How to use the cbapi.example_helpers.get_cb_defense_object function in cbapi

To help you get started, we’ve selected a few cbapi examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github carbonblack / cbapi-python / test / cbapi / test_model_conflict.py View on Github external
def test_model_conflict():
    # this is setup temporary stuff
    args = TempArgs()
    args.verbose = False
    args.cburl = "https://localhost.example.com"
    args.apitoken = "foo"
    args.no_ssl_verify = True
    apiobj = get_cb_defense_object(args)
    # this is the actual test
    mod1 = Policy(apiobj)
    mod2 = PolicyOld(apiobj)
    mod1.do_funky_things()
    with pytest.raises(AttributeError):
        mod2.do_funky_things()
github carbonblack / cbapi-python / examples / defense / list_devices.py View on Github external
def main():
    parser = build_cli_parser("List devices")
    device_options = parser.add_mutually_exclusive_group(required=False)
    device_options.add_argument("-i", "--id", type=int, help="Device ID of sensor")
    device_options.add_argument("-n", "--hostname", help="Hostname")

    args = parser.parse_args()
    cb = get_cb_defense_object(args)

    if args.id:
        devices = [cb.select(Device, args.id)]
    elif args.hostname:
        devices = list(cb.select(Device).where("hostNameExact:{0}".format(args.hostname)))
    else:
        devices = list(cb.select(Device))

    print("{0:9} {1:40}{2:18}{3}".format("ID", "Hostname", "IP Address", "Last Checkin Time"))
    for device in devices:
        print("{0:9} {1:40s}{2:18s}{3}".format(device.deviceId, device.name or "None",
                                               device.lastInternalIpAddress or "Unknown", device.lastContact))
github carbonblack / cbapi-python / examples / defense / cblr_cli.py View on Github external
def main():
    parser = build_cli_parser("Cb Defense Live Response CLI")
    parser.add_argument("--log", help="Log activity to a file", default='')
    args = parser.parse_args()
    cb = get_cb_defense_object(args)

    if args.log:
        file_handler = logging.FileHandler(args.log)
        file_handler.setLevel(logging.DEBUG)
        log.addHandler(file_handler)

    cli = CblrCli(cb, connect_callback)
    cli.cmdloop()
github carbonblack / cbapi-python / examples / defense / list_events.py View on Github external
def main():
    parser = build_cli_parser("List Events for a device")
    event_options = parser.add_mutually_exclusive_group(required=False)
    event_date_options = parser.add_argument_group("Date Range Arguments")
    event_date_options.add_argument("--start", help="start time")
    event_date_options.add_argument("--end", help="end time")
    event_options.add_argument("-n", "--hostname", help="Hostname")

    args = parser.parse_args()
    cb = get_cb_defense_object(args)

    if args.hostname:
        events = list(cb.select(Event).where("hostNameExact:{0}".format(args.hostname)))
    elif args.start and args.end:
        # flipped the start and end arguments around so script can be called with the start date being
        # the earliest date. it's just easier on the eyes for most folks.

        events = list(cb.select(Event).where("startTime:{0}".format(args.end))) and (
            cb.select(Event).where("endTime:{0}".format(args.start)))
    else:
        events = list(cb.select(Event))

    for event in events:
        # convert event and create times
        event_time = str(convert_time(event.createTime))
        create_time = str(convert_time(event.eventTime))
github carbonblack / cbapi-python / examples / defense / list_events_with_cmdline_csv.py View on Github external
def main():
    parser = build_cli_parser("List Events for a device")
    event_options = parser.add_mutually_exclusive_group(required=False)
    event_date_options = parser.add_argument_group("Date Range Arguments")
    event_date_options.add_argument("--start", help="start time")
    event_date_options.add_argument("--end", help="end time")
    event_options.add_argument("-n", "--hostname", help="Hostname")

    args = parser.parse_args()
    cb = get_cb_defense_object(args)

    if args.hostname:
        events = list(cb.select(Event).where("hostNameExact:{0}".format(args.hostname)))
    elif args.start and args.end:
        # flipped the start and end arguments around so script can be called with the start date
        # being the earliest date. it's just easier on the eyes for most folks.

        events = list(cb.select(Event).where("startTime:{0}".format(args.end))) and (
            cb.select(Event).where("endTime:{0}".format(args.start)))
    else:
        events = list(cb.select(Event))

    # print the column headers
    print("Event Time|Event ID|Create Time|Event Type|Description|Command Line")

    for event in events:
github carbonblack / cbapi-python / examples / defense / cblr / jobrunner.py View on Github external
def main():
    parser = build_cli_parser()
    parser.add_argument("--job", action="store", default="examplejob", required=True)

    args = parser.parse_args()

    cb = get_cb_defense_object(args)

    sensor_query = cb.select(Device)

    # Retrieve the list of sensors that are online
    # calculate based on sensors that have checked in during the last five minutes
    now = datetime.utcnow()
    delta = timedelta(minutes=5)

    online_sensors = []
    offline_sensors = []
    for sensor in sensor_query:
        if now - sensor.lastContact < delta:
            online_sensors.append(sensor)
        else:
            offline_sensors.append(sensor)
github carbonblack / cbapi-python / examples / defense / move_device.py View on Github external
def main():
    parser = build_cli_parser("Move a device into a new security policy")
    device_options = parser.add_mutually_exclusive_group(required=True)
    device_options.add_argument("-i", "--id", type=int, help="Device ID of sensor to move")
    device_options.add_argument("-n", "--hostname", help="Hostname to move")

    policy_options = parser.add_mutually_exclusive_group(required=True)
    policy_options.add_argument("--policyid", type=int, help="Policy ID")
    policy_options.add_argument("--policyname", help="Policy name")

    args = parser.parse_args()
    cb = get_cb_defense_object(args)

    if args.id:
        devices = [cb.select(Device, args.id)]
    else:
        devices = list(cb.select(Device).where("hostNameExact:{0}".format(args.hostname)))

    for device in devices:
        if args.policyid:
            destpolicy = int(args.policyid)
            device.policyId = int(args.policyid)
        else:
            destpolicy = args.policyname
            device.policyName = args.policyname

        device.save()
        print("Moved device id {0} (hostname {1}) into policy {2}".format(device.deviceId, device.name, destpolicy))