yaml_to_notebook.py

import nbformat as nbf
import yaml

# *** Read YAML file ***
analytic = yaml.safe_load(open("WIN-190815181010.yaml").read())

# *** Create Notebook object ***
nb = nbf.v4.new_notebook()
nb['cells'] = []

nb['cells'].append(nbf.v4.new_markdown_cell("# {}".format(analytic['title'])))
nb['cells'].append(nbf.v4.new_markdown_cell("## Metadata"))

nb['cells'].append(nbf.v4.new_markdown_cell(
        """
|               |    |
|:--------------|:---|
| id            | {} |
| author        | {} |
| creation date | {} |
| platform      | {} |
| playbook link | {} |
        """.format(analytic['id'], analytic['author'], analytic['creation_date'], analytic['platform'], analytic['playbook_link'])
    ))

# *** TECHNICAL DESCRIPTION ****
nb['cells'].append(nbf.v4.new_markdown_cell("""## Technical Description
{}""".format(analytic['description'])))

# *** HYPOTHESIS ****
nb['cells'].append(nbf.v4.new_markdown_cell("""## Hypothesis
{}""".format(analytic['hypothesis'])))

# *** ANALYTICS ****
nb['cells'].append(nbf.v4.new_markdown_cell("## Analytics"))
nb['cells'].append(nbf.v4.new_markdown_cell("### Initialize Analytics Engine"))
nb['cells'].append(nbf.v4.new_code_cell(
        """from openhunt.mordorutils import *
spark = get_spark()"""
    ))
nb['cells'].append(nbf.v4.new_markdown_cell("### Download & Process Mordor File"))
nb['cells'].append(nbf.v4.new_code_cell(
        """mordor_file = "{}"
registerMordorSQLTable(spark, mordor_file, "mordorTable")""".format(analytic['validation_dataset'][0]['url'])
    ))
for a in analytic['analytics']:
    nb['cells'].append(nbf.v4.new_markdown_cell("### {}".format(a['name'])))
    nb['cells'].append(nbf.v4.new_markdown_cell(
            """
| FP Rate  | Log Channel | Description   |
| :--------| :-----------| :-------------|
| {}       | {}          | {}            |
            """.format(a['false_positives'], a['data_sources'], a['description'])
     ))
    nb['cells'].append(nbf.v4.new_code_cell(
        """df = spark.sql(
    '''
{}
    '''
)
df.show(1,False)""".format(a['logic'])
        ))
# *** DETECTION BLINDSPOTS ****
nb['cells'].append(nbf.v4.new_markdown_cell("""## Detection Blindspots
{}""".format(analytic['detection_blindspots'])))

# *** HUNTER NOTES ****
nb['cells'].append(nbf.v4.new_markdown_cell("""## Hunter Notes
{}""".format(analytic['hunter_notes'])))

# *** HUNT OUTPUT****
if analytic['hunt_output']:
    output_table = """
| Category | Type | Name     |
| :--------| :----| :--------|"""
    for output in analytic['hunt_output']:
        output_table += """
| {} | {} | [{}]({}) |""".format(output['category'], output['type'], output['name'], output['url'])   
else:
    output_table = ''

nb['cells'].append(nbf.v4.new_markdown_cell("""## Hunt Output
{}""".format(output_table)))

# *** REFERENCES ****
nb['cells'].append(nbf.v4.new_markdown_cell("""## References
{}""".format(analytic['references'])))

# *** Write Notebook to file ***
nbf.write(nb, "{}.ipynb".format(analytic['id']))