# Copyright (C) 2025 James Brotosky, Brandon Wickline # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as published # by the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . import datetime import requests import json import os import utils.pretty as ct def devicehistory(url, outputjson: bool): endpoint = url + '/v1/getexechistory' print("\n") print(ct.colorText("1. Today", "yellow")) print(ct.colorText("2. Last 24 Hours", "yellow")) print(ct.colorText("3. Past 7 Days", "yellow")) print(ct.colorText("4. Past 30 Days", "yellow")) print(ct.colorText("5. Custom Date Range","yellow")) choice = input(ct.colorText("\nSelect Date Range: ", "white")) today = datetime.date.today() today = today.strftime("%Y-%m-%d") if choice == '1': date_selected = today elif choice == '2': date_selected = datetime.date.today() - datetime.timedelta(days=1) date_selected = date_selected.strftime('%Y-%m-%d') elif choice == '3': date_selected = datetime.date.today() - datetime.timedelta(days=7) date_selected = date_selected.strftime('%Y-%m-%d') elif choice == '4': date_selected = datetime.date.today() - datetime.timedelta(days=30) date_selected = date_selected.strftime('%Y-%m-%d') elif choice == "5": print(ct.colorText("Please Input Dates as YYYY-MM-DD", "cyan")) date_selected = input(ct.colorText("From: ", "white")) today = input(ct.colorText("Date To: ", "white")) print(ct.colorText("WARNING: Device Name is Case Sensitive", "red")) device = input(ct.colorText("Enter Device Name: ", "white")) payload_dict = { "datefrom": date_selected, "dateto": today, "hostname": device } payload = json.dumps(payload_dict) print(ct.colorText(payload, "green")) headers = { "X-APIKey": os.getenv('APIKEY') } response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False) if outputjson: return response parse_text = json.loads(response.text) # Safely get exechistory exechistory = parse_text.get('response', {}).get('exechistory') if isinstance(exechistory, list): for block in exechistory: print(ct.colorText(f"Command: {block.get('commandline', 'N/A')}", "green")) print(ct.colorText(f"Date: {block.get('datetime', 'N/A')}", "green")) print(ct.colorText(f"Filename: {block.get('filename', 'N/A')}", "green")) print(ct.colorText(f"Policy Name: {block.get('policyname', 'N/A')}", "green")) print(ct.colorText(f"Hostname: {block.get('hostname', 'N/A')}", "green")) print(ct.colorText(f"Hash: {block.get('sha256', 'N/A')}", "green")) print("\n") else: print(ct.colorText("No execution history found or data is not in expected format.", "red"))