Cheng Zhou
38 lines
1.1 KiB
Python
38 lines
1.1 KiB
Python
"""Security event classification shared by writers and monitoring APIs."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from app.services.ip_location import IpLocation
|
|
|
|
|
|
SENSITIVE_PROBE_MARKERS = (
|
|
"/.env",
|
|
".env",
|
|
"/.git",
|
|
".git/config",
|
|
"backup",
|
|
"config.php",
|
|
"wp-config",
|
|
"database.yml",
|
|
)
|
|
|
|
def classify_security_event(
|
|
*,
|
|
path: str,
|
|
status_code: int,
|
|
auth_status: str,
|
|
ip_location: IpLocation | None = None,
|
|
) -> dict[str, str]:
|
|
normalized_path = (path or "").lower()
|
|
if any(marker in normalized_path for marker in SENSITIVE_PROBE_MARKERS):
|
|
return {"category": "PROBE", "severity": "CRITICAL"}
|
|
if status_code >= 500:
|
|
return {"category": "SERVER_ERROR", "severity": "HIGH"}
|
|
if auth_status == "INVALID_TOKEN":
|
|
return {"category": "INVALID_TOKEN", "severity": "MEDIUM"}
|
|
if auth_status == "ANONYMOUS" and status_code in {401, 403}:
|
|
return {"category": "ANONYMOUS_API", "severity": "MEDIUM"}
|
|
if status_code == 404:
|
|
return {"category": "NOT_FOUND_NOISE", "severity": "LOW"}
|
|
return {"category": "OTHER", "severity": "LOW"}
|