diff --git a/integrations/harfanglab/scripts/deisolate_from_threat.py b/integrations/harfanglab/scripts/deisolate_from_threat.py new file mode 100644 index 0000000..05e07a4 --- /dev/null +++ b/integrations/harfanglab/scripts/deisolate_from_threat.py @@ -0,0 +1,32 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + url = base + "/api/data/alert/alert/Threat/" + str(inputs.get("threat_id")) + "/deisolation/" + print(json.dumps(request("POST", url, headers))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/harfanglab/scripts/isolate_from_threat.py b/integrations/harfanglab/scripts/isolate_from_threat.py new file mode 100644 index 0000000..471aa4e --- /dev/null +++ b/integrations/harfanglab/scripts/isolate_from_threat.py @@ -0,0 +1,32 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + url = base + "/api/data/alert/alert/Threat/" + str(inputs.get("threat_id")) + "/isolation/" + print(json.dumps(request("POST", url, headers))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/harfanglab/scripts/job_cancel.py b/integrations/harfanglab/scripts/job_cancel.py new file mode 100644 index 0000000..ae05a84 --- /dev/null +++ b/integrations/harfanglab/scripts/job_cancel.py @@ -0,0 +1,32 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + url = base + "/api/data/Job/" + str(inputs.get("job_id")) + "/cancel/" + print(json.dumps(request("POST", url, headers))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/harfanglab/scripts/job_relaunch.py b/integrations/harfanglab/scripts/job_relaunch.py new file mode 100644 index 0000000..df73f28 --- /dev/null +++ b/integrations/harfanglab/scripts/job_relaunch.py @@ -0,0 +1,32 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + url = base + "/api/data/Job/" + str(inputs.get("job_id")) + "/relaunch/" + print(json.dumps(request("POST", url, headers))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/harfanglab/scripts/wait_for_job.py b/integrations/harfanglab/scripts/wait_for_job.py new file mode 100644 index 0000000..64b2c8e --- /dev/null +++ b/integrations/harfanglab/scripts/wait_for_job.py @@ -0,0 +1,45 @@ +import json, os, sys, time, urllib.request, urllib.parse, urllib.error + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + job_id = str(inputs.get("job_id")) + timeout = int(inputs.get("timeout") or 300) + interval = max(1, int(inputs.get("interval") or 10)) + deadline = time.time() + timeout + job = {} + finished = False + while True: + job = request("GET", base + "/api/data/Job/" + job_id + "/", headers) + total = int(job.get("instance") or 0) + settled = int(job.get("done") or 0) + int(job.get("error") or 0) + int(job.get("canceled") or 0) + finished = total > 0 and settled >= total + if finished or time.time() >= deadline: + break + time.sleep(interval) + print(json.dumps({"done": finished, "job": job})) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1)