DetectionForm.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "9269e20e-30d4-4828-b6ec-26d9592ed4be",
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    }
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "WARNING: pip is being invoked by an old script wrapper. This will fail in a future version of pip.\n",
      "Please see https://github.com/pypa/pip/issues/5599 for advice on fixing the underlying issue.\n",
      "To avoid this problem you can invoke Python with '-m pip' instead of running pip directly.\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: IPython in /usr/lib/python3/dist-packages (8.29.0)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: IPython in /usr/lib/python3/dist-packages (8.29.0)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: ipywidgets in /usr/local/lib/python3.12/dist-packages (8.1.5)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: ipywidgets in /usr/local/lib/python3.12/dist-packages (8.1.5)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: decorator in /usr/lib/python3/dist-packages (from IPython) (5.1.1)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: decorator in /usr/lib/python3/dist-packages (from IPython) (5.1.1)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: jedi&gt;=0.16 in /usr/lib/python3/dist-packages (from IPython) (0.19.1)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: jedi>=0.16 in /usr/lib/python3/dist-packages (from IPython) (0.19.1)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: matplotlib-inline in /usr/lib/python3/dist-packages (from IPython) (0.1.6)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: matplotlib-inline in /usr/lib/python3/dist-packages (from IPython) (0.1.6)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: prompt-toolkit&lt;3.1.0,&gt;=3.0.41 in /usr/lib/python3/dist-packages (from IPython) (3.0.48)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: prompt-toolkit<3.1.0,>=3.0.41 in /usr/lib/python3/dist-packages (from IPython) (3.0.48)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: pygments&gt;=2.4.0 in /usr/lib/python3/dist-packages (from IPython) (2.18.0)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: pygments>=2.4.0 in /usr/lib/python3/dist-packages (from IPython) (2.18.0)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: stack-data in /usr/lib/python3/dist-packages (from IPython) (0.6.3)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: stack-data in /usr/lib/python3/dist-packages (from IPython) (0.6.3)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: traitlets&gt;=5.13.0 in /usr/lib/python3/dist-packages (from IPython) (5.14.3)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: traitlets>=5.13.0 in /usr/lib/python3/dist-packages (from IPython) (5.14.3)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: pexpect&gt;4.3 in /usr/lib/python3/dist-packages (from IPython) (4.9.0)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: pexpect>4.3 in /usr/lib/python3/dist-packages (from IPython) (4.9.0)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: comm&gt;=0.1.3 in /usr/local/lib/python3.12/dist-packages (from ipywidgets) (0.2.2)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: comm>=0.1.3 in /usr/local/lib/python3.12/dist-packages (from ipywidgets) (0.2.2)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: widgetsnbextension~=4.0.12 in /usr/local/lib/python3.12/dist-packages (from ipywidgets) (4.0.13)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: widgetsnbextension~=4.0.12 in /usr/local/lib/python3.12/dist-packages (from ipywidgets) (4.0.13)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: jupyterlab-widgets~=3.0.12 in /usr/local/lib/python3.12/dist-packages (from ipywidgets) (3.0.13)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: jupyterlab-widgets~=3.0.12 in /usr/local/lib/python3.12/dist-packages (from ipywidgets) (3.0.13)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: ptyprocess&gt;=0.5 in /usr/lib/python3/dist-packages (from pexpect&gt;4.3-&gt;IPython) (0.7.0)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: ptyprocess>=0.5 in /usr/lib/python3/dist-packages (from pexpect>4.3->IPython) (0.7.0)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: wcwidth in /usr/lib/python3/dist-packages (from prompt-toolkit&lt;3.1.0,&gt;=3.0.41-&gt;IPython) (0.2.13)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: wcwidth in /usr/lib/python3/dist-packages (from prompt-toolkit<3.1.0,>=3.0.41->IPython) (0.2.13)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: asttokens&gt;=2.1.0 in /usr/lib/python3/dist-packages (from stack-data-&gt;IPython) (2.4.1)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: asttokens>=2.1.0 in /usr/lib/python3/dist-packages (from stack-data->IPython) (2.4.1)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: executing&gt;=1.2.0 in /usr/lib/python3/dist-packages (from stack-data-&gt;IPython) (2.1.0)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: executing>=1.2.0 in /usr/lib/python3/dist-packages (from stack-data->IPython) (2.1.0)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\">Requirement already satisfied: pure-eval in /usr/lib/python3/dist-packages (from stack-data-&gt;IPython) (0.2.3)\n",
       "</pre>\n"
      ],
      "text/plain": [
       "Requirement already satisfied: pure-eval in /usr/lib/python3/dist-packages (from stack-data->IPython) (0.2.3)\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<pre style=\"white-space:pre;overflow-x:auto;line-height:normal;font-family:Menlo,'DejaVu Sans Mono',consolas,'Courier New',monospace\"><span style=\"color: #808000; text-decoration-color: #808000\">WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable.It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning.\n",
       "</span></pre>\n"
      ],
      "text/plain": [
       "\u001b[33mWARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable.It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning.\u001b[0m\u001b[33m\n",
       "\u001b[0m"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "0"
      ]
     },
     "execution_count": 1,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "import pip\n",
    "pip.main([\"install\",\"IPython\",\"ipywidgets\",\"--break-system-packages\",\"--upgrade\"])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "fa25e78d-08e3-48df-9ce2-4ab1187055b0",
   "metadata": {
    "editable": true,
    "slideshow": {
     "slide_type": ""
    },
    "tags": [
     "hide-input"
    ]
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "3cf9dd57398c4fa0a3e55e4dd949085c",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(Text(value='', placeholder='Detection Title'), Textarea(value='', placeholder='Goals'), Textare…"
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from IPython.display import display, Markdown\n",
    "from ipywidgets import interact, widgets, HTML\n",
    "import base64\n",
    "\n",
    "title=widgets.Text(value='', placeholder='Detection Title', description='')\n",
    "goal=widgets.Textarea(value='', placeholder='Goals', description='')\n",
    "cat=widgets.Textarea(value='', placeholder='Category', description='')\n",
    "abstract=widgets.Textarea(value='', placeholder='Abstract / Overview', description='')\n",
    "tech=widgets.Textarea(value='', placeholder='Technical Details', description='')\n",
    "rules=widgets.Textarea(value='', placeholder='Detection Rules (Yara/Sigma/Etc...)', description='')\n",
    "blind=widgets.Textarea(value='', placeholder='Blind Spots', description='')\n",
    "false=widgets.Textarea(value='', placeholder='Known False Positive Events', description='')\n",
    "priority=widgets.Textarea(value='', placeholder='Priority for responders', description='')\n",
    "validation=widgets.Textarea(value='', placeholder='Validation Mechanisms', description='')\n",
    "response=widgets.Textarea(value='', placeholder='Response Techniques', description='')\n",
    "additional=widgets.Textarea(value='', placeholder='Additional Info/Resources/Links', description='')\n",
    "out = widgets.Output()\n",
    "submit_button = widgets.Button(description='submit')\n",
    "\n",
    "def submit(button):\n",
    "    template=\"\"\"# Table of contents\n",
    "1. [Goals](#goals)\n",
    "2. [Categorization](#cat)\n",
    "3. [Strategy Abstract](#abstract)\n",
    "4. [Technical Context](#context)\n",
    "    1. [Sigma/Yara Rules](#rules)\n",
    "6. [Blind Spots & Assumptions](#blind)\n",
    "7. [False Positives](#false)\n",
    "8. [Priority](#priority)\n",
    "9. [Validation](#validation)\n",
    "10. [Response](#response)\n",
    "11. [Additional Resources](#additional)\n",
    "\n",
    "# Detection: {title} <a name=\"detection\"></a>\n",
    "## Goal <a name=\"goals\"></a>\n",
    "{goal}\n",
    "## Categorization <a name=\"cat\"></a>\n",
    "{cat}\n",
    "## Strategy Abstract <a name=\"abstract\"></a>\n",
    "{abstract}\n",
    "## Technical Context <a name=\"context\"></a>\n",
    "{tech}\n",
    "### Sigma/Yara Rules <a name=\"rules\"></a>\n",
    "{rules}\n",
    "## Blind Spots & Assumptions <a name=\"blind\"></a>\n",
    "{blind}\n",
    "## False Positives <a name=\"false\"></a>\n",
    "{false}\n",
    "## Priority <a name=\"priority\"></a>\n",
    "{priority}\n",
    "## Validation <a name=\"validation\"></a>\n",
    "{validation}\n",
    "## Response <a name=\"response\"></a>\n",
    "{response}\n",
    "## Additional Resources <a name=\"additional\"></a>\n",
    "{additional}\n",
    "\"\"\".format(title=title.value,goal=goal.value,cat=cat.value,abstract=abstract.value,tech=tech.value,rules=rules.value, blind=blind.value, false=false.value,priority=priority.value,validation=validation.value,response=response.value,additional=additional.value)\n",
    "    out.clear_output()\n",
    "    with out:\n",
    "        display(Markdown(template))\n",
    "        filename = 'detection.md'\n",
    "        b64 = base64.b64encode(template.encode())\n",
    "        payload = b64.decode()\n",
    "        html_buttons = '''<html>\n",
    "<head>\n",
    "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n",
    "</head>\n",
    "<body>\n",
    "<a download=\"{filename}\" href=\"data:text/csv;base64,{payload}\" download>\n",
    "<button class=\"p-Widget jupyter-widgets jupyter-button widget-button mod-warning\">Download File</button>\n",
    "</a>\n",
    "</body>\n",
    "</html>\n",
    "'''\n",
    "        html_button = html_buttons.format(payload=payload,filename=filename)\n",
    "        display(HTML(html_button))\n",
    "        #open('tmp-detection.md','w').write(template)\n",
    "        #display('File written to temp')\n",
    "        submit_button.on_click(submit)\n",
    "\n",
    "widgets.VBox([title,goal,cat,abstract,tech,rules,blind,false,priority,validation,response,additional, submit_button, out])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "96c310ce-6784-4f9f-87dd-685363e61523",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.12.7"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}