RabbitMQ Relay Module (Cisco Hosted)

RabbitMQ relay module.

Communication Flow

                                                             response
                                                  ┌────────────────────────────┐
                                                  │                            │
                                                  │                            │
                                                  ▼                            │
       ┌─────────────┐               * ┌───────────────────┐ *        ┌────────┴────────┐
       │             │               * │                   │ * waits  │                 │
       │ SecureX tr  │  ──────────►  * │  tr-05-rabbitmq   │ * ─────► │  RabbitMQ Serv  │
       │             │               * │                   │ *        │                 │
       └─────────────┘               * └───────────────────┘ *        └─────────────────┘
                                                                          ▲   ▲
                                                                          │   │
                                       ┌──────────────────────────────────┘   │
                                       │                     API response     │
                            ┌──────────┴─────────┐                            │ SecureX Cloud
                            │                    │                       FW ──┼───────
                            │  Vendor Integrated │     Polling for Messages   │ On-Premise Equipment
                    ┌────── │  RPC Client        │ ───────────────────────────┘
                    │       │                    │
                    │       └────────────────────┘
                    │
                    │       ┌────────────────────┐
                    │   API │                    │
                    └──────►│ On-Premise SIEM    │
                       HTTP │                    │
                            └────────────────────┘

Rationale

• We need an application that will translate API requests from SecureX Threat Response to the third-party integration, and vice versa.
• The remote end will need to communicate through AMQP (RabbitMQ) messages
• We need an application that can be completely self contained within a virtualized container using Docker.

Testing (Optional)

Open the code folder in your terminal.

cd code

If you want to test the application you have to install dependencies from the Pipfile file:

pip install --no-cache-dir --upgrade pipenv && pipenv install --dev

You can perform two kinds of testing:

• Run static code analysis checking for any semantic discrepancies and PEP 8 compliance:

  flake8 .

• Run the suite of unit tests and measure the code coverage:

  coverage run --source api/ -m pytest --verbose tests/unit/ && coverage report

Building the Docker Container

In order to build the application, we need to use a Dockerfile.

1. Open a terminal. Build the container image using the docker build command.

docker build -t tr-05-rabbitmq .

2. Once the container is built, and an image is successfully created, start your container using the docker run command and specify the name of the image we have just created. By default, the container will listen for HTTP requests using port 9090.

docker run -dp 9090:9090 --name tr-05-rabbitmq tr-05-rabbitmq

3. Watch the container logs to ensure it starts correctly.

docker logs tr-05-rabbitmq

4. Once the container has started correctly, open your web browser to http://localhost:9090. You should see a response from the container.

curl http://localhost:9090

Implementation Details

This application was developed and tested under Python version 3.9.

NOTE. Remember that this application is just a template so here N/A means that it has no implemented Relay endpoints and supported types of observables. That will not be the case for real integrations with third-party services so you may consider the following sections as some placeholders.

Implemented Relay Endpoints

N/A

Supported Types of Observables

N/A