Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
err('defdir does not exist')
sys.exit(1)
for root, dirs, files in os.walk(args.defdir):
for filename in files:
if filename.endswith('.json'):
definition_files.append(os.path.join(root, filename))
if _python3:
output_file = open(output_filename, 'w', newline='')
else:
output_file = open(output_filename, 'wb')
writer = csv.writer(output_file)
writer.writerow(["endpoint","username","process_path","cmdline","program","source"])
if args.profile:
cb = CbEnterpriseResponseAPI(profile=args.profile)
else:
cb = CbEnterpriseResponseAPI()
if args.query:
log("Processing query", newline='')
result_set = process_search(cb, args.query, query_base)
result_count = len(result_set)
log(': %s results' % result_count)
for r in result_set:
row = [r[0], r[1], r[2], r[3], args.query, 'query']
if _python3 == False:
row = [col.encode('utf8') if isinstance(col, unicode) else col for col in row]
writer.writerow(row)
elif args.iocfile:
# Output options
parser.add_argument("--timestamps", action="store_true",
help="Include timestamps in results.")
args = parser.parse_args()
if args.queryfile:
sys.exit("queryfile not supported in this utility")
if args.prefix:
output_filename = '%s-usbstor.csv' % args.prefix
else:
output_filename = 'usbstor.csv'
if args.profile:
cb = CbEnterpriseResponseAPI(profile=args.profile)
else:
cb = CbEnterpriseResponseAPI()
output_file = open(output_filename, 'w')
writer = csv.writer(output_file, quoting=csv.QUOTE_ALL)
header_row = ['endpoint', 'vendor', 'product', 'version', 'serial']
if args.timestamps == True:
header_row.insert(0, 'timestamp')
writer.writerow(header_row)
for term in search_terms:
query = 'process_name:ntoskrnl.exe regmod:%s' % term
if args.days:
query += ' last_update:-%dm' % (args.days*1440)
raise LiveResponseError(res)
else:
time.sleep(delay)
raise TimeoutError(uri=url, message="timeout polling for Live Response")
if __name__ == "__main__":
from cbapi.response import CbEnterpriseResponseAPI
import logging
root = logging.getLogger()
root.addHandler(logging.StreamHandler())
logging.getLogger("cbapi").setLevel(logging.DEBUG)
c = CbEnterpriseResponseAPI()
j = GetFileJob(r"c:\test.txt")
with c.select(Sensor, 3).lr_session() as lr_session:
file_contents = lr_session.get_file(r"c:\test.txt")
future = c.live_response.submit_job(j.run, 3)
wait([future, ])
print(future.result())
help="Include timestamps in results.")
args = parser.parse_args()
if args.queryfile:
sys.exit("queryfile not supported in this utility")
if args.prefix:
output_filename = '%s-usbstor.csv' % args.prefix
else:
output_filename = 'usbstor.csv'
if args.profile:
cb = CbEnterpriseResponseAPI(profile=args.profile)
else:
cb = CbEnterpriseResponseAPI()
output_file = open(output_filename, 'w')
writer = csv.writer(output_file, quoting=csv.QUOTE_ALL)
header_row = ['endpoint', 'vendor', 'product', 'version', 'serial']
if args.timestamps == True:
header_row.insert(0, 'timestamp')
writer.writerow(header_row)
for term in search_terms:
query = 'process_name:ntoskrnl.exe regmod:%s' % term
if args.days:
query += ' last_update:-%dm' % (args.days*1440)
elif args.minutes:
query += ' last_update:-%dm' % args.minutes
output_filename = 'processes.csv'
if args.append == True or args.queryfile is not None:
file_mode = 'a'
else:
file_mode = 'w'
if args.days:
query_base = ' start:-{0}m'.format(args.days*1440)
elif args.minutes:
query_base = ' start:-{0}m'.format(args.minutes)
else:
query_base = ''
if args.profile:
cb = CbEnterpriseResponseAPI(profile=args.profile)
else:
cb = CbEnterpriseResponseAPI()
if args.groupby:
groupby = args.groupby
else:
groupby = None
queries = []
if args.query:
queries.append(args.query)
elif args.queryfile:
with open(args.queryfile, 'r') as f:
for query in f.readlines():
queries.append(query.strip())
f.close()
# argparse foolery, by all means . . .
if args.filemods == False and \
args.netconns == False and \
args.processes == False and \
args.regmods == False:
(filemods, netconns, processes, regmods) = (True, True, True, True)
else:
filemods = args.filemods
netconns = args.netconns
processes = args.processes
regmods = args.regmods
if args.profile:
cb = CbEnterpriseResponseAPI(profile=args.profile)
else:
cb = CbEnterpriseResponseAPI()
queries = []
if args.query:
queries.append(args.query)
elif args.queryfile:
with open(args.queryfile, 'r') as f:
for query in f.readlines():
queries.append(query.strip())
f.close()
else:
queries.append('')
file = open(filename, file_mode)
writer = csv.writer(file)
writer.writerow(["event_type",
"timestamp",
# all to True. If any are set to True, then evaluate each independently.
# If you're reading this and know of a cleaner way to do this, ideally via
# argparse foolery, by all means . . .
if args.filemods == False and \
args.netconns == False and \
args.processes == False and \
args.regmods == False:
(filemods, netconns, processes, regmods) = (True, True, True, True)
else:
filemods = args.filemods
netconns = args.netconns
processes = args.processes
regmods = args.regmods
if args.profile:
cb = CbEnterpriseResponseAPI(profile=args.profile)
else:
cb = CbEnterpriseResponseAPI()
queries = []
if args.query:
queries.append(args.query)
elif args.queryfile:
with open(args.queryfile, 'r') as f:
for query in f.readlines():
queries.append(query.strip())
f.close()
else:
queries.append('')
file = open(filename, file_mode)
writer = csv.writer(file)
help="Count processes associated with this sensor.")
parser.add_argument("--tamper-count", action="store_true",
help="Count tamper events associated with this sensor.")
parser.add_argument("--checkin-ip", action="store_true",
help="Return the latest public IP associated with the sensor.")
args = parser.parse_args()
if args.prefix:
output_filename = '%s-sensors.csv' % args.prefix
else:
output_filename = 'sensors.csv'
if args.profile:
cb = CbEnterpriseResponseAPI(profile=args.profile)
else:
cb = CbEnterpriseResponseAPI()
output_file = open(output_filename, 'w')
writer = csv.writer(output_file, quoting=csv.QUOTE_ALL)
header_row = ['computer_name',
'computer_dns_name',
'sensor_group_id',
'os',
'os_type',
'computer_sid',
'last_checkin_time',
'registration_time',
'network_adapters',
'id',