def get_page(self,
page_num=1,
page_size=None,
begin_time=None,
end_time=None,
event_types=None,
user_ids=None,
usernames=None,
user_ip_addresses=None,
affected_user_ids=None,
affected_usernames=None,
format=None,
**kwargs):
date_range = {}
if begin_time:
date_range[
"startTime"] = parse_timestamp_to_microseconds_precision(
begin_time)
if end_time:
date_range["endTime"] = parse_timestamp_to_microseconds_precision(
end_time)
uri = "/rpc/search/search-audit-log"
page_size = page_size or settings.items_per_page
params = dict(
page=page_num - 1,
pageSize=page_size,
dateRange=date_range,
eventTypes=to_list(event_types),
actorIds=to_list(user_ids),
actorNames=to_list(usernames),
actorIpAddresses=to_list(user_ip_addresses),
affectedUserIds=to_list(affected_user_ids),
affectedUserNames=to_list(affected_usernames),
)
params.update(**kwargs)
headers = HEADER_MAP.get(format.upper()) if format else None
return self._connection.post(uri, json=params, headers=headers)
def _get_security_detection_events(
self,
user_uid=None,
plan_uid=None,
cursor=None,
include_files=None,
event_types=None,
min_timestamp=None,
max_timestamp=None,
summarize=None,
):
uri = u"/api/SecurityDetectionEvent"
min_time_str = None
max_time_str = None
if min_timestamp:
min_time_str = parse_timestamp_to_microseconds_precision(
min_timestamp)
if max_timestamp:
max_time_str = parse_timestamp_to_microseconds_precision(
max_timestamp)
params = {
u"userUid": user_uid,
u"planUid": plan_uid,
u"cursor": cursor,
u"incFiles": include_files,
u"eventType": event_types,
u"minTs": min_time_str,
u"maxTs": max_time_str,
u"summarize": summarize,
}
return self._connection.get(uri, params=params)
def test_parse_timestamp_to_microseconds_precision_returns_expected_timestamp_with_float_time():
actual = util.parse_timestamp_to_microseconds_precision(1599653541.001002)
assert actual == "2020-09-09T12:12:21.001002Z"
def test_parse_timestamp_to_microseconds_precision_returns_expected_timestamp_with_datetime_time():
dt = datetime.strptime("2020-09-09 12:12:21", "%Y-%m-%d %H:%M:%S")
actual = util.parse_timestamp_to_microseconds_precision(dt)
assert actual == "2020-09-09T12:12:21.000000Z"
def test_parse_timestamp_to_microseconds_precision_when_given_unicode_returns_expected_timestamp_with_str_format_time():
actual = util.parse_timestamp_to_microseconds_precision("2020-09-09 12:12:21")
assert actual == "2020-09-09T12:12:21.000000Z"
def test_parse_timestamp_to_microseconds_precision_returns_expected_timestamp_with_str_format_time(
):
assert (util.parse_timestamp_to_microseconds_precision(
u"2020-09-09 12:12:21") == "2020-09-09T12:12:21.000000Z")
def test_parse_timestamp_to_microseconds_precision_returns_expected_timestamp_with_epoch_time(
):
assert (util.parse_timestamp_to_microseconds_precision(1599653541) ==
"2020-09-09T12:12:21.000000Z")
def _parse_timestamp(value):
return parse_timestamp_to_microseconds_precision(value)
