59 lines
2.5 KiB
Python
59 lines
2.5 KiB
Python
import io, json, os, sys, urllib.request, urllib.parse, urllib.error
|
|
|
|
|
|
def _cfg():
|
|
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
|
region = str(s.get("region") or "us").strip().lower()
|
|
base = "https://" + region + ".api.insight.rapid7.com/"
|
|
headers = {"X-Api-Key": s.get("api_key", ""), "Content-Type": "application/json", "Accept": "application/json"}
|
|
multi = str(s.get("is_multi_customer") or "").strip().lower() in ("1", "true", "yes")
|
|
is_v2 = str(s.get("is_v2") or "true").strip().lower() in ("1", "true", "yes")
|
|
return base, headers, multi, is_v2
|
|
|
|
|
|
def request(method, path, params=None, body=None):
|
|
base, headers, _, _ = _cfg()
|
|
url = base + path.lstrip("/")
|
|
if params:
|
|
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
|
if clean:
|
|
url += ("&" if "?" in url else "?") + urllib.parse.urlencode(clean, doseq=True)
|
|
data = json.dumps(body).encode("utf-8") if body is not None else None
|
|
req = urllib.request.Request(url, data=data, headers=headers, method=method)
|
|
with urllib.request.urlopen(req, timeout=60) as r:
|
|
raw = r.read()
|
|
return json.loads(raw) if raw else {}
|
|
|
|
|
|
def run():
|
|
try:
|
|
request("GET", "idr/v1/investigations", params={"size": 1})
|
|
except urllib.error.HTTPError as e:
|
|
detail = e.read().decode("utf-8", "replace")
|
|
if e.code != 403 or "Essential" not in detail:
|
|
raise urllib.error.HTTPError(e.url, e.code, e.msg, e.hdrs, io.BytesIO(detail.encode("utf-8")))
|
|
# The Essential package has no Investigations or Alert Triage API, but
|
|
# Log Search answers: the key is good and LEQL feeds are the way in.
|
|
request("GET", "log_search/management/logsets")
|
|
print(json.dumps({"ok": True, "package": "essential",
|
|
"note": "InsightIDR Essential: investigation and alert commands are not available. "
|
|
"Ingest detections with query_log_set, using each detection rule's LEQL query."}))
|
|
return
|
|
print(json.dumps({"ok": True}))
|
|
|
|
|
|
try:
|
|
run()
|
|
except urllib.error.HTTPError as e:
|
|
detail = e.read().decode("utf-8", "replace")
|
|
if e.code == 401:
|
|
print(json.dumps({"ok": False, "error": "API key is not valid."}))
|
|
elif e.code == 500:
|
|
print(json.dumps({"ok": False, "error": "Wrong account region."}))
|
|
else:
|
|
print(json.dumps({"ok": False, "error": "HTTP " + str(e.code), "detail": detail}))
|
|
sys.exit(1)
|
|
except Exception as e:
|
|
print(json.dumps({"ok": False, "error": str(e)}))
|
|
sys.exit(1)
|