Add configurable notable severity

contentctl/input/new_content_generator.py

@@ -61,6 +61,7 @@ def execute(self, input_dto: NewContentGeneratorInputDto) -> None:
             self.output_dto.obj['tags']['risk_score'] = 'UPDATE (impact * confidence)/100'
             self.output_dto.obj['tags']['security_domain'] = answers['security_domain']
             #self.output_dto.obj['source'] = answers['detection_kind']
+            self.output_dto.obj['tags']['severity'] = answers['severity']
 
 
         elif input_dto.type == SecurityContentType.stories:

contentctl/input/new_content_questions.py

@@ -1,5 +1,8 @@
 
 
+from contentctl.objects.enums import NotableSeverity
+
+
 class NewContentQuestions():
 
     @classmethod
@@ -91,6 +94,13 @@ def get_questions_detection(self) -> list:
                 ],
                 'default': 'endpoint'
             },
+            {
+                'type': 'select',
+                'message': 'Severity',
+                'name': 'severity',
+                'choices': [item.value for item in NotableSeverity],
+                'default': NotableSeverity.Medium.value,
+            },
         ]
         return questions
 

contentctl/objects/detection_tags.py

@@ -1,6 +1,7 @@
 import re
 
 from pydantic import BaseModel, validator, ValidationError, root_validator
+from contentctl.objects.enums import NotableSeverity
 from contentctl.objects.mitre_attack_enrichment import MitreAttackEnrichment
 from contentctl.objects.constants import *
 
@@ -13,6 +14,7 @@ class DetectionTags(BaseModel):
     cis20: list = None
     confidence: str
     impact: int
+    severity: NotableSeverity = NotableSeverity.Medium
     kill_chain_phases: list = None
     message: str
     mitre_attack_id: list = None

contentctl/objects/enums.py

@@ -8,6 +8,14 @@ class AnalyticsType(enum.Enum):
     correlation = 4
 
 
+class NotableSeverity(enum.Enum):
+    Informational = "informational"
+    Low = "low"
+    Medium = "medium"
+    High = "high"
+    Critical = "critical"
+
+
 class DataModel(enum.Enum):
     Endpoint = 1
     Network_Traffic = 2

contentctl/output/templates/savedsearches_detections.j2

@@ -70,7 +70,7 @@ action.notable.param.nes_fields = {{ detection.nes_fields }}
 action.notable.param.rule_description = {{ detection.deployment.notable.rule_description | custom_jinja2_enrichment_filter(detection) }}
 action.notable.param.rule_title = {{ detection.deployment.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}
 action.notable.param.security_domain = {{ detection.tags.security_domain }}
-action.notable.param.severity = high
+action.notable.param.severity = {{ detection.tags.severity.value }}
 {% endif %}
 {% if detection.deployment.email.to is defined %}
 action.email.subject.alert = {{ detection.deployment.email.subject | custom_jinja2_enrichment_filter(detection) }}