check-msdefender 1.0.0__py3-none-any.whl → 1.1.1__py3-none-any.whl

check_msdefender/cli/commands/__init__.py

@@ -6,6 +6,7 @@ from .vulnerabilities import register_vulnerability_commands
 from .onboarding import register_onboarding_commands
 from .machines import register_machines_commands
 from .detail import register_detail_commands
+from .alerts import register_alerts_commands
 
 
 def register_all_commands(main_group: Any) -> None:
@@ -15,3 +16,4 @@ def register_all_commands(main_group: Any) -> None:
     register_onboarding_commands(main_group)
     register_machines_commands(main_group)
     register_detail_commands(main_group)
+    register_alerts_commands(main_group)

check_msdefender/cli/commands/alerts.py

@@ -0,0 +1,61 @@
+"""Alerts commands for CLI."""
+
+import sys
+import click
+from typing import Optional, Any
+
+from check_msdefender.core.auth import get_authenticator
+from check_msdefender.core.config import load_config
+from check_msdefender.core.defender import DefenderClient
+from check_msdefender.core.nagios import NagiosPlugin
+from check_msdefender.services.alerts_service import AlertsService
+from ..decorators import common_options
+
+
+def register_alerts_commands(main_group: Any) -> None:
+    """Register alerts commands with the main CLI group."""
+
+    @main_group.command("alerts")
+    @common_options
+    def alerts_cmd(
+        config: str,
+        verbose: int,
+        machine_id: Optional[str],
+        dns_name: Optional[str],
+        warning: Optional[float],
+        critical: Optional[float],
+    ) -> None:
+        """Check alerts for Microsoft Defender."""
+        warning = warning if warning is not None else 1
+        critical = critical if critical is not None else 0
+
+        try:
+            # Load configuration
+            cfg = load_config(config)
+
+            # Get authenticator
+            authenticator = get_authenticator(cfg)
+
+            # Create Defender client
+            client = DefenderClient(authenticator, verbose_level=verbose)
+
+            # Create the alerts service
+            service = AlertsService(client, verbose_level=verbose)
+
+            # Create Nagios plugin
+            plugin = NagiosPlugin(service, "alerts")
+
+            # Execute check
+            result = plugin.check(
+                machine_id=machine_id,
+                dns_name=dns_name,
+                warning=warning,
+                critical=critical,
+                verbose=verbose,
+            )
+
+            sys.exit(result or 0)
+
+        except Exception as e:
+            print(f"UNKNOWN: {str(e)}")
+            sys.exit(3)

check_msdefender/core/defender.py

@@ -167,6 +167,44 @@ class DefenderClient:
                 self.logger.debug(f"Response: {str(e.response.content)}")
             raise DefenderAPIError(f"Failed to query MS Defender API: {str(e)}")
 
+    def get_alerts(self) -> Dict[str, Any]:
+        """Get alerts from Microsoft Defender."""
+        self.logger.method_entry("get_alerts")
+
+        token = self._get_token()
+
+        url = f"{self.base_url}/api/alerts"
+        headers = {
+            "Authorization": f"Bearer {token}",
+            "Content-Type": DefenderClient.application_json,
+        }
+
+        params = {
+            "$top": "100",
+            "$expand": "evidence",
+            "$orderby": "alertCreationTime desc",
+            "$select": "status,title,machineId,computerDnsName,alertCreationTime,firstEventTime,lastEventTime,lastUpdateTime,severity",
+        }
+
+        try:
+            start_time = time.time()
+            self.logger.info("Querying alerts")
+            response = requests.get(url, headers=headers, params=params, timeout=self.timeout)
+            elapsed = time.time() - start_time
+
+            self.logger.api_call("GET", url, response.status_code, elapsed)
+            response.raise_for_status()
+
+            result = cast(Dict[str, Any], response.json())
+            self.logger.json_response(str(result))
+            self.logger.method_exit("get_alerts", result)
+            return result
+        except requests.RequestException as e:
+            self.logger.debug(f"API request failed: {str(e)}")
+            if hasattr(e, "response") and e.response is not None:
+                self.logger.debug(f"Response: {str(e.response.content)}")
+            raise DefenderAPIError(f"Failed to query MS Defender API: {str(e)}")
+
     def _get_token(self) -> str:
         """Get access token from authenticator."""
         self.logger.trace("Getting access token from authenticator")

check_msdefender/services/alerts_service.py

@@ -0,0 +1,98 @@
+"""Alerts service implementation."""
+
+from datetime import datetime
+from typing import Dict, Optional, Any, List
+from check_msdefender.core.exceptions import ValidationError
+from check_msdefender.core.logging_config import get_verbose_logger
+
+
+class AlertsService:
+    """Service for checking machine alerts."""
+
+    def __init__(self, defender_client: Any, verbose_level: int = 0) -> None:
+        """Initialize with Defender client."""
+        self.defender = defender_client
+        self.logger = get_verbose_logger(__name__, verbose_level)
+
+    def get_result(
+        self, machine_id: Optional[str] = None, dns_name: Optional[str] = None
+    ) -> Dict[str, Any]:
+        """Get alerts result with value and details for a machine."""
+        self.logger.method_entry("get_result", machine_id=machine_id, dns_name=dns_name)
+
+        if not machine_id and not dns_name:
+            raise ValidationError("Either machine_id or dns_name must be provided")
+
+        # Get machine information
+        target_dns_name = dns_name
+        target_machine_id = machine_id
+
+        if machine_id:
+            # Get DNS name from machine_id
+            machine_details = self.defender.get_machine_by_id(machine_id)
+            target_dns_name = machine_details.get("computerDnsName", "Unknown")
+        elif dns_name:
+            # Get machine_id from dns_name
+            dns_response = self.defender.get_machine_by_dns_name(dns_name)
+            machines = dns_response.get("value", [])
+            if not machines:
+                raise ValidationError(f"Machine not found with DNS name: {dns_name}")
+            target_machine_id = machines[0].get("id")
+            target_dns_name = dns_name
+
+        # Get all alerts
+        self.logger.info("Fetching alerts from Microsoft Defender")
+        alerts_data = self.defender.get_alerts()
+        all_alerts = alerts_data.get("value", [])
+
+        # Filter alerts for the specific machine
+        machine_alerts = [
+            alert
+            for alert in all_alerts
+            if alert.get("machineId") == target_machine_id
+            or alert.get("computerDnsName") == target_dns_name
+        ]
+
+        self.logger.info(f"Found {len(machine_alerts)} alerts for machine {target_dns_name}")
+
+        # Categorize alerts by status and severity
+        unresolved_alerts = [alert for alert in machine_alerts if alert.get("status") != "Resolved"]
+        informational_alerts = [
+            alert for alert in unresolved_alerts if alert.get("severity") == "Informational"
+        ]
+        critical_warning_alerts = [
+            alert
+            for alert in unresolved_alerts
+            if alert.get("severity") in ["High", "Medium", "Low"]
+        ]
+
+        # Create details for output
+        details = []
+        if unresolved_alerts:
+            summary_line = f"Unresolved alerts for {target_dns_name}"
+            if informational_alerts and not critical_warning_alerts:
+                summary_line = f"Unresolved informational alerts for {target_dns_name}"
+            elif critical_warning_alerts:
+                summary_line = f"Unresolved alerts for {target_dns_name}"
+            details.append(summary_line)
+
+            # Add individual alerts (limit to 10)
+            for alert in unresolved_alerts[:10]:
+                creation_time = alert.get("alertCreationTime", "Unknown")
+                title = alert.get("title", "Unknown alert")
+                status = alert.get("status", "Unknown")
+                severity = alert.get("severity", "Unknown")
+                details.append(f"{creation_time} - {title} ({status} {severity.lower()})")
+
+        # Return the number of unresolved alerts as the value
+        # This will be used by Nagios plugin for determining status based on thresholds
+        value = len(unresolved_alerts)
+
+        result = {
+            "value": value,
+            "details": details,
+        }
+
+        self.logger.info(f"Alert analysis complete: {len(unresolved_alerts)} unresolved alerts")
+        self.logger.method_exit("get_result", result)
+        return result

{check_msdefender-1.0.0.dist-info → check_msdefender-1.1.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: check-msdefender
-Version: 1.0.0
+Version: 1.1.1
 Summary: A Nagios plugin for monitoring Microsoft Defender API endpoints
 Author-email: ldvchosal <ldvchosal@github.com>
 License: MIT
@@ -46,7 +46,7 @@ A comprehensive **Nagios plugin** for monitoring Microsoft Defender for Endpoint
 ## ✨ Features
 
 - 🔐 **Dual Authentication** - Support for Client Secret and Certificate-based authentication
-- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, and machine details
+- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, alerts, and machine details
 - 📊 **Nagios Compatible** - Standard exit codes and performance data output
 - 🏗️ **Clean Architecture** - Modular design with testable components
 - 🔧 **Flexible Configuration** - File-based configuration with sensible defaults
@@ -78,6 +78,9 @@ check_msdefender lastseen -d machine.domain.tld -W 7 -C 30
 # Check vulnerabilities
 check_msdefender vulnerabilities -d machine.domain.tld -W 10 -C 100
 
+# Check alerts
+check_msdefender alerts -d machine.domain.tld -W 1 -C 5
+
 # List all machines
 check_msdefender machines
 
@@ -92,6 +95,7 @@ check_msdefender detail -d machine.domain.tld
 | `onboarding` | Check machine onboarding status | W:1, C:2 |
 | `lastseen` | Days since machine last seen | W:7, C:30 |
 | `vulnerabilities` | Vulnerability score calculation | W:10, C:100 |
+| `alerts` | Count of unresolved alerts | W:1, C:0 |
 | `machines` | List all machines | W:10, C:25 |
 | `detail` | Get detailed machine information | - |
 
@@ -103,6 +107,14 @@ The vulnerability score is calculated as:
 - **Medium vulnerabilities** × 5
 - **Low vulnerabilities** × 1
 
+### Alert Monitoring
+
+The alerts command monitors unresolved security alerts for a machine:
+- **Counts only unresolved alerts** (status ≠ "Resolved")
+- **Excludes informational alerts** when critical/warning alerts exist
+- **Shows alert details** including creation time, title, and severity
+- **Default thresholds**: Warning at 1 alert, Critical at 0 (meaning any alert triggers warning)
+
 ### Onboarding Status Values
 
 - `0` - Onboarded ✅
@@ -145,6 +157,7 @@ timeout = 5
    - `Machine.Read.All`
    - `Vulnerability.Read`
    - `Vulnerability.Read.All`
+   - `Alert.Read.All`
 3. **Create Authentication** (Secret or Certificate)
 4. **Note Credentials** (Client ID, Tenant ID, Secret/Certificate)
 
@@ -182,6 +195,11 @@ define command {
     command_name    check_defender_vulnerabilities
     command_line    $USER1$/check_msdefender/bin/check_msdefender vulnerabilities -d $HOSTALIAS$ -W 10 -C 100
 }
+
+define command {
+    command_name    check_defender_alerts
+    command_line    $USER1$/check_msdefender/bin/check_msdefender alerts -d $HOSTALIAS$ -W 1 -C 5
+}
 ```
 
 ### Service Definitions
@@ -208,6 +226,13 @@ define service {
     check_command           check_defender_vulnerabilities
     hostgroup_name          msdefender
 }
+
+define service {
+    use                     generic-service
+    service_description     DEFENDER_ALERTS
+    check_command           check_defender_alerts
+    hostgroup_name          msdefender
+}
 ```
 
 ## 🏗️ Architecture
@@ -221,6 +246,7 @@ check_msdefender/
 │   │   ├── onboarding.py      # Onboarding status command
 │   │   ├── lastseen.py        # Last seen command
 │   │   ├── vulnerabilities.py # Vulnerabilities command
+│   │   ├── alerts.py          # Alerts monitoring command
 │   │   ├── machines.py        # List machines command
 │   │   └── detail.py          # Machine detail command
 │   ├── decorators.py          # Common CLI decorators
@@ -236,6 +262,7 @@ check_msdefender/
 │   ├── onboarding_service.py  # Onboarding business logic
 │   ├── lastseen_service.py    # Last seen business logic
 │   ├── vulnerabilities_service.py # Vulnerability business logic
+│   ├── alerts_service.py      # Alerts monitoring business logic
 │   ├── machines_service.py    # Machines business logic
 │   ├── detail_service.py      # Detail business logic
 │   └── models.py              # Data models
@@ -317,6 +344,14 @@ DEFENDER WARNING - Last seen: 10 days ago | lastseen=10;7;30;0;
 DEFENDER CRITICAL - Vulnerability score: 150 (1 Critical, 5 High) | vulnerabilities=150;10;100;0;
 ```
 
+### Alerts Warning
+```
+DEFENDER WARNING - Unresolved alerts for machine.domain.com | alerts=2;1;5;0;
+Unresolved alerts for machine.domain.com
+2025-09-14T10:22:14.12Z - Suspicious activity detected (New high)
+2025-09-14T12:00:00.00Z - Malware detection (InProgress medium)
+```
+
 ## 🔧 Troubleshooting
 
 ### Common Issues

{check_msdefender-1.0.0.dist-info → check_msdefender-1.1.1.dist-info}/RECORD

@@ -5,7 +5,8 @@ check_msdefender/cli/__init__.py,sha256=NWaS5ZI9_252AcReugF_WGPMOvQ_B7sC_s3pSrGu
 check_msdefender/cli/__main__.py,sha256=TuNsRSdnkQm9OdBTAwD5aB2zV_Irc50WgylVWhrfnLY,124
 check_msdefender/cli/decorators.py,sha256=iMd2zrQI2SVSTa9hD8w4AjFqsctFaWUIzdT8_cSTVG8,772
 check_msdefender/cli/handlers.py,sha256=RAUsH8gI_fQV4ZNvs3Ih1lCoSOSortpVWRhyQHXe6yU,1418
-check_msdefender/cli/commands/__init__.py,sha256=mKF0lp4uMI9VYQGFg7N4W74GOLmACeXWVxpReLvre34,644
+check_msdefender/cli/commands/__init__.py,sha256=VkPrCVpBK3DnhVDZuwd_4uK69JYAE9rHZBjAZhyOBII,730
+check_msdefender/cli/commands/alerts.py,sha256=R3Xb_X7fjc6zNQ0mYQ01DW_pIxIHu_NctbKjrZu8BH0,1834
 check_msdefender/cli/commands/detail.py,sha256=k2pDCGXtiGbKmXxDYUvkmUgmQA60jKdIzTY-Jt160jE,2532
 check_msdefender/cli/commands/lastseen.py,sha256=TJHArqLkQtXF1XL5U5Dk_ExfVhK95C2TJQg0WBHbyp8,1891
 check_msdefender/cli/commands/machines.py,sha256=uHpxc2j4iJnbhp2MRAW-KR1K0NPrqdqQtJbGgSRO5tk,1737
@@ -14,20 +15,21 @@ check_msdefender/cli/commands/vulnerabilities.py,sha256=EzllIUw67qAnarKVTy-zx4nW
 check_msdefender/core/__init__.py,sha256=naBiEkixiWTuHU3GENk8fqC8H3p_hkzRsmSY2uiM_TQ,47
 check_msdefender/core/auth.py,sha256=7mkGmhGHy4t38O0e4Rz7dQ52xfMbK3IUXMlw3u83aB4,1585
 check_msdefender/core/config.py,sha256=IoWBL_DB110F4i6hFfli6iFDBXx57dHh32lCuLkcgNk,1170
-check_msdefender/core/defender.py,sha256=5_Mq1p9WxlttQeeqnY9RCWgDbf2Wbagw4LUFY2aqrrA,7315
+check_msdefender/core/defender.py,sha256=XicGQrWuc9UCBr_Vc0SZxNSoZ_OwFXiFwfP_c9-eRtc,8838
 check_msdefender/core/exceptions.py,sha256=X4s_XM64SEVSs-4mGKqnF8xXwGFY3E0buvkgRNuCCX4,600
 check_msdefender/core/logging_config.py,sha256=27gLjvbP_AgedDQWZQEFfn_CGn5y6HcJQlI5jlxQHow,4067
 check_msdefender/core/nagios.py,sha256=nZSo-1VV57WFSieyRp456tw_OqpjXOoM_MEjnLkgxlE,6600
 check_msdefender/services/__init__.py,sha256=_fiKXxcz263IghXn9BnUWDKPgedhUPoSakEN3tBd2SU,44
+check_msdefender/services/alerts_service.py,sha256=RNdjsmL9YPjPl4Dv98Z9ceWhIt7k9g4lwIGpJTk9BUo,4069
 check_msdefender/services/detail_service.py,sha256=i-jXubNfsNf-fS6ba2MQecN886GzU0UC40DwS3HrnnY,3382
 check_msdefender/services/lastseen_service.py,sha256=LiNVeUbAoMzowMvE90P7zCtKFHBLbIDp5mmkVHRLwqs,3128
 check_msdefender/services/machines_service.py,sha256=5s5BXB4GUMQ8z3rPy32lybp0DslG0QVhWxm-n_AU97k,3119
 check_msdefender/services/models.py,sha256=8p8UHh86h9TjeYahhu_qCBpfuGGS3tObhtlpYk9kB8I,985
 check_msdefender/services/onboarding_service.py,sha256=RIOsvALCoKV0YqnCHKYRkelSPrO-F-6vNBLlto4MpiI,2686
 check_msdefender/services/vulnerabilities_service.py,sha256=ikD6E-hg7LtvCiTg7cTCqGSTly6Wgtql82NJD81D2n0,6812
-check_msdefender-1.0.0.dist-info/licenses/LICENSE,sha256=kW3DwIsKc9HVYdS4f4tI6sLo-EPqBQbz-WmuvHU4Nak,1065
-check_msdefender-1.0.0.dist-info/METADATA,sha256=feCju74gUaR5YTuoshCDVnYagetTZWpFt64Itep5ckw,12750
-check_msdefender-1.0.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-check_msdefender-1.0.0.dist-info/entry_points.txt,sha256=EMA_qKSvf5dC6yRrajd0W-UgS3C5Ce0o04i3_5A34Cs,63
-check_msdefender-1.0.0.dist-info/top_level.txt,sha256=0XgjD7gBWFImxE44zghS94ZGdonRZlfVEpfspnBnG5A,17
-check_msdefender-1.0.0.dist-info/RECORD,,
+check_msdefender-1.1.1.dist-info/licenses/LICENSE,sha256=kW3DwIsKc9HVYdS4f4tI6sLo-EPqBQbz-WmuvHU4Nak,1065
+check_msdefender-1.1.1.dist-info/METADATA,sha256=Ew5sloXo0tys9KMjetkTtsu35oPa2MYuqL3g0fPFkPw,14074
+check_msdefender-1.1.1.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+check_msdefender-1.1.1.dist-info/entry_points.txt,sha256=EMA_qKSvf5dC6yRrajd0W-UgS3C5Ce0o04i3_5A34Cs,63
+check_msdefender-1.1.1.dist-info/top_level.txt,sha256=0XgjD7gBWFImxE44zghS94ZGdonRZlfVEpfspnBnG5A,17
+check_msdefender-1.1.1.dist-info/RECORD,,