check-msdefender 1.1.0__py3-none-any.whl → 1.1.2__py3-none-any.whl

check_msdefender/check_msdefender.py

@@ -1,6 +1,5 @@
 """Main entry point for check_msdefender Nagios plugin."""
 
-import sys
 from check_msdefender.cli import main
 
 if __name__ == "__main__":

check_msdefender/cli/commands/alerts.py

@@ -1,7 +1,6 @@
 """Alerts commands for CLI."""
 
 import sys
-import click
 from typing import Optional, Any
 
 from check_msdefender.core.auth import get_authenticator

check_msdefender/cli/commands/detail.py

@@ -16,7 +16,6 @@ def register_detail_commands(main_group: Any) -> None:
     """Register detail commands with the main CLI group."""
 
     @main_group.command("detail")
-    @click.option("-i", "--id", "machine_id_alt", help="Machine ID (GUID)")
     @common_options
     def detail_cmd(
         config: str,
@@ -25,7 +24,6 @@ def register_detail_commands(main_group: Any) -> None:
         dns_name: Optional[str],
         warning: Optional[float],
         critical: Optional[float],
-        machine_id_alt: Optional[str],
     ) -> None:
         """Get detailed machine information from Microsoft Defender."""
         try:
@@ -44,9 +42,6 @@ def register_detail_commands(main_group: Any) -> None:
             # Create custom Nagios plugin for detail output
             plugin = NagiosPlugin(service, "detail")
 
-            # Use -i option if provided, otherwise fallback to -m
-            final_machine_id = machine_id_alt or machine_id
-
             # Set default thresholds for detail command to show proper performance data
             # Based on expected test output patterns
             if warning is not None and critical is None:
@@ -58,7 +53,7 @@ def register_detail_commands(main_group: Any) -> None:
 
             # Execute check
             result = plugin.check(
-                machine_id=final_machine_id,
+                machine_id=machine_id,
                 dns_name=dns_name,
                 warning=warning,
                 critical=critical,

check_msdefender/cli/commands/lastseen.py

@@ -1,7 +1,6 @@
 """Last seen commands for CLI."""
 
 import sys
-import click
 from typing import Optional, Any
 
 from check_msdefender.core.auth import get_authenticator

check_msdefender/cli/commands/machines.py

@@ -1,7 +1,6 @@
 """List machines commands for CLI."""
 
 import sys
-import click
 from typing import Optional, Any
 
 from check_msdefender.core.auth import get_authenticator

check_msdefender/cli/commands/onboarding.py

@@ -1,7 +1,6 @@
 """Onboarding status commands for CLI."""
 
 import sys
-import click
 from typing import Optional, Any
 
 from check_msdefender.core.auth import get_authenticator

check_msdefender/cli/commands/vulnerabilities.py

@@ -1,7 +1,6 @@
 """Vulnerability commands for CLI."""
 
 import sys
-import click
 from typing import Optional, Any
 
 from check_msdefender.core.auth import get_authenticator

check_msdefender/cli/decorators.py

@@ -10,7 +10,7 @@ def common_options(func: Callable[..., Any]) -> Callable[..., Any]:
         "-c", "--config", default="check_msdefender.ini", help="Configuration file path"
     )(func)
     func = click.option("-v", "--verbose", count=True, help="Increase verbosity")(func)
-    func = click.option("-m", "--machine-id", help="Machine ID (GUID)")(func)
+    func = click.option("-m", "--machine-id", "-i", "--id", help="Machine ID (GUID)")(func)
     func = click.option("-d", "--dns-name", help="Computer DNS Name (FQDN)")(func)
     func = click.option("-W", "--warning", type=float, help="Warning threshold")(func)
     func = click.option("-C", "--critical", type=float, help="Critical threshold")(func)

check_msdefender/cli/handlers.py

@@ -1,7 +1,6 @@
 """Error handlers and formatters for click CLI."""
 
 import click
-from typing import Any
 
 
 class ClickErrorHandler:

check_msdefender/services/alerts_service.py

@@ -1,7 +1,7 @@
 """Alerts service implementation."""
 
-from datetime import datetime
-from typing import Dict, Optional, Any, List
+from typing import Dict, Optional, Any
+
 from check_msdefender.core.exceptions import ValidationError
 from check_msdefender.core.logging_config import get_verbose_logger
 

check_msdefender/services/machines_service.py

@@ -1,7 +1,7 @@
 """Machines service implementation."""
 
 from typing import Dict, List, Any
-from check_msdefender.core.exceptions import ValidationError
+
 from check_msdefender.core.logging_config import get_verbose_logger
 
 

check_msdefender/services/models.py

@@ -2,8 +2,8 @@
 
 from dataclasses import dataclass
 from datetime import datetime
-from typing import Optional, List
 from enum import Enum
+from typing import Optional
 
 
 class OnboardingStatus(Enum):

{check_msdefender-1.1.0.dist-info → check_msdefender-1.1.2.dist-info}/METADATA

@@ -1,14 +1,10 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.1
 Name: check-msdefender
-Version: 1.1.0
+Version: 1.1.2
 Summary: A Nagios plugin for monitoring Microsoft Defender API endpoints
-Author-email: ldvchosal <ldvchosal@github.com>
-License: MIT
-Project-URL: Homepage, https://github.com/lduchosal/check_msdefender
-Project-URL: Bug Reports, https://github.com/lduchosal/check_msdefender/issues
-Project-URL: Source, https://github.com/lduchosal/check_msdefender
-Project-URL: Documentation, https://github.com/lduchosal/check_msdefender/blob/main/README.md
 Keywords: nagios,monitoring,microsoft,graph,api,azure
+Author-Email: ldvchosal <ldvchosal@github.com>
+License: MIT
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: System Administrators
 Classifier: License :: OSI Approved :: MIT License
@@ -19,9 +15,11 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Topic :: System :: Monitoring
 Classifier: Topic :: System :: Systems Administration
+Project-URL: Homepage, https://github.com/lduchosal/check_msdefender
+Project-URL: Bug Reports, https://github.com/lduchosal/check_msdefender/issues
+Project-URL: Source, https://github.com/lduchosal/check_msdefender
+Project-URL: Documentation, https://github.com/lduchosal/check_msdefender/blob/main/README.md
 Requires-Python: >=3.9
-Description-Content-Type: text/markdown
-License-File: LICENSE
 Requires-Dist: nagiosplugin>=1.4.0
 Requires-Dist: azure-identity>=1.12.0
 Requires-Dist: click<9.0,>=8.0
@@ -33,7 +31,8 @@ Requires-Dist: black>=21.0; extra == "dev"
 Requires-Dist: flake8>=3.8; extra == "dev"
 Requires-Dist: mypy>=0.800; extra == "dev"
 Requires-Dist: twine>=6.2.0; extra == "dev"
-Dynamic: license-file
+Requires-Dist: pdm>=2.0.0; extra == "dev"
+Description-Content-Type: text/markdown
 
 # 🛡️ Check MS Defender
 
@@ -46,7 +45,7 @@ A comprehensive **Nagios plugin** for monitoring Microsoft Defender for Endpoint
 ## ✨ Features
 
 - 🔐 **Dual Authentication** - Support for Client Secret and Certificate-based authentication
-- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, and machine details
+- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, alerts, and machine details
 - 📊 **Nagios Compatible** - Standard exit codes and performance data output
 - 🏗️ **Clean Architecture** - Modular design with testable components
 - 🔧 **Flexible Configuration** - File-based configuration with sensible defaults
@@ -78,6 +77,9 @@ check_msdefender lastseen -d machine.domain.tld -W 7 -C 30
 # Check vulnerabilities
 check_msdefender vulnerabilities -d machine.domain.tld -W 10 -C 100
 
+# Check alerts
+check_msdefender alerts -d machine.domain.tld -W 1 -C 5
+
 # List all machines
 check_msdefender machines
 
@@ -92,6 +94,7 @@ check_msdefender detail -d machine.domain.tld
 | `onboarding` | Check machine onboarding status | W:1, C:2 |
 | `lastseen` | Days since machine last seen | W:7, C:30 |
 | `vulnerabilities` | Vulnerability score calculation | W:10, C:100 |
+| `alerts` | Count of unresolved alerts | W:1, C:0 |
 | `machines` | List all machines | W:10, C:25 |
 | `detail` | Get detailed machine information | - |
 
@@ -103,6 +106,14 @@ The vulnerability score is calculated as:
 - **Medium vulnerabilities** × 5
 - **Low vulnerabilities** × 1
 
+### Alert Monitoring
+
+The alerts command monitors unresolved security alerts for a machine:
+- **Counts only unresolved alerts** (status ≠ "Resolved")
+- **Excludes informational alerts** when critical/warning alerts exist
+- **Shows alert details** including creation time, title, and severity
+- **Default thresholds**: Warning at 1 alert, Critical at 0 (meaning any alert triggers warning)
+
 ### Onboarding Status Values
 
 - `0` - Onboarded ✅
@@ -145,6 +156,7 @@ timeout = 5
    - `Machine.Read.All`
    - `Vulnerability.Read`
    - `Vulnerability.Read.All`
+   - `Alert.Read.All`
 3. **Create Authentication** (Secret or Certificate)
 4. **Note Credentials** (Client ID, Tenant ID, Secret/Certificate)
 
@@ -182,6 +194,11 @@ define command {
     command_name    check_defender_vulnerabilities
     command_line    $USER1$/check_msdefender/bin/check_msdefender vulnerabilities -d $HOSTALIAS$ -W 10 -C 100
 }
+
+define command {
+    command_name    check_defender_alerts
+    command_line    $USER1$/check_msdefender/bin/check_msdefender alerts -d $HOSTALIAS$ -W 1 -C 5
+}
 ```
 
 ### Service Definitions
@@ -208,6 +225,13 @@ define service {
     check_command           check_defender_vulnerabilities
     hostgroup_name          msdefender
 }
+
+define service {
+    use                     generic-service
+    service_description     DEFENDER_ALERTS
+    check_command           check_defender_alerts
+    hostgroup_name          msdefender
+}
 ```
 
 ## 🏗️ Architecture
@@ -221,6 +245,7 @@ check_msdefender/
 │   │   ├── onboarding.py      # Onboarding status command
 │   │   ├── lastseen.py        # Last seen command
 │   │   ├── vulnerabilities.py # Vulnerabilities command
+│   │   ├── alerts.py          # Alerts monitoring command
 │   │   ├── machines.py        # List machines command
 │   │   └── detail.py          # Machine detail command
 │   ├── decorators.py          # Common CLI decorators
@@ -236,6 +261,7 @@ check_msdefender/
 │   ├── onboarding_service.py  # Onboarding business logic
 │   ├── lastseen_service.py    # Last seen business logic
 │   ├── vulnerabilities_service.py # Vulnerability business logic
+│   ├── alerts_service.py      # Alerts monitoring business logic
 │   ├── machines_service.py    # Machines business logic
 │   ├── detail_service.py      # Detail business logic
 │   └── models.py              # Data models
@@ -317,6 +343,14 @@ DEFENDER WARNING - Last seen: 10 days ago | lastseen=10;7;30;0;
 DEFENDER CRITICAL - Vulnerability score: 150 (1 Critical, 5 High) | vulnerabilities=150;10;100;0;
 ```
 
+### Alerts Warning
+```
+DEFENDER WARNING - Unresolved alerts for machine.domain.com | alerts=2;1;5;0;
+Unresolved alerts for machine.domain.com
+2025-09-14T10:22:14.12Z - Suspicious activity detected (New high)
+2025-09-14T12:00:00.00Z - Malware detection (InProgress medium)
+```
+
 ## 🔧 Troubleshooting
 
 ### Common Issues
@@ -393,4 +427,4 @@ This project is licensed under the **MIT License** - see the [LICENSE](LICENSE)
 
 [🐛 Report Bug](https://github.com/lduchosal/check_msdefender/issues) • [💡 Request Feature](https://github.com/lduchosal/check_msdefender/issues) • [📖 Documentation](https://github.com/lduchosal/check_msdefender/blob/main/README.md)
 
-</div>
+</div>

check_msdefender-1.1.2.dist-info/RECORD

@@ -0,0 +1,34 @@
+check_msdefender-1.1.2.dist-info/METADATA,sha256=fJ9nhfz8Hx61xVoQ0KR-l7rNaJOCcqxU9YqBB3wrC1g,14071
+check_msdefender-1.1.2.dist-info/WHEEL,sha256=9P2ygRxDrTJz3gsagc0Z96ukrxjr-LFBGOgv3AuKlCA,90
+check_msdefender-1.1.2.dist-info/entry_points.txt,sha256=OqVzHI1PaD9V22g0K7BhA2nYv4O-pH8mcLzuGdsk5rM,79
+check_msdefender-1.1.2.dist-info/licenses/LICENSE,sha256=kW3DwIsKc9HVYdS4f4tI6sLo-EPqBQbz-WmuvHU4Nak,1065
+check_msdefender/__init__.py,sha256=HDn1Ub7Ohqkfko0kUPT8w7HqU52jXwo-leSTImO1x_k,161
+check_msdefender/__main__.py,sha256=TuNsRSdnkQm9OdBTAwD5aB2zV_Irc50WgylVWhrfnLY,124
+check_msdefender/check_msdefender.py,sha256=OO4Tg2DBW28AT-2LOH-qJM2pE5TPcF615BF7HjyZsmA,137
+check_msdefender/cli/__init__.py,sha256=NWaS5ZI9_252AcReugF_WGPMOvQ_B7sC_s3pSrGujcI,291
+check_msdefender/cli/__main__.py,sha256=TuNsRSdnkQm9OdBTAwD5aB2zV_Irc50WgylVWhrfnLY,124
+check_msdefender/cli/commands/__init__.py,sha256=VkPrCVpBK3DnhVDZuwd_4uK69JYAE9rHZBjAZhyOBII,730
+check_msdefender/cli/commands/alerts.py,sha256=bC3nSF1iE83hOjwJdrL76yBpH4ovnWYNUZTnMzoIdIw,1821
+check_msdefender/cli/commands/detail.py,sha256=qCATgEo_au7t93usEqyWAer6jYlHktQ7D_6iaeLvg3E,2284
+check_msdefender/cli/commands/lastseen.py,sha256=my-kW00ioaFdmec3zjqrLk12kt9Pld8rqu5n8wcT4Ys,1878
+check_msdefender/cli/commands/machines.py,sha256=uyQal7P4VI4a3dECFWgXKBiUPcdxhUrpWFOyKHmpORU,1724
+check_msdefender/cli/commands/onboarding.py,sha256=5QSP75uyrX0MQ1ABiGFSDKIzVszLF8U3uQ4bqFF9F2g,1912
+check_msdefender/cli/commands/vulnerabilities.py,sha256=fl8NYAO4Ug2Yk5NmQ6CT9TuibhFHWE01R6YjDIPgYl4,1931
+check_msdefender/cli/decorators.py,sha256=wRUv4vY6SL3nFjpYW9h1M1xDO_pzA6--gCtg3y6MmQM,786
+check_msdefender/cli/handlers.py,sha256=hp_CX_3qPoQGrPPVeiojb2j7tuFMva4ebWg9CxVUiPg,1395
+check_msdefender/core/__init__.py,sha256=naBiEkixiWTuHU3GENk8fqC8H3p_hkzRsmSY2uiM_TQ,47
+check_msdefender/core/auth.py,sha256=7mkGmhGHy4t38O0e4Rz7dQ52xfMbK3IUXMlw3u83aB4,1585
+check_msdefender/core/config.py,sha256=IoWBL_DB110F4i6hFfli6iFDBXx57dHh32lCuLkcgNk,1170
+check_msdefender/core/defender.py,sha256=XicGQrWuc9UCBr_Vc0SZxNSoZ_OwFXiFwfP_c9-eRtc,8838
+check_msdefender/core/exceptions.py,sha256=X4s_XM64SEVSs-4mGKqnF8xXwGFY3E0buvkgRNuCCX4,600
+check_msdefender/core/logging_config.py,sha256=27gLjvbP_AgedDQWZQEFfn_CGn5y6HcJQlI5jlxQHow,4067
+check_msdefender/core/nagios.py,sha256=nZSo-1VV57WFSieyRp456tw_OqpjXOoM_MEjnLkgxlE,6600
+check_msdefender/services/__init__.py,sha256=_fiKXxcz263IghXn9BnUWDKPgedhUPoSakEN3tBd2SU,44
+check_msdefender/services/alerts_service.py,sha256=poKZw1WKphmtPPnuMDrGRuPQbRLjLDZpo2rhFCh7TDc,4034
+check_msdefender/services/detail_service.py,sha256=i-jXubNfsNf-fS6ba2MQecN886GzU0UC40DwS3HrnnY,3382
+check_msdefender/services/lastseen_service.py,sha256=LiNVeUbAoMzowMvE90P7zCtKFHBLbIDp5mmkVHRLwqs,3128
+check_msdefender/services/machines_service.py,sha256=XTiEctJ2EmZrjPu3xBlFbC_UkkPbUROrPXmqX2bUYss,3059
+check_msdefender/services/models.py,sha256=CDmQ5vU0-GawIalqXjXNk3rry6gsyjv6eSlW2NiXwQ0,979
+check_msdefender/services/onboarding_service.py,sha256=RIOsvALCoKV0YqnCHKYRkelSPrO-F-6vNBLlto4MpiI,2686
+check_msdefender/services/vulnerabilities_service.py,sha256=ikD6E-hg7LtvCiTg7cTCqGSTly6Wgtql82NJD81D2n0,6812
+check_msdefender-1.1.2.dist-info/RECORD,,

{check_msdefender-1.1.0.dist-info → check_msdefender-1.1.2.dist-info}/WHEEL

@@ -1,5 +1,4 @@
 Wheel-Version: 1.0
-Generator: setuptools (80.9.0)
+Generator: pdm-backend (2.4.5)
 Root-Is-Purelib: true
 Tag: py3-none-any
-

{check_msdefender-1.1.0.dist-info → check_msdefender-1.1.2.dist-info}/entry_points.txt

@@ -1,2 +1,5 @@
 [console_scripts]
 check_msdefender = check_msdefender.cli:main
+
+[gui_scripts]
+

check_msdefender-1.1.0.dist-info/RECORD

@@ -1,35 +0,0 @@
-check_msdefender/__init__.py,sha256=HDn1Ub7Ohqkfko0kUPT8w7HqU52jXwo-leSTImO1x_k,161
-check_msdefender/__main__.py,sha256=TuNsRSdnkQm9OdBTAwD5aB2zV_Irc50WgylVWhrfnLY,124
-check_msdefender/check_msdefender.py,sha256=M_i2CIZWxfPisxxiWTFqGVAjoAS89euyVbbbtmaikQk,148
-check_msdefender/cli/__init__.py,sha256=NWaS5ZI9_252AcReugF_WGPMOvQ_B7sC_s3pSrGujcI,291
-check_msdefender/cli/__main__.py,sha256=TuNsRSdnkQm9OdBTAwD5aB2zV_Irc50WgylVWhrfnLY,124
-check_msdefender/cli/decorators.py,sha256=iMd2zrQI2SVSTa9hD8w4AjFqsctFaWUIzdT8_cSTVG8,772
-check_msdefender/cli/handlers.py,sha256=RAUsH8gI_fQV4ZNvs3Ih1lCoSOSortpVWRhyQHXe6yU,1418
-check_msdefender/cli/commands/__init__.py,sha256=VkPrCVpBK3DnhVDZuwd_4uK69JYAE9rHZBjAZhyOBII,730
-check_msdefender/cli/commands/alerts.py,sha256=R3Xb_X7fjc6zNQ0mYQ01DW_pIxIHu_NctbKjrZu8BH0,1834
-check_msdefender/cli/commands/detail.py,sha256=k2pDCGXtiGbKmXxDYUvkmUgmQA60jKdIzTY-Jt160jE,2532
-check_msdefender/cli/commands/lastseen.py,sha256=TJHArqLkQtXF1XL5U5Dk_ExfVhK95C2TJQg0WBHbyp8,1891
-check_msdefender/cli/commands/machines.py,sha256=uHpxc2j4iJnbhp2MRAW-KR1K0NPrqdqQtJbGgSRO5tk,1737
-check_msdefender/cli/commands/onboarding.py,sha256=I_hKWngVdSITkEFQ3pDE2oIGlYsCurG7XbCi_fKNoAM,1925
-check_msdefender/cli/commands/vulnerabilities.py,sha256=EzllIUw67qAnarKVTy-zx4nWVHDxg2icRsC1irdBhnU,1944
-check_msdefender/core/__init__.py,sha256=naBiEkixiWTuHU3GENk8fqC8H3p_hkzRsmSY2uiM_TQ,47
-check_msdefender/core/auth.py,sha256=7mkGmhGHy4t38O0e4Rz7dQ52xfMbK3IUXMlw3u83aB4,1585
-check_msdefender/core/config.py,sha256=IoWBL_DB110F4i6hFfli6iFDBXx57dHh32lCuLkcgNk,1170
-check_msdefender/core/defender.py,sha256=XicGQrWuc9UCBr_Vc0SZxNSoZ_OwFXiFwfP_c9-eRtc,8838
-check_msdefender/core/exceptions.py,sha256=X4s_XM64SEVSs-4mGKqnF8xXwGFY3E0buvkgRNuCCX4,600
-check_msdefender/core/logging_config.py,sha256=27gLjvbP_AgedDQWZQEFfn_CGn5y6HcJQlI5jlxQHow,4067
-check_msdefender/core/nagios.py,sha256=nZSo-1VV57WFSieyRp456tw_OqpjXOoM_MEjnLkgxlE,6600
-check_msdefender/services/__init__.py,sha256=_fiKXxcz263IghXn9BnUWDKPgedhUPoSakEN3tBd2SU,44
-check_msdefender/services/alerts_service.py,sha256=RNdjsmL9YPjPl4Dv98Z9ceWhIt7k9g4lwIGpJTk9BUo,4069
-check_msdefender/services/detail_service.py,sha256=i-jXubNfsNf-fS6ba2MQecN886GzU0UC40DwS3HrnnY,3382
-check_msdefender/services/lastseen_service.py,sha256=LiNVeUbAoMzowMvE90P7zCtKFHBLbIDp5mmkVHRLwqs,3128
-check_msdefender/services/machines_service.py,sha256=5s5BXB4GUMQ8z3rPy32lybp0DslG0QVhWxm-n_AU97k,3119
-check_msdefender/services/models.py,sha256=8p8UHh86h9TjeYahhu_qCBpfuGGS3tObhtlpYk9kB8I,985
-check_msdefender/services/onboarding_service.py,sha256=RIOsvALCoKV0YqnCHKYRkelSPrO-F-6vNBLlto4MpiI,2686
-check_msdefender/services/vulnerabilities_service.py,sha256=ikD6E-hg7LtvCiTg7cTCqGSTly6Wgtql82NJD81D2n0,6812
-check_msdefender-1.1.0.dist-info/licenses/LICENSE,sha256=kW3DwIsKc9HVYdS4f4tI6sLo-EPqBQbz-WmuvHU4Nak,1065
-check_msdefender-1.1.0.dist-info/METADATA,sha256=KqV6aUgS9lNXlAj6I6K4aa9CnQrgdlp3nq8aea1MRuQ,12750
-check_msdefender-1.1.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-check_msdefender-1.1.0.dist-info/entry_points.txt,sha256=EMA_qKSvf5dC6yRrajd0W-UgS3C5Ce0o04i3_5A34Cs,63
-check_msdefender-1.1.0.dist-info/top_level.txt,sha256=0XgjD7gBWFImxE44zghS94ZGdonRZlfVEpfspnBnG5A,17
-check_msdefender-1.1.0.dist-info/RECORD,,

check_msdefender-1.1.0.dist-info/top_level.txt

@@ -1 +0,0 @@
-check_msdefender