check-msdefender 1.1.15__tar.gz → 1.1.17__tar.gz

{check_msdefender-1.1.15 → check_msdefender-1.1.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: check-msdefender
-Version: 1.1.15
+Version: 1.1.17
 Summary: A Nagios plugin for monitoring Microsoft Defender API endpoints
 Keywords: nagios,monitoring,microsoft,graph,api,azure
 Author-Email: ldvchosal <ldvchosal@github.com>

{check_msdefender-1.1.15 → check_msdefender-1.1.17}/check_msdefender/__init__.py

@@ -1,4 +1,4 @@
 """Check Microsoft Defender API endpoints and check values - Nagios plugin."""
-__version__ = "1.1.15"
+__version__ = "1.1.17"
 __author__ = "ldvchosal"
 __email__ = "ldvchosa@github.com"

{check_msdefender-1.1.15 → check_msdefender-1.1.17}/check_msdefender/core/defender.py

@@ -225,14 +225,14 @@ class DefenderClient:
 
         token = self._get_token()
 
-        # Use the TVM API endpoint for products
-        url = f"{self.base_url}/api/machines/SoftwareVulnerabilitiesByMachine"
+        # Use the TVM API endpoint for vulnerabilities by machine
+        url = f"{self.base_url}/api/vulnerabilities/machinesVulnerabilities"
         headers = {
             "Authorization": f"Bearer {token}",
             "Content-Type": DefenderClient.application_json,
         }
 
-        params = {"pageIndex": "1", "pageSize": "50000"}
+        params = {"$top": "10000"}
 
         try:
             start_time = time.time()

{check_msdefender-1.1.15 → check_msdefender-1.1.17}/check_msdefender/core/nagios.py

@@ -1,4 +1,5 @@
 """Nagios plugin implementation."""
+import traceback
 
 import nagiosplugin
 from typing import List, Optional, Union, Any
@@ -137,7 +138,7 @@ class NagiosPlugin:
                 return int(e.code) if e.code is not None else 0
 
         except Exception as e:
-            print(f"UNKNOWN: {str(e)}")
+            print(f"UNKNOWN: {str(e)}\n{traceback.format_exc()}")
             return 3
 
 

{check_msdefender-1.1.15 → check_msdefender-1.1.17}/check_msdefender/services/machines_service.py

@@ -40,13 +40,13 @@ class MachinesService:
 
         # Liat machines
         # Define the sort order
-        status_priority = {"Onboarded": 1, "InsufficientInfo": 2, "Unsupported": 3}
+        status_priority = {"Onboarded": 1, "InsufficientInfo": 2, "Unsupported": 3, "CanBeOnboarded": 4}
 
-        # Sort by priority
+        # Sort by priority (unknown statuses get priority 99)
         sorted_machines = sorted(
             machines,
             key=lambda x: (
-                status_priority[x["onboardingStatus"] or ""],
+                status_priority.get(x["onboardingStatus"] or "", 99),
                 x["computerDnsName"] or "",
             ),
         )

{check_msdefender-1.1.15 → check_msdefender-1.1.17}/check_msdefender/services/products_service.py

@@ -54,7 +54,7 @@ class ProductsService:
         products_data = self.defender.get_products()
         all_products = products_data.get("value", [])
         products = [
-            product for product in all_products if product.get("deviceId") == target_machine_id
+            product for product in all_products if product.get("machineId") == target_machine_id
         ]
 
         self.logger.info(f"Found {len(products)} vulnerabilities for machine {target_dns_name}")
@@ -62,14 +62,14 @@ class ProductsService:
         # Group vulnerabilities by software
         software_vulnerabilities = {}
         for vulnerability in products:
-            software_name = vulnerability.get("softwareName", "Unknown")
-            software_version = vulnerability.get("softwareVersion", "Unknown")
-            software_vendor = vulnerability.get("softwareVendor", "Unknown")
+            software_name = vulnerability.get("productName", "Unknown")
+            software_version = vulnerability.get("productVersion", "Unknown")
+            software_vendor = vulnerability.get("productVendor", "Unknown")
             cve_id = vulnerability.get("cveId", "Unknown")
             cvss_score = vulnerability.get("cvssScore", 0)
             disk_paths = vulnerability.get("diskPaths", [])
             registry_paths = vulnerability.get("registryPaths", [])
-            severity = vulnerability.get("vulnerabilitySeverityLevel", "Unknown")
+            severity = vulnerability.get("severity", "Unknown")
 
             software_key = f"{software_name}-{software_version}-{software_vendor}"
 
@@ -101,7 +101,8 @@ class ProductsService:
         low_count = 0
 
         for vulnerability in products:
-            severity = vulnerability.get("vulnerabilitySeverityLevel", "Unknown").lower()
+            severityLevel = vulnerability.get("severity", "Unknown")
+            severity = (severityLevel or "Unknown").lower()
             if severity == "critical":
                 critical_count += 1
             elif severity == "high":
@@ -133,15 +134,16 @@ class ProductsService:
                 cve_list = ", ".join(unique_cves[:5])  # Show first 5 CVEs
                 severities = ""
                 # Count severities
-                severity_counts = {"Critical": 0, "High": 0, "Medium": 0, "Low": 0}
+                severity_counts = {"Critical": 0, "High": 0, "Medium": 0, "Low": 0, "Unknown": 0}
                 for sev in software["severities"]:
+                    sev = (sev or "Unknown")
                     severity_counts[sev] += 1
                 severities = ", ".join(
                     f"{key}: {value}" for key, value in severity_counts.items() if value > 0
                 )
 
                 for cve in software["cves"]:
-                    severity = cve["severity"].lower()
+                    severity = (cve["severity"] or "Unknown").lower()
                     if severity == "critical":
                         score += 100
                     elif severity == "high":

{check_msdefender-1.1.15 → check_msdefender-1.1.17}/pyproject.toml

@@ -39,7 +39,7 @@ dependencies = [
     "azure-identity>=1.12.0",
     "click>=8.0,<9.0",
 ]
-version = "1.1.15"
+version = "1.1.17"
 
 [project.license]
 text = "MIT"