SecurityBrewery / catalyst

⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes
https://catalyst.security-brewery.com/
GNU Affero General Public License v3.0
350 stars 37 forks source link

Template not showing up #1060

Closed LinghGroove closed 4 months ago

LinghGroove commented 8 months ago

Hello, great tool, i really appreciate your work, i hope it will get even better than this. The problem: i am using it with Wazuh. I have set up this simple script to send events to catalyst:

import sys
import requests
import json

tokenheader = {'PRIVATE-TOKEN': 'MyToKeN'}

devid = "somestuff"
srcip = "123.456.3.70"
dstip = "170.70.70.70"
action = "blocked"
customer = "blahblah"

r = requests.post('https://my.catalyst.env/api/tickets', verify=False, headers=tokenheader, json={
        "name":"Wazuh | TEST NEW ",
        "status":"open",
        "type":"static-tests",
        "template":"prova",
        "default_template":"prova",
        "details":{
                "description":" DESCRIPTION ",
                "Priority":"Low",
                "status":"Open",
                "Cliente":"" + str(customer),
                "Stato":"New",
                "Category":"Info",
                "Signature":"Qua va messo msg o attack",
                "Source IP":"" + str(srcip),
                "Destination IP":"" + str(dstip),
                "Action":"" + str(action),},
})
print(r.json())
sys.exit(0)

it works fine, it creates the ticket on catalyst and puts the info inside the template. The only problem is that the template is not selected by default:

Immagine 2024-03-19 200853

nothing is shown, my template appears only when i select "change template" and select my template:

image

this screen is after the template selection from "change template". Is there a way to select the template in advance from the api request? Is this a bug or am i doing something wrong? (My ticket type has for default template my custom template that i want to be shown)

cugu commented 4 months ago

I'll close this one out, as it does not apply for v0.12.0 any more.