px;">  </li></ul>`;
  4713.                 iframeDocument.getElementById('labels').value = white['LogSourceDomain'];
  4714.                 iframeDocument.getElementById('customfield_14601').value = formatDate();
  4715.                 iframeDocument.getElementById('customfield_14600').value = formatDate();
  4716.                 iframeDocument.getElementById('customfield_14610').value = 'Yes';
  4717.                 iframeDocument.getElementById('customfield_14609').value = 'Yes';
  4718.                 iframeDocument.getElementById('customfield_14608').value = 'Yes';
  4719.                 clearInterval(interval);
  4720.             }
  4721.         }, 600);
  4722.     }
  4723.     let cachedEntry = GM_getValue('cachedEntry', null);
  4724.     if (window.location.href.includes('/servlet/desk/portal/2') && window.location.href.includes('DEV')) {
  4725.         window.location.href = `${cachedEntry['hk']}/browse/` + window.location.href.split('portal/2/')[1];
  4726.         localStorage.setItem('Dev_link', window.location.href.split('portal/2/')[1]);
  4727.     }
  4728.     if (window.location.href.includes(localStorage.getItem('Dev_link'))) {
  4729.         document.getElementById('edit-issue').click();
  4730.         const interval = setInterval(() => {
  4731.             const components = document.querySelector('#components-textarea');
  4732.             if (components) {
  4733.                 $('#components-textarea').val(white['Component']);
  4734.                 $('#components-textarea').click();
  4735.                 $('#issuelinks-issues-textarea').val(white['MSS'].split('browse/')[1]);
  4736.                 $('#tab-0').click();
  4737.                 localStorage.removeItem('Dev_link');
  4738.                 clearInterval(interval);
  4739.             }
  4740.         }, 500);
  4741.     }
  4742. }
  4743.  
  4744. function WhiteFilehash(filehash) {
  4745.     if (filehash == undefined) {
  4746.         return 0;
  4747.     }
  4748.     const cachedWhitehashContent = GM_getValue('cachedWhitehashContent', null);
  4749.     for (const f of cachedWhitehashContent) {
  4750.         if (filehash.includes(f['hash'].toLowerCase())) {
  4751.             console.log('命中了', filehash);
  4752.             return true;
  4753.         }
  4754.     }
  4755. }
  4756.  
  4757. function RealTimeMonitoring() {
  4758.     // Filter page: audio control registration and regular issues table update
  4759.     if (
  4760.         (window.location.href.includes('filter=15200') ||
  4761.             window.location.href.includes('filter=26405') ||
  4762.             window.location.href.includes('filter=13300')) &&
  4763.         !window.location.href.includes('MSS')
  4764.     ) {
  4765.         console.log('#### Code includes filter run ####');
  4766.         const NotifyControls = createNotifyControls();
  4767.         if (window.location.href.includes('filter=15200') || window.location.href.includes('filter=26405')) {
  4768.             setInterval(() => {
  4769.                 notifyKey = [];
  4770.                 $('.aui-button.aui-button-primary.search-button').click();
  4771.                 setTimeout(() => {
  4772.                     checkupdate(NotifyControls);
  4773.                 }, 10000);
  4774.             }, 180000);
  4775.         }
  4776.         if (window.location.href.includes('filter=13300')) {
  4777.             setInterval(() => {
  4778.                 notifyKey = [];
  4779.                 $('.aui-button.aui-button-primary.search-button').click();
  4780.                 setTimeout(() => {
  4781.                     monitorList();
  4782.                 }, 10000);
  4783.             }, 60000);
  4784.         }
  4785.     }
  4786.     if (window.location.href.includes('login.microsoftonline.com')) {
  4787.         setTimeout(() => {
  4788.             switch_user_microsoft();
  4789.         }, 2000);
  4790.     }
  4791.     if (window.location.href.includes('security.microsoft.com/homepage?&current=')) {
  4792.         setTimeout(() => {
  4793.             security_microsoft();
  4794.         }, 3000);
  4795.     }
  4796.     // Issue page: Alert Handler
  4797.     const generation_description = setInterval(() => {
  4798.         var LogSourceDomain = $('#customfield_10223-val').text().trim();
  4799.         let rawLog = $('#field-customfield_10219 > div:first-child > div:nth-child(2)').text().trim().split('\n');
  4800.         if (rawLog == '') {
  4801.             rawLog = $('#field-customfield_10904 > div:first-child > div:nth-child(2)').text().trim().split('\n');
  4802.         }
  4803.         const summary = $('#summary-val').text().trim();
  4804.         if ($('#issue-content').length && !$('#generateDescription').length) {
  4805.             console.log('#### Code Issue page: Alert Handler ####');
  4806.             const handlers = {
  4807.                 'cortex-xdr-json': cortexAlertHandler,
  4808.                 'mde-api-json': MDE365AlertHandler,
  4809.                 'sangfor-ccom-json': HTSCAlertHandler,
  4810.                 'carbonblack': CBAlertHandler,
  4811.                 'carbonblack_cef': VMCEFAlertHandler,
  4812.                 'windows_eventchannel': WineventAlertHandler,
  4813.                 'fortigate-firewall-v5': FortigateAlertHandler,
  4814.                 'crowdstrike_cef': CSAlertHandler,
  4815.                 'sophos': SophosAlertHandler,
  4816.                 'sepm-security': SpemAlertHandler,
  4817.                 'sepm-traffic': SpemAlertHandler,
  4818.                 'vmwarecarbonblack_cef': VMCEFAlertHandler,
  4819.                 'aws-cloudtrail': AwsAlertHandler,
  4820.                 'aws-cisco-umbrella': AwsAlertHandler,
  4821.                 'm365-defender-json': MDE365AlertHandler,
  4822.                 'azureeventhub': AzureAlertHandler,
  4823.                 'azuregraphapi-json': AzureGraphAlertHandler,
  4824.                 'paloalto-firewall': paloaltoAlertHandler,
  4825.                 'impervainc_cef': SangforAlertHandler,
  4826.                 'proofpoint_tap': ProofpointAlertHandler,
  4827.                 'zscaler-zpa-json': ZscalerAlertHandler,
  4828.                 'pulse-secure': PulseAlertHandler,
  4829.                 'aws-guardduty': AwsAlertHandler,
  4830.                 'alicloud-json': AlicloudAlertHandler,
  4831.                 'darktrace-json': DarktraceAlertHandler,
  4832.                 'sangfor_cef': SangforAlertHandler,
  4833.                 'cyberark_cef': SangforAlertHandler,
  4834.                 'radware-json': RadwareAlertHandler,
  4835.                 'carbonblack_cloud': CarbonAlertHandler,
  4836.                 'windows-syslog': WindowsSysAlertHandler,
  4837.                 'claroty_cef': ClarotyAlertHandler,
  4838.                 'office-365': Risky_Countries_AlertHandler,
  4839.                 'fireeye': FireeyeAlertHandler,
  4840.                 'web-accesslog': WebAccesslogAlertHandler,
  4841.                 'checkpoint_cef': SangforAlertHandler,
  4842.                 'incapsula_cef': SangforAlertHandler,
  4843.                 'fireeye-etp-json': FireeyeEtpAlertHandler,
  4844.                 'sentinelone-json': SentinelOneAlertHandler,
  4845.                 'sonicwall': FortigateAlertHandler,
  4846.                 'trellix_cef': SangforAlertHandler
  4847.             };
  4848.             let DecoderName = $('#customfield_10807-val').text().trim().toLowerCase();
  4849.             if (DecoderName == '') {
  4850.                 DecoderName = $('#customfield_10906-val').text().trim().toLowerCase();
  4851.             }
  4852.             if (DecoderName.includes('m365-defender-json')) {
  4853.                 let decoder_name = [];
  4854.                 DecoderName.split(' ').forEach((element, index) => {
  4855.                     if (element != 'hide\n' && element != '' && element != 'show\n' && element != '\n') {
  4856.                         decoder_name.push(element);
  4857.                     }
  4858.                 });
  4859.                 if (decoder_name[0].includes('m365-defender-json\n')) {
  4860.                     DecoderName = 'm365-defender-json';
  4861.                 }
  4862.             }
  4863.             const handler = handlers[DecoderName];
  4864.             if (handler) {
  4865.                 handler({ LogSourceDomain: LogSourceDomain, rawLog: rawLog, summary: summary });
  4866.             }
  4867.             const No_Decoder_handlers = {
  4868.                 'detect aad, o365 sign-in from risky countries': Risky_Countries_AlertHandler,
  4869.                 'successful azure/o365 login from malware-ip': Risky_Countries_AlertHandler,
  4870.                 'rarely country signin from o365': Risky_Countries_AlertHandler,
  4871.                 'agent disconnected': Agent_Disconnect_AlertHandler,
  4872.                 'suspicious geolocation ip login success': PulseAlertHandler,
  4873.                 'login success from malware ip(s)': ThreatMatrixAlertHandler,
  4874.                 'multiple account being disabled or deleted in short period of time': MultipleAccountAlertHandler,
  4875.                 'multiple sms request for same source ip': AwsAlertHandler
  4876.             };
  4877.             const Summary = $('#summary-val').text().trim();
  4878.             let No_Decoder_handler = null;
  4879.             Object.keys(No_Decoder_handlers).forEach((key) => {
  4880.                 if (Summary.toLowerCase().includes(key)) {
  4881.                     No_Decoder_handler = No_Decoder_handlers[key];
  4882.                 }
  4883.             });
  4884.             if (No_Decoder_handler !== null) {
  4885.                 No_Decoder_handler({ LogSourceDomain: LogSourceDomain, rawLog: rawLog, summary: Summary });
  4886.             }
  4887.             if (LogSourceDomain == '') {
  4888.                 LogSourceDomain = $('#customfield_10846-val').text().trim();
  4889.             }
  4890.             const Log_Domain_handlers = {
  4891.                 mdb: MdbAlertHandler, //这里面有点工单为decoder name:sshd
  4892.                 dst: DstAlertHandler
  4893.             };
  4894.             const Log_Domain_handler = Log_Domain_handlers[LogSourceDomain];
  4895.             if (Log_Domain_handler) {
  4896.                 Log_Domain_handler({ LogSourceDomain: LogSourceDomain, rawLog: rawLog, summary: summary });
  4897.             }
  4898.             clearInterval(generation_description);
  4899.         }
  4900.     }, 1000);
  4901.     // Issue page: check Keywords and ATT&CK and Org
  4902.     setTimeout(() => {
  4903.         if ($('#issue-content').length && !$('.aui-banner-error').length) {
  4904.             console.log('#### Code Issue page: check Keywords ####');
  4905.             checkKeywords();
  4906.             checkATTCK();
  4907.         }
  4908.     }, 4500);
  4909.  
  4910.     // Issue page: Edit Notify
  4911.     setTimeout(() => {
  4912.         let LogSourceDomain,
  4913.             Source,
  4914.             Labels,
  4915.             LogSource,
  4916.             DecoderName,
  4917.             TicketAutoEscalate,
  4918.             Status,
  4919.             RawLog,
  4920.             Summary,
  4921.             AgentName;
  4922.         let cachedEntry = GM_getValue('cachedEntry', null);
  4923.         if (window.location.host === cachedEntry['hk'].split('//')[1]) {
  4924.             // for HK
  4925.             LogSourceDomain = $('#customfield_10223-val').text().trim();
  4926.             Source = $('#customfield_10113-val').text().trim();
  4927.             Labels = $('.labels-wrap .labels li a span').text();
  4928.             LogSource = $('#customfield_10204-val').text().trim();
  4929.             DecoderName = $('#customfield_10807-val').text().trim().toLowerCase();
  4930.             TicketAutoEscalate = $('#customfield_12202-val').text().trim();
  4931.             Status = $('#status-val > span').text().trim();
  4932.             RawLog =
  4933.                 $('#field-customfield_10219 > div:first-child > div:nth-child(2)').text().trim() ||
  4934.                 $('#customfield_10219-val').text().trim() ||
  4935.                 $('#field-customfield_10232 > div.twixi-wrap.verbose > div > div > div > pre').text();
  4936.             Summary = $('#summary-val').text().trim();
  4937.             AgentName = $('#customfield_10805-val').text().trim();
  4938.         } else if (window.location.host === cachedEntry['macao'].split('//')[1]) {
  4939.             // for MO
  4940.             LogSourceDomain = $('#customfield_10846-val').text().trim();
  4941.             Source = $('#customfield_10872-val').text().trim();
  4942.             Labels = $('#labels-212244-value').text().trim();
  4943.             LogSource = $('#customfield_10854-val').text().trim();
  4944.             DecoderName = $('#customfield_10906-val').text().trim();
  4945.             TicketAutoEscalate = $('#customfield_10893-val').text().trim();
  4946.             Status = $('#status-value > span').text().trim();
  4947.             RawLog = $('#field-customfield_10904 > div.twixi-wrap.verbose > div').text().trim();
  4948.             Summary = $('#summary-val').text().trim();
  4949.             AgentName = $('#customfield_10802-val').text().trim();
  4950.         }
  4951.  
  4952.         const pageData = {
  4953.             LogSourceDomain,
  4954.             Source,
  4955.             Labels,
  4956.             LogSource,
  4957.             DecoderName,
  4958.             TicketAutoEscalate,
  4959.             Status,
  4960.             RawLog,
  4961.             Summary,
  4962.             AgentName
  4963.         };
  4964.  
  4965.         // If it pops up once, it will not be reminded again
  4966.         if (
  4967.             ($('#issue-content').length &&
  4968.                 !$('#generateTicketNotify').length &&
  4969.                 window.location.href.includes('MSS')) ||
  4970.             window.location.href.includes('OPS')
  4971.         ) {
  4972.             addButton('towhitelist', 'WhiteList', ToWhitelist);
  4973.             ticketNotify(pageData);
  4974.         }
  4975.     }, 1000);
  4976.  
  4977.     // Issue page: Norm Alert
  4978.     setTimeout(() => {
  4979.         var LogSourceDomain = $('#customfield_10223-val').text().trim();
  4980.         let DecoderName = $('#customfield_10807-val').text().trim().toLowerCase();
  4981.         if (DecoderName == '') {
  4982.             DecoderName = $('#customfield_10906-val').text().trim().toLowerCase();
  4983.         }
  4984.         if (LogSourceDomain.includes('lhg')) {
  4985.             LHG_CS_AlertHandler(DecoderName);
  4986.         }
  4987.     }, 3500);
  4988.  
  4989.     // Issue page: Quick Reply
  4990.     setInterval(() => {
  4991.         if (document.querySelector('#reply') == null) {
  4992.             QuickReply();
  4993.         }
  4994.     }, 3000);
  4995. }
  4996.  
  4997. (function () {
  4998.     ('use strict');
  4999.     RealTimeMonitoring();
  5000.  
  5001.     registerSearchMenu();
  5002.     registerExceptionMenu();
  5003.     registerCustomQuickReplyMenu();
  5004.     addCss();
  5005.     MonitorDev();
  5006.     AJS.whenIType('zv').execute(function () {
  5007.         document.getElementById('opsbar-transitions_more').click();
  5008.         const interval = setInterval(() => {
  5009.             const element = document.querySelector('#action_id_761');
  5010.             if (element) {
  5011.                 document.getElementById('action_id_761').click();
  5012.                 clearInterval(interval);
  5013.             }
  5014.         }, 100); // 每100毫秒检查一次
  5015.     });
  5016.     AJS.whenIType('zx').execute(function () {
  5017.         document.getElementById('edit-issue').click();
  5018.         const interval = setInterval(() => {
  5019.             const tabsMenu = document.querySelector('#horizontal');
  5020.             const elements = tabsMenu.querySelectorAll('*');
  5021.             const elementsArray = Array.from(elements);
  5022.             const reviewElement = elementsArray.find((element) => element.outerText.trim() === 'Review');
  5023.             if (reviewElement) {
  5024.                 const menuItem = reviewElement.querySelector('.menu-item a');
  5025.                 const idValue = menuItem.id;
  5026.                 const element = document.querySelector('#' + idValue);
  5027.                 if (element) {
  5028.                     document.getElementById(idValue).click();
  5029.                     $('#customfield_17201').val(formatCurrentDateTime());
  5030.                     const metaElement = document
  5031.                         .querySelector('meta[name="ajs-remote-user-fullname"]')
  5032.                         .getAttribute('content');
  5033.                     $('#customfield_17203-field').val(metaElement);
  5034.                     document.getElementById('customfield_17203-field').click();
  5035.                     clearInterval(interval);
  5036.                 }
  5037.             }
  5038.         }, 500);
  5039.         const intervals = setInterval(() => {
  5040.             const element1 = document.querySelector('#showing-1-of-1-matching-users');
  5041.             console.log(element1);
  5042.             if (element1) {
  5043.                 document.querySelector('#showing-1-of-1-matching-users li').click();
  5044.                 clearInterval(intervals);
  5045.             }
  5046.         }, 500);
  5047.     });
  5048.     RealMonitorMe();
  5049. })();