From 6d311740f97444e9a72c76d65e493b360f7a4b9c Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Tue, 21 Jul 2026 21:52:39 +0200 Subject: [PATCH] feat(harfanglab): kill/dump process response commands Co-Authored-By: Claude Fable 5 --- .../harfanglab/scripts/dump_process.py | 55 +++++++++++++++++++ .../harfanglab/scripts/kill_process.py | 55 +++++++++++++++++++ 2 files changed, 110 insertions(+) create mode 100644 integrations/harfanglab/scripts/dump_process.py create mode 100644 integrations/harfanglab/scripts/kill_process.py diff --git a/integrations/harfanglab/scripts/dump_process.py b/integrations/harfanglab/scripts/dump_process.py new file mode 100644 index 0000000..d3a7b4d --- /dev/null +++ b/integrations/harfanglab/scripts/dump_process.py @@ -0,0 +1,55 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + +FIELD_TYPES = { + "name": 0, "path": 1, "username": 3, "commandline": 4, + "parent_name": 10, "parent_path": 11, "parent_commandline": 14, + "pid": 15, "md5": 16, "sha1": 17, "sha256": 18, +} +OPERATORS = {"eq": 0, "not_eq": 1, "contains": 2, "not_contains": 3} + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + field = str(inputs.get("field") or "name").lower() + operator = str(inputs.get("operator") or "eq").lower() + if field not in FIELD_TYPES: + print(json.dumps({"error": "invalid field: " + field + " (expected one of " + ", ".join(sorted(FIELD_TYPES)) + ")"})) + sys.exit(1) + if operator not in OPERATORS: + print(json.dumps({"error": "invalid operator: " + operator + " (expected one of eq, not_eq, contains, not_contains)"})) + sys.exit(1) + criteria = [{ + "param_type": FIELD_TYPES[field], + "param_operator": OPERATORS[operator], + "param_value": str(inputs.get("value") or ""), + }] + body = { + "targets": {"agents": [inputs.get("agent_id")]}, + "actions": [{"value": "searchProcessDumper", "params": {"values": criteria}}], + } + print(json.dumps(request("POST", base + "/api/data/Job/", headers, body))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/harfanglab/scripts/kill_process.py b/integrations/harfanglab/scripts/kill_process.py new file mode 100644 index 0000000..324f2b0 --- /dev/null +++ b/integrations/harfanglab/scripts/kill_process.py @@ -0,0 +1,55 @@ +import json, os, sys, urllib.request, urllib.parse, urllib.error + +FIELD_TYPES = { + "name": 0, "path": 1, "username": 3, "commandline": 4, + "parent_name": 10, "parent_path": 11, "parent_commandline": 14, + "pid": 15, "md5": 16, "sha1": 17, "sha256": 18, +} +OPERATORS = {"eq": 0, "not_eq": 1, "contains": 2, "not_contains": 3} + + +def request(method, url, headers, body=None): + data = json.dumps(body).encode("utf-8") if body is not None else None + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as resp: + raw = resp.read() + return json.loads(raw) if raw else {} + + +def main(): + secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + base = secrets.get("url", "").rstrip("/") + headers = { + "Authorization": "Token " + secrets.get("api_token", ""), + "Accept": "application/json", + "Content-Type": "application/json", + } + field = str(inputs.get("field") or "name").lower() + operator = str(inputs.get("operator") or "eq").lower() + if field not in FIELD_TYPES: + print(json.dumps({"error": "invalid field: " + field + " (expected one of " + ", ".join(sorted(FIELD_TYPES)) + ")"})) + sys.exit(1) + if operator not in OPERATORS: + print(json.dumps({"error": "invalid operator: " + operator + " (expected one of eq, not_eq, contains, not_contains)"})) + sys.exit(1) + criteria = [{ + "param_type": FIELD_TYPES[field], + "param_operator": OPERATORS[operator], + "param_value": str(inputs.get("value") or ""), + }] + body = { + "targets": {"agents": [inputs.get("agent_id")]}, + "actions": [{"value": "wildcardProcessFinderKiller", "params": {"values": criteria}}], + } + print(json.dumps(request("POST", base + "/api/data/Job/", headers, body))) + + +try: + main() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1)