brotoskyj
91 lines
2.5 KiB
Python
91 lines
2.5 KiB
Python
from typing import Dict, List
|
|
|
|
def pull_policy_exec_histories(
|
|
self, type: List[str], checkpoint: str, policy: List[str]
|
|
) -> str:
|
|
"""Retrieve execution history logs."""
|
|
|
|
def api(AirlockAPIWrapper):
|
|
"""
|
|
An implementation of the python AirlockAPIWrapper class to pass Python data into Rust
|
|
|
|
Parameters
|
|
----------
|
|
base_url : str
|
|
(Required) Base URL of the Airlock API, this should be in your .env file.
|
|
api_key : str
|
|
(Required) API Key for your profile in airlock, this should be in your credential manager.
|
|
headers : {"X-APIKey": self.api_key}
|
|
|
|
```def __init__(self, base_url: str, api_key: str):
|
|
self.base_url = base_ur.rstrip("/")
|
|
self.api_key = api_key
|
|
self.headers = {"X-APIKey": self.api_key}
|
|
```
|
|
"""
|
|
|
|
def history_logging(
|
|
api,
|
|
exec_types: str,
|
|
checkpoint_number: str,
|
|
policy_names: str,
|
|
) -> List[Dict[str, Any]]:
|
|
"""
|
|
Query execution history logs from the Airlock API.
|
|
|
|
Parameters
|
|
----------
|
|
exec_types : str
|
|
A JSON-style string list of execution types to retrieve.
|
|
Example: "[3,5,8]"
|
|
- 0 = Trusted Execution
|
|
- 1 = Blocked Execution
|
|
- 2 = Untrusted Execution [Audit]
|
|
- 3 = Untrusted Execution [OTP]
|
|
- 5 = Trusted Publisher Execution
|
|
- 8 = Trusted Process Execution
|
|
(etc.)
|
|
|
|
checkpoint_number : str
|
|
The checkpoint ID. Used to fetch results after a certain event.
|
|
Example: "601d275487bacb01e3470713"
|
|
|
|
policy_names : str
|
|
A comma-separated or JSON-style list of policy group names.
|
|
Example: "Apple Mac" or "["Apple Mac", "Servers London"]"
|
|
|
|
Returns
|
|
-------
|
|
List[Dict[str, Any]]
|
|
A list of dictionaries, where each dictionary represents an
|
|
execution history record. Each record can include fields like:
|
|
|
|
- checkpoint: str
|
|
- type: int
|
|
- username: str
|
|
- hostname: str
|
|
- filename: str
|
|
- ppolicy: str
|
|
- policyname: str
|
|
- policyver: str
|
|
- commandline: str
|
|
- publisher: str
|
|
- pprocess: str
|
|
- gprocess: str
|
|
- sha256: str
|
|
- datetime: str
|
|
- ip: str
|
|
- localip: str
|
|
Raises
|
|
------
|
|
RuntimeError
|
|
If the request fails or the response cannot be parsed.
|
|
|
|
Example
|
|
-------
|
|
>>> histories = await airlock_libs.history_logging("[3,5,8]", "601d275487bacb01e3470713", "Apple Mac")
|
|
>>> print(histories[0]["filename"])
|
|
'chrome.exe'
|
|
"""
|
|
...
|