import json, os, sys, urllib.request, urllib.parse, urllib.error def _cfg(): s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/") headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"} return base, headers def _inputs(): return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) def request(path, params): base, headers = _cfg() clean = {k: v for k, v in params.items() if v not in (None, "")} url = base + "/" + path.lstrip("/") + ("?" + urllib.parse.urlencode(clean, doseq=True) if clean else "") req = urllib.request.Request(url, headers=headers, method="GET") with urllib.request.urlopen(req, timeout=90) as r: raw = r.read() return json.loads(raw) if raw else {} def run(): inp = _inputs() params = { "limit": inp.get("limit") or 50, "orderby": "triggered", "direction": inp.get("direction") or "desc", "status": inp.get("status"), "alertRule": inp.get("alert_rule"), "freetext": inp.get("freetext"), } trig = inp.get("triggered") if trig: t = str(trig) # A bare timestamp/relative value becomes the lower bound of a range. params["triggered"] = t if ("[" in t or "," in t) else ("[" + t + ",]") print(json.dumps(request("/v2/alert/search", params))) try: run() except urllib.error.HTTPError as e: print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) sys.exit(1) except Exception as e: print(json.dumps({"error": str(e)})) sys.exit(1)