deepsecurity 0.0.15 → 0.0.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
data/.yardopts CHANGED
@@ -1,4 +1,2 @@
1
1
  --markup-provider=redcarpet
2
2
  --markup=markdown
3
- --no-private
4
- --files lib/deepsecurity/transport_object.rb
data/bin/dsc CHANGED
@@ -27,11 +27,11 @@ program_desc 'DeepSecurity command line client'
27
27
 
28
28
  version Dsc::VERSION
29
29
 
30
- desc 'Enable client debug output. One of debug, info, warn, error or fatal'
30
+ desc "Enable client debug output. (One of #{Dsc::Command.valid_debug_levels_string})"
31
31
  arg_name 'debug'
32
32
  flag [:d, :debug]
33
33
 
34
- desc 'Deep Security Manager'
34
+ desc 'Deep Security Manager Host'
35
35
  arg_name 'hostname'
36
36
  flag [:m, :manager]
37
37
 
@@ -40,7 +40,7 @@ arg_name 'port'
40
40
  default_value '4119'
41
41
  flag [:port]
42
42
 
43
- desc 'Tennat'
43
+ desc 'Tenat Name'
44
44
  arg_name 'tenat'
45
45
  default_value ''
46
46
  flag [:t, :tenant]
@@ -54,111 +54,40 @@ desc 'Password'
54
54
  arg_name 'password'
55
55
  flag [:p, :password]
56
56
 
57
- desc 'Output file'
57
+ desc 'Output filename'
58
58
  default_value '--'
59
59
  flag [:o, :outfile]
60
60
 
61
- desc 'Show progress'
61
+ desc 'Show progressbar'
62
62
  default_value false
63
63
  switch [:P]
64
64
 
65
- desc 'host detail'
66
- # arg_name 'Describe arguments to host_status here'
67
- command :host_detail do |c|
68
-
69
- c.desc "list"
70
- c.command :list do |list|
71
-
72
- list.desc 'fields'
73
- list.default_value Dsc::HostDetail.default_fields_string
74
- list.flag [:fields]
75
-
76
- list.action do |global_options, options, args|
77
- Dsc.output_from_option(global_options[:o]) do |output|
78
- Dsc::HostDetail.list(global_options[:m],
79
- global_options[:port].to_i,
80
- global_options[:t],
81
- global_options[:u],
82
- global_options[:p],
83
- :host_filter,
84
- Dsc::HostDetail.fields_from_string(options[:fields]),
85
- output, global_options[:P],
86
- Dsc.debug_level_from_option(global_options[:d]))
87
- end
88
- end
89
- end
90
-
91
- c.desc "schema"
92
- c.command :schema do |schema|
93
- schema.action do |global_options, options, args|
94
- Dsc.output_from_option(global_options[:o]) do |output|
95
- Dsc::HostDetail.print_schema(output)
96
- end
97
- end
98
- end
99
-
65
+ command_class = Dsc::HostDetailCommand
66
+ desc "Access #{command_class.transport_class_string}s"
67
+ command command_class.command_symbol do |c|
68
+ command_class.define_list_command(c)
69
+ command_class.define_schema_command(c)
100
70
  end
101
71
 
102
- desc 'anti malware events'
103
- # arg_name 'Describe arguments to host_status here'
104
- command :anti_malware_events do |c|
105
-
106
- c.desc "list"
107
- c.command :list do |list|
108
-
109
- list.desc 'fields'
110
- list.default_value Dsc::AntiMalwareEvent.default_fields_string
111
- list.flag [:fields]
112
-
113
- list.desc 'time filter'
114
- list.long_desc "One of #{Dsc::AntiMalwareEvent.valid_time_filters.keys.join(', ')}"
115
- list.default_value "last_day"
116
- list.flag [:time_filter]
117
-
118
- list.action do |global_options, options, args|
119
- Dsc.output_from_option(global_options[:o]) do |output|
120
- Dsc::AntiMalwareEvent.list(global_options[:m],
121
- global_options[:port].to_i,
122
- global_options[:t],
123
- global_options[:u],
124
- global_options[:p],
125
- :host_filter,
126
- Dsc::AntiMalwareEvent.parse_time_filter(options[:time_filter]),
127
- Dsc::AntiMalwareEvent.fields_from_string(options[:fields]),
128
- output, global_options[:P],
129
- Dsc.debug_level_from_option(global_options[:d]))
130
- end
131
- end
132
- end
133
-
134
- c.desc "schema"
135
- c.command :schema do |schema|
136
- schema.action do |global_options, options, args|
137
- Dsc.output_from_option(global_options[:o]) do |output|
138
- Dsc::AntiMalwareEvent.print_schema(output)
139
- end
140
- end
141
- end
142
-
72
+ command_class = Dsc::AntiMalwareEventCommand
73
+ desc "Access #{command_class.transport_class_string}s"
74
+ command command_class.command_symbol do |c|
75
+ command_class.define_list_command(c)
76
+ command_class.define_schema_command(c)
143
77
  end
144
78
 
145
- desc 'API Version'
79
+ desc 'Display API Version'
146
80
  command :api_version do |c|
147
-
148
81
  c.action do |global_options, options, args|
149
- Dsc.output_from_option(global_options[:o]) do |output|
150
- Dsc.print_api_version(global_options[:m], global_options[:port].to_i, global_options[:t], global_options[:u], global_options[:p], output, Dsc.debug_level_from_option(global_options[:d]))
151
- end
82
+ Dsc::Command.new(global_options).print_api_version(options, args)
152
83
  end
153
84
  end
154
85
 
155
- desc 'Manager time'
86
+ desc 'Display Manager time'
156
87
  command :manager_time do |c|
157
88
 
158
89
  c.action do |global_options, options, args|
159
- Dsc.output_from_option(global_options[:o]) do |output|
160
- Dsc.print_manager_time(global_options[:m], global_options[:port].to_i, global_options[:t], global_options[:u], global_options[:p], output, Dsc.debug_level_from_option(global_options[:d]))
161
- end
90
+ Dsc::Command.new(global_options).print_manager_time(options, args)
162
91
  end
163
92
  end
164
93
 
data/deepsecurity.gemspec CHANGED
@@ -15,16 +15,16 @@ Gem::Specification.new do |gem|
15
15
  gem.require_paths = ["lib"]
16
16
  gem.version = DeepSecurity::VERSION
17
17
 
18
- gem.add_dependency "json"
19
18
  gem.add_dependency "savon"
20
19
  gem.add_dependency "ruby-cache"
21
20
 
22
21
  gem.add_dependency "gli"
23
-
24
- gem.add_dependency 'yard'
25
- # gem.add_dependency 'redcarpet'
26
- # gem.add_dependency 'github-markup'
27
22
  gem.add_dependency 'progressbar'
23
+ gem.add_dependency "json"
24
+
25
+ gem.add_development_dependency 'yard'
26
+ gem.add_development_dependency 'redcarpet'
27
+ gem.add_development_dependency 'github-markup'
28
28
 
29
29
  end
30
30
 
@@ -1,3 +1,3 @@
1
1
  module DeepSecurity
2
- VERSION = "0.0.15"
2
+ VERSION = "0.0.16"
3
3
  end
@@ -0,0 +1,86 @@
1
+ module Dsc
2
+
3
+ class AntiMalwareEventCommand < Command
4
+
5
+
6
+ def self.transport_class
7
+ DeepSecurity::AntiMalwareEvent
8
+ end
9
+
10
+ def self.default_fields
11
+ [
12
+ # DNS name of system
13
+ :"host.name",
14
+
15
+
16
+ # fully qualified system node
17
+ :"host.display_name",
18
+
19
+ # signature / pattern version used in detection
20
+ # MISSING
21
+
22
+ # datetime the event was generated and/or received OS version
23
+ :log_date,
24
+ :start_time,
25
+ :end_time,
26
+
27
+ # system domain or system group
28
+ # MISSING
29
+
30
+ # account logged on during detection
31
+ # MISSING
32
+
33
+ # action taken
34
+ :scan_action1,
35
+ :scan_action2,
36
+ :summary_scan_result,
37
+
38
+ # result of action taken
39
+ :scan_result_action1,
40
+ :scan_result_action2,
41
+ # :spyware_items,
42
+ # :"spyware_items.to_json",
43
+
44
+ # name of malware/detection
45
+ :malware_name,
46
+ :malware_type,
47
+
48
+ # source/path/filename/object of detection
49
+ :infected_file_path,
50
+ :infection_source
51
+
52
+ ]
53
+ end
54
+
55
+ def list(options, args)
56
+ fields = parse_fields(options[:fields])
57
+ time_filter = parse_time_filter(options[:time_filter])
58
+ output do |output|
59
+ authenticate do |dsm|
60
+ progressBar = ProgressBar.new("anti_malware_event", 100) if @show_progress_bar
61
+ DeepSecurity::Host.all # Make sure that hosts are cached
62
+ progressBar.set(10) if @show_progress_bar
63
+ hostFilter = DeepSecurity::HostFilter.all_hosts
64
+ eventIdFilter = DeepSecurity::IDFilter.greater_than(0)
65
+ anti_malware_events = DeepSecurity::AntiMalwareEvent.find_all(time_filter, hostFilter, eventIdFilter)
66
+ progressBar.set(25) if @show_progress_bar
67
+ csv = CSV.new(output)
68
+ csv << fields
69
+ anti_malware_events.each do |anti_malware_event|
70
+ progressBar.inc(75/anti_malware_events.size) if @show_progress_bar
71
+ csv << fields.map { |attribute| anti_malware_event.instance_eval(attribute) }
72
+ end
73
+ progressBar.finish if @show_progress_bar
74
+ end
75
+ end
76
+ end
77
+
78
+ def self.define_list_command(c)
79
+ super(c) do |list|
80
+ define_time_filter_argument(list)
81
+ end
82
+ end
83
+
84
+ end
85
+
86
+ end
@@ -0,0 +1,184 @@
1
+ require "progressbar"
2
+ require "csv"
3
+
4
+ module Dsc
5
+
6
+ class Command
7
+
8
+ def self.transport_class
9
+ nil
10
+ end
11
+
12
+ def self.transport_class_name
13
+ class_name = transport_class.name.split('::').last || ''
14
+ end
15
+
16
+ def self.transport_class_string
17
+ transport_class_name.split(/(?=[A-Z])/).join(" ")
18
+ end
19
+
20
+ def self.command_symbol
21
+ transport_class_name.split(/(?=[A-Z])/).join("_").downcase.to_sym
22
+ end
23
+
24
+ def self.schema
25
+ transport_class.mappings
26
+ end
27
+
28
+ def initialize(global_options)
29
+ @hostname = global_options[:m]
30
+ @port = global_options[:port].to_i
31
+ @tenant = global_options[:t]
32
+ @username =global_options[:u]
33
+ @password = global_options[:p]
34
+ @show_progress_bar = global_options[:P]
35
+ @debug_level = debug_level_from_option(global_options[:d])
36
+ @output = global_options[:o]
37
+ end
38
+
39
+ def self.valid_debug_levels
40
+ DeepSecurity::LOG_MAPPING.keys
41
+ end
42
+
43
+ def self.valid_debug_levels_string
44
+ valid_debug_levels.join(", ")
45
+ end
46
+
47
+ def self.default_fields
48
+ []
49
+ end
50
+
51
+ def self.default_fields_string
52
+ default_fields.join(",")
53
+ end
54
+
55
+ def self.valid_fields
56
+ transport_class.defined_attributes.sort
57
+ end
58
+
59
+ def self.valid_fields_string
60
+ valid_fields.join(", ")
61
+ end
62
+
63
+ def parse_fields(string)
64
+ fields = string.split(",").map(&:strip)
65
+ unknown_fields = fields.reject { |each| self.class.transport_class.has_attribute_chain(each) }
66
+ raise "Unknown field found (#{unknown_fields.join(', ')}) - known fields are: #{self.class.valid_fields.join(', ')}" unless unknown_fields.empty?
67
+ fields
68
+ end
69
+
70
+ def self.valid_time_filters
71
+ {
72
+ :last_hour => DeepSecurity::TimeFilter.last_hour,
73
+ :last_24_hours => DeepSecurity::TimeFilter.last_24_hours,
74
+ :last_7_days => DeepSecurity::TimeFilter.last_7_days,
75
+ :last_day => DeepSecurity::TimeFilter.last_day
76
+ }
77
+ end
78
+
79
+ def self.valid_time_filters_string
80
+ valid_time_filters.keys.join(', ')
81
+ end
82
+
83
+ def parse_time_filter(string)
84
+ filter = self.class.valid_time_filters[string.to_sym]
85
+ raise "Unknown time filter" if filter.nil?
86
+ filter
87
+ end
88
+
89
+
90
+ def debug_level_from_option(option)
91
+ return nil if option.blank?
92
+ return option.to_sym if (DeepSecurity::LOG_MAPPING.keys.include?(option.to_sym))
93
+ :debug
94
+ end
95
+
96
+ def output
97
+ unless @output == '--'
98
+ output = File.open(option, 'w')
99
+ else
100
+ output = STDOUT
101
+ end
102
+ yield output
103
+ output.close() unless @output == '--'
104
+ end
105
+
106
+ def connect
107
+ yield DeepSecurity::Manager.server(@hostname, @port, @debug_level)
108
+ end
109
+
110
+ def authenticate
111
+ connect do |dsm|
112
+ begin
113
+ dsm.connect(@tenant, @username, @password)
114
+ yield dsm
115
+ rescue DeepSecurity::AuthenticationFailedException => e
116
+ puts "Authentication failed! #{e.message}"
117
+ ensure
118
+ dsm.disconnect()
119
+ end
120
+ end
121
+ end
122
+
123
+
124
+ def print_api_version(options, args)
125
+ output do |output|
126
+ authenticate do |dsm|
127
+ output.puts dsm.api_version()
128
+ end
129
+ end
130
+ end
131
+
132
+ def print_manager_time(options, args)
133
+ output do |output|
134
+ authenticate do |dsm|
135
+ output.puts dsm.manager_time()
136
+ end
137
+ end
138
+ end
139
+
140
+ def print_schema(options, args)
141
+ output do |output|
142
+ schema = self.class.schema()
143
+ schema.keys.sort.each do |key|
144
+ output.puts "#{key} (#{schema[key].type_string}): #{schema[key].description}"
145
+ end
146
+ end
147
+ end
148
+
149
+ def self.define_list_command(command)
150
+ command.desc "List #{self.transport_class_string}s"
151
+ command.command :list do |list|
152
+ define_fields_argument(list)
153
+ yield list if block_given?
154
+ list.action do |global_options, options, args|
155
+ self.new(global_options).list(options, args)
156
+ end
157
+ end
158
+ end
159
+
160
+ def self.define_schema_command(command)
161
+ command.desc "Show #{self.transport_class_string} schema"
162
+ command.command :schema do |schema|
163
+ yield schema if block_given?
164
+ schema.action do |global_options, options, args|
165
+ self.new(global_options).print_schema(options, args)
166
+ end
167
+ end
168
+ end
169
+
170
+ def self.define_time_filter_argument(command)
171
+ command.desc "A filter specifying the time interval to query (One of #{self.valid_time_filters_string})"
172
+ command.default_value "last_day"
173
+ command.flag [:time_filter]
174
+ end
175
+
176
+ def self.define_fields_argument(command)
177
+ command.desc "A comma separated list of fields to display. (Available fields: #{self.valid_fields_string})"
178
+ command.default_value self.default_fields_string
179
+ command.flag [:fields]
180
+ end
181
+
182
+ end
183
+
184
+ end
data/lib/dsc/helper.rb CHANGED
@@ -1,48 +1,6 @@
1
1
  module Dsc
2
2
 
3
3
 
4
- def self.output_from_option(option)
5
- unless option == '--'
6
- output = File.open(option, 'w')
7
- else
8
- output = STDOUT
9
- end
10
4
 
11
- yield output
12
-
13
- output.close() unless option == '--'
14
- end
15
-
16
- def self.debug_level_from_option(option)
17
- return nil if option.blank?
18
- return option.to_sym if (DeepSecurity::LOG_MAPPING.keys.include?(option.to_sym))
19
- :debug
20
- end
21
-
22
- def self.dsm_connect(hostname, port, tenat, username, password, debug)
23
-
24
- begin
25
- dsm = DeepSecurity::Manager.server(hostname, port, debug)
26
- dsm.connect(tenat, username, password)
27
- yield dsm
28
- rescue DeepSecurity::AuthenticationFailedException => e
29
- puts "Authentication failed! #{e.message}"
30
- ensure
31
- dsm.disconnect()
32
- end
33
-
34
- end
35
-
36
- def self.print_api_version(hostname, port, tenat, username, password, output, debug)
37
- dsm_connect(hostname, port, tenat, username, password, debug) do |dsm|
38
- output.puts dsm.api_version()
39
- end
40
- end
41
-
42
- def self.print_manager_time(hostname, port, tenat, username, password, output, debug)
43
- dsm_connect(hostname, port, tenat, username, password, debug) do |dsm|
44
- output.puts dsm.manager_time()
45
- end
46
- end
47
5
 
48
6
  end
@@ -1,9 +1,6 @@
1
- require "progressbar"
2
- require "csv"
3
-
4
1
  module Dsc
5
2
 
6
- class HostDetail < DscObject
3
+ class HostDetailCommand < Command
7
4
 
8
5
 
9
6
  def self.transport_class
@@ -33,30 +30,30 @@ module Dsc
33
30
  :platform,
34
31
  :host_type,
35
32
  # system domain or system group
36
- :host_group_id
33
+ :host_group_id,
37
34
 
38
35
  # last/currently logged on account
39
36
  ]
40
-
41
-
42
37
  end
43
38
 
44
- def self.list(hostname, port, tenat, username, password, host_filter, fields, output, progress_bar, debug)
45
- Dsc.dsm_connect(hostname, port, tenat, username, password, debug) do |dsm|
46
- hostFilter = DeepSecurity::HostFilter.all_hosts
47
- progressBar = ProgressBar.new("host_status", 100) if progress_bar
48
- hostDetails = DeepSecurity::HostDetail.find_all(hostFilter, :low)
49
- progressBar.set(25) if progress_bar
50
- csv = CSV.new(output)
51
- csv << fields
52
- hostDetails.each do |hostDetail|
53
- progressBar.inc(75/hostDetails.size) if progress_bar
54
- csv << fields.map { |attribute| hostDetail.instance_eval(attribute) }
39
+ def list(options, args)
40
+ fields = parse_fields(options[:fields])
41
+ output do |output|
42
+ authenticate do |dsm|
43
+ hostFilter = DeepSecurity::HostFilter.all_hosts
44
+ progressBar = ProgressBar.new("host_status", 100) if @show_progress_bar
45
+ hostDetails = DeepSecurity::HostDetail.find_all(hostFilter, :low)
46
+ progressBar.set(25) if @show_progress_bar
47
+ csv = CSV.new(output)
48
+ csv << fields
49
+ hostDetails.each do |hostDetail|
50
+ progressBar.inc(75/hostDetails.size) if @show_progress_bar
51
+ csv << fields.map { |attribute| hostDetail.instance_eval(attribute) }
52
+ end
53
+ progressBar.finish if @show_progress_bar
55
54
  end
56
- progressBar.finish if progress_bar
57
55
  end
58
56
  end
59
-
60
57
  end
61
58
 
62
59
  end
data/lib/dsc.rb CHANGED
@@ -1,6 +1,6 @@
1
1
  require 'dsc_version'
2
2
  require 'dsc/helper'
3
3
 
4
- require "dsc/dsc_object"
5
- require "dsc/host_detail"
6
- require "dsc/anti_malware_event"
4
+ require "dsc/command"
5
+ require "dsc/host_detail_command"
6
+ require "dsc/anti_malware_event_command"
@@ -28,6 +28,10 @@ module SavonHelper
28
28
  logger.error { "#{self.class}##{__method__}() not implemented!" }
29
29
  end
30
30
 
31
+ def type_string
32
+ logger.error { "#{self.class}##{__method__}() not implemented!" }
33
+ end
34
+
31
35
  end
32
36
 
33
37
  class ArrayMapping < TypeMapping
@@ -70,7 +74,11 @@ module SavonHelper
70
74
 
71
75
  def object_klass
72
76
  @element_mapping.object_klass
73
- end
77
+ end
78
+
79
+ def type_string
80
+ "Array<#{@element_mapping.type_string}>"
81
+ end
74
82
 
75
83
  end
76
84
 
@@ -84,6 +92,10 @@ module SavonHelper
84
92
  value.to_s
85
93
  end
86
94
 
95
+ def type_string
96
+ "bool"
97
+ end
98
+
87
99
  end
88
100
 
89
101
  class DatetimeMapping < TypeMapping
@@ -96,6 +108,10 @@ module SavonHelper
96
108
  value.to_datetime.to_s
97
109
  end
98
110
 
111
+ def type_string
112
+ "datetime"
113
+ end
114
+
99
115
  end
100
116
 
101
117
  class EnumMapping < TypeMapping
@@ -113,6 +129,10 @@ module SavonHelper
113
129
  @enum.key(value)
114
130
  end
115
131
 
132
+ def type_string
133
+ "enum"
134
+ end
135
+
116
136
  end
117
137
 
118
138
  class FloatMapping < TypeMapping
@@ -125,6 +145,10 @@ module SavonHelper
125
145
  value.to_s
126
146
  end
127
147
 
148
+ def type_string
149
+ "float"
150
+ end
151
+
128
152
  end
129
153
 
130
154
  class IntegerMapping < TypeMapping
@@ -137,6 +161,9 @@ module SavonHelper
137
161
  value.to_s
138
162
  end
139
163
 
164
+ def type_string
165
+ "int"
166
+ end
140
167
  end
141
168
 
142
169
  class IPAddressMapping < TypeMapping
@@ -149,6 +176,10 @@ module SavonHelper
149
176
  value.to_s
150
177
  end
151
178
 
179
+ def type_string
180
+ "IPAddress"
181
+ end
182
+
152
183
  end
153
184
 
154
185
  class ObjectMapping < TypeMapping
@@ -166,6 +197,10 @@ module SavonHelper
166
197
  @klass
167
198
  end
168
199
 
200
+ def type_string
201
+ "#{@klass}"
202
+ end
203
+
169
204
  end
170
205
 
171
206
  class StringMapping < TypeMapping
@@ -182,6 +217,10 @@ module SavonHelper
182
217
  String
183
218
  end
184
219
 
220
+ def type_string
221
+ "String"
222
+ end
223
+
185
224
  end
186
225
 
187
226
  class MissingMapping < TypeMapping
@@ -194,6 +233,10 @@ module SavonHelper
194
233
  value
195
234
  end
196
235
 
236
+ def type_string
237
+ "MISSING"
238
+ end
239
+
197
240
  end
198
241
 
199
242
  class HintMapping < TypeMapping
@@ -207,6 +250,10 @@ module SavonHelper
207
250
  @klass
208
251
  end
209
252
 
253
+ def type_string
254
+ "HINT"
255
+ end
256
+
210
257
  end
211
258
 
212
259
  def self.define_missing_type_mapping(klass, ivar_name, value, mappings)
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: deepsecurity
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.0.15
4
+ version: 0.0.16
5
5
  prerelease:
6
6
  platform: ruby
7
7
  authors:
@@ -9,10 +9,10 @@ authors:
9
9
  autorequire:
10
10
  bindir: bin
11
11
  cert_chain: []
12
- date: 2013-03-11 00:00:00.000000000 Z
12
+ date: 2013-03-13 00:00:00.000000000 Z
13
13
  dependencies:
14
14
  - !ruby/object:Gem::Dependency
15
- name: json
15
+ name: savon
16
16
  requirement: !ruby/object:Gem::Requirement
17
17
  none: false
18
18
  requirements:
@@ -28,7 +28,7 @@ dependencies:
28
28
  - !ruby/object:Gem::Version
29
29
  version: '0'
30
30
  - !ruby/object:Gem::Dependency
31
- name: savon
31
+ name: ruby-cache
32
32
  requirement: !ruby/object:Gem::Requirement
33
33
  none: false
34
34
  requirements:
@@ -44,7 +44,7 @@ dependencies:
44
44
  - !ruby/object:Gem::Version
45
45
  version: '0'
46
46
  - !ruby/object:Gem::Dependency
47
- name: ruby-cache
47
+ name: gli
48
48
  requirement: !ruby/object:Gem::Requirement
49
49
  none: false
50
50
  requirements:
@@ -60,7 +60,7 @@ dependencies:
60
60
  - !ruby/object:Gem::Version
61
61
  version: '0'
62
62
  - !ruby/object:Gem::Dependency
63
- name: gli
63
+ name: progressbar
64
64
  requirement: !ruby/object:Gem::Requirement
65
65
  none: false
66
66
  requirements:
@@ -76,7 +76,7 @@ dependencies:
76
76
  - !ruby/object:Gem::Version
77
77
  version: '0'
78
78
  - !ruby/object:Gem::Dependency
79
- name: yard
79
+ name: json
80
80
  requirement: !ruby/object:Gem::Requirement
81
81
  none: false
82
82
  requirements:
@@ -92,14 +92,46 @@ dependencies:
92
92
  - !ruby/object:Gem::Version
93
93
  version: '0'
94
94
  - !ruby/object:Gem::Dependency
95
- name: progressbar
95
+ name: yard
96
96
  requirement: !ruby/object:Gem::Requirement
97
97
  none: false
98
98
  requirements:
99
99
  - - ! '>='
100
100
  - !ruby/object:Gem::Version
101
101
  version: '0'
102
- type: :runtime
102
+ type: :development
103
+ prerelease: false
104
+ version_requirements: !ruby/object:Gem::Requirement
105
+ none: false
106
+ requirements:
107
+ - - ! '>='
108
+ - !ruby/object:Gem::Version
109
+ version: '0'
110
+ - !ruby/object:Gem::Dependency
111
+ name: redcarpet
112
+ requirement: !ruby/object:Gem::Requirement
113
+ none: false
114
+ requirements:
115
+ - - ! '>='
116
+ - !ruby/object:Gem::Version
117
+ version: '0'
118
+ type: :development
119
+ prerelease: false
120
+ version_requirements: !ruby/object:Gem::Requirement
121
+ none: false
122
+ requirements:
123
+ - - ! '>='
124
+ - !ruby/object:Gem::Version
125
+ version: '0'
126
+ - !ruby/object:Gem::Dependency
127
+ name: github-markup
128
+ requirement: !ruby/object:Gem::Requirement
129
+ none: false
130
+ requirements:
131
+ - - ! '>='
132
+ - !ruby/object:Gem::Version
133
+ version: '0'
134
+ type: :development
103
135
  prerelease: false
104
136
  version_requirements: !ruby/object:Gem::Requirement
105
137
  none: false
@@ -149,10 +181,10 @@ files:
149
181
  - lib/deepsecurity/transport_objects/time_filter.rb
150
182
  - lib/deepsecurity/version.rb
151
183
  - lib/dsc.rb
152
- - lib/dsc/anti_malware_event.rb
153
- - lib/dsc/dsc_object.rb
184
+ - lib/dsc/anti_malware_event_command.rb
185
+ - lib/dsc/command.rb
154
186
  - lib/dsc/helper.rb
155
- - lib/dsc/host_detail.rb
187
+ - lib/dsc/host_detail_command.rb
156
188
  - lib/dsc_version.rb
157
189
  - lib/savon_helper.rb
158
190
  - lib/savon_helper/caching_object.rb
@@ -1,101 +0,0 @@
1
- require "progressbar"
2
- require "csv"
3
-
4
- module Dsc
5
-
6
- class AntiMalwareEvent < DscObject
7
-
8
-
9
- def self.transport_class
10
- DeepSecurity::AntiMalwareEvent
11
- end
12
-
13
- def self.default_fields
14
- [
15
- # DNS name of system
16
- :"host.name",
17
-
18
-
19
- # fully qualified system node
20
- :"host.display_name",
21
-
22
- # signature / pattern version used in detection
23
- # MISSING
24
-
25
- # datetime the event was generated and/or received OS version
26
- :log_date,
27
- :start_time,
28
- :end_time,
29
-
30
- # system domain or system group
31
- # MISSING
32
-
33
- # account logged on during detection
34
- # MISSING
35
-
36
- # action taken
37
- :scan_action1,
38
- :scan_action2,
39
- :summary_scan_result,
40
-
41
- # result of action taken
42
- :scan_result_action1,
43
- :scan_result_action2,
44
- # :spyware_items,
45
- # :"spyware_items.to_json",
46
-
47
- # name of malware/detection
48
- :malware_name,
49
- :malware_type,
50
-
51
- # source/path/filename/object of detection
52
- :infected_file_path,
53
- :infection_source
54
-
55
- ]
56
- end
57
-
58
- def self.list(hostname, port, tenat, username, password, host_filter, time_filter, fields, output, progress_bar, debug)
59
- Dsc.dsm_connect(hostname, port, tenat, username, password, debug) do |dsm|
60
-
61
- progressBar = ProgressBar.new("anti_malware_event", 100) if progress_bar
62
-
63
- DeepSecurity::Host.all # Make sure that hosts are cached
64
- progressBar.set(10) if progress_bar
65
-
66
- hostFilter = DeepSecurity::HostFilter.all_hosts
67
- eventIdFilter = DeepSecurity::IDFilter.greater_than(0)
68
-
69
-
70
- anti_malware_events = DeepSecurity::AntiMalwareEvent.find_all(time_filter, hostFilter, eventIdFilter)
71
- progressBar.set(25) if progress_bar
72
- csv = CSV.new(output)
73
- csv << fields
74
- anti_malware_events.each do |anti_malware_event|
75
- progressBar.inc(75/anti_malware_events.size) if progress_bar
76
-
77
- csv << fields.map { |attribute| anti_malware_event.instance_eval(attribute) }
78
- end
79
- progressBar.finish if progress_bar
80
- end
81
-
82
- end
83
-
84
- def self.parse_time_filter(string)
85
- filter = valid_time_filters[string.to_sym]
86
- raise "Unknown time filter" if filter.nil?
87
- filter
88
- end
89
-
90
- def self.valid_time_filters
91
- {
92
- :last_hour => DeepSecurity::TimeFilter.last_hour,
93
- :last_24_hours => DeepSecurity::TimeFilter.last_24_hours,
94
- :last_7_days => DeepSecurity::TimeFilter.last_7_days,
95
- :last_day => DeepSecurity::TimeFilter.last_day
96
- }
97
- end
98
-
99
- end
100
-
101
- end
@@ -1,41 +0,0 @@
1
- module Dsc
2
-
3
- class DscObject
4
-
5
-
6
- def self.transport_class
7
- raise "Subclass responsibility!"
8
- end
9
-
10
- def self.default_fields
11
- []
12
- end
13
-
14
- def self.default_fields_string
15
- default_fields.join(",")
16
- end
17
-
18
- def self.schema
19
- result ={}
20
- transport_class.mappings.each { |key, value| result[key] = value.description }
21
- result
22
- end
23
-
24
- def self.print_schema(output)
25
- schema = self.schema()
26
- schema.keys.sort.each do |key|
27
- output.puts "#{key}: #{schema[key]}"
28
- end
29
- end
30
-
31
- def self.fields_from_string(string)
32
- fields = string.split(",").map(&:strip)
33
- unknown_fields = fields.reject { |each| transport_class.has_attribute_chain(each) }
34
- raise "Unknown field found (#{unknown_fields.join(', ')}) - known fields are: #{transport_class.defined_attributes.sort.join(', ')}" unless unknown_fields.empty?
35
- fields
36
- end
37
-
38
-
39
- end
40
-
41
- end