securitybrewery / catalyst Goto Github PK

Catalyst is an open source SOAR and ticket system that helps to automate alert handling and incident response processes

License: GNU Affero General Public License v3.0

Dockerfile 0.03% Go 41.81% Python 0.10% ANTLR 0.59% Shell 0.16% JavaScript 14.42% HTML 0.04% Vue 17.73% TypeScript 25.10% Makefile 0.01%

soar incident-response digital-forensics dfir

catalyst's Introduction

Catalyst

Speed up your reactions

Website - The Catalyst Handbook (Documentation) - Try online

Catalyst is an incident response platform or SOAR (Security Orchestration, Automation and Response) system. It can help you to automate your alert handling and incident response procedures.

Features

Ticket (Alert & Incident) Management

Tickets are the core of Catalyst. They represent alerts, incidents, forensics investigations, threat hunts or any other event you want to handle in your organisation.

Ticket Templates

Templates define the custom information for tickets. The core information for tickets like title, creation date or closing status is kept quite minimal and other information like criticality, description or MITRE ATT&CK information can be added individually.

Conditional Custom Fields

Custom Fields can be dependent on each other. So if you, for example choose "malware" as an incident type a custom field ask you to define it further as ransomware, worm, etc. which a "phishing" incident would ask for the number of received mails in that campaign.

Playbooks

Playbooks represent processes that can be attached to tickets. Playbooks can contain manual and automated tasks. Complex workflows with different workflow branches, parallel tasks and task dependencies can be modeled.

Automations

Automations are scripts that automate tasks or enrich artifacts. Automations are run in their own Docker containers. This enables them to be created in different scripting languages and run securely in their own environment.

Dashboards

Catalyst comes with a dashboard editor that allows you to create custom dashboards for your organisation. Dashboards can be created with line, bar, and pie charts.

Users

Catalyst has two different types of users, normal users accessing the platform via OIDC authentication and API keys for external script. A fine-grained access model is available for both types and allows to define possible actions for each user.

License

Portions of this software are licensed as follows:

All third party components incorporated into Catalyst are licensed under the original license provided by the owner of the applicable component. Those files contain a license notice on top of the file and are listed in the NOTICE file.
Content outside the above-mentioned files above is available under the GNU Affero General Public License v3.0.

catalyst's People

Stargazers

Watchers

catalyst's Issues

catalyst container can not commuinicate with database

After following the installation guide, the application does not work. In the catalyst docker container logs I found the following error every 10 seconds:
db.go:89: could not connect to database: not authorized to execute this request, retrying in 10 seconds
Does anyone know what I need to change?

Issue with .well-known Configuration

Hello,
I tried to Set up Catalyst with the respective Guide at https://catalyst-soar.com/docs/catalyst/admin/install and run into some Issues with my Setup, I believe.
I'm getting the Error:

and

I currently don't use a dedicated OpenID Connect system, so I kept the Default Values for that, since commenting out lead to Errors related to OIDC.

Step 5-6C says to create a Keycloak Client, but as far as I'm aware (and the linked documentation describes) that's only possible in the Keycloak Web interface, which is started in Step 6, is my Issue in that Step?

My Server is virtualized via Proxmox. The Traffic is routed via a Sophos XG Virtual Appliance to a Reverse Proxy VM and from there routed to the VM that runs Catalyst.
Had no Issues so far setting up other systems like matrix synapse, so I don't think my routing outside the vm should be an Issue.

Cheers

'unique constraint violated' when using email as preferred username claim with Google OIDC

My setup that generated this error utilizes Google's OIDC provider for authentication into Catalyst.
(https://accounts.google.com/.well-known/openid-configuration)
(https://support.google.com/cloud/answer/6158849?hl=en)

Problem

When attempting to log in with accounts.google.com configured as the OIDC provider, and email as the OIDC username, catalyst responds first with JSONErrorStatus 500 could not load user and then could not create user: HTTPError(409): unique constraint violated on a second attempt.

To reproduce

Set up a catalyst to authenticate via Google OIDC
Set OIDC_CLAIM_USERNAME to email
Start catalyst (docker compose up or your configuration)
Navigate to the catalyst page. Click "Log in with OIDC"
Experience a redirect to the login page.
See the following error on the backend:

api.go:28: JSONErrorStatus 500 could not load user: HTTPError(404): document not found

Click "login" once again.
See the following error message:

{"error":"could not create user: HTTPError(409): unique constraint violated - in index primary of type primary over '_key'; conflicting key: my-email@domain-com"}

Add breadcrump navigation

Unable to login after installation

OS: POP OS

Hi, I had installed Catalyst on following the documentation but I had not provided any domain as parameter.

However the installation had completed and I was able to see a login screen in which I entered the default admin creds and it threw me an error as shown below.

Hoping that someone can help solve the issue.

Thanks

Add running automation from local script/executable

Hi, we are going to deploy Catalyst on Kubernetes, but our devops guy told us we can't mount docker socket to container in order to run automation script in containers. Is there any way to run local script in automation tasks?

Cheers

Add links to the handbook

Automations as root task do not start automatically

LDAP authentication via Authelia

Hello! There is an issue with LDAP authentication to Catalyst using Authelia.

Authelia can authenticate users by LDAP, but Catalyst doesn't "understand" that and you cannot login using this method.
If using default Authelia authentication method (by adding users to file) everything works fine.

Implicitly related tickets (via artifact) show remove button

Conflict with arangobd on restart

Every time when you restart docker with catalyst, it is trying to create "setup" key in arangodb without any checking if this key already exists, that causes an error

main.go:27: failed to create authenticator: HTTPError(409): unique constraint violated - in index primary of type primary over '_key'; conflicting key: setup

Can there be any procedure that will check if "setup" exists in arango before trying to create it?

Add automation scheduler

Run automations on a schedule.

Use https://github.com/reugn/go-quartz or https://github.com/go-co-op/gocron

Add ticket automations

Support for Authentik

Is there any support for using authentik rather than authelia. I attempted to change authelia settings to authentik with the authentik setup with an OAuth/OIDC Provider and a catalyst application and fed the client id and secret to catalyst docker-compose this didn't work with the following logs:

catalyst container
   
        <link rel="stylesheet" type="text/css" href="/static/dist/authentik.css">
        <link rel="stylesheet" type="text/css" href="/static/dist/custom.css" data-inject>
        <script src="/static/dist/poly.js?version=2023.10.6" type="module"></script>
        <script src="/static/dist/standalone/loading/index.js?version=2023.10.6" type="module"></script>
        
<style>
:root {
    --ak-flow-background: url("/static/dist/assets/images/flow_background.jpg");
    --pf-c-background-image--BackgroundImage: var(--ak-flow-background);
    --pf-c-background-image--BackgroundImage-2x: var(--ak-flow-background);
    --pf-c-background-image--BackgroundImage--sm: var(--ak-flow-background);
    --pf-c-background-image--BackgroundImage--sm-2x: var(--ak-flow-background);
    --pf-c-background-image--BackgroundImage--lg: var(--ak-flow-background);
}
/* Form with user */
.form-control-static {
    margin-top: var(--pf-global--spacer--sm);
    display: flex;
    align-items: center;
    justify-content: space-between;
}
.form-control-static .avatar {
    display: flex;
    align-items: center;
}
.form-control-static img {
    margin-right: var(--pf-global--spacer--xs);
}
.form-control-static a {
    padding-top: var(--pf-global--spacer--xs);
    padding-bottom: var(--pf-global--spacer--xs);
    line-height: var(--pf-global--spacer--xl);
}
</style>
        <meta name="sentry-trace" content="9c1bc1da946d4f7eaea0203de7135a2b-a6c92271e6c837a7-0" />
    </head>
    <body>
        
<div class="pf-c-background-image">
    <svg xmlns="http://www.w3.org/2000/svg" class="pf-c-background-image__filter" width="0" height="0">
        <filter id="image_overlay">
            <feColorMatrix in="SourceGraphic" type="matrix" values="1.3 0 0 0 0 0 1.3 0 0 0 0 0 1.3 0 0 0 0 0 1 0" />
            <feComponentTransfer color-interpolation-filters="sRGB" result="duotone">
                <feFuncR type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncR>
                <feFuncG type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncG>
                <feFuncB type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncB>
                <feFuncA type="table" tableValues="0 1"></feFuncA>
            </feComponentTransfer>
        </filter>
    </svg>
</div>
<ak-message-container></ak-message-container>
<div class="pf-c-login">
    <div class="ak-login-container">
        <header class="pf-c-login__header">
            <div class="pf-c-brand ak-brand">
                <img src="/static/dist/assets/icons/icon_left_brand.svg" alt="authentik Logo" />
            </div>
        </header>
        
        <main class="pf-c-login__main">
            <header class="pf-c-login__main-header">
                <h1 class="pf-c-title pf-m-3xl">
                    
�      
d
                </h1>
            </header>
            <div class="pf-c-login__main-body">
                
<form method="POST" class="pf-c-form">
    <p></p>
    <a id="ak-back-home" href="/" class="pf-c-button pf-m-primary">
        Go home
    </a>
</form>
            </div>
        </main>
        
        <footer class="pf-c-login__footer">
            <ul class="pf-c-list pf-m-inline">
                
                <li>
                    <a href="https://goauthentik.io?utm_source=authentik">
                        Powered by authentik
                    </a>
                </li>
            </ul>
        </footer>
    </div>
</div>
        
        
    </body>
</html>

Consider migrating to "github.com/antlr/antlr4/runtime/Go/antlr/v4"

It seems that v1 module of github.com/antlr/antlr4/runtime/Go/antlr has been deprecated.

https://github.com/antlr/antlr4/blob/master/runtime/Go/antlr/go.mod

// Deprecated: Please switch to the new v4 module path: github.com/antlr/antlr4/runtime/Go/antlr/v4 - see https://github.com/antlr/antlr4/blob/master/doc/go-target.md
module github.com/antlr/antlr4/runtime/Go/antlr

The new module is github.com/antlr/antlr4/runtime/Go/antlr/v4 and it fit more properly with the idiomatic ways of Go than v1 module.

Is there any plan to migrate to github.com/antlr/antlr4/runtime/Go/antlr/v4? If so, this doc may help.

File upload in playbook not working

Redo upload API

Create three panel view for tickets

Unable to login after installation

Login screen not showing

Server OS	Client OS	Client Browser
Redhat 8.7	Windows 10	Chrome

Hi,

I had an issue with the login screen not showing uo when after installing Catalyst on a machine in the cloud.

The authentication URL had seemed to initially redirect to http://localhost:8082 which showed up on the browser address bar and didn't lead to any page.

So I had edited the install_catalyst.sh script with the following changes

    # set default domain
    if [ -z "$1" ]; then
        - echo "No domain provided, using default domain: localhost"
        + echo "No domain provided, using default domain: <IP>"
        - catalyst_domain="localhost"
        + catalyst_domain="<IP>"
    else
        catalyst_domain="$1"
    fi

    # set default hostname
    if [ -z "$2" ]; then
        - echo "No hostname provided, using default: http://localhost"
        + echo "No hostname provided, using default: http://<IP>"
        - catalyst_addr="http://localhost"
        + catalyst_addr="http://<IP>"
    else
        catalyst_addr="$2"
    fi

    # set default authelia hostname
    if [ -z "$3" ]; then
        - echo "No authelia hostname provided, using default: http://localhost:8082"
        + echo "No authelia hostname provided, using default: http://<IP>:8082"
        - authelia_addr="http://localhost:8082"
        + authelia_addr="http://<IP>:8082"
    else
        authelia_addr="$3"
    fi

After the above changes, on browsing to http://<IP>, I was greeted with the screen below

On selecting Login with OIDC it redirected to "http://<IP>:8082" with a blank screen with no login prompt

Please let me know how to solve this issue. Thanks.

Please find the attached logs
catalystlog1.txt
authelialog1.txt

Template not showing up

Hello, great tool, i really appreciate your work, i hope it will get even better than this.
The problem: i am using it with Wazuh. I have set up this simple script to send events to catalyst:

import sys
import requests
import json

tokenheader = {'PRIVATE-TOKEN': 'MyToKeN'}

devid = "somestuff"
srcip = "123.456.3.70"
dstip = "170.70.70.70"
action = "blocked"
customer = "blahblah"

r = requests.post('https://my.catalyst.env/api/tickets', verify=False, headers=tokenheader, json={
        "name":"Wazuh | TEST NEW ",
        "status":"open",
        "type":"static-tests",
        "template":"prova",
        "default_template":"prova",
        "details":{
                "description":" DESCRIPTION ",
                "Priority":"Low",
                "status":"Open",
                "Cliente":"" + str(customer),
                "Stato":"New",
                "Category":"Info",
                "Signature":"Qua va messo msg o attack",
                "Source IP":"" + str(srcip),
                "Destination IP":"" + str(dstip),
                "Action":"" + str(action),},
})
print(r.json())
sys.exit(0)

it works fine, it creates the ticket on catalyst and puts the info inside the template. The only problem is that the template is not selected by default:

nothing is shown, my template appears only when i select "change template" and select my template:

this screen is after the template selection from "change template". Is there a way to select the template in advance from the api request? Is this a bug or am i doing something wrong? (My ticket type has for default template my custom template that i want to be shown)

Add csv imports/export for ticket list

Add option to merge tickets

Admin role based on OIDC groups/roles

Is it possible to set the admin user role based on OIDC group/role membership? This would make management of admin users much easier.

Add rerun button for tasks

Link other tickets

See https://fritx.github.io/vue-at/#/en/props or https://vue-mention.netlify.app/

Playbook editor validation

Find loops, missing tasks, multiple roots (?) in playbook

Sorting on multiple ticket fields fails

Hi! I've encountered another bug (or feature) in catasyt. When i'm trying to filter tickets by any of fiends (creation, status, Last Modification) I got this error

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository problems

Renovate tried to run on this repository, but found these problems.

WARN: Package lookup failures

Warning

Renovate failed to look up the following dependencies: Could not determine new digest for update (go package github.com/antlr/antlr4/runtime/Go/antlr).

Files affected: go.mod

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Update dependency yaml to v2.2.2 [SECURITY]
Update module github.com/docker/docker to v20 [SECURITY]
Update dependency antlr4 to v4.13.1
Update dependency typescript to v5.2.2
Update dependency ant-design-vue to v4
Update module github.com/tus/tusd to v2
Update typescript-eslint monorepo to v6 (major) (@typescript-eslint/eslint-plugin, @typescript-eslint/parser)
Click on this checkbox to rebase all open PRs at once

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

Detected dependencies

docker-compose

dev/docker-compose.yml

nginx 1.25

arangodb/arangodb 3.8.1

authelia/authelia 4

dockerfile

Dockerfile

ubuntu 18.04

github-actions

.github/workflows/ci.yml

actions/checkout v4

actions/setup-go v4

golangci/golangci-lint-action v3

actions/checkout v4

actions/setup-node v4

actions/setup-go v4

codecov/codecov-action v3

actions/checkout v4

actions/setup-go v4

actions/setup-node v4

cypress-io/github-action v4

actions/checkout v4

actions/setup-node v4

actions/upload-artifact v3

actions/checkout v4

actions/setup-go v4

actions/download-artifact v3

docker/login-action v3

docker/metadata-action v5

docker/build-push-action v5

ubuntu 22.04

gomod

go.mod

go 1.19

github.com/warjiang/gojsonschema v1.2.1-0.20201027075954-b076d39a02e5@b076d39a02e5

github.com/alecthomas/kong v0.8.1

github.com/alecthomas/kong-yaml v0.2.0

github.com/antlr/antlr4/runtime/Go/antlr v0.0.0-20220816024939-bc8df83d7b9d@bc8df83d7b9d

github.com/arangodb/go-driver v1.6.0

github.com/aws/aws-sdk-go v1.46.2

github.com/blevesearch/bleve/v2 v2.3.10

github.com/coreos/go-oidc/v3 v3.7.0

github.com/docker/docker v17.12.0-ce-rc1.0.20201201034508-7d75c1d40d88+incompatible

github.com/go-chi/chi/v5 v5.0.10

github.com/gobwas/ws v1.3.0

github.com/google/uuid v1.3.1

github.com/iancoleman/strcase v0.3.0

github.com/icza/dyno v0.0.0-20230330125955-09f820a8d9c0@09f820a8d9c0

github.com/imdario/mergo v0.3.16

github.com/jonas-plum/maut v0.0.0-20221105155335-ed984fd96915@ed984fd96915

github.com/mingrammer/commonregex v1.0.1

github.com/stretchr/testify v1.8.4

github.com/tidwall/gjson v1.17.0

github.com/tidwall/sjson v1.2.5

github.com/tus/tusd v1.13.0

github.com/xeipuuv/gojsonschema v1.2.0

golang.org/x/exp v0.0.0-20231006140011-7918f672742d@7918f672742d

golang.org/x/oauth2 v0.13.0

gopkg.in/yaml.v3 v3.0.1

npm

ui/package.json

@crinkles/digl ^2.0.2

@koumoul/vjsf 2.23.2

@mdi/font 7.3.67

@mdi/util 0.3.2

@types/luxon 3.3.3

@types/prismjs 1.26.2

@uppy/core 1.20.1

@uppy/tus 1.9.2

@uppy/vue 0.2.7

ajv 8.12.0

ant-design-vue 1.7.8

antlr4 4.11.0

axios 1.5.1

chart.js 2.9.4

core-js 3.33.1

d3 ^7.8.0

graphlib 2.1.8

json-schema-editor-vue 2.2.3

just-kebab-case 4.2.0

less 4.2.0

less-loader 11.1.3

lodash 4.17.21

luxon 3.4.3

panzoom ^9.4.3

register-service-worker 1.7.2

splitpanes 2.4.1

swagger-ui 4.13.0

vue 2.7.15

vue-axios 3.5.2

vue-chartjs 3.5.1

vue-class-component 7.2.6

vue-cropperjs 5.0.0

vue-d3-network 0.1.28

vue-lodash 2.1.2

vue-luxon 0.10.0

vue-markdown 2.2.4

vue-native-websocket 2.0.15

vue-pipeline 1.0.12

vue-prism-editor 1.3.0

vue-property-decorator 9.1.2

vue-router 3.6.5

vuetify 2.7.1

vuex 3.6.2

yaml 2.0.1

@testing-library/vue 7.0.0

@types/jest 29.5.6

@types/lodash 4.14.200

@types/vue-markdown 2.2.3

@typescript-eslint/eslint-plugin 5.62.0

@typescript-eslint/parser 5.62.0

@vue/cli-plugin-babel 4.5.19

@vue/cli-plugin-eslint 4.5.19

@vue/cli-plugin-pwa 4.5.19

@vue/cli-plugin-router 4.5.19

@vue/cli-plugin-typescript 4.5.19

@vue/cli-plugin-unit-jest 4.5.19

@vue/cli-plugin-vuex 4.5.19

@vue/cli-service 4.5.19

@vue/compiler-sfc 3.3.6

@vue/eslint-config-typescript 10.0.0

@vue/test-utils 2.4.1

@babel/eslint-parser 7.22.15

cypress 11.2.0

eslint 7.32.0

eslint-plugin-jest 27.4.3

eslint-plugin-vue 7.20.0

sass 1.69.4

typescript 5.1.6

vue-cli-plugin-vuetify 2.5.8

vue-template-compiler 2.7.15

vuetify-loader 1.9.2

Check this box to trigger a request for Renovate to run again on this repository

Install the system without ssl

Following the installation guide - https://catalyst-soar.com/docs/catalyst/admin/install#installation-process
I tried to execute the installation with the --no-ssl flag:
bash install_catalyst.sh http://192.168.70.252 http://192.168.70.252 --no-ssl admin:admin:[email protected]
But I got the error:
Error: hostname must start with https://
So I tried to install it with https in the hostname
As a result - I was able to access the ip only with http, https was not responding, but and all of the urls in the http page contained https links.
How can I install the system without certificate?

OpenAPI specification

Would like it if we had an OpenAPI specification JSON file for importing to other WebApps.

Generation of webhooks notifications

Add webhook support for better integration.

Discussed in #355

^{Originally posted by susangz July 20, 2022}
Do you foresee to generate webhooks notifications of the actions taken by the users on the system (e.g. changes in the tickets or in the tasks) so they can be integrated with other tools/scripts? I mean something similar to the webhooks feature provided by TheHive (https://docs.thehive-project.org/thehive/legacy/thehive3/admin/webhooks/ or https://blog.agood.cloud/posts/2022/07/02/thehive5-webhooks/)

Add ticket query builder

Add dashboards

https://vue-responsive-dash-vuetify.netlify.app/#/Chartjs

Improve job UI

Multiple sequential comments do not display correctly until the page is refreshed

If you add multiple comments in a row to an investigation ticket, the first comment is displayed multiple times instead of each new comment. When the page is refreshed, the comments then update to whatever you actually submitted.

Example before refresh:

After refresh:

So far I'm really loving Catalyst!

Websocket connection issue

Hello,

I am currently trying to install Catalyst as per the secure install documentation for my organisation (public hospital)
I am now at the point where I have setup the new admin user in keycloak and changed the OIDC settings to match including secret and client ID etc.
When I browse the login page (catalyst.example.local/ui), enter the correct login details, and click login, the login button goes grey and disables and will not proceed any further.
After further investigation, I saw that the HTTP response header says "Wrong username or password" and in the catalyst container logs I can see the username and password are printed.

I also noticed in the network monitor on the browser that the websocket (/wss) is not able to be connected to, I have tried modifying the nginx.conf file to resolve this to no avail.
In the nginx logs, I see that the keep-alive connection for the websocket is getting disconnected - I'm unsure if this would cause this issue.

I will get some more detailed logs and screenshots when I am back at work on Monday, and I am working on this myself to hopefully see if I can make a PR to resolve this for others, but for now just posting this to see if anyone else has had this issue.

I am running this on Ubuntu Server 22.04 on vSphere

Add ticket bulk actions

Change owner
Close
Open
Delete

Catalyst v0.11.0 requires missing GLIBC_2.32 and GLIBC_2.34 runtimes

I noticed that catalyst version 0.11.0 can't startup anymore.
When trying to run the docker-compose file locally, I get the following errors:

docker logs catalyst-setup-0103-catalyst-1                                                                                                                                 ✔  5s  
/app/catalyst: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.32' not found (required by /app/catalyst)
/app/catalyst: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by /app/catalyst)

I assume this is because of the version upgrade of some of catalyst's dependencies that came with the release of 0.11.0.
The ubuntu 18.04 base image only offers libc-2.27.so, which is the reason the app can't find this library

A upgrade of this base image probably should do the trick to fix this