cyberhaven-incidents 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1852bcc7cbcbb90acce8ad0a6958b9987b5dc77c81def0f2a3acf9704f5b759
-  data.tar.gz: 3fc25b31c33f5acd2cfc9977779fadf5df4ccb213680ea971ebfda52edf05602
+  metadata.gz: 117a00860ffb6bcb9995a8cd5873f19fc79e59a4ce145c1dccf388f37d4148ab
+  data.tar.gz: 0ba9dcedfa1bd2b20eeb23c46ff1c6951ebd06b0c9796ee54ccc531bfe405ded
 SHA512:
-  metadata.gz: e44d80eaab68028327e398fa3d88ce749d94c9a83876fbb34f6120f9e1f84f6ed8d58e483e17333272beb2f00e495bb315ab49eda46b3b882f0d9fe3f9389004
-  data.tar.gz: 90c4298aadf9d12d5e81eb35d611c6b0e6a8cef73d260f046664d1e1ddbc72f52241771ccb3ac6b545aaf12679848620b55ac42c8764f1198b80953494066da5
+  metadata.gz: 14708bcbd39f466f0d5de88bb13a29163abec446df9b69de2b585a9d60d07b62e8596db33966ac8919c0eb3b9354aa54d09fb65d7b45ec5ee9558984c016cad0
+  data.tar.gz: 684d1cef9121a450e57fdfc9e9f3bdb09101145d0a79cb768be38e4ac30ec6fd5f3ad4d77f8db6b3112550de90517617e88b494b0500c5eaffbd72d944d004ad

data/CHANGELOG.md

@@ -1,4 +1,8 @@
 
+## 0.4.1
+Add: add user civ
+Fixed: pagination on user events
+
 ## 0.4.0
 Add: add user incidenetss for status and number of events
 

data/README.md

@@ -39,14 +39,14 @@ Cyberhaven::Incidents::totalInProgressIncidents
 Cyberhaven::Incidents::totalResolvedIncidents
 
 ## Detailed Incident details by ID
-Cyberhaven::Incidents::Id::DetailedJson("#{incidentID}")
-Cyberhaven::Incidents::Id::DetailedYaml("#{incidentID}")
-Cyberhaven::Incidents::Id::DetailedReport("#{incidentID}")
+Cyberhaven::Incidents::Id::DetailedJson("incidentID")
+Cyberhaven::Incidents::Id::DetailedYaml("incidentID")
+Cyberhaven::Incidents::Id::DetailedReport("incidentID")
 
 ## Summaried Incidents details by ID
-Cyberhaven::Incidents::Id::SummaryJson("#{incidentID}")
-Cyberhaven::Incidents::Id::SummaryYaml("#{incidentID}")
-Cyberhaven::Incidents::Id::SummaryReport("#{incidentID}")
+Cyberhaven::Incidents::Id::SummaryJson("incidentID")
+Cyberhaven::Incidents::Id::SummaryYaml("incidentID")
+Cyberhaven::Incidents::Id::SummaryReport("incidentID")
 
 ## Incident details by user
 puts Cyberhaven::Incidents::User::DetailedRaw("username", "status", numberOfEvents)

data/lib/cyberhaven/incidents/user.rb

@@ -1,11 +1,15 @@
 # frozen_string_literal: true
 
 
+require 'etc'
+require 'csv'
+require "set"
+
+
 module Cyberhaven
   module Incidents
     module User
-        ## DETAILED VERBOSE ----------------------------------------------------
-        def self.DetailedRaw(username, status, numberOfEvents)
+        def self.TotalIncidents(username)
             
             $pageToken = "1"
             loop do
@@ -17,15 +21,15 @@ module Cyberhaven
 
                     $query ={
                         "filters":{
-                            "resolution_statuses": [
-                                "#{status}"
-                            ],
+                            # "resolution_statuses": [
+                            #     "#{status}"
+                            # ],
                             "users": [
                                 "#{username}"
                             ],
                         },
                         "sort_by": "event_time",
-                        "page_size": numberOfEvents,
+                        "page_id": "#{$pageToken}",
                         "sort_desc": true
                     }.to_json
             
@@ -40,317 +44,214 @@ module Cyberhaven
                     status = response.code
                     results = JSON.parse(response.read_body)
 
-                    pageToken = results["next_page_id"]
-                    $data = results["incidents"]
-                    return $data
+                    puts results["total"]
                 else
                     break
                 end
             end
         end
-
-        def self.DetailedJson(username, status, numberOfEvents)
-            DetailedRaw("#{username}", "#{status}", numberOfEvents)
-            return $data.to_json
-        end
-
-        # def self.DetailedYaml(incidentID)
-        #     DetailedRaw("#{incidentID}")
-        #     puts $data.to_yaml
-        # end
-
-        # def self.DetailedReport(incidentID)
-        #     $query ={
-        #         "filters":{
-        #             "incident_ids": [
-        #                 "#{incidentID}"
-        #             ],
-        #         },
-        #         "sort_by": "event_time",
-        #         "page_size": 1,
-        #         "sort_desc": true
-        #     }.to_json
         
-        #     url = URI("https://#{$deployment}/api/rest/v1/incidents/list")
-        #     https = Net::HTTP.new(url.host, url.port)
-        #     https.use_ssl = true
-        #     request = Net::HTTP::Get.new(url)
-        #     request["Content-Type"] = "application/json"
-        #     request["Authorization"] = "Bearer #{$bearerToken}"
-        #     request.body = $query
-        #     response = https.request(request)
-        #     status = response.code
-        #     results = JSON.parse(response.read_body)
+        def self.AllIncidentsResults(username)
+
+            $incidentArray = []
             
-        #     results["incidents"].each do |item|
-        #         puts "INCIDENT ID: #{item["id"]}"
-        #         puts "  EVENT TIME: #{item["event_time"]}"
-        #         puts "  TRIGGER TIME: #{item["trigger_time"]}"
-        #         puts "  POLICY NAME: #{item["category"]["name"]}"
-        #         puts "  POLICY SEVERITY: #{item["category"]["severity"]}"
-        #         puts "  USER: #{item["user"]}"
-        #         puts "  STATUS: #{item["resolution_status"]}"
-        #         puts "  OUTDATED POLICY: #{item["outdated_policy"]}"
-        #         puts "  FILE: #{item["file"]}"
-        #         puts "  FILE PATH: #{item["data"]["path"]}"
-        #         puts "  SOURCE DATA: #{item["source_data"]["path"]}"
-        #         puts "  PERSONAL INFO:"
-        #         if ! item["personal_info"].nil?
-        #             item["personal_info"].each do |personalItem|
-        #                 puts "    #{personalItem}"
-        #             end
-        #         end
-        #         puts "  ASSIGNEE: #{item["assignee"]}"
-        #         puts "  CONTENT TAGS: #{item["content_tags"]}"
-        #         puts "  RESPONSE: #{item["incident_response"]}"
-        #         puts "  REACTION: #{item["incident_reactions"]}"
-        #         puts "  ADMIN HISTORY: #{item["admin_history"]}"
-        #         puts "  CATEGOERY MODIFIED: #{item["category_last_modified"]}"
-        #         puts "  DATASET MODIFIED: #{item["dataset_last_modified"]}"
-        #         puts "  ALERT ID: #{item["alert_id"]}"
-        #         puts "  SCREENSHOT GUID: #{item["screenshot_guid"]}"
-        #         puts ""
+            $pageToken = "1"
+            loop do
+                unless $pageToken.empty?
         
-        #         puts "  DATASET:"
-        #         puts "    ID: #{item["dataset"]["id"]}"
-        #         puts "    NAME: #{item["dataset"]["name"]}"
-        #         puts "    SENSITIVITY: #{item["dataset"]["sensitivity"]}"
-        #         puts "    LAST MODIFIED: #{item["dataset"]["last_modified"]}"
-        #         puts ""
+                    if $pageToken == "1"
+                        $pageToken = ""
+                    end
 
-        #         puts "  POLICY:"
-        #         puts "    ID: #{item["category"]["id"]}"
-        #         puts "    NAME: #{item["category"]["name"]}"
-        #         puts "    SEVERITY: #{item["category"]["severity"]}"
-        #         puts "    DATASET IDS: #{item["category"]["dataset_ids"]}"
-        #         puts "    EXCLUDE ORIGIN: #{item["category"]["exclude_origin"]}"
-        #         puts "    LAST MODIFIED: #{item["category"]["last_modified"]}"
-        #         puts "    SELECTION TYPE: #{item["category"]["selection_type"]}"
-        #         puts "    RULE:"
-        #         puts "      ID: #{item["category"]["rule"]["id"]}"
-        #         puts "      STATUS: #{item["category"]["rule"]["status"]}"
-        #         puts "      CREATE INCIDENT: #{item["category"]["rule"]["create_incident"]}"
-        #         puts "      RECORD SCREENSHOT: #{item["category"]["rule"]["record_screenshots"]}"
-        #         puts "      NOTIFY ENABLED: #{item["category"]["rule"]["notify_enabled"]}"
-        #         puts "      NOTIFY STATUS: #{item["category"]["rule"]["notify_status"]}"
-        #         puts "      NOTIFY EMAIL: #{item["category"]["rule"]["notify_email"]}"
-        #         puts "      SHOW TITLE: #{item["category"]["rule"]["show_title"]}"
-        #         puts "      SHOW LOGO: #{item["category"]["rule"]["show_logo"]}"
-        #         puts "      REQUIRE JUSTIFICATION: #{item["category"]["rule"]["require_justification"]}"
-        #         puts "      REQUIRE ACKNOWLEDGEMENT: #{item["category"]["rule"]["should_ack_warning"]}"
-        #         puts "      ALLOW REVIEW: #{item["category"]["rule"]["allow_request_review"]}"
-        #         puts "      OVERRIDE ENABLED: #{item["category"]["rule"]["override_enabled"]}"
-        #         puts "      BLOCKING ACTION: #{item["category"]["rule"]["blocking_action"]}"
-        #         puts "      INCIDENT ACTION: #{item["category"]["rule"]["incident_action"]}"
-        #         puts "      WARNING MESSAGE:"
-        #         puts "        TITLE: #{item["category"]["rule"]["warning_dialog"]["title"]}"
-        #         puts "        EXPLANATION: #{item["category"]["rule"]["warning_dialog"]["explanation"]}"
-        #         puts "        PLACEHOLDER: #{item["category"]["rule"]["warning_dialog"]["placeholder"]}"
-        #         puts "        CHECK TEXT: #{item["category"]["rule"]["warning_dialog"]["check_text"]}"
-        #         puts "        REVIEW CHECK TEXT: #{item["category"]["rule"]["warning_dialog"]["review_check_text"]}"
-        #         puts "        SUBMIT LABEL: #{item["category"]["rule"]["warning_dialog"]["submit_label"]}"
-        #         puts "        ALLOW LABEL: #{item["category"]["rule"]["warning_dialog"]["allow_label"]}"
-        #         puts "      BLOCKING MESSAGE:"
-        #         puts "        TITLE: #{item["category"]["rule"]["blocking_dialog"]["title"]}"
-        #         puts "        EXPLANATION: #{item["category"]["rule"]["blocking_dialog"]["explanation"]}"
-        #         puts "        PLACEHOLDER: #{item["category"]["rule"]["blocking_dialog"]["placeholder"]}"
-        #         puts "        CHECK TEXT: #{item["category"]["rule"]["blocking_dialog"]["check_text"]}"
-        #         puts "        REVIEW CHECK TEXT: #{item["category"]["rule"]["blocking_dialog"]["review_check_text"]}"
-        #         puts "        SUBMIT LABEL: #{item["category"]["rule"]["blocking_dialog"]["submit_label"]}"
-        #         puts "        ALLOW LABEL: #{item["category"]["rule"]["blocking_dialog"]["allow_label"]}"
-        #         puts ""
-                
-        #         puts "  SOURCE INFORMATION:"
-        #         puts "    PATH: #{item["edge"]["source"]["path"]}"
-        #         puts "    EXTENSION: #{item["edge"]["source"]["extension"]}"
-        #         puts "    URL: #{item["edge"]["source"]["url"]}"
-        #         puts "    BROWSER URL: #{item["edge"]["source"]["browser_page_url"]}"
-        #         puts "    BROWSER DOMAIN: #{item["edge"]["source"]["browser_page_domain"]}"
-        #         puts "    BROWSER TITLE: #{item["edge"]["source"]["browser_page_title"]}"
-        #         puts "    HOSTNAME: #{item["edge"]["source"]["hostname"]}"
-        #         puts "    URI: #{item["edge"]["source"]["content_uri"]}"
-        #         puts "    LOCATION: #{item["edge"]["source"]["location"]}"
-        #         puts "    LOCATION OUTLINE: #{item["edge"]["source"]["location_outline"]}"
-        #         puts "    CATEGORY: #{item["edge"]["source"]["category"]}"
-        #         puts "    LINKS: #{item["edge"]["source"]["links"]}"
-        #         puts "    ID: #{item["edge"]["source"]["raw_id"]}"
-        #         puts "    TAGS: #{item["edge"]["source"]["tags_applied"]}"
-        #         puts "    UPLOAD URI: #{item["edge"]["source"]["content_upload_uri"]}"
-        #         puts "    REPORT URI: #{item["edge"]["source"]["content_report_uri"]}"
-        #         puts "    TAGS: #{item["edge"]["source"]["tags_applied"]}"
-        #         puts "    EVENT TYPE: #{item["edge"]["source"]["event_type"]}"
-        #         puts "    SENSOR: #{item["edge"]["source"]["sensor_name"]}"
-        #         puts "    USERNAME: #{item["edge"]["source"]["local_user_name"]}"
-        #         puts "    USER ID: #{item["edge"]["source"]["local_user_sid"]}"
-        #         puts "    LOCAL TIME: #{item["edge"]["source"]["local_time"]}"
-        #         puts "    MACHINE NAME: #{item["edge"]["source"]["local_machine_name"]}"
-        #         puts "    ENDPIONT ID: #{item["edge"]["source"]["endpoint_id"]}"
-        #         puts "    GROUP NAME: #{item["edge"]["source"]["group_name"]}"
-        #         puts "    LOCAL ID: #{item["edge"]["source"]["local_id"]}"
-        #         puts "    BLOCKED: #{item["edge"]["source"]["blocked"]}"
-        #         puts "    DATA SIZE: #{item["edge"]["source"]["data_size"]}"
-        #         puts ""
+                    $query ={
+                        "filters":{
+                            "resolution_statuses":[
+                                "unresolved", "ignored", "in_progress", "resolved"
+                            ],
+                            "users": [
+                                "#{username}"
+                            ],
+                        },
+                        "sort_by": "event_time",
+                        "page_id": "#{$pageToken}",
+                        "page_size": 1000,
+                        "sort_desc": true
+                    }.to_json
+            
+                    url = URI("https://#{$deployment}/api/rest/v1/incidents/list")
+                    https = Net::HTTP.new(url.host, url.port)
+                    https.use_ssl = true
+                    request = Net::HTTP::Get.new(url)
+                    request["Content-Type"] = "application/json"
+                    request["Authorization"] = "Bearer #{$bearerToken}"
+                    request.body = $query
+                    response = https.request(request)
+                    status = response.code
+                    results = JSON.parse(response.read_body)
+
+                    $pageToken = results["next_page_id"]
+                    results["incidents"].each do |item|
+                        $incidentArray.push(item)
+                    end
+                else
+                    break
+                end
+            end
+        end
 
-        #         puts "  DESTINATION INFORMATION:"
-        #         puts "    PATH: #{item["edge"]["destination"]["path"]}"
-        #         puts "    EXTENSION: #{item["edge"]["destination"]["extension"]}"
-        #         puts "    UPLOAD FILE ID: #{item["edge"]["destination"]["upload_file_id"]}"
-        #         puts "    URL: #{item["edge"]["destination"]["url"]}"
-        #         puts "    BROWSER TITLE: #{item["edge"]["destination"]["browser_page_title"]}"
-        #         puts "    HOSTNAME: #{item["edge"]["destination"]["hostname"]}"
-        #         puts "    MD5: #{item["edge"]["destination"]["md5_hash"]}"
-        #         puts "    FILE SIZE: #{item["edge"]["destination"]["file_size"]}"
-        #         puts "    PATH COMPONENTS: #{item["edge"]["destination"]["path_components"]}"
-        #         puts "    BASENAME: #{item["edge"]["destination"]["path_basename"]}"
-        #         puts "    DOMAIN COMPONENTS: #{item["edge"]["destination"]["domain_components"]}"
-        #         puts "    DOMAIN: #{item["edge"]["destination"]["domain"]}"
-        #         puts "    URI: #{item["edge"]["destination"]["content_uri"]}"
-        #         puts "    LOCATION: #{item["edge"]["destination"]["location"]}"
-        #         puts "    LOCATION OUTLINE: #{item["edge"]["destination"]["location_outline"]}"
-        #         puts "    CATEGORY: #{item["edge"]["destination"]["category"]}"
-        #         puts "    LINKS: #{item["edge"]["destination"]["links"]}"
-        #         puts "    RAW ID: #{item["edge"]["destination"]["raw_id"]}"
-        #         puts "    TAGS: #{item["edge"]["destination"]["tags_applied"]}"
-        #         puts "    CONTENT UPLOAD URI: #{item["edge"]["destination"]["content_upload_uri"]}"
-        #         puts "    CONTENT REPORT URI: #{item["edge"]["destination"]["content_report_uri"]}"
-        #         puts "    EVENT TYPE: #{item["edge"]["destination"]["event_type"]}"
-        #         puts "    SENSOR: #{item["edge"]["destination"]["sensor_name"]}"
-        #         puts "    LOCAL USERNAME: #{item["edge"]["destination"]["local_user_name"]}"
-        #         puts "    LOCAL USERID: #{item["edge"]["destination"]["local_user_sid"]}"
-        #         puts "    LOCAL TIME: #{item["edge"]["destination"]["local_time"]}"
-        #         puts "    LOCAL MACHINE NAME: #{item["edge"]["destination"]["local_machine_name"]}"
-        #         puts "    ENDPOINT ID: #{item["edge"]["destination"]["endpoint_id"]}"
-        #         puts "    GROUP NAMES: #{item["edge"]["destination"]["group_name"]}"
-        #         puts "    BLOCKED: #{item["edge"]["destination"]["blocked"]}"
-        #         puts "    DATA SIZE: #{item["edge"]["destination"]["data_size"]}"
-        #         puts "    LOCAL ID: #{item["edge"]["destination"]["local_id"]}"
-        #         puts "    GDRIVE FILE ID: #{item["edge"]["destination"]["gdrive_file_id"]}"
-        #         puts "    CLOUD PROVIDER: #{item["edge"]["destination"]["cloud_provider"]}"
-        #         puts "    CLOUD APP: #{item["edge"]["destination"]["cloud_app"]}"
-        #         puts "    CLOUD ACCOUNT: #{item["edge"]["destination"]["cloud_app_account"]}"
-        #         puts "    DLP SCAN ID: #{item["edge"]["destination"]["  dlp_scan_linking_id"]}"
-        #         puts ""
-        #     end
-        # end
+        def self.AllIncidents(username)
+            AllIncidentsResults("#{username}")
+            return $incidentArray
+        end
 
+        def self.AllIncidentsCSV(username)
+            now_date = DateTime.now
+            datetime = now_date.strftime('%Y%m%d')
+            $currentUser = ENV['USER']
+            $reportPath="/Users/#{$currentUser}/Desktop/#{datetime}_#{username}_report.csv"
     
-        # ## SUMMARIES -----------------------------------------------------------
-        # def self.SummaryRaw(incidentID)
-        #     $query ={
-        #         "filters":{
-        #             "incident_ids": [
-        #                 "#{incidentID}"
-        #             ],
-        #         },
-        #         "sort_by": "event_time",
-        #         "page_size": 1,
-        #         "sort_desc": true
-        #     }.to_json
+            $pageToken = "1"
+            $incidentArray = []
+          
+            loop do
+                unless $pageToken.empty?
         
-        #     url = URI("https://#{$deployment}/api/rest/v1/incidents/list")
-        #     https = Net::HTTP.new(url.host, url.port)
-        #     https.use_ssl = true
-        #     request = Net::HTTP::Get.new(url)
-        #     request["Content-Type"] = "application/json"
-        #     request["Authorization"] = "Bearer #{$bearerToken}"
-        #     request.body = $query
-        #     response = https.request(request)
-        #     status = response.code
-        #     results = JSON.parse(response.read_body)
-            
-        #     results["incidents"].each do |item|
-        #     $data = {
-        #         values: { 
-        #         "incident_id": " #{item["id"]}".to_s,
-        #         "event_time": " #{item["event_time"]}".to_s,
-        #         "policy_name": "#{item["category"]["name"]}".to_s,
-        #         "policy_severity": " #{item["category"]["severity"]}".to_s,
-        #         "user": "#{item["user"]}".to_s,
-        #         "status": "#{item["resolution_status"]}".to_s,
-        #         "dataset": "#{item["dataset"]["name"]}".to_s,
-        #         "dataset_sensitivity": "#{item["dataset"]["sensitivity"]}".to_i,
-        #         "ploiicy_severity": "#{item["category"]["severity"]}".to_i,
-        #         "create_incident": " #{item["category"]["rule"]["create_incident"]}".to_s,
-        #         "incident_action": "#{item["category"]["rule"]["incident_action"]}".to_s,
-        #         "src_url": "#{item["edge"]["source"]["url"]}".to_s,
-        #         "src_browser_url": "#{item["edge"]["source"]["browser_page_url"]}".to_s,
-        #         "src_browser_domain": " #{item["edge"]["source"]["browser_page_domain"]}".to_s,
-        #         "src_browser_title": "#{item["edge"]["source"]["browser_page_title"]}".to_s,
-        #         "src_location": "#{item["edge"]["destination"]["location"]}".to_s,
-        #         "src_location_outline": "#{item["edge"]["source"]["location_outline"]}".to_s,
-        #         "src_category": "#{item["edge"]["source"]["category"]}".to_s,
-        #         "dst_browser_title": "#{item["edge"]["destination"]["browser_page_title"]}".to_s,
-        #         "dst_basename": "#{item["edge"]["destination"]["path_basename"]}".to_s,
-        #         "dst_domain": "#{item["edge"]["destination"]["domain"]}".to_s,
-        #         "dest_location": "#{item["edge"]["destination"]["location"]}".to_s,
-        #         "dst_location_outline": "#{item["edge"]["destination"]["location_outline"]}".to_s,
-        #         "dst_category": "#{item["edge"]["destination"]["category"]}".to_s,
-        #         "dst_event_type": "#{item["edge"]["destination"]["event_type"]}".to_s,
-        #         "dst_sensor": "#{item["edge"]["destination"]["sensor_name"]}".to_s,
-        #         "dst_local_username": "#{item["edge"]["destination"]["local_user_name"]}".to_s,
-        #         "dst_local_machine_name": "#{item["edge"]["destination"]["local_machine_name"]}".to_s,
-        #         "dst_blocked": "#{item["edge"]["destination"]["blocked"]}".to_s,
-        #         "dst_data_size": "#{item["edge"]["destination"]["data_size"]}".to_s,
-        #         "dst_gdrive_file_id": "#{item["edge"]["destination"]["gdrive_file_id"]}".to_s,
-        #         "dst_cloud_provider": "#{item["edge"]["destination"]["cloud_provider"]}".to_s,
-        #         "dst_cloud_app": "#{item["edge"]["destination"]["cloud_app"]}".to_s,
-        #         "dst_cloud_account": "#{item["edge"]["destination"]["cloud_app_account"]}".to_s,
-        #         }}
-        #         return $data
-        #     end
-        # end
-
-        # def self.SummaryJson(incidentID)
-        #     SummaryRaw("#{incidentID}")
-        #     puts $data.to_json
-        # end
+                    if $pageToken == "1"
+                        $pageToken = ""
+                    end
+        
+                    $query ={
+                        "filters":{
+                            "resolution_statuses":[
+                                "unresolved", "ignored", "in_progress", "resolved"
+                            ],
+                            "users": [
+                                "#{username}"
+                            ],
+                        },
+                        "page_id": "#{$pageToken}",
+                        "sort_by": "event_time",
+                        "page_size": 1000,
+                        "sort_desc": true
+                    }.to_json
+        
+                    url = URI("https://dailypay.cyberhaven.io/api/rest/v1/incidents/list")
+                    https = Net::HTTP.new(url.host, url.port)
+                    https.use_ssl = true
+                    request = Net::HTTP::Get.new(url)
+                    request["Content-Type"] = "application/json"
+                    request["Authorization"] = "Bearer #{$bearerToken}"
+                    request.body = $query
+                    response = https.request(request)
+                    status = response.code
+                    results = JSON.parse(response.read_body)
+                    
+                    $pageToken = results["next_page_id"]
+                    # puts results["total"]
+                    # puts results["next_page_id"]
         
-        # def self.SummaryYaml(incidentID)
-        #     SummaryRaw("#{incidentID}")
-        #     puts $data.to_yaml
-        # end
+                    array = []
+                    results["incidents"].each do |item|
+                    $incident_hash = {
+                        "Event Time" => "#{item["event_time"]}",
+                        "Trigger Time" => "#{item["trigger_time"]}",
+                        "ID" => "#{item["id"]}",
+                        "Policy Name" => "#{item["category"]["name"]}",
+                        "Policy Severity" => "#{item["category"]["severity"]}",
+                        "User" => "#{item["user"]}",
+                        "Assignee" => "#{item["assignee"]}",
+                        "Status" => "#{item["resolution_status"]}",
+                        "Severity" => "#{item["severity"]}",
+                        "Dataset Name" => "#{item["dataset"]["name"]}",
+                        "Category Severity" => "#{item["category"]["severity"]}",
+                        "File" => "#{item["file"]}",
+                        "Data Path" => "#{item["data"]["path"]}",
+                        "Source Path" => "#{item["source_data"]["path"]}",
+                        "Content Tags" => "#{item["content_tags"]}",
+                        "Source Path " => "#{item["edge"]["source"]["path"]}",
+                        "Source Extension" => "#{item["edge"]["source"]["extension"]}",
+                        "Source Url" => "#{item["edge"]["source"]["url"]}",
+                        "Source Browser Url" => "#{item["edge"]["source"]["browser_page_url"]}",
+                        "Source Domain" => "#{item["edge"]["source"]["browser_page_domain"]}",
+                        "Source Browser Title" => "#{item["edge"]["source"]["browser_page_title"]}",
+                        "Source Hostname" => "#{item["edge"]["source"]["hostname"]}",
+                        "Source URI" => "#{item["edge"]["source"]["content_uri"]}",
+                        "Source Location" => "#{item["edge"]["source"]["location"]}",
+                        "Source Location Outline" => "#{item["edge"]["source"]["location_outline"]}",
+                        "Source Category" => "#{item["edge"]["source"]["category"]}",
+                        "Source Links" => "#{item["edge"]["source"]["links"]}",
+                        "Source ID" => "#{item["edge"]["source"]["links"]}",
+                        "Tags Applied" => "#{item["edge"]["source"]["tags_applied"]}",
+                        "Source Upload URI" => "#{item["edge"]["source"]["content_upload_uri"]}",
+                        "Source Report URI" => "#{item["edge"]["source"]["content_report_uri"]}",
+                        "Source Event Type" => "#{item["edge"]["source"]["event_type"]}",
+                        "Source Sensor Name" => "#{item["edge"]["source"]["sensor_name"]}",
+                        "Source Local User" => "#{item["edge"]["source"]["local_user_name"]}",
+                        "Source Local User ID" => "#{item["edge"]["source"]["local_user_sid"]}",
+                        "Source Local Time" => "#{item["edge"]["source"]["local_time"]}",
+                        "Source Local Machine" => "#{item["edge"]["source"]["local_machine_name"]}",
+                        "Source Endpoint ID" => "#{item["edge"]["source"]["endpoint_id"]}",
+                        "Source Local ID" => "#{item["edge"]["source"]["local_id"]}",
+                        "Destination Path" => "#{item["edge"]["destination"]["path"]}",
+                        "Destination Extension" => "#{item["edge"]["destination"]["extension"]}",
+                        "Destination Upload File ID" => "#{item["edge"]["destination"]["upload_file_id"]}",
+                        "Destination Browser Page Title" => "#{item["edge"]["destination"]["browser_page_title"]}",
+                        "Destination Hostname" => "#{item["edge"]["destination"]["hostname"]}",
+                        "Destination MD5" => "#{item["edge"]["destination"]["md5_hash"]}",
+                        "Destination File Size" => "#{item["edge"]["destination"]["file_size"]}",
+                        "Destination Path Components" => "#{item["edge"]["destination"]["path_components"]}",
+                        "Destination Path Basename" => "#{item["edge"]["destination"]["path_basename"]}",
+                        "Destination Domain" => "#{item["edge"]["destination"]["domain"]}",
+                        "Destination URI" => "#{item["edge"]["destination"]["content_uri"]}",
+                        "Destination Location" => "#{item["edge"]["destination"]["location"]}",
+                        "Destination Location Outline" => "#{item["edge"]["destination"]["location_outline"]}",
+                        "Destination Category" => "#{item["edge"]["destination"]["category"]}",
+                        "Destination Links" => "#{item["edge"]["destination"]["links"]}",
+                        "Destination Event Type" => "#{item["edge"]["destination"]["event_type"]}",
+                        "Destination Sensor Name" => "#{item["edge"]["destination"]["sensor_name"]}",
+                        "Destination Local User" => "#{item["edge"]["destination"]["local_user_name"]}",
+                        "Destination Local User ID" => "#{item["edge"]["destination"]["local_user_sid"]}",
+                        "Destination Local Time" => "#{item["edge"]["destination"]["local_time"]}",
+                        "Destination Local Machine" => "#{item["edge"]["destination"]["local_machine_name"]}",
+                        "Destination Endpoint ID" => "#{item["edge"]["destination"]["endpoint_id"]}",
+                        "Destination Local ID" => "#{item["edge"]["destination"]["local_id"]}",
+                        "Destination Blocked" => "#{item["edge"]["destination"]["blocked"]}",
+                        "Destination Data Size" => "#{item["edge"]["destination"]["data_size"]}",
+                        "Destination Google Drive ID" => "#{item["edge"]["destination"]["gdrive_file_id"]}",
+                        "Destination Cloud Provider" => "#{item["edge"]["destination"]["cloud_provider"]}",
+                        "Destination Cloud App" => "#{item["edge"]["destination"]["cloud_app"]}",
+                        "Destination Cloud Account" => "#{item["edge"]["destination"]["cloud_app_account"]}",
+                        "Destination Scan ID" => "#{item["edge"]["destination"]["dlp_scan_linking_id"]}"
+                    }
+                    $incidentArray.push($incident_hash)
+                    end
+                else
+                    break
+                end
+            end
+        
+            CSV.open("#{$reportPath}", 'w') do |csv|
+                # Write the header based on the keys of the first hash
+                csv << $incidentArray.first.keys
+              
+                # Write each hash as a row in the CSV file
+                $incidentArray.each do |hash|
+                  csv << hash.values
+                end
+            end
+            puts "Finished writting report: #{$reportPath}"
+        end
+    
+        def self.AllIncidentsJson(username)
+            AllIncidentsResults("#{username}")
+            return $incidentArray.to_json
+        end
 
-        # def self.SummaryReport(incidentID)
-        #     SummaryRaw("#{incidentID}")
+         def self.AllIncidentsYaml(incidentID)
+            AllIncidentsResults("#{incidentID}")
+            return $incidentArray.to_yaml
+        end
 
-        #     puts "INCIDENT ID: #{$data[:values][:incident_id]}"
-        #     puts "  EVENT TIME: #{$data[:values][:event_time]}" 
-        #     puts "  POLICY NAME: #{$data[:values][:policy_name]}" 
-        #     puts "  POLICY SEVERITY: #{$data[:values][:policy_severity]}"
-        #     puts "  USER: #{$data[:values][:user]}"
-        #     puts "  STATUS: #{$data[:values][:status]}"
-        #     puts "  DATASET NAME: #{$data[:values][:dataset]}"
-        #     puts "  DATASET SENSITIVITY: #{$data[:values][:dataset_sensitivity]}"
-        #     puts "  POLICY SEVERITY: #{$data[:values][:ploiicy_severity]}"
-        #     puts "  CREATE INCIDENT: #{$data[:values][:create_incident]}"
-        #     puts "  INCIDENT ACTION: #{$data[:values][:incident_action]}"
-        #     puts "  SOURCE INFORMATION:"
-        #     puts "    URL: #{$data[:values][:src_url]}"
-        #     puts "    BROWSER URL: #{$data[:values][:src_browser_url]}"
-        #     puts "    BROWSER DOMAIN: #{$data[:values][:src_browser_domain]}"
-        #     puts "    BROWSER TITLE: #{$data[:values][:src_browser_title]}"
-        #     puts "    LOCATION: #{$data[:values][:src_location]}"
-        #     puts "    LOCATION OUTLINE: #{$data[:values][:src_location_outline]}"
-        #     puts "    CATEGORY: #{$data[:values][:src_category]}"
-        #     puts "  DESTINATION INFORMATION:"
-        #     puts "    BROWSER TITLE: #{$data[:values][:dst_browser_title]}"
-        #     puts "    BASENAME: #{$data[:values][:dst_basename]}"
-        #     puts "    DOMAIN: #{$data[:values][:dst_domain]}"
-        #     puts "    LOCATION: #{$data[:values][:dest_location]}"
-        #     puts "    LOCATION OUTLINE: #{$data[:values][:dst_location_outline]}"
-        #     puts "    CATEGORY: #{$data[:values][:dst_category]}"
-        #     puts "    EVENT TYPE: #{$data[:values][:dst_event_type]}"
-        #     puts "    SENSOR: #{$data[:values][:dst_sensor]}"
-        #     puts "    LOCAL USERNAME: #{$data[:values][:dst_local_username]}"
-        #     puts "    LOCAL MACHINE NAME: #{$data[:values][:dst_local_machine_name]}"
-        #     puts "    BLOCKED: #{$data[:values][:dst_blocked]}"
-        #     puts "    DATA SIZE: #{$data[:values][:dst_data_size]}"
-        #     puts "    GDRIVE FILE ID: #{$data[:values][:dst_gdrive_file_id]}"
-        #     puts "    CLOUD PROVIDER: #{$data[:values][:dst_cloud_provider]}"
-        #     puts "    CLOUD APP: #{$data[:values][:dst_cloud_app]}"
-        #     puts "    CLOUD ACCOUNT: #{$data[:values][:dst_cloud_account]}"
-        # end
-    
     end
   end
 end

data/lib/cyberhaven/incidents/version.rb

@@ -2,6 +2,6 @@
 
 module Cyberhaven
   module Incidents
-    VERSION = "0.4.0"
+    VERSION = "0.4.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cyberhaven-incidents
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - nic scott
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-01-05 00:00:00.000000000 Z
+date: 2024-01-07 00:00:00.000000000 Z
 dependencies: []
 description: 
 email: