How to use the cbapi.example_helpers.get_cb_response_object function in cbapi

To help you get started, we’ve selected a few cbapi examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github carbonblack / cbapi-python / examples / response / sensor_export.py View on Github external
def main():
    parser = build_cli_parser(description="Export CbR Sensors from your environment as CSV")
    parser.add_argument("--output", "-o", dest="exportfile", help="The file to export to", required=True)
    parser.add_argument("--fields", "-f", dest="exportfields", help="The fields to export",
                        default="id,hostname,group_id,network_interfaces,os_environment_display_string,"
                        "build_version_string,network_isolation_enabled,last_checkin_time",
                        required=False)
    parser.add_argument("--query", "-q", dest="query", help="optional query to filter exported sensors", required=False)
    args = parser.parse_args()
    cb = get_cb_response_object(args)
    export_fields = args.exportfields.split(",")
    return export_sensors(cb, export_file_name=args.exportfile, export_fields=export_fields, query=args.query)
github carbonblack / cbapi-python / examples / response / partition_operations.py View on Github external
commands.add_parser("list", help="List all storage partitions")

    commands.add_parser("create", help="Create new active writer partition")

    del_command = commands.add_parser("delete", help="Delete partition")
    del_command.add_argument("-N", "--name", help="Name of partition to delete.", required=True)

    mount_command = commands.add_parser("mount", help="Mount partition")
    mount_command.add_argument("-N", "--name", help="Name of partition to mount.", required=True)

    unmount_command = commands.add_parser("unmount", help="Unmount partition")
    unmount_command.add_argument("-N", "--name", help="Name of partition to unmount.", required=True)

    args = parser.parse_args()
    cb = get_cb_response_object(args)

    if cb.cb_server_version < LooseVersion("6.1.0"):
        parser.error("This script can only work with server versions >= 6.1.0; {0} is running {1}"
                     .format(cb.url, cb.cb_server_version))
        return 1

    if args.command_name == "list":
        return list_partitions(cb, parser, args)
    elif args.command_name == "create":
        return create_partition(cb, parser, args)
    elif args.command_name == "delete":
        return delete_partition(cb, parser, args)
    elif args.command_name == "mount":
        return mount_partition(cb, parser, args)
    elif args.command_name == "unmount":
        return unmount_partition(cb, parser, args)
github carbonblack / cbapi-python / examples / response / user_operations.py View on Github external
add_team_command.add_argument("-A", "--administrator", help="Add administrator rights to the given sensor group",
                                  metavar="SENSOR-GROUP", action="append")
    add_team_command.add_argument("-V", "--viewer", help="Add viewer rights to the given sensor group",
                                  metavar="SENSOR-GROUP", action="append")

    get_api_key_command = commands.add_parser("get-api-key", help="Get API key for user")
    get_api_key_command.add_argument("-u", "--username", help="Username", required=True)
    get_api_key_command.add_argument("-p", "--password", help="Password - if not specified, prompt at runtime",
                                     required=False)

    del_command = commands.add_parser("delete", help="Delete user")
    del_user_specifier = del_command.add_mutually_exclusive_group(required=True)
    del_user_specifier.add_argument("-u", "--username", help="Name of user to delete.")

    args = parser.parse_args()
    cb = get_cb_response_object(args)

    if args.command_name == "list":
        return list_users(cb, parser, args)
    elif args.command_name == "list-teams":
        return list_teams(cb, parser, args)
    elif args.command_name == "add":
        return add_user(cb, parser, args)
    elif args.command_name == "add-team":
        return add_team(cb, parser, args)
    elif args.command_name == "delete":
        return delete_user(cb, parser, args)
github carbonblack / cbapi-python / examples / response / check_datasharing.py View on Github external
def main():
    parser = build_cli_parser("Check datasharing settings on server")

    args = parser.parse_args()
    cb = get_cb_response_object(args)

    virustotal_groups = []
    for sg in cb.select(SensorGroup):
        settings = cb.get_object("/api/v1/group/{0}/datasharing".format(sg.id)) or []
        for setting in settings:
            if setting.get("what") == "BIN" and setting.get("who") == "VIRUSTOTAL":
                virustotal_groups.append(sg)

    if len(virustotal_groups) == 0:
        print("No sensor groups are configured to send unknown binaries to VirusTotal")
        return 0
    elif len(virustotal_groups) == len(cb.select(SensorGroup)):
        print("**ALL** sensor groups are configured to send unknown binaries to VirusTotal")
        return 1
    else:
        print("The following sensor groups are configured to send unknown binaries to VirusTotal:")
github carbonblack / cbapi-python / examples / response / walk_children.py View on Github external
def main():
    parser = build_cli_parser("Walk the children of a given process")
    group = parser.add_mutually_exclusive_group()
    group.add_argument("--process", "-p", help="process GUID to walk", default='')
    group.add_argument("--query", "-q", help="walk the children of all processes matching this query")
    parser.add_argument("--children", "-c", default=15, help="number of children to fetch")
    args = parser.parse_args()
    c = get_cb_response_object(args)

    if args.process:
        try:
            procs = [c.select(Process, args.process, max_children=args.children, force_init=True)]
        except ObjectNotFoundError:
            print("Could not find process {0:s}".format(args.procss))
            return 1
        except ApiError as e:
            print("Encountered error retrieving process: {0:s}".format(str(e)))
            return 1
        except Exception as e:
            print("Encountered unknown error retrieving process: {0:s}".format(str(e)))
            return 1
    elif args.query:
        procs = c.select(Process).where(args.query).group_by("id").max_children(args.children)
    else:
github carbonblack / cbapi-python / examples / response / sensor_operations.py View on Github external
def main():
    parser = build_cli_parser(description="Automatic detection and response based on watchlists")
    parser.add_argument("--watchlists", "-w", dest="watchlists", help="The watchlists in question", required=True)
    parser.add_argument("--operation", "-o", dest="operation", help="The operation to perform", required=True,
                        default="Isolate")
    parser.add_argument("--dryrun", "-d", dest="dryrun", help="Dry run mode", default=False, required=False)
    args = parser.parse_args()
    cb = get_cb_response_object(args)
    return sensor_operations(cb, watchlists=args.watchlists, operation=args.operation, dryrun=args.dryrun)
github carbonblack / cbapi-python / examples / response / feed_operations.py View on Github external
del_command = commands.add_parser("delete", help="Delete feeds")
    del_feed_specifier = del_command.add_mutually_exclusive_group(required=True)
    del_feed_specifier.add_argument("-i", "--id", type=int, help="ID of feed to delete")
    del_feed_specifier.add_argument("-f", "--feedname", help="Name of feed to delete. Specify --force to delete"
                                    " multiple feeds that have the same name")
    del_command.add_argument("--force", help="If FEEDNAME matches multiple feeds, delete all matching feeds",
                             action="store_true", default=False)

    enable_command = commands.add_parser("enable", help="Enable a feed")
    enable_command.add_argument("-f", "--feedname", help="Name of feed to enable", required=True)

    disable_command = commands.add_parser("disable", help="Disable a feed")
    disable_command.add_argument("-f", "--feedname", help="Name of feed to disable", required=True)

    args = parser.parse_args()
    cb = get_cb_response_object(args)

    if args.command_name == "list":
        return list_feeds(cb, parser, args)
    elif args.command_name == "list-actions":
        return list_actions(cb, parser, args)
    elif args.command_name == "add":
        return add_feed(cb, parser, args)
    elif args.command_name == "delete":
        return delete_feed(cb, parser, args)
    elif args.command_name in ("disable", "enable"):
        return toggle_feed(cb, args.feedname, enable=args.command_name=="enable")
github carbonblack / cbapi-python / examples / response / binary_download.py View on Github external
def main():
    parser = build_cli_parser()
    parser.add_argument("--md5", help="binary query", required=True)
    parser.add_argument("--filename", help="local filename to save the binary as", required=True)
    args = parser.parse_args()

    cb = get_cb_response_object(args)
    binary = cb.select(Binary, args.md5)
    shutil.copyfileobj(binary.file, open(args.filename, "wb"))

    print("-> Downloaded binary %s [%u bytes]" % (args.md5, binary.size))

    return 0
github carbonblack / cbapi-python / examples / response / watchlist_operations.py View on Github external
add_command = commands.add_parser("add", help="Add new watchlist")
    add_command.add_argument("-N", "--name", help="Name of watchlist", required=True)
    add_command.add_argument("-q", "--query", help="Watchlist query string, e.g. process_name:notepad.exe",
                             required=True)
    add_command.add_argument("-t", "--type", help="Watchlist type 'events' or 'modules'", required=True)

    del_command = commands.add_parser("delete", help="Delete watchlists")
    del_watchlist_specifier = del_command.add_mutually_exclusive_group(required=True)
    del_watchlist_specifier.add_argument("-i", "--id", type=int, help="ID of watchlist to delete")
    del_watchlist_specifier.add_argument("-N", "--name", help="Name of watchlist to delete. Specify --force to delete"
                                         " multiple watchlists that have the same name")
    del_command.add_argument("--force", help="If NAME matches multiple watchlists, delete all matching watchlists",
                             action="store_true", default=False)

    args = parser.parse_args()
    cb = get_cb_response_object(args)

    if args.command_name == "list":
        return list_watchlists(cb, parser, args)
    elif args.command_name == "list-actions":
        return list_actions(cb, parser, args)
    elif args.command_name == "add":
        return add_watchlist(cb, parser, args)
    elif args.command_name == "delete":
        return delete_watchlist(cb, parser, args)