Guillaume BOURGEOIS
fb82de7f93
Umbrella Enforcement API, 4 commands: add domain (DNS-layer block), list enforced domains, delete domain. Customer-key auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
70 lines
2.1 KiB
Python
70 lines
2.1 KiB
Python
import json, os, sys, urllib.parse, urllib.request, urllib.error
|
|
import datetime
|
|
|
|
|
|
def _cfg():
|
|
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
|
|
|
|
|
def _inputs():
|
|
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
|
|
|
|
|
def _base(cfg):
|
|
return (str(cfg.get("api_url") or "https://s-platform.api.opendns.com")).rstrip("/")
|
|
|
|
|
|
def request(method, path, cfg, body=None, params=None):
|
|
p = {"customerKey": str(cfg.get("api_key", ""))}
|
|
if params:
|
|
p.update(params)
|
|
url = _base(cfg) + path + "?" + urllib.parse.urlencode(p)
|
|
data = json.dumps(body).encode("utf-8") if body is not None else None
|
|
headers = {"Accept": "application/json"}
|
|
if data is not None:
|
|
headers["Content-Type"] = "application/json"
|
|
req = urllib.request.Request(url, data=data, headers=headers, method=method)
|
|
with urllib.request.urlopen(req, timeout=60) as r:
|
|
raw = r.read()
|
|
return json.loads(raw) if raw else {}
|
|
|
|
|
|
def _run(fn):
|
|
try:
|
|
print(json.dumps(fn(_cfg(), _inputs())))
|
|
except urllib.error.HTTPError as e:
|
|
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
|
sys.exit(1)
|
|
except Exception as e:
|
|
print(json.dumps({"error": str(e)}))
|
|
sys.exit(1)
|
|
|
|
|
|
def main(cfg, inputs):
|
|
domain = str(inputs.get("domain") or "").strip()
|
|
if not domain:
|
|
raise Exception("domain is required")
|
|
|
|
url = str(inputs.get("url") or ("http://" + domain + "/"))
|
|
device_id = str(inputs.get("device_id") or "ba6a59f4-e692-4724-ba36-c28132c761de")
|
|
device_version = str(inputs.get("device_version") or "1.0")
|
|
provider_name = str(inputs.get("provider_name") or "Riposte SOAR")
|
|
|
|
ts = datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%S.0Z")
|
|
|
|
body = {
|
|
"alertTime": ts,
|
|
"deviceId": device_id,
|
|
"deviceVersion": device_version,
|
|
"dstDomain": domain,
|
|
"dstUrl": url,
|
|
"eventTime": ts,
|
|
"protocolVersion": "1.0a",
|
|
"providerName": provider_name,
|
|
}
|
|
|
|
return request("POST", "/1.0/events", cfg, body=body)
|
|
|
|
|
|
_run(main)
|