import datetime import requests import json import os import time def allowlistexechistories(url, outputjson: bool): endpoint = url + '/v1/group' print("[+] Grabbing All Policies") payload = {} headers = { "X-APIKey": os.getenv('APIKEY') } response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False) parse_text = json.loads(response.text) policiesnames = [] policyids = [] for index, list in enumerate(parse_text['response']['groups'], start=1): print(f"{index}. {list['name']}") policiesnames.append(list['name']) policyids.append(list['groupid']) choice = input("Select Policy Group: ") choice = int(choice) - 1 checkpoint = '000000000000000000000000' json_output = {'error': 'Success', 'response': {'exechistories': []}} while True: json_response_data = checkpoint_stomper(checkpoint, url, policiesnames[choice], headers) if not json_response_data['response']['exechistories']: break for index, item in enumerate(json_response_data['response']['exechistories']): if index == len(json_response_data['response']['exechistories']) -1: checkpoint = item['checkpoint'] print(f"Date Greater than 30 Days, Stepping to new Checkpoint. {item['checkpoint']}") else: if (datetime.date.today() - datetime.timedelta(days=1) > datetime.datetime.strptime(item['datetime'].replace(' +0000 UTC', ''), '%Y-%m-%dT%H:%M:%SZ').date()): pass else: #json_output['response']['exechistories'].append(json_response_data['response']['exechistories'][1]) for output in json_response_data['response']['exechistories']: json_output['response']['exechistories'].append(output) json_output = json.dumps(json_output) if outputjson == True: return json_output #endpoint = url + '/v1/logging/exechistories' #payload_dict = { # "type":[1, 2, 6, 7], # "checkpoint":"000000000000000000000000", # "policy": [policiesnames[choice]] #} #payload = json.dumps(payload_dict) #print(payload) #response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False) #parse_text = json.loads(response.text) #text_response = checkpoint_stomper(parse_text['response']['exechistories'], url, policiesnames[choice]) # #if outputjson == False: # return response # #parse_text = json.loads(response.text) # #for item in parse_text['response']['exechistories']: # print(item['checkpoint']) # print(item['datetime']) # print(item['hostname']) # print(item['filename']) # checkpoint_stomper(item['checkpoint'], endpoint, headers, policiesnames[choice]) def checkpoint_stomper(checkpoint, url, policy, headers): endpoint = url + '/v1/logging/exechistories' payload_dict = { "type":[1,2,6,7], "checkpoint": checkpoint, "policy": [policy] } payload = json.dumps(payload_dict) response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False) parse_text = json.loads(response.text) return parse_text #for index, item in enumerate(parse_text): # if index == len(parse_text) - 1: # checkpoint = item['checkpoint'] # print(f"Time: {item['datetime']} Checkpoint: {item['checkpoint']}") # response_fuzzer(checkpoint, url, policyname) # else: # if (datetime.date.today() - datetime.timedelta(days=30) > datetime.datetime.strptime(item['datetime'].replace( ' +0000 UTC', ''), '%Y-%m-%dT%H:%M:%SZ').date()): # pass # else: # response_fuzzer(checkpoint, url, policyname) print("Finished")