# Kaspersky XDR integration with Ideco NGFW

This integration allows you to automate the scenario of blocking IP/URLs detected by Kaspersky Extended Detection and Response Expert (XDR).

## Installation

### Regular installation

Via pip:

```bash
pip install -r requirements.txt
```

From wheel:

```bash
pip install ./dist/kaspersky_xdr_ideco_integration-<version>-py3-none-any.whl
```

### Offline installation

In case if you don't have internet access, you can install the script offline, but you have to download all the dependencies first:

```bash
pip download -r requirements.txt
```

Next step:

```bash
pip install --no-index --find-links <folder_path_to_downloaded_dependencies> -r requirements.txt
```

## Configuration

There are two options for configuring the script:

1. Via .env-file:

```bash
cp .env.sample .env
nano .env
```

2. Or edit alternative options in the body of the `ideco.py` script:

```python
BASE_URL: str = getenv("BASE_URL", "https://your-ip:your-port")
LOGIN: str = getenv("LOGIN", "your-login")
PASSWORD: str = getenv("PASSWORD", "your-password")
IP_DENY_LIMIT: int = int(getenv("IP_DENY_LIMIT", 1000))
```

## How to use?

### Add firewall rule

Adding firewall rule is so simple, just run script `ideco.py` with command `add_firewall_rule` and pass IP addresses that have to be blocked into `--ip_address` (1000 IP max by default, but you cat change it the configuration).

```bash
python ideco.py add_firewall_rule --ip_address "12.12.12.12, 13.13.13.13"
```

After that, deny rule for selected IPs will be added:

![Adding content filtering rule](./assets/screencasts/ideco_add_firewall_rule.gif)

IP addresses should be string with valid IPv4 addresses like "12.12.12.12, 13.13.13.13" with or without spaces between `,`.

The logic of the command is as follows:

* Check if IPs about exist in the Ideco NGFWobject list. If they do exist, the current IP is not added, if it does not exist, the current IP is added.
* Check if the list of IP addresses with the name "XDR" is about to exist. If it exists, the current one is reused and IP addresses are added to it; if the list of addresses named "XDR" does not exist, a new list of addresses is created and IP addresses are added to it.
* Check if the firewall rule named "XDR" exists. If it exists, it is re-used and the list of IP addresses from the previous step is added to it; if it does not exist, a new firewall rule is created and the list of IP addresses from the previous step is added to it.


### Delete IP from firewall rule

Deleting IP from firewall rule is so simple, just run script `ideco.py` with command `delete_firewall_rule` and pass IP addresses that have to be blocked into `--ip_address` (1000 IP max by default, but you cat change it the configuration).

```bash
python ideco.py delete_firewall_rule --ip_address "12.12.12.12, 13.13.13.13"
```

After that, deny rule for selected IPs will be deleted:

IP addresses should be string with valid IPv4 addresses like "12.12.12.12, 13.13.13.13" with or without spaces between `,`.

The logic of the command is as follows:

* Check if IPs about exist in the Ideco NGFWobject list. If they do exist, the current IP is deleted, if it does not exist, the current IP is not deleted.
* Check if the list of IP addresses with the name "XDR" is empty. If it is empty, the list and  firewall rule named "XDR" are deleted, else nothing

### Add content filtering rule

Content filtering rules is a simple way to block malicious URLs, so we can do with the script: just run script `ideco.py` with command `add_content_filter_fule` and pass URLs that have to be blocked into `--url`.

```bash
python ideco.py add_content_filter_rule --url "https://url_1.com, http://url_2.com.uk, http://qwerty.nl, http://zxc.xc"
```

After that, deny rule for selected URLs will be added:

![Adding content filtering rule](./assets/screencasts/ideco_add_content_filtering_rule.gif)

URLs must be with `http://` or `https://` prefixes.

The logic of the command is as follows:

* Check if a category named "XDR" exists, if it exists - then add URLs to it; if not, a new category is created and URLs are added to it.
* Check if there is a content filtering rule named "XDR", if there is, the category from the previous step is added to it; if not, a new content filtering rule is created and the category from the previous step is added to it.


### Delete content filtering rule

Content filtering rules is a simple way to block malicious URLs, so we can do with the script: just run script `ideco.py` with command `delete_content_filter_fule` and pass URLs that have to be unblocked into `--url`.

```bash
python ideco.py delete_content_filter_rule --url "https://url_1.com, http://url_2.com.uk, http://qwerty.nl, http://zxc.xc"
```

After that, deny rule for selected URLs will be added:

URLs must be with `http://` or `https://` prefixes.

The logic of the command is as follows:

* Check if a category named "XDR" exists, if it exists - get all urls from the rule and update the rule with urls without urls from command line; if not, do nothing.
* Check if a category named "XDR" is empty, if it exists - delete the category and rule


### Which versions are supported?

The script supports versions 17.0.0 and above.
