diff --git a/integrations/splunk/manifest.yaml b/integrations/splunk/manifest.yaml new file mode 100644 index 0000000..c4ed970 --- /dev/null +++ b/integrations/splunk/manifest.yaml @@ -0,0 +1,279 @@ +id: splunk +name: Splunk +version: 1.1.0 +description: "Splunk (REST API, management port 8089) — run SPL searches with notable/CIM finding ingestion and an OCSF mapper, manage search jobs, indexes and event submission (incl. HEC), full KV Store collection/entry management, and user administration. Token or basic authentication." +changelog: "1.1.0 — Full coverage: search jobs (create/status/results), indexes listing, event submission (receivers/simple + HEC), and the complete KV Store command set (collection create/config/delete, list, data list/add/delete, entry search/delete/update). 1.0.0 — Initial release: SPL search (oneshot) ingestion with a bundled OCSF mapper for notable/CIM events, get_users, delete_user and a KV Store entry update." +category: siem + +# Per-instance configuration. The REST API lives on the Splunk management port (default 8089), +# NOT the web port. Token auth uses an authentication token (Settings → Tokens); basic auth +# uses a username + password. HEC fields are only needed for splunk-submit-event-hec. +config_schema: + properties: + host: + type: string + description: "Splunk server host or URL (e.g. splunk.example.com or https://splunk.example.com)" + port: + type: string + description: "REST management port (default 8089)" + default: "8089" + auth_type: + type: string + description: "Authentication method: token (Bearer authentication token) or basic (username + password)" + default: token + username: + type: string + description: "Username (basic auth only)" + password: + type: string + description: "Authentication token (token auth) or password (basic auth)" + x-soar-sensitive: true + app: + type: string + description: "Default app namespace for KV Store operations (default 'search')" + default: search + hec_url: + type: string + description: "HTTP Event Collector base URL for splunk-submit-event-hec (e.g. https://splunk.example.com:8088)" + hec_token: + type: string + description: "HTTP Event Collector token for splunk-submit-event-hec" + x-soar-sensitive: true + verify: + type: boolean + description: "Verify the server TLS certificate (default false; Splunk often uses self-signed certs)" + default: false + required: + - host + - password + +# Documented for reference; the bundled scripts build the Authorization header themselves. +# token: Authorization: Bearer basic: Authorization: Basic base64(user:pass) +auth: + - id: apikey + type: api_key + in: header + name: Authorization + value_template: "Bearer {{secret}}" + secret_field: password + +commands: + # ── Ingestion / search ──────────────────────────────────────────────────── + - id: search + name: splunk-search + description: "Run an SPL search (oneshot) and return the result rows. Use as an ingestion source by searching for notable events; results are under the 'results' array." + risk: read + inputs_schema: + properties: + query: { type: string, description: "SPL query (a leading 'search ' is added automatically if missing)" } + earliest: { type: string, description: "Earliest time (e.g. -24h, -7d@d, or an epoch); incremental fetch watermark" } + latest: { type: string, description: "Latest time (e.g. now)" } + limit: { type: number, description: "Maximum result rows (default 100)" } + app: { type: string, description: "App namespace to run the search in (defaults to the instance 'app' config)" } + required: [query] + outputs_schema: { properties: {} } + ingest: + results_path: results + dedup_key: event_id + incremental_field: earliest + + # ── Search jobs ─────────────────────────────────────────────────────────── + - id: job_create + name: splunk-job-create + description: "Dispatch an asynchronous search job and return its sid. Poll with splunk-job-status, then fetch with splunk-job-results." + risk: read + inputs_schema: + properties: + query: { type: string, description: "SPL query (a leading 'search ' is added automatically if missing)" } + earliest: { type: string, description: "Earliest time (e.g. -24h)" } + latest: { type: string, description: "Latest time (e.g. now)" } + app: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + required: [query] + outputs_schema: { properties: {} } + - id: job_status + name: splunk-job-status + description: "Return the status (dispatchState, doneProgress, resultCount) of a search job by sid." + risk: read + inputs_schema: + properties: + sid: { type: string, description: "Search job id" } + required: [sid] + outputs_schema: { properties: {} } + - id: job_results + name: splunk-job-results + description: "Fetch the results of a completed search job by sid." + risk: read + inputs_schema: + properties: + sid: { type: string, description: "Search job id" } + offset: { type: number, description: "Result offset (default 0)" } + limit: { type: number, description: "Maximum result rows (default 100; 0 = all)" } + required: [sid] + outputs_schema: { properties: {} } + + # ── Indexes & event submission ──────────────────────────────────────────── + - id: get_indexes + name: splunk-get-indexes + description: "List the indexes configured on the Splunk instance with their event counts and sizes." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } + - id: submit_event + name: splunk-submit-event + description: "Submit a single event to an index via the REST receivers/simple endpoint." + inputs_schema: + properties: + index: { type: string, description: "Target index name" } + event: { type: string, description: "Event payload (raw string)" } + sourcetype: { type: string, description: "Sourcetype to assign (optional)" } + source: { type: string, description: "Source to assign (optional)" } + host: { type: string, description: "Host to assign (optional)" } + required: [index, event] + outputs_schema: { properties: {} } + - id: submit_event_hec + name: splunk-submit-event-hec + description: "Submit an event through the HTTP Event Collector (HEC). Requires hec_url and hec_token in the instance config." + inputs_schema: + properties: + event: { type: string, description: "Event payload (string or JSON object as a string)" } + index: { type: string, description: "Target index (optional)" } + sourcetype: { type: string, description: "Sourcetype (optional)" } + source: { type: string, description: "Source (optional)" } + host: { type: string, description: "Host (optional)" } + fields: { type: object, description: "Indexed fields object (optional)" } + required: [event] + outputs_schema: { properties: {} } + + # ── User management ─────────────────────────────────────────────────────── + - id: get_users + name: splunk-get-users + description: "List Splunk users with their roles and metadata." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } + - id: delete_user + name: splunk-delete-user + description: "Delete a Splunk user by username." + inputs_schema: + properties: + username: { type: string, description: "Username to delete" } + required: [username] + outputs_schema: { properties: {} } + + # ── KV Store: collections ───────────────────────────────────────────────── + - id: kv_store_collections_list + name: splunk-kv-store-collections-list + description: "List the KV Store collections defined in an app." + risk: read + inputs_schema: + properties: + app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + required: [] + outputs_schema: { properties: {} } + - id: kv_store_collection_create + name: splunk-kv-store-collection-create + description: "Create a new KV Store collection in an app." + inputs_schema: + properties: + app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + kv_store_name: { type: string, description: "Name of the collection to create" } + required: [kv_store_name] + outputs_schema: { properties: {} } + - id: kv_store_collection_config + name: splunk-kv-store-collection-config + description: "Define field types on a KV Store collection (e.g. field.name=string). Pass a JSON object mapping field name to type." + inputs_schema: + properties: + app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + kv_store_collection_name: { type: string, description: "Collection name" } + fields: { type: object, description: "Object mapping field name to type (string|number|bool|time|cidr)" } + required: [kv_store_collection_name, fields] + outputs_schema: { properties: {} } + - id: kv_store_collection_delete + name: splunk-kv-store-collection-delete + description: "Delete a KV Store collection and all of its data." + inputs_schema: + properties: + app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + kv_store_collection_name: { type: string, description: "Collection name to delete" } + required: [kv_store_collection_name] + outputs_schema: { properties: {} } + + # ── KV Store: data ──────────────────────────────────────────────────────── + - id: kv_store_collection_add_entries + name: splunk-kv-store-collection-add-entries + description: "Insert one or more entries into a KV Store collection (batch_save). Pass a JSON array of objects." + inputs_schema: + properties: + app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + kv_store_collection_name: { type: string, description: "Collection name" } + entries: { type: array, description: "Array of entry objects to insert" } + required: [kv_store_collection_name, entries] + outputs_schema: { properties: {} } + - id: kv_store_collection_data_list + name: splunk-kv-store-collection-data-list + description: "List all entries in a KV Store collection." + risk: read + inputs_schema: + properties: + app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + kv_store_collection_name: { type: string, description: "Collection name" } + limit: { type: number, description: "Maximum entries (default 0 = all)" } + required: [kv_store_collection_name] + outputs_schema: { properties: {} } + - id: kv_store_collection_data_delete + name: splunk-kv-store-collection-data-delete + description: "Delete ALL entries in a KV Store collection (the collection itself is kept)." + inputs_schema: + properties: + app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + kv_store_collection_name: { type: string, description: "Collection name" } + required: [kv_store_collection_name] + outputs_schema: { properties: {} } + - id: kv_store_collection_search_entry + name: splunk-kv-store-collection-search-entry + description: "Search entries in a KV Store collection with a Mongo-style query (JSON object)." + risk: read + inputs_schema: + properties: + app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + kv_store_collection_name: { type: string, description: "Collection name" } + query: { type: object, description: "Mongo-style query object, e.g. {\"name\": \"foo\"}" } + required: [kv_store_collection_name, query] + outputs_schema: { properties: {} } + - id: kv_store_collection_delete_entry + name: splunk-kv-store-collection-delete-entry + description: "Delete entries in a KV Store collection matching a Mongo-style query (JSON object)." + inputs_schema: + properties: + app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + kv_store_collection_name: { type: string, description: "Collection name" } + query: { type: object, description: "Mongo-style query object selecting entries to delete" } + required: [kv_store_collection_name, query] + outputs_schema: { properties: {} } + - id: kv_store_update_entry + name: splunk-kv-store-update-entry + description: "Update a single field of an existing KV Store entry by key, preserving the other fields." + inputs_schema: + properties: + app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" } + kv_store_collection_name: { type: string, description: "KV Store collection name" } + entry_key: { type: string, description: "The _key of the entry to update" } + field_name: { type: string, description: "Field to update" } + new_value: { type: string, description: "New value for the field" } + required: [kv_store_collection_name, entry_key, field_name, new_value] + outputs_schema: { properties: {} } + + # ── Connectivity ────────────────────────────────────────────────────────── + - id: test_connection + name: splunk-test-connection + description: "Verify connectivity and credentials against the Splunk REST API (used by the Test button)." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } diff --git a/integrations/splunk/mappers/search.yaml b/integrations/splunk/mappers/search.yaml new file mode 100644 index 0000000..37e99ae --- /dev/null +++ b/integrations/splunk/mappers/search.yaml @@ -0,0 +1,35 @@ +name: "Splunk Notable / CIM → OCSF" +description: "Maps a Splunk notable / CIM finding row (search results_path = results) to OCSF Finding fields. Built for ES notable events surfaced by the `notable` macro (rule_title/rule_name/urgency/security_domain) enriched with CIM Network/Authentication fields (src/dest/user/dvc). Severity is normalised to the OCSF 1-5 scale from the notable `urgency`." +field_mappings: + title: "rule_title ? rule_title : (source ? source : event_id)" + # urgency: informational/low -> low, up to critical=5 (OCSF 1-5 scale). + severity: "urgency = 'critical' ? 5 : (urgency = 'high' ? 4 : (urgency = 'medium' ? 3 : (urgency = 'low' ? 2 : 1)))" + description: "rule_description" +# results_path = results; source_path is JSONata over ONE result row. +# Fields absent from a given row are skipped at ingestion, so extra entries are safe. +ocsf: + # ── Finding ─────────────────────────────────────────────────────── + - { source_path: "event_id", ocsf_field: "finding_info.uid" } + - { source_path: "rule_title", ocsf_field: "finding_info.title" } + - { source_path: "rule_description", ocsf_field: "finding_info.desc" } + - { source_path: "`_time`", ocsf_field: "finding_info.created_time" } + - { source_path: "security_domain", ocsf_field: "finding_info.analytic.category" } + - { source_path: "status_label", ocsf_field: "status" } + # ── Rule (correlation search) / provenance ──────────────────────── + - { source_path: "rule_name", ocsf_field: "rule.name" } + - { source_path: "rule_description", ocsf_field: "rule.desc" } + - { source_path: "signature", ocsf_field: "metadata.event_code" } + - { source_path: "source", ocsf_field: "metadata.log_name" } + - { source_path: "sourcetype", ocsf_field: "metadata.log_source" } + # ── Source endpoint (CIM Network) ───────────────────────────────── + - { source_path: "src", ocsf_field: "src_endpoint.hostname" } + - { source_path: "src_ip", ocsf_field: "src_endpoint.ip" } + - { source_path: "src_port", ocsf_field: "src_endpoint.port" } + # ── Destination endpoint (CIM Network) ──────────────────────────── + - { source_path: "dest", ocsf_field: "dst_endpoint.hostname" } + - { source_path: "dest_ip", ocsf_field: "dst_endpoint.ip" } + - { source_path: "dest_port", ocsf_field: "dst_endpoint.port" } + # ── Affected device / users (CIM) ───────────────────────────────── + - { source_path: "dvc", ocsf_field: "device.hostname" } + - { source_path: "user", ocsf_field: "user.name" } + - { source_path: "src_user", ocsf_field: "actor.user.name" } diff --git a/integrations/splunk/scripts/delete_user.py b/integrations/splunk/scripts/delete_user.py new file mode 100644 index 0000000..924a859 --- /dev/null +++ b/integrations/splunk/scripts/delete_user.py @@ -0,0 +1,83 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + user = I["username"] + res = req("DELETE", "/services/authentication/users/" + qq(user), + params={"output_mode": "json"}) + out({"deleted": user, "result": res}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/get_indexes.py b/integrations/splunk/scripts/get_indexes.py new file mode 100644 index 0000000..0ec64fd --- /dev/null +++ b/integrations/splunk/scripts/get_indexes.py @@ -0,0 +1,86 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + res = req("GET", "/services/data/indexes", params={"output_mode": "json", "count": "-1"}) + indexes = [] + for e in res.get("entry", []): + c = e.get("content", {}) + indexes.append({"name": e.get("name"), "totalEventCount": c.get("totalEventCount"), + "currentDBSizeMB": c.get("currentDBSizeMB"), "disabled": c.get("disabled")}) + out({"indexes": indexes}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/get_users.py b/integrations/splunk/scripts/get_users.py new file mode 100644 index 0000000..5d59bc0 --- /dev/null +++ b/integrations/splunk/scripts/get_users.py @@ -0,0 +1,87 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + res = req("GET", "/services/authentication/users", params={"output_mode": "json", "count": "-1"}) + users = [] + for e in res.get("entry", []): + c = e.get("content", {}) + users.append({"name": e.get("name"), "realname": c.get("realname"), + "email": c.get("email"), "roles": c.get("roles"), + "type": c.get("type"), "locked-out": c.get("locked-out")}) + out({"users": users}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/job_create.py b/integrations/splunk/scripts/job_create.py new file mode 100644 index 0000000..0e71e6e --- /dev/null +++ b/integrations/splunk/scripts/job_create.py @@ -0,0 +1,90 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + q = (I.get("query") or "").strip() + if not (q.lower().startswith("search ") or q.startswith("|")): + q = "search " + q + data = {"search": q, "output_mode": "json"} + if I.get("earliest"): + data["earliest_time"] = I["earliest"] + if I.get("latest"): + data["latest_time"] = I["latest"] + path = "/servicesNS/nobody/" + qq(_app()) + "/search/jobs" + res = req("POST", path, data=data) + out({"sid": res.get("sid"), "result": res}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/job_results.py b/integrations/splunk/scripts/job_results.py new file mode 100644 index 0000000..00a2f65 --- /dev/null +++ b/integrations/splunk/scripts/job_results.py @@ -0,0 +1,84 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + sid = I["sid"] + params = {"output_mode": "json", "offset": int(I.get("offset") or 0), + "count": int(I.get("limit") or 100)} + res = req("GET", "/services/search/jobs/" + qq(sid) + "/results", params=params) + out({"results": res.get("results", [])}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/job_status.py b/integrations/splunk/scripts/job_status.py new file mode 100644 index 0000000..9a88b0f --- /dev/null +++ b/integrations/splunk/scripts/job_status.py @@ -0,0 +1,89 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + sid = I["sid"] + res = req("GET", "/services/search/jobs/" + qq(sid), params={"output_mode": "json"}) + content = {} + try: + content = res["entry"][0]["content"] + except Exception: + pass + out({"sid": sid, "dispatchState": content.get("dispatchState"), + "isDone": content.get("isDone"), "doneProgress": content.get("doneProgress"), + "resultCount": content.get("resultCount")}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/kv_store_collection_add_entries.py b/integrations/splunk/scripts/kv_store_collection_add_entries.py new file mode 100644 index 0000000..e352ecb --- /dev/null +++ b/integrations/splunk/scripts/kv_store_collection_add_entries.py @@ -0,0 +1,84 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + coll = I["kv_store_collection_name"] + entries = I.get("entries") or [] + base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll) + "/batch_save" + res = req("POST", base, params={"output_mode": "json"}, data=entries, ctype="json") + out({"keys": res}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/kv_store_collection_config.py b/integrations/splunk/scripts/kv_store_collection_config.py new file mode 100644 index 0000000..5c3db5b --- /dev/null +++ b/integrations/splunk/scripts/kv_store_collection_config.py @@ -0,0 +1,87 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + coll = I["kv_store_collection_name"] + fields = I.get("fields") or {} + data = {} + for k, v in fields.items(): + data["field." + k] = v + base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config/" + qq(coll) + res = req("POST", base, params={"output_mode": "json"}, data=data) + out({"configured": coll, "fields": fields, "result": res}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/kv_store_collection_create.py b/integrations/splunk/scripts/kv_store_collection_create.py new file mode 100644 index 0000000..baebc9d --- /dev/null +++ b/integrations/splunk/scripts/kv_store_collection_create.py @@ -0,0 +1,83 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + name = I["kv_store_name"] + base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config" + res = req("POST", base, params={"output_mode": "json"}, data={"name": name}) + out({"created": name, "result": res}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/kv_store_collection_data_delete.py b/integrations/splunk/scripts/kv_store_collection_data_delete.py new file mode 100644 index 0000000..cd76f33 --- /dev/null +++ b/integrations/splunk/scripts/kv_store_collection_data_delete.py @@ -0,0 +1,83 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + coll = I["kv_store_collection_name"] + base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll) + req("DELETE", base, params={"output_mode": "json"}) + out({"deleted_all": coll}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/kv_store_collection_data_list.py b/integrations/splunk/scripts/kv_store_collection_data_list.py new file mode 100644 index 0000000..14ad8b4 --- /dev/null +++ b/integrations/splunk/scripts/kv_store_collection_data_list.py @@ -0,0 +1,87 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + coll = I["kv_store_collection_name"] + params = {"output_mode": "json"} + lim = int(I.get("limit") or 0) + if lim: + params["limit"] = lim + base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll) + res = req("GET", base, params=params) + out({"data": res}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/kv_store_collection_delete.py b/integrations/splunk/scripts/kv_store_collection_delete.py new file mode 100644 index 0000000..c973da9 --- /dev/null +++ b/integrations/splunk/scripts/kv_store_collection_delete.py @@ -0,0 +1,83 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + coll = I["kv_store_collection_name"] + base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config/" + qq(coll) + req("DELETE", base, params={"output_mode": "json"}) + out({"deleted": coll}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/kv_store_collection_delete_entry.py b/integrations/splunk/scripts/kv_store_collection_delete_entry.py new file mode 100644 index 0000000..95297ed --- /dev/null +++ b/integrations/splunk/scripts/kv_store_collection_delete_entry.py @@ -0,0 +1,87 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + coll = I["kv_store_collection_name"] + query = I.get("query") or {} + if isinstance(query, str): + query = json.loads(query) + params = {"output_mode": "json", "query": json.dumps(query)} + base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll) + req("DELETE", base, params=params) + out({"deleted": coll, "query": query}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/kv_store_collection_search_entry.py b/integrations/splunk/scripts/kv_store_collection_search_entry.py new file mode 100644 index 0000000..8c92a46 --- /dev/null +++ b/integrations/splunk/scripts/kv_store_collection_search_entry.py @@ -0,0 +1,87 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + coll = I["kv_store_collection_name"] + query = I.get("query") or {} + if isinstance(query, str): + query = json.loads(query) + params = {"output_mode": "json", "query": json.dumps(query)} + base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll) + res = req("GET", base, params=params) + out({"data": res}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/kv_store_collections_list.py b/integrations/splunk/scripts/kv_store_collections_list.py new file mode 100644 index 0000000..ce04773 --- /dev/null +++ b/integrations/splunk/scripts/kv_store_collections_list.py @@ -0,0 +1,82 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config" + res = req("GET", base, params={"output_mode": "json", "count": "-1"}) + out({"collections": [e.get("name") for e in res.get("entry", [])]}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/kv_store_update_entry.py b/integrations/splunk/scripts/kv_store_update_entry.py new file mode 100644 index 0000000..a6ab029 --- /dev/null +++ b/integrations/splunk/scripts/kv_store_update_entry.py @@ -0,0 +1,89 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + coll = I["kv_store_collection_name"] + key = I["entry_key"] + field_name = I["field_name"] + new_value = I["new_value"] + base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll) + "/" + qq(key) + current = req("GET", base, params={"output_mode": "json"}) + if isinstance(current, dict): + current[field_name] = new_value + res = req("POST", base, params={"output_mode": "json"}, data=current, ctype="json") + out({"updated": key, "result": res}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/search.py b/integrations/splunk/scripts/search.py new file mode 100644 index 0000000..4366a6d --- /dev/null +++ b/integrations/splunk/scripts/search.py @@ -0,0 +1,91 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + q = (I.get("query") or "").strip() + if not (q.lower().startswith("search ") or q.startswith("|")): + q = "search " + q + data = {"search": q, "exec_mode": "oneshot", "output_mode": "json", + "count": int(I.get("limit") or 100)} + if I.get("earliest"): + data["earliest_time"] = I["earliest"] + if I.get("latest"): + data["latest_time"] = I["latest"] + path = "/servicesNS/nobody/" + qq(_app()) + "/search/jobs" + res = req("POST", path, data=data) + out({"results": res.get("results", [])}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/submit_event.py b/integrations/splunk/scripts/submit_event.py new file mode 100644 index 0000000..11083e6 --- /dev/null +++ b/integrations/splunk/scripts/submit_event.py @@ -0,0 +1,86 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + params = {"index": I["index"], "output_mode": "json"} + for k in ("sourcetype", "source", "host"): + if I.get(k): + params[k] = I[k] + res = req("POST", "/services/receivers/simple", params=params, + data=(I.get("event") or ""), ctype="text/plain") + out({"submitted": True, "result": res}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/submit_event_hec.py b/integrations/splunk/scripts/submit_event_hec.py new file mode 100644 index 0000000..7d2ec5f --- /dev/null +++ b/integrations/splunk/scripts/submit_event_hec.py @@ -0,0 +1,99 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + + +def run(): + hec_url = (S.get("hec_url") or "").rstrip("/") + hec_token = S.get("hec_token") or "" + if not hec_url or not hec_token: + out({"error": "hec_url and hec_token must be configured on the instance"}) + return + ev = I.get("event") + if isinstance(ev, str): + try: + ev = json.loads(ev) + except ValueError: + pass + payload = {"event": ev} + for k in ("index", "sourcetype", "source", "host"): + if I.get(k): + payload[k] = I[k] + if I.get("fields"): + payload["fields"] = I["fields"] + res = req("POST", "/services/collector/event", base=hec_url, + auth="Splunk " + hec_token, data=payload, ctype="json") + out(res) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) diff --git a/integrations/splunk/scripts/test_connection.py b/integrations/splunk/scripts/test_connection.py new file mode 100644 index 0000000..bb54542 --- /dev/null +++ b/integrations/splunk/scripts/test_connection.py @@ -0,0 +1,85 @@ +import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error + +S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) +I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def qq(v): + return urllib.parse.quote(str(v), safe="") + + +def _base(): + host = (S.get("host") or "").strip() + if "://" in host: + host = host.split("://", 1)[1] + host = host.strip("/") + if ":" not in host: + host = host + ":" + str(S.get("port") or "8089").strip() + return "https://" + host + + +def _auth(): + if str(S.get("auth_type") or "token").lower() == "basic": + raw = (S.get("username") or "") + ":" + (S.get("password") or "") + return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii") + return "Bearer " + (S.get("password") or "") + + +def _ctx(): + v = S.get("verify") + if isinstance(v, str): + v = v.lower() in ("1", "true", "yes") + return ssl.create_default_context() if v else ssl._create_unverified_context() + + +def _app(default="search"): + return I.get("app") or I.get("app_name") or S.get("app") or default + + +def req(method, path, params=None, data=None, base=None, auth=None, ctype=None): + url = (base or _base()) + path + if params: + url += "?" + urllib.parse.urlencode(params, doseq=True) + headers = {"Authorization": auth or _auth(), "Accept": "application/json"} + body = None + if data is not None: + if ctype == "json": + body = json.dumps(data).encode("utf-8") + headers["Content-Type"] = "application/json" + elif isinstance(data, dict): + body = urllib.parse.urlencode(data, doseq=True).encode("utf-8") + headers["Content-Type"] = "application/x-www-form-urlencoded" + else: + body = data.encode("utf-8") if isinstance(data, str) else data + headers["Content-Type"] = ctype or "text/plain" + request = urllib.request.Request(url, data=body, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp: + raw = resp.read() + try: + return json.loads(raw) if raw else {} + except ValueError: + return {"raw": raw.decode("utf-8", "replace")} + + +def out(value): + print(json.dumps(value)) + + +def run(): + info = req("GET", "/services/server/info", params={"output_mode": "json"}) + version = "" + try: + version = info["entry"][0]["content"].get("version", "") + except Exception: + pass + out({"ok": True, "version": version}) + + +try: + run() +except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) +except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1)