Creating a custom CounterMeasure

You can create custom CounterMeasure actions using Python. Some example actions that can be leveraged using Python:

• Rebooting

• Authentication

• Interacting with APIs

• Managing state over multiple steps

CounterMeasure workflow

1. Create a custom CounterMeasure.

2. Add CounterMeasure plugins you created to the /usr/share/onsight/countermeasures directory. See Deployment.

3. Add a CounterMeasure to a metric threshold, such as Disk % used. See Configuring a CounterMeasure.

4. If the threshold is crossed, the CounterMeasure will be run.

Any output provided by the CounterMeasure will be attached to the incident record and will be available in the FortiMonitor control panel.

Create custom CounterMeasure actions

To create a custom CounterMeasure action:

Create a new python file in the /usr/share/onsight/countermeasures directory and ensure your implementation subclasses the CountermeasurePlugin class.

A full reference is available in the Implementation Reference section. Largely, implementing the run() method and providing a few instance variables is all that is required. You can see a basic example in CounterMeasure Action metadata example.

Note: The name of your custom class needs to end with Countermeasure.

Example custom CounterMeasure action

The following CounterMeasure plugin allows you to reboot an AWS EC2 instance:

from CountermeasurePlugin import CountermeasurePlugin
import boto3

class AwsEc2RebootCountermeasure(CountermeasurePlugin):
    textkey = "aws.ec2.reboot"
    author = "demo"
    name = "AWS EC2 reboot countermeasure"
    description = "Reboot aws ec2 instance"

def run(self):
    # get server info from metadata
    server = self.metadata.get('server')
    fqdn = server.get('fqdn')

    # get access/secret key from secrent management framework
    aws_access_key_id = self.get_secret('vault-kv', 'aws_access_key')
    aws_secret_access_key = self.get_secret('vault-kv', 'aws_secret_key')

    client = boto3.client('ec2',
                          region_name='us-east-2',
                          aws_access_key_id=aws_access_key_id,
                          aws_secret_access_key=aws_secret_access_key)

    response = client.describe_instances()
    for reservation in response['Reservations']:
        instance = reservation['Instances'][0]

        instance_id = instance['InstanceId']
        public_dns_name = instance['PublicDnsName']
        private_dns_name = instance['PrivateDnsName']
        public_ip = instance['PublicIpAddress']
        private_ip = instance['PrivateIpAddress']

        if fqdn in (public_dns_name, private_dns_name, public_ip, private_ip):
            client.reboot_instances(InstanceIds=[instance_id])
            self.logger.info("AwsEc2RebootCountermeasure: rebooted %s (%s)" % (instance_id, fqdn))
            self.save_output("rebooted %s (%s)" % (instance_id, fqdn))
            break

The following CounterMeasure plugin allows you to reboot a FortiGate:

from CountermeasurePlugin import CountermeasurePlugin
import json


class FortiGateRebootCountermeasure(CountermeasurePlugin):
    name = "FortiGate reboot"
    textkey = "fortigate.reboot"

    def run(self):
        server = self.metadata.get("server")
        instance_id = server.get("id")

        data = { "event_log_message": "Reboot by onsight countermeasure" }
        output = self.fortiapi_fortios(instance_id, "/api/v2/monitor/system/os/reboot", method="POST", data=data)
        self.save_output(json.dumps(output))