Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def main():
parser = build_cli_parser(description="Export CbR Sensors from your environment as CSV")
parser.add_argument("--output", "-o", dest="exportfile", help="The file to export to", required=True)
parser.add_argument("--fields", "-f", dest="exportfields", help="The fields to export",
default="id,hostname,group_id,network_interfaces,os_environment_display_string,"
"build_version_string,network_isolation_enabled,last_checkin_time",
required=False)
parser.add_argument("--query", "-q", dest="query", help="optional query to filter exported sensors", required=False)
args = parser.parse_args()
cb = get_cb_response_object(args)
export_fields = args.exportfields.split(",")
return export_sensors(cb, export_file_name=args.exportfile, export_fields=export_fields, query=args.query)
commands.add_parser("list", help="List all storage partitions")
commands.add_parser("create", help="Create new active writer partition")
del_command = commands.add_parser("delete", help="Delete partition")
del_command.add_argument("-N", "--name", help="Name of partition to delete.", required=True)
mount_command = commands.add_parser("mount", help="Mount partition")
mount_command.add_argument("-N", "--name", help="Name of partition to mount.", required=True)
unmount_command = commands.add_parser("unmount", help="Unmount partition")
unmount_command.add_argument("-N", "--name", help="Name of partition to unmount.", required=True)
args = parser.parse_args()
cb = get_cb_response_object(args)
if cb.cb_server_version < LooseVersion("6.1.0"):
parser.error("This script can only work with server versions >= 6.1.0; {0} is running {1}"
.format(cb.url, cb.cb_server_version))
return 1
if args.command_name == "list":
return list_partitions(cb, parser, args)
elif args.command_name == "create":
return create_partition(cb, parser, args)
elif args.command_name == "delete":
return delete_partition(cb, parser, args)
elif args.command_name == "mount":
return mount_partition(cb, parser, args)
elif args.command_name == "unmount":
return unmount_partition(cb, parser, args)
add_team_command.add_argument("-A", "--administrator", help="Add administrator rights to the given sensor group",
metavar="SENSOR-GROUP", action="append")
add_team_command.add_argument("-V", "--viewer", help="Add viewer rights to the given sensor group",
metavar="SENSOR-GROUP", action="append")
get_api_key_command = commands.add_parser("get-api-key", help="Get API key for user")
get_api_key_command.add_argument("-u", "--username", help="Username", required=True)
get_api_key_command.add_argument("-p", "--password", help="Password - if not specified, prompt at runtime",
required=False)
del_command = commands.add_parser("delete", help="Delete user")
del_user_specifier = del_command.add_mutually_exclusive_group(required=True)
del_user_specifier.add_argument("-u", "--username", help="Name of user to delete.")
args = parser.parse_args()
cb = get_cb_response_object(args)
if args.command_name == "list":
return list_users(cb, parser, args)
elif args.command_name == "list-teams":
return list_teams(cb, parser, args)
elif args.command_name == "add":
return add_user(cb, parser, args)
elif args.command_name == "add-team":
return add_team(cb, parser, args)
elif args.command_name == "delete":
return delete_user(cb, parser, args)
def main():
parser = build_cli_parser("Check datasharing settings on server")
args = parser.parse_args()
cb = get_cb_response_object(args)
virustotal_groups = []
for sg in cb.select(SensorGroup):
settings = cb.get_object("/api/v1/group/{0}/datasharing".format(sg.id)) or []
for setting in settings:
if setting.get("what") == "BIN" and setting.get("who") == "VIRUSTOTAL":
virustotal_groups.append(sg)
if len(virustotal_groups) == 0:
print("No sensor groups are configured to send unknown binaries to VirusTotal")
return 0
elif len(virustotal_groups) == len(cb.select(SensorGroup)):
print("**ALL** sensor groups are configured to send unknown binaries to VirusTotal")
return 1
else:
print("The following sensor groups are configured to send unknown binaries to VirusTotal:")
def main():
parser = build_cli_parser("Walk the children of a given process")
group = parser.add_mutually_exclusive_group()
group.add_argument("--process", "-p", help="process GUID to walk", default='')
group.add_argument("--query", "-q", help="walk the children of all processes matching this query")
parser.add_argument("--children", "-c", default=15, help="number of children to fetch")
args = parser.parse_args()
c = get_cb_response_object(args)
if args.process:
try:
procs = [c.select(Process, args.process, max_children=args.children, force_init=True)]
except ObjectNotFoundError:
print("Could not find process {0:s}".format(args.procss))
return 1
except ApiError as e:
print("Encountered error retrieving process: {0:s}".format(str(e)))
return 1
except Exception as e:
print("Encountered unknown error retrieving process: {0:s}".format(str(e)))
return 1
elif args.query:
procs = c.select(Process).where(args.query).group_by("id").max_children(args.children)
else:
def main():
parser = build_cli_parser(description="Automatic detection and response based on watchlists")
parser.add_argument("--watchlists", "-w", dest="watchlists", help="The watchlists in question", required=True)
parser.add_argument("--operation", "-o", dest="operation", help="The operation to perform", required=True,
default="Isolate")
parser.add_argument("--dryrun", "-d", dest="dryrun", help="Dry run mode", default=False, required=False)
args = parser.parse_args()
cb = get_cb_response_object(args)
return sensor_operations(cb, watchlists=args.watchlists, operation=args.operation, dryrun=args.dryrun)
del_command = commands.add_parser("delete", help="Delete feeds")
del_feed_specifier = del_command.add_mutually_exclusive_group(required=True)
del_feed_specifier.add_argument("-i", "--id", type=int, help="ID of feed to delete")
del_feed_specifier.add_argument("-f", "--feedname", help="Name of feed to delete. Specify --force to delete"
" multiple feeds that have the same name")
del_command.add_argument("--force", help="If FEEDNAME matches multiple feeds, delete all matching feeds",
action="store_true", default=False)
enable_command = commands.add_parser("enable", help="Enable a feed")
enable_command.add_argument("-f", "--feedname", help="Name of feed to enable", required=True)
disable_command = commands.add_parser("disable", help="Disable a feed")
disable_command.add_argument("-f", "--feedname", help="Name of feed to disable", required=True)
args = parser.parse_args()
cb = get_cb_response_object(args)
if args.command_name == "list":
return list_feeds(cb, parser, args)
elif args.command_name == "list-actions":
return list_actions(cb, parser, args)
elif args.command_name == "add":
return add_feed(cb, parser, args)
elif args.command_name == "delete":
return delete_feed(cb, parser, args)
elif args.command_name in ("disable", "enable"):
return toggle_feed(cb, args.feedname, enable=args.command_name=="enable")
def main():
parser = build_cli_parser()
parser.add_argument("--md5", help="binary query", required=True)
parser.add_argument("--filename", help="local filename to save the binary as", required=True)
args = parser.parse_args()
cb = get_cb_response_object(args)
binary = cb.select(Binary, args.md5)
shutil.copyfileobj(binary.file, open(args.filename, "wb"))
print("-> Downloaded binary %s [%u bytes]" % (args.md5, binary.size))
return 0
add_command = commands.add_parser("add", help="Add new watchlist")
add_command.add_argument("-N", "--name", help="Name of watchlist", required=True)
add_command.add_argument("-q", "--query", help="Watchlist query string, e.g. process_name:notepad.exe",
required=True)
add_command.add_argument("-t", "--type", help="Watchlist type 'events' or 'modules'", required=True)
del_command = commands.add_parser("delete", help="Delete watchlists")
del_watchlist_specifier = del_command.add_mutually_exclusive_group(required=True)
del_watchlist_specifier.add_argument("-i", "--id", type=int, help="ID of watchlist to delete")
del_watchlist_specifier.add_argument("-N", "--name", help="Name of watchlist to delete. Specify --force to delete"
" multiple watchlists that have the same name")
del_command.add_argument("--force", help="If NAME matches multiple watchlists, delete all matching watchlists",
action="store_true", default=False)
args = parser.parse_args()
cb = get_cb_response_object(args)
if args.command_name == "list":
return list_watchlists(cb, parser, args)
elif args.command_name == "list-actions":
return list_actions(cb, parser, args)
elif args.command_name == "add":
return add_watchlist(cb, parser, args)
elif args.command_name == "delete":
return delete_watchlist(cb, parser, args)