check-msdefender 1.1.16__tar.gz → 1.1.17__tar.gz

{check_msdefender-1.1.16 → check_msdefender-1.1.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: check-msdefender
-Version: 1.1.16
+Version: 1.1.17
 Summary: A Nagios plugin for monitoring Microsoft Defender API endpoints
 Keywords: nagios,monitoring,microsoft,graph,api,azure
 Author-Email: ldvchosal <ldvchosal@github.com>

{check_msdefender-1.1.16 → check_msdefender-1.1.17}/check_msdefender/__init__.py

@@ -1,4 +1,4 @@
 """Check Microsoft Defender API endpoints and check values - Nagios plugin."""
-__version__ = "1.1.16"
+__version__ = "1.1.17"
 __author__ = "ldvchosal"
 __email__ = "ldvchosa@github.com"

{check_msdefender-1.1.16 → check_msdefender-1.1.17}/check_msdefender/core/defender.py

@@ -225,14 +225,14 @@ class DefenderClient:
 
         token = self._get_token()
 
-        # Use the TVM API endpoint for products
-        url = f"{self.base_url}/api/machines/SoftwareVulnerabilitiesByMachine"
+        # Use the TVM API endpoint for vulnerabilities by machine
+        url = f"{self.base_url}/api/vulnerabilities/machinesVulnerabilities"
         headers = {
             "Authorization": f"Bearer {token}",
             "Content-Type": DefenderClient.application_json,
         }
 
-        params = {"pageIndex": "1", "pageSize": "50000"}
+        params = {"$top": "10000"}
 
         try:
             start_time = time.time()

{check_msdefender-1.1.16 → check_msdefender-1.1.17}/check_msdefender/services/machines_service.py

@@ -40,13 +40,13 @@ class MachinesService:
 
         # Liat machines
         # Define the sort order
-        status_priority = {"Onboarded": 1, "InsufficientInfo": 2, "Unsupported": 3}
+        status_priority = {"Onboarded": 1, "InsufficientInfo": 2, "Unsupported": 3, "CanBeOnboarded": 4}
 
-        # Sort by priority
+        # Sort by priority (unknown statuses get priority 99)
         sorted_machines = sorted(
             machines,
             key=lambda x: (
-                status_priority[x["onboardingStatus"] or ""],
+                status_priority.get(x["onboardingStatus"] or "", 99),
                 x["computerDnsName"] or "",
             ),
         )

{check_msdefender-1.1.16 → check_msdefender-1.1.17}/check_msdefender/services/products_service.py

@@ -54,7 +54,7 @@ class ProductsService:
         products_data = self.defender.get_products()
         all_products = products_data.get("value", [])
         products = [
-            product for product in all_products if product.get("deviceId") == target_machine_id
+            product for product in all_products if product.get("machineId") == target_machine_id
         ]
 
         self.logger.info(f"Found {len(products)} vulnerabilities for machine {target_dns_name}")
@@ -62,14 +62,14 @@ class ProductsService:
         # Group vulnerabilities by software
         software_vulnerabilities = {}
         for vulnerability in products:
-            software_name = vulnerability.get("softwareName", "Unknown")
-            software_version = vulnerability.get("softwareVersion", "Unknown")
-            software_vendor = vulnerability.get("softwareVendor", "Unknown")
+            software_name = vulnerability.get("productName", "Unknown")
+            software_version = vulnerability.get("productVersion", "Unknown")
+            software_vendor = vulnerability.get("productVendor", "Unknown")
             cve_id = vulnerability.get("cveId", "Unknown")
             cvss_score = vulnerability.get("cvssScore", 0)
             disk_paths = vulnerability.get("diskPaths", [])
             registry_paths = vulnerability.get("registryPaths", [])
-            severity = vulnerability.get("vulnerabilitySeverityLevel", "Unknown")
+            severity = vulnerability.get("severity", "Unknown")
 
             software_key = f"{software_name}-{software_version}-{software_vendor}"
 
@@ -101,7 +101,7 @@ class ProductsService:
         low_count = 0
 
         for vulnerability in products:
-            severityLevel = vulnerability.get("vulnerabilitySeverityLevel", "Unknown")
+            severityLevel = vulnerability.get("severity", "Unknown")
             severity = (severityLevel or "Unknown").lower()
             if severity == "critical":
                 critical_count += 1

{check_msdefender-1.1.16 → check_msdefender-1.1.17}/pyproject.toml

@@ -39,7 +39,7 @@ dependencies = [
     "azure-identity>=1.12.0",
     "click>=8.0,<9.0",
 ]
-version = "1.1.16"
+version = "1.1.17"
 
 [project.license]
 text = "MIT"