‎Jinja Basics

{% set user = {
    "username": "Alice",
    "department": "Security Operations Center",
    "role": "Incident Responder",
    "access_level": "?",
    "last_login": "2024-02-07T10:30:00Z"
} %}

{{ user }}

{% set user = PlaybookData | jsonpath('$.["Defining and Assigning Variables"].returnData') %}

{% set updated_user = {
    "username": user.username,
    "department": user.department,
    "role": user.role,
    "access_level": "Tier-2",
    "last_login": user.last_login
} %}

{{ updated_user }}

{{ "D3 Security" }}  
{{ 2025 }}  
{{ true }}
{{ none }}

{% set threat_level = "Critical" %}

Threat Level: {{ threat_level }}

{% set failed_attempts = 5 %}

Lockout Threshold: {{ failed_attempts * 2 }} 

{% set is_malicious = True %}
{% set is_whitelisted = False %}

Suspicious: {{ is_malicious and not is_whitelisted }}

{% set x = 10 %}
{% set y = 5 %}

x greater than y: {{ x > y }}

{% macro greet_user(username) %}
    Hello {{ username }}!
{% endmacro %}

{{ greet_user("Alice") }}
{{ greet_user("Emily") }}

{% set log_entry = "User Lex Fridman logged in from 192.168.1.100 at 7:30 AM." %}

Sanitized Log: {{ log_entry 
    | replace("Lex Fridman", "[REDACTED_USER]") 
    | replace("192.168.1.100", "[REDACTED_IP]") }}

{% set user_role = "admin" %}

Admin Role Defined: {{ user_role is defined }}  
Guest Role Defined: {{ guest_role is defined }}  

{{ "D3 Security" | length }}  

{% set alert = {"description": "Malware detected on endpoint."} %}

{{ alert.description | replace("Malware", "SUSPICIOUS ACTIVITY") }}

{% set alert = {
    "timestamps": [
        "2024-02-06T14:15:00",
        "2024-02-06T10:00:00",
        "2024-02-06T12:30:00",
        "2024-02-06T09:45:00",
        "2024-02-06T16:00:00"
    ]
} %}

{% set first_time = alert.timestamps | sort | first | replace("T", " ") %}
{% set last_time = alert.timestamps | sort | last | replace("T", " ") %}

First Seen: {{ first_time }}
Last Seen: {{ last_time }}

{% set severity = "Medium" %}

{% if severity == "High" %}
    Alert requires immediate attention.
{% elif severity == "Medium" %}
    Alert should be reviewed soon.
{% else %}
    No immediate action required.
{% endif %}

{% set threat = {
    "severity": "Critical",
    "anomaly_detected": True,
    "attack_vector": "Ransomware"
} %}

{% if threat.severity == "Critical" %}
    Immediate escalation is required.
    {% if threat.anomaly_detected %}
        Anomaly confirmed. Engage the incident response team.
    {% else %}
        Anomaly not detected. Reassess threat data.
    {% endif %}
{% else %}
    No immediate action is required.
{% endif %}

{% set firewall_enabled = False %}
{% if not firewall_enabled %}
    SOC Alert: Firewall is not enabled.
{% endif %}

{% set ip_addresses = [
    "192.168.1.10",
    "10.0.0.5",
    "172.16.0.3",
    "203.0.113.25",
    "198.51.100.42",
    "192.168.2.15"
] %}

{# The allowed IP ranges are private networks: 192.168.x.x, 10.x.x.x, and 172.16.x.x. #}
{% for ip in ip_addresses %}
    {% if not (ip.startswith("192.168") or ip.startswith("10.") or ip.startswith("172.16")) %}
        External IP flagged: {{ ip }}
    {% endif %}
{% endfor %}

{% set file_hash = "a3f1c4b92e7d6f8098b2a1d5c3e4f7g601a2b3c4d5e6f7h8091a2b3c4d5e6f7a" %}
{% set segments = file_hash | batch(8, '') | list %}

{% for index in range(8) %}
    Segment {{ index + 1 }}: {{ segments[index] | join('') }}
{% endfor %}

{% set ip_address = "192.168.1.100" %}
{% set octets = ip_address.split('.') %}

{% for index in range(octets | length) %}
    Octet {{ index + 1 }}: {{ octets[index] }}
{% endfor %}

{% set security_events = {
    "Unauthorized Access": "Critical",
    "Malware Infection": "High",
    "Suspicious Login": "Medium"
} %}

{% for event, severity in security_events.items() %}
    Event "{{ event }}" has a severity level of: {{ severity }}
{% endfor %}

{% set filename = "malware$payload.exe" %}
{% set suspicious_chars = "!@#$%^&*" %}

{% for char in filename %}
    {% if char in suspicious_chars %}
        Alert: Suspicious character "{{ char }}" found in filename.
    {% endif %}
{% endfor %}

{% set incident_list = [
    {"Incident": "Incident 1", "related_events": [
        {"Incident": "Incident 1.1"},
        {"Incident": "Incident 1.2", "related_events": [
            {"Incident": "Incident 1.2.1"},
            {"Incident": "Incident 1.2.2"}
        ]}
    ]},
    {"Incident": "Incident 2", "related_events": [
        {"Incident": "Incident 2.1"},
        {"Incident": "Incident 2.2"}
    ]}
] %}

{{ '[' }}
{% for object in incident_list recursive %}
    "{{ object.Incident }}"
    {% if object.related_events %}, [
        {{ loop(object.related_events) }}
    ]{% endif %}
    {% if not loop.last %}, {% endif %}
{% endfor %}
{{ ']' }}

{% set alerts = [
    "Failed Login from 192.168.1.10",
    "Malware Detected on Endpoint",
    "Failed Login from 192.168.1.10",
    "Unauthorized Access Attempt",
    "Malware Detected on Endpoint"
] %}

{% set unique_alerts = alerts | unique %}

Unique Security Alerts:
{% for alert in unique_alerts %}
    - {{ alert }}
{% endfor %}

{% set list1 = ["malicious.com", "badactor.net"] %}
{% set list2 = ["phishingsite.org", "hacker.xyz"] %}

{% set combined = list1 + list2 %}

All Malicious Domains: {{ combined }}

{% set security_events = [
    {"username": "alice", "event": "Phishing Attempt"},
    {"username": "bob", "event": "Brute Force Attack"},
    {"username": "alice", "event": "Credential Stuffing"},
    {"username": "dave", "event": "DLP Violation"},
    {"username": "alice", "event": "Unauthorized Access Attempt"},
    {"username": "bob", "event": "Failed MFA Authentication"},
    {"username": "eve", "event": "Brute Force Attack"}
] %}

{# Step 1: Extract usernames from the list of events #}
{% set targeted_users = security_events | map('username') | list %}

{# Step 2: Count occurrences using a dictionary #}
{% set user_counts = {} %}
{% for user in targeted_users %}
    {% if user_counts[user] is not defined %}
        {% set _ = user_counts.update({user: 1}) %}
    {% else %}
        {% set _ = user_counts.update({user: user_counts[user] + 1}) %}
    {% endif %}
{% endfor %}

{# Step 3: Filter users who appear more than once #}
{% set repeated_targets = [] %}
{% for user, count in user_counts.items() %}
    {% if count > 1 %}
        {% set _ = repeated_targets.append(user) %}
    {% endif %}
{% endfor %}

{# Step 4: Output Users Who Were Targeted Multiple Times #}
Repeatedly Targeted Users:
{% for user in repeated_targets %}
    - {{ user }}
{% endfor %}

{% set security_events = [
    {"event": "Event1", "severity": "Critical"},
    {"event": "Event2", "severity": "Low"},
    {"event": "Event3", "severity": "Critical"},
    {"event": "Event4", "severity": "Informational"},
    {"event": "Event5", "severity": "High"},
    {"event": "Event6", "severity": "Medium"},
    {"event": "Event7", "severity": "High"},
    {"event": "Event8", "severity": "Critical"}
] %}

{% set high_critical_events = security_events | selectattr("severity", "in", ["High", "Critical"]) | list %}

High-Priority Security Events:
{% for event in high_critical_events %}
    - {{ event.event }} ({{ event.severity }})
{% endfor %}

{% set ipv6_address = "2001:0db8:85a3:0000:0000:8a2e:0370:7334" %}
{% set segments = ipv6_address.split(':') %}

First 4 Segments: {{ segments[:4] | join(':') }}  
Last 4 Segments: {{ segments[-4:] | join(':') }}

{% macro hex_to_binary(hex_value) %}
    {%- set binary_str = [] -%}
    {%- for char in hex_value -%}
        {%- set binary_digit = "{:04b}".format(char | int(base=16)) -%}
        {%- set _ = binary_str.append(binary_digit) -%}
    {%- endfor -%}
    {{ binary_str | join(" ") }} 
{% endmacro %}

Binary Representation: {{ hex_to_binary("ABCD") }}

{% macro detect_sqli(request) %}
    {% set sqli_signatures = ["SELECT ", "UNION ", "DROP ", "--", "' OR '1'='1", "INSERT ", "UPDATE ", "DELETE "] %}
    {% set detected_signatures = [] %}

    {%- for sig in sqli_signatures -%}
        {%- if sig in request -%}
            {%- set _ = detected_signatures.append(sig) -%}
        {%- endif -%}
    {%- endfor -%}

    {%- if detected_signatures -%}
        {
            "alert": "SQL Injection Attempt Detected",
            "request": "{{ request }}",
            "matched_signatures": {{ detected_signatures | join(", ") }},
            "severity": "High"
        }
    {%- endif -%}
{% endmacro %}

SQLi Detection Output: {{ detect_sqli("GET /search?q=' OR '1'='1' UNION SELECT password FROM users") }}

{% macro detect_xss(input_data) %}
    {% set xss_signatures = ["<script", "javascript:", "onerror=", "onload=", "alert(", "document.cookie", "eval("] %}
    {% set detected_signatures = [] %}

    {%- for sig in xss_signatures -%}
        {%- if sig in input_data -%}
            {%- set _ = detected_signatures.append(sig) -%}
        {%- endif -%}
    {%- endfor -%}

    {%- if detected_signatures -%}
        {
            "alert": "Cross-Site Scripting (XSS) Attempt Detected",
            "input": "{{ input_data }}",
            "matched_signatures": {{ detected_signatures | join(", ") }},
            "severity": "High"
        }
    {%- endif -%}
{% endmacro %}

XSS Detection Output: {{ detect_xss('<script>alert("XSS")</script>') }}

{% set num = 25 %}
{{ "The number is " + num }} 

{% set num = 25 %}
{{ "The number is " + num | string }}

{% set users = [{"name": "Elon"}, {"name": "Alice"}, {"name": "Emily"}] %}

{{ users | map("attribute", "name") | list }}

{% set users = [{"name": "Elon"}, {"name": "Alice"}, {"name": "Emily"}] %}

{% set result = [] %}
{% for user in users %}
    {% set _ = result.append(user.name) %}
{% endfor %}

{{ result | list }}

{{ "C:\Users\name\Downloads" }} 

{{ "C:\\Users\\name\\Downloads" }}

{% set data = {"users": [{"name": "Alice"}, {"name": "Emily"}]} %}

First User: {{ data.users | first.name }}

{% set data = {"users": [{"name": "Alice"}, {"name": "Emily"}]} %}

{% set first_user = data.users | first %}

First User: {{ first_user.name }}

{% set results = [] %}

{% set results = {
    Region: "demo_region",
    Business Unit: "demo_business_unit",
    Application ID: "demo_app_ID",
} %}

{{ results | tojson }}

{% set results = [] %}

{% set results = {
    "Region": "demo_region",
    "Business Unit": "demo_business_unit",
    "Application ID": "demo_app_ID",
} %}

{{ results | tojson }}