"""Autogenerated API"""
import requests
from argus_cli.plugin import register_command
[docs]@register_command(extending=('alarms','v1','signature'))
def get_signatures(keywords: list = None, keywordField: list = None, keywordMatch: str = 'all', offset: int = 0, limit: int = 25,json: bool = True, verify: bool = True, apiKey: str = "", authentication: dict = {}) -> dict:
"""Get all signatures including alarms if mapped (PUBLIC)
:param list keywords: Search by keywords
:param list keywordField: Set field strategy for keyword search
:param str keywordMatch: Set match strategy for keyword search
:param int offset: Skip a number of signatures
:param int limit: Maximum number of returned signatures
:raises AuthenticationFailedException: on 401
:raises ValidationErrorException: on 412
:raises AccessDeniedException: on 403
:returns: {"offset": 710, "limit": 484, "responseCode": 200, "count": 248, "data": [{"lastUpdatedByUser": {"id": 973, "customerID": 139, "userName": "mcdonaldjennifer", "name": "Patrick Brooks"}, "lastUpdatedTimestamp": 1250111928, "comments": [{"timestamp": 768627410, "comment": "Audience price change issue edge."}], "mappedTimestamp": 1190970539, "mappedByUser": {"id": 736, "customerID": 561, "userName": "amoore", "name": "Cody Baldwin"}, "firstTriggeredTimestamp": 163652404, "lastTriggeredTimestamp": 153406368, "triggerAmount": 315, "signature": "Ready keep get campaign.", "flags": ["SNORT"]}], "metaData": {"additionalProperties": {}}, "messages": [{"message": "A market bring reflect look.", "messageTemplate": "Our myself upon former action ball early.", "field": "Fill yet more watch alone.", "parameter": {}, "timestamp": 872435576}], "currentPage": 155, "size": 386}
"""
from requests import get
from argus_api.exceptions import http
url = "https://osl-argus-trunk-web1.mnemonic.no/web/api/alarms/v1/signature".format()
headers = {
'Content-Type': 'application/json',
'User-Agent': 'ArgusToolbelt/1.0'
}
if apiKey:
headers["Argus-API-Key"] = apiKey
elif authentication and isinstance(authentication, dict):
headers.update(authentication)
elif callable(authentication):
headers.update(authentication(url))
body = {}
if keywordMatch:
body.update({"keywordMatch": keywordMatch})
if offset:
body.update({"offset": offset})
if limit:
body.update({"limit": limit})
if keywords:
body.update({"keywords": keywords})
if keywordField:
body.update({"keywordField": keywordField})
response = get(url, json=body if body else None, verify=verify, headers=headers)
errors = []
if response.status_code == 401:
raise http.AuthenticationFailedException(response)
elif response.status_code == 403:
raise http.AccessDeniedException(response)
elif response.status_code == 412:
raise http.ValidationErrorException(response)
elif response.status_code == 404:
raise http.ObjectNotFoundException(response)
return response.json() if json else response
[docs]@register_command(extending=('alarms','v1','signature'))
def search_signatures(limit: int = None, offset: int = None, includeFlags: int = None, excludeFlags: int = None, subCriteria: list = None, attackCategoryID: list = None, alarmID: list = None, signature: list = None, minTriggerAmount: int = None, maxTriggerAmount: int = None, startTimestamp: int = None, endTimestamp: int = None, timeFieldStrategy: list = None, keywords: list = None, keywordFieldStrategy: list = None, sortBy: list = None, timeMatchStrategy: str = 'any', keywordMatchStrategy: str = 'all', includeDeleted: bool = 'False', exclude: bool = 'False', required: bool = 'False',json: bool = True, verify: bool = True, apiKey: str = "", authentication: dict = {}) -> dict:
"""Get all signatures matching a given search criteria (PUBLIC)
:param int limit: Set this value to set max number of results. By default, no restriction on result set size.
:param int offset: Set this value to skip the first (offset) objects. By default, return result from first object.
:param int includeFlags: Only include objects which have includeFlags set.
:param int excludeFlags: Exclude objects which have excludeFlags set.
:param list subCriteria:
:param list attackCategoryID: A set of IDs for attack categories (alarm category).
:param list alarmID: A set of IDs for alarms.
:param list signature: A set of signatures. It does an exact match.
:param int minTriggerAmount: Minimum trigger amount, default 0 means disabled
:param int maxTriggerAmount: Maximum trigger amount, default 0 means disabled
:param int startTimestamp: Only include mappings based on the set TimeFieldStrategy and TimeMatchStrategy (start timestamp)
:param int endTimestamp: Only include mappings based on the set TimeFieldStrategy and TimeMatchStrategy (end timestamp)
:param list timeFieldStrategy: TimeFieldStrategy to define which timestamp field(s) to match. (default lastTriggeredTimestamp)
:param list keywords: A set of keywords matched against mappings based on the set KeywordFieldStrategy and KeywordMatchStrategy.
:param list keywordFieldStrategy: KeywordFieldStrategy to define which field(s) to match against keywords. (default all)
:param list sortBy: List of properties to sort by (prefix with "-" to sort descending).
:param str timeMatchStrategy: TimeMatchStrategy to define how to match startTimestamp and endTimestamp with fields. (default any)
:param str keywordMatchStrategy: KeywordMatchStrategy to define how to match keywords with fields. (default all)
:param bool includeDeleted: Set to true to include deleted objects. By default, exclude deleted objects.
:param bool exclude: Only relevant for subcriteria. If set to true, objects matching this subcriteria object will be excluded.
:param bool required: Only relevant for subcriteria. If set to true, objects matching this subcriteria are required (AND-ed together with parent criteria).
:raises AuthenticationFailedException: on 401
:raises ValidationErrorException: on 412
:raises AccessDeniedException: on 403
:returns: {"offset": 523, "limit": 589, "responseCode": 200, "count": 627, "data": [{"lastUpdatedByUser": {"id": 387, "customerID": 989, "userName": "donaldgraham", "name": "Kristen Horne"}, "lastUpdatedTimestamp": 512706881, "comments": [{"timestamp": 1046666458, "comment": "Bill mean decision way."}], "mappedTimestamp": 261327939, "mappedByUser": {"id": 93, "customerID": 550, "userName": "markwhite", "name": "Scott Crosby"}, "firstTriggeredTimestamp": 592656240, "lastTriggeredTimestamp": 352926705, "triggerAmount": 520, "signature": "On see dark including care.", "flags": ["ISS_SIGNATURE"]}], "metaData": {"additionalProperties": {}}, "messages": [{"message": "Lead decide capital look agent but let painting.", "messageTemplate": "Thus public professor put head.", "field": "Worker another do put.", "parameter": {}, "timestamp": 1136747933}], "currentPage": 738, "size": 125}
"""
from requests import post
from argus_api.exceptions import http
url = "https://osl-argus-trunk-web1.mnemonic.no/web/api/alarms/v1/signature/search".format()
headers = {
'Content-Type': 'application/json',
'User-Agent': 'ArgusToolbelt/1.0'
}
if apiKey:
headers["Argus-API-Key"] = apiKey
elif authentication and isinstance(authentication, dict):
headers.update(authentication)
elif callable(authentication):
headers.update(authentication(url))
body = {}
if timeMatchStrategy:
body.update({"timeMatchStrategy": timeMatchStrategy})
if keywordMatchStrategy:
body.update({"keywordMatchStrategy": keywordMatchStrategy})
if limit:
body.update({"limit": limit})
if offset:
body.update({"offset": offset})
if includeDeleted:
body.update({"includeDeleted": includeDeleted})
if includeFlags:
body.update({"includeFlags": includeFlags})
if excludeFlags:
body.update({"excludeFlags": excludeFlags})
if subCriteria:
body.update({"subCriteria": subCriteria})
if exclude:
body.update({"exclude": exclude})
if required:
body.update({"required": required})
if attackCategoryID:
body.update({"attackCategoryID": attackCategoryID})
if alarmID:
body.update({"alarmID": alarmID})
if signature:
body.update({"signature": signature})
if minTriggerAmount:
body.update({"minTriggerAmount": minTriggerAmount})
if maxTriggerAmount:
body.update({"maxTriggerAmount": maxTriggerAmount})
if startTimestamp:
body.update({"startTimestamp": startTimestamp})
if endTimestamp:
body.update({"endTimestamp": endTimestamp})
if timeFieldStrategy:
body.update({"timeFieldStrategy": timeFieldStrategy})
if keywords:
body.update({"keywords": keywords})
if keywordFieldStrategy:
body.update({"keywordFieldStrategy": keywordFieldStrategy})
if sortBy:
body.update({"sortBy": sortBy})
response = post(url, json=body if body else None, verify=verify, headers=headers)
errors = []
if response.status_code == 401:
raise http.AuthenticationFailedException(response)
elif response.status_code == 403:
raise http.AccessDeniedException(response)
elif response.status_code == 412:
raise http.ValidationErrorException(response)
elif response.status_code == 404:
raise http.ObjectNotFoundException(response)
return response.json() if json else response