126 lines
3.5 KiB
Python
126 lines
3.5 KiB
Python
from typing import Any, Dict, List, Optional
|
|
|
|
def pull_policy_exec_histories(
|
|
api,
|
|
type: str,
|
|
days: int,
|
|
policy_name: Optional[str] = None,
|
|
) -> str:
|
|
"""
|
|
Pull execution history for policies.
|
|
|
|
Parameters
|
|
----------
|
|
api : AirlockAPIWrapper
|
|
The API wrapper instance
|
|
policy_name : Optional[str]
|
|
Name of the policy to query. If None, returns history for all policies.
|
|
type : str
|
|
JSON-style string list of execution types, e.g., "[1,2,3]"
|
|
days : int
|
|
Number of days to look back
|
|
|
|
Returns
|
|
-------
|
|
str
|
|
JSON string containing execution history response with structure:
|
|
{"response": {"exechistories": [...]}}
|
|
"""
|
|
...
|
|
|
|
def history_logging(
|
|
api,
|
|
exec_types: str,
|
|
checkpoint_number: str,
|
|
policy_names: Optional[str] = None,
|
|
) -> List[Dict[str, Any]]:
|
|
"""
|
|
Query execution history logs from the Airlock API.
|
|
|
|
Parameters
|
|
----------
|
|
api : AirlockAPIWrapper
|
|
The API wrapper instance
|
|
|
|
exec_types : str
|
|
A JSON-style string list of execution types to retrieve.
|
|
Example: "[3,5,8]"
|
|
- 0 = Trusted Execution
|
|
- 1 = Blocked Execution
|
|
- 2 = Untrusted Execution [Audit]
|
|
- 3 = Untrusted Execution [OTP]
|
|
- 4 = Trusted Path Execution
|
|
- 5 = Trusted Publisher Execution
|
|
- 6 = Blocklist Execution
|
|
- 7 = Blocklist Execution [Audit]
|
|
- 8 = Trusted Process Execution
|
|
- 9 = Constrained Execution
|
|
- 10 = Trusted Metadata Execution
|
|
- 11 = Trusted Browser Execution
|
|
- 12 = Blocked Browser Execution
|
|
- 13 = Untrusted Browser Execution [Audit]
|
|
- 14 = Untrusted Browser Execution [OTP]
|
|
- 15 = Blocklist Browser Execution [Audit]
|
|
- 16 = Blocklist Browser Execution
|
|
- 17 = Trusted Installer Execution
|
|
- 18 = Trusted Browser Metadata Execution
|
|
|
|
checkpoint_number : str
|
|
The checkpoint ID. Used to fetch results after a certain event.
|
|
Example: "601d275487bacb01e3470713"
|
|
|
|
policy_names : Optional[str], default None
|
|
A comma-separated or JSON-style list of policy group names.
|
|
If None or not provided, retrieves execution history for ALL policies.
|
|
Example: "Apple Mac" or '["Apple Mac", "Servers London"]'
|
|
|
|
Returns
|
|
-------
|
|
List[Dict[str, Any]]
|
|
A list of dictionaries, where each dictionary represents an
|
|
execution history record. Each record can include fields like:
|
|
|
|
- checkpoint: str
|
|
- type: int
|
|
- username: str
|
|
- hostname: str
|
|
- filename: str
|
|
- ppolicy: str
|
|
- policyname: str
|
|
- policyver: str
|
|
- commandline: str
|
|
- publisher: str
|
|
- pprocess: str
|
|
- gprocess: str
|
|
- sha256: str
|
|
- datetime: str
|
|
- ip: str
|
|
- localip: str
|
|
|
|
Raises
|
|
------
|
|
RuntimeError
|
|
If the request fails or the response cannot be parsed.
|
|
|
|
Examples
|
|
--------
|
|
>>> # Get execution history for ALL policies
|
|
>>> histories = airlock_libs.history_logging(
|
|
... api,
|
|
... "[1,2,3]",
|
|
... "601d275487bacb01e3470713",
|
|
... None # or omit this parameter
|
|
... )
|
|
>>>
|
|
>>> # Get execution history for a specific policy
|
|
>>> histories = airlock_libs.history_logging(
|
|
... api,
|
|
... "[3,5,8]",
|
|
... "601d275487bacb01e3470713",
|
|
... "Apple Mac"
|
|
... )
|
|
>>> print(histories[0]["filename"])
|
|
'chrome.exe'
|
|
"""
|
|
...
|