def set_log_source_values(module, qradar_request): if module.params["type_name"]: log_source_type_found = qradar_request.get_by_path( "api/config/event_sources/log_source_management/log_source_types?filter={0}".format( quote('name="{0}"'.format(module.params["type_name"])) ) )[0] if module.params["type_id"]: log_source_type_found = qradar_request.get_by_path( "api/config/event_sources/log_source_management/log_source_types?filter={0}".format( quote('id="{0}"'.format(module.params["type_id"])) ) )[0] if log_source_type_found: if not module.params["type_id"]: module.params["type_id"] = log_source_type_found["id"] else: module.fail_json( msg="Incompatible type provided, please consult QRadar Documentation for Log Source Types" ) if module.params["protocol_type_id"]: found_dict_in_list, _fdil_index = find_dict_in_list( log_source_type_found["protocol_types"], "protocol_id", module.params["protocol_type_id"], ) if not found_dict_in_list: module.fail_json( msg="Incompatible protocol_type_id provided, please consult QRadar Documentation for Log Source Types" ) else: # Set it to the default as provided by the QRadar Instance module.params["protocol_type_id"] = log_source_type_found["protocol_types"][0][ "protocol_id" ] module.params["protocol_parameters"] = [ { "id": module.params["protocol_type_id"], "name": "identifier", "value": module.params["identifier"], } ]
def main(): argspec = dict( id=dict(required=False, type="int"), name=dict(required=False, type="str"), assigned_to=dict(required=False, type="str"), closing_reason=dict(required=False, type="str"), closing_reason_id=dict(required=False, type="int"), follow_up=dict(required=False, type="bool", default=None), protected=dict(required=False, type="bool", default=None), status=dict( required=False, choices=["open", "OPEN", "hidden", "HIDDEN", "closed", "CLOSED"], default="open", type="str", ), ) module = AnsibleModule( argument_spec=argspec, mutually_exclusive=[("closing_reason", "closing_reason_id")], supports_check_mode=True, ) qradar_request = QRadarRequest( module, headers={ "Content-Type": "application/json", "Version": "9.1" }, not_rest_data_keys=["name", "id", "assigned_to", "closing_reason"], ) # if module.params['name']: # # FIXME - QUERY HERE BY NAME NATIVELY VIA REST API (DOESN'T EXIST YET) # found_offense = qradar_request.get_by_path('api/siem/offenses?filter={0}'.format(module.params['name'])) set_offense_values(module, qradar_request) if module.params["id"]: offenses = qradar_request.get_by_path("api/siem/offenses/{0}".format( module.params["id"])) else: query_strs = [] if module.params["status"]: query_strs.append( quote("status={0}".format(to_text(module.params["status"])))) if module.params["assigned_to"]: query_strs.append( quote("assigned_to={0}".format(module.params["assigned_to"]))) if module.params["closing_reason_id"]: query_strs.append( quote("closing_reason_id={0}".format( module.params["closing_reason_id"]))) if module.params["follow_up"] is not None: query_strs.append( quote("follow_up={0}".format(module.params["follow_up"]))) if module.params["protected"] is not None: query_strs.append( quote("protected={0}".format(module.params["protected"]))) if query_strs: offenses = qradar_request.get_by_path( "api/siem/offenses?filter={0}".format("&".join(query_strs))) else: offenses = qradar_request.get_by_path("api/siem/offenses") if module.params["name"]: named_offense = find_dict_in_list(offenses, "description", module.params["name"]) if named_offense: offenses = named_offense else: offenses = [] module.exit_json(offenses=offenses, changed=False)
def main(): argspec = dict( name=dict(required=True, type="str"), state=dict(choices=["present", "absent"], required=True), type_name=dict(required=False, type="str"), type_id=dict(required=False, type="int"), identifier=dict(required=True, type="str"), protocol_type_id=dict(required=False, type="int"), description=dict(required=True, type="str"), ) module = AnsibleModule( argument_spec=argspec, required_one_of=[("type_name", "type_id")], mutually_exclusive=[("type_name", "type_id")], supports_check_mode=True, ) qradar_request = QRadarRequest( module, headers={ "Content-Type": "application/json", "Version": "9.1" }, not_rest_data_keys=["state", "type_name", "identifier"], ) log_source_exists = qradar_request.get_by_path( "api/config/event_sources/log_source_management/log_sources?filter={0}" .format(quote('name="{0}"'.format(module.params["name"])))) if log_source_exists: if module.params["state"] == "present": existing_log_source_protocol_identifier, _elspi_index = find_dict_in_list( log_source_exists[0]["protocol_parameters"], "name", "identifier") set_log_source_values(module, qradar_request) comparison_map = [ existing_log_source_protocol_identifier["value"] == module.params["identifier"], log_source_exists[0]["name"] == module.params["name"], log_source_exists[0]["type_id"] == module.params["type_id"], to_text(log_source_exists[0]["description"]) == to_text( module.params["description"]), ] if all(comparison_map): module.exit_json(changed=False, msg="Nothing to do.") else: log_source_exists[0]["protocol_parameters"][ _elspi_index] = module.params["protocol_parameters"][0] log_source_exists[0]["name"] = module.params["name"] log_source_exists[0]["type_id"] = module.params["type_id"] log_source_exists[0]["description"] = module.params[ "description"] if module.check_mode: qradar_return_data = { "EMPTY": "IN CHECK MODE, NO TRANSACTION TOOK PLACE" } else: qradar_return_data = qradar_request.create_update( "api/config/event_sources/log_source_management/log_sources", data=json.dumps(log_source_exists), ) module.exit_json( msg="Successfully updated log source: {0}".format( module.params["name"]), qradar_return_data=qradar_return_data, changed=True, ) if module.params["state"] == "absent": if module.check_mode: qradar_return_data = { "EMPTY": "IN CHECK MODE, NO TRANSACTION TOOK PLACE" } else: qradar_return_data = qradar_request.delete_by_path( "api/config/event_sources/log_source_management/log_sources/{0}" .format(log_source_exists[0]["id"])) module.exit_json( msg="Successfully deleted log source: {0}".format( module.params["name"]), qradar_return_data=qradar_return_data, changed=True, ) else: if module.params["state"] == "present": set_log_source_values(module, qradar_request) if module.check_mode: qradar_return_data = { "EMPTY": "IN CHECK MODE, NO TRANSACTION TOOK PLACE" } else: qradar_return_data = qradar_request.create_update( "api/config/event_sources/log_source_management/log_sources", data=json.dumps([qradar_request.get_data()]), ) module.exit_json( msg="Successfully created log source: {0}".format( module.params["name"]), qradar_return_data=qradar_return_data, changed=True, ) if module.params["state"] == "absent": module.exit_json(changed=False, msg="Nothing to do.")