=
80 lines
3.1 KiB
Python
80 lines
3.1 KiB
Python
# Copyright (C) 2025 James Brotosky, Brandon Wickline
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License as published
|
|
# by the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
import datetime
|
|
import requests
|
|
import json
|
|
import os
|
|
import utils.colortext as ct
|
|
|
|
def devicehistory(url, outputjson: bool):
|
|
endpoint = url + '/v1/getexechistory'
|
|
print("\n")
|
|
print(ct.colorText("1. Today", "yellow"))
|
|
print(ct.colorText("2. Last 24 Hours", "yellow"))
|
|
print(ct.colorText("3. Past 7 Days", "yellow"))
|
|
print(ct.colorText("4. Past 30 Days", "yellow"))
|
|
print(ct.colorText("5. Custom Date Range","yellow"))
|
|
choice = input(ct.colorText("\nSelect Date Range: ", "white"))
|
|
today = datetime.date.today()
|
|
today = today.strftime("%Y-%m-%d")
|
|
if choice == '1':
|
|
date_selected = today
|
|
elif choice == '2':
|
|
date_selected = datetime.date.today() - datetime.timedelta(days=1)
|
|
date_selected = date_selected.strftime('%Y-%m-%d')
|
|
elif choice == '3':
|
|
date_selected = datetime.date.today() - datetime.timedelta(days=7)
|
|
date_selected = date_selected.strftime('%Y-%m-%d')
|
|
elif choice == '4':
|
|
date_selected = datetime.date.today() - datetime.timedelta(days=30)
|
|
date_selected = date_selected.strftime('%Y-%m-%d')
|
|
elif choice == "5":
|
|
print(ct.colorText("Please Input Dates as YYYY-MM-DD", "cyan"))
|
|
date_selected = input(ct.colorText("From: ", "white"))
|
|
today = input(ct.colorText("Date To: ", "white"))
|
|
print(ct.colorText("WARNING: Device Name is Case Sensitive", "red"))
|
|
device = input(ct.colorText("Enter Device Name: ", "white"))
|
|
payload_dict = {
|
|
"datefrom": date_selected,
|
|
"dateto": today,
|
|
"hostname": device
|
|
}
|
|
payload = json.dumps(payload_dict)
|
|
print(ct.colorText(payload, "green"))
|
|
headers = {
|
|
"X-APIKey": os.getenv('APIKEY')
|
|
}
|
|
|
|
response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
|
|
|
|
if outputjson:
|
|
return response
|
|
|
|
parse_text = json.loads(response.text)
|
|
|
|
# Safely get exechistory
|
|
exechistory = parse_text.get('response', {}).get('exechistory')
|
|
|
|
if isinstance(exechistory, list):
|
|
for block in exechistory:
|
|
print(ct.colorText(f"Command: {block.get('commandline', 'N/A')}", "green"))
|
|
print(ct.colorText(f"Date: {block.get('datetime', 'N/A')}", "green"))
|
|
print(ct.colorText(f"Filename: {block.get('filename', 'N/A')}", "green"))
|
|
print(ct.colorText(f"Policy Name: {block.get('policyname', 'N/A')}", "green"))
|
|
print(ct.colorText(f"Hostname: {block.get('hostname', 'N/A')}", "green"))
|
|
print(ct.colorText(f"Hash: {block.get('sha256', 'N/A')}", "green"))
|
|
print("\n")
|
|
else:
|
|
print(ct.colorText("No execution history found or data is not in expected format.", "red")) |