brotoskyj
61 lines
2.4 KiB
Python
61 lines
2.4 KiB
Python
import datetime
|
|
import requests
|
|
import json
|
|
import os
|
|
import time
|
|
|
|
def pullPolicyExechistories(url, choice, policiesnames, outputjson: bool):
|
|
|
|
headers = {
|
|
"X-APIKey": os.getenv('APIKEY')
|
|
}
|
|
checkpoint = '000000000000000000000000'
|
|
json_output = {'error': 'Success', 'response': {'exechistories': []}}
|
|
while True:
|
|
json_response_data = checkpoint_stomper(checkpoint, url, policiesnames[choice], headers)
|
|
if not json_response_data['response']['exechistories']:
|
|
break
|
|
for index, item in enumerate(json_response_data['response']['exechistories']):
|
|
if index == len(json_response_data['response']['exechistories']) -1:
|
|
checkpoint = item['checkpoint']
|
|
print(f"Date Greater than 30 Days, Stepping to new Checkpoint. {item['checkpoint']}")
|
|
else:
|
|
if (datetime.date.today() - datetime.timedelta(days=10) > datetime.datetime.strptime(item['datetime'].replace(' +0000 UTC', ''), '%Y-%m-%dT%H:%M:%SZ').date()):
|
|
pass
|
|
else:
|
|
for output in json_response_data['response']['exechistories']:
|
|
json_output['response']['exechistories'].append(output)
|
|
json_output = json.dumps(json_output)
|
|
if outputjson == True:
|
|
return json_output
|
|
|
|
def checkpoint_stomper(checkpoint, url, policy, headers):
|
|
endpoint = url + '/v1/logging/exechistories'
|
|
payload_dict = {
|
|
"type":[1,2,6,7],
|
|
"checkpoint": checkpoint,
|
|
"policy": [policy]
|
|
}
|
|
payload = json.dumps(payload_dict)
|
|
response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
|
|
parse_text = json.loads(response.text)
|
|
return parse_text
|
|
|
|
def listPolicies(url):
|
|
endpoint = url + '/v1/group'
|
|
print("[+] Grabbing All Policies")
|
|
payload = {}
|
|
headers = {
|
|
"X-APIKey": os.getenv('APIKEY')
|
|
}
|
|
response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
|
|
parse_text = json.loads(response.text)
|
|
policiesnames = []
|
|
policyids = []
|
|
for index, list in enumerate(parse_text['response']['groups'], start=1):
|
|
print(f"{index}. {list['name']}")
|
|
policiesnames.append(list['name'])
|
|
policyids.append(list['groupid'])
|
|
choice = input("Select Policy Group: ")
|
|
choice = int(choice) - 1
|
|
return choice, policiesnames |