# Copyright (C) 2025 James Brotosky, Brandon Wicklines # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as published # by the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . import datetime import requests import json import os def devicehistory(url, outputjson: bool): endpoint = url + '/v1/getexechistory' print("\n") print("1. Today") print("2. Last 24 Hours") print("3. Past 7 Days") print("4. Past 30 Days") print("5. Custom Date Range") choice = input("\nSelect Date Range: ") today = datetime.date.today() today = today.strftime("%Y-%m-%d") if choice == '1': date_selected = today elif choice == '2': date_selected = datetime.date.today() - datetime.timedelta(days=1) date_selected = date_selected.strftime('%Y-%m-%d') elif choice == '3': date_selected = datetime.date.today() - datetime.timedelta(days=7) date_selected = date_selected.strftime('%Y-%m-%d') elif choice == '4': date_selected = datetime.date.today() - datetime.timedelta(days=30) date_selected = date_selected.strftime('%Y-%m-%d') elif choice == "5": print("Please Input Dates as YYYY-MM-DD") date_selected = input("From: ") today = input("Date To: ") print("WARNING: Device Name is Case Sensitive") device = input("Enter Device Name: ") payload_dict = { "datefrom": date_selected, "dateto": today, "hostname": device } payload = json.dumps(payload_dict) print(payload) headers = { "X-APIKey": os.getenv('APIKEY') } response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False) if outputjson == True: return response parse_text = json.loads(response.text) for block in parse_text['response']['exechistory']: print(f"Command: {block['commandline']}") print(f"Date: {block['datetime']}") print(f"Filename: {block['filename']}") print(f"Policy Name: {block['policyname']}") print(f"Hostname: {block['hostname']}") print(f"Hash: {block['sha256']}") print("\n")