diff --git a/integrations/wallix-bastion/manifest.yaml b/integrations/wallix-bastion/manifest.yaml new file mode 100644 index 0000000..34b846e --- /dev/null +++ b/integrations/wallix-bastion/manifest.yaml @@ -0,0 +1,83 @@ +id: wallix_bastion +name: WALLIX Bastion +version: 1.0.0 +description: "WALLIX Bastion (PAM REST API) — privileged access visibility: list devices, accounts and authorizations, and list/read sessions. API-key authentication; stdlib-only, no extra Python dependencies. (French vendor.)" +changelog: "1.0.0 — Initial release: list devices/accounts/authorizations, list/get sessions." +category: identity + +# Per-instance configuration. Auth uses the 'X-Auth-User' and 'X-Auth-Key' headers. +config_schema: + properties: + base_url: + type: string + description: "Bastion URL (e.g. https://bastion.example.com)" + api_user: + type: string + description: "API user name" + api_key: + type: string + description: "API key" + x-soar-sensitive: true + insecure: + type: boolean + description: "Trust any TLS certificate (not secure)" + default: false + required: + - base_url + - api_user + - api_key + +commands: + - id: list_devices + name: wallix-list-devices + description: "List devices." + risk: read + inputs_schema: + properties: + limit: { type: number, description: "Max devices (default 50)" } + required: [] + outputs_schema: { properties: {} } + - id: list_accounts + name: wallix-list-accounts + description: "List accounts." + risk: read + inputs_schema: + properties: + limit: { type: number, description: "Max accounts (default 50)" } + required: [] + outputs_schema: { properties: {} } + - id: list_authorizations + name: wallix-list-authorizations + description: "List authorizations." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } + - id: list_sessions + name: wallix-list-sessions + description: "List sessions (optionally filter by status)." + risk: read + inputs_schema: + properties: + status: { type: string, description: "Status filter (e.g. current, closed)" } + required: [] + outputs_schema: { properties: {} } + - id: get_session + name: wallix-get-session + description: "Get a single session by ID." + risk: read + inputs_schema: + properties: + session_id: { type: string, description: "Session ID" } + required: [session_id] + outputs_schema: { properties: {} } + + - id: test_connection + name: wallix-test-connection + description: "Verify connectivity and credentials (used by the Test button)." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } diff --git a/integrations/wallix-bastion/scripts/get_session.py b/integrations/wallix-bastion/scripts/get_session.py new file mode 100644 index 0000000..b88f06b --- /dev/null +++ b/integrations/wallix-bastion/scripts/get_session.py @@ -0,0 +1,57 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +def request(method, path, cfg, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + "/api" + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + headers = { + "X-Auth-User": str(cfg.get("api_user", "")), + "X-Auth-Key": str(cfg.get("api_key", "")), + "Accept": "application/json", + } + req = urllib.request.Request(url, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + session_id = inputs.get("session_id") + if not session_id: + raise Exception("session_id is required") + q = lambda v: urllib.parse.quote(str(v), safe="") + return request("GET", "/sessions/" + q(session_id), cfg) + + +_run(main) diff --git a/integrations/wallix-bastion/scripts/list_accounts.py b/integrations/wallix-bastion/scripts/list_accounts.py new file mode 100644 index 0000000..a94ae33 --- /dev/null +++ b/integrations/wallix-bastion/scripts/list_accounts.py @@ -0,0 +1,54 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +def request(method, path, cfg, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + "/api" + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + headers = { + "X-Auth-User": str(cfg.get("api_user", "")), + "X-Auth-Key": str(cfg.get("api_key", "")), + "Accept": "application/json", + } + req = urllib.request.Request(url, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + limit = inputs.get("limit") or 50 + return request("GET", "/accounts", cfg, params={"limit": int(limit)}) + + +_run(main) diff --git a/integrations/wallix-bastion/scripts/list_authorizations.py b/integrations/wallix-bastion/scripts/list_authorizations.py new file mode 100644 index 0000000..cf58db7 --- /dev/null +++ b/integrations/wallix-bastion/scripts/list_authorizations.py @@ -0,0 +1,53 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +def request(method, path, cfg, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + "/api" + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + headers = { + "X-Auth-User": str(cfg.get("api_user", "")), + "X-Auth-Key": str(cfg.get("api_key", "")), + "Accept": "application/json", + } + req = urllib.request.Request(url, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + return request("GET", "/authorizations", cfg) + + +_run(main) diff --git a/integrations/wallix-bastion/scripts/list_devices.py b/integrations/wallix-bastion/scripts/list_devices.py new file mode 100644 index 0000000..abcf469 --- /dev/null +++ b/integrations/wallix-bastion/scripts/list_devices.py @@ -0,0 +1,54 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +def request(method, path, cfg, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + "/api" + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + headers = { + "X-Auth-User": str(cfg.get("api_user", "")), + "X-Auth-Key": str(cfg.get("api_key", "")), + "Accept": "application/json", + } + req = urllib.request.Request(url, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + limit = inputs.get("limit") or 50 + return request("GET", "/devices", cfg, params={"limit": int(limit)}) + + +_run(main) diff --git a/integrations/wallix-bastion/scripts/list_sessions.py b/integrations/wallix-bastion/scripts/list_sessions.py new file mode 100644 index 0000000..4fe9096 --- /dev/null +++ b/integrations/wallix-bastion/scripts/list_sessions.py @@ -0,0 +1,54 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +def request(method, path, cfg, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + "/api" + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + headers = { + "X-Auth-User": str(cfg.get("api_user", "")), + "X-Auth-Key": str(cfg.get("api_key", "")), + "Accept": "application/json", + } + req = urllib.request.Request(url, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + status = inputs.get("status") + return request("GET", "/sessions", cfg, params={"status": status}) + + +_run(main) diff --git a/integrations/wallix-bastion/scripts/test_connection.py b/integrations/wallix-bastion/scripts/test_connection.py new file mode 100644 index 0000000..d6adc38 --- /dev/null +++ b/integrations/wallix-bastion/scripts/test_connection.py @@ -0,0 +1,54 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +def request(method, path, cfg, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + "/api" + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + headers = { + "X-Auth-User": str(cfg.get("api_user", "")), + "X-Auth-Key": str(cfg.get("api_key", "")), + "Accept": "application/json", + } + req = urllib.request.Request(url, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + request("GET", "/devices", cfg, params={"limit": 1}) + return {"ok": True} + + +_run(main)