def set_log_source_values(module, qradar_request):
if module.params["type_name"]:
log_source_type_found = qradar_request.get_by_path(
"api/config/event_sources/log_source_management/log_source_types?filter={0}".format(
quote('name="{0}"'.format(module.params["type_name"]))
)
)[0]
if module.params["type_id"]:
log_source_type_found = qradar_request.get_by_path(
"api/config/event_sources/log_source_management/log_source_types?filter={0}".format(
quote('id="{0}"'.format(module.params["type_id"]))
)
)[0]
if log_source_type_found:
if not module.params["type_id"]:
module.params["type_id"] = log_source_type_found["id"]
else:
module.fail_json(
msg="Incompatible type provided, please consult QRadar Documentation for Log Source Types"
)
if module.params["protocol_type_id"]:
found_dict_in_list, _fdil_index = find_dict_in_list(
log_source_type_found["protocol_types"],
"protocol_id",
module.params["protocol_type_id"],
)
if not found_dict_in_list:
module.fail_json(
msg="Incompatible protocol_type_id provided, please consult QRadar Documentation for Log Source Types"
)
else:
# Set it to the default as provided by the QRadar Instance
module.params["protocol_type_id"] = log_source_type_found["protocol_types"][0][
"protocol_id"
]
module.params["protocol_parameters"] = [
{
"id": module.params["protocol_type_id"],
"name": "identifier",
"value": module.params["identifier"],
}
]
def main():
argspec = dict(
id=dict(required=False, type="int"),
name=dict(required=False, type="str"),
assigned_to=dict(required=False, type="str"),
closing_reason=dict(required=False, type="str"),
closing_reason_id=dict(required=False, type="int"),
follow_up=dict(required=False, type="bool", default=None),
protected=dict(required=False, type="bool", default=None),
status=dict(
required=False,
choices=["open", "OPEN", "hidden", "HIDDEN", "closed", "CLOSED"],
default="open",
type="str",
),
)
module = AnsibleModule(
argument_spec=argspec,
mutually_exclusive=[("closing_reason", "closing_reason_id")],
supports_check_mode=True,
)
qradar_request = QRadarRequest(
module,
headers={
"Content-Type": "application/json",
"Version": "9.1"
},
not_rest_data_keys=["name", "id", "assigned_to", "closing_reason"],
)
# if module.params['name']:
# # FIXME - QUERY HERE BY NAME NATIVELY VIA REST API (DOESN'T EXIST YET)
# found_offense = qradar_request.get_by_path('api/siem/offenses?filter={0}'.format(module.params['name']))
set_offense_values(module, qradar_request)
if module.params["id"]:
offenses = qradar_request.get_by_path("api/siem/offenses/{0}".format(
module.params["id"]))
else:
query_strs = []
if module.params["status"]:
query_strs.append(
quote("status={0}".format(to_text(module.params["status"]))))
if module.params["assigned_to"]:
query_strs.append(
quote("assigned_to={0}".format(module.params["assigned_to"])))
if module.params["closing_reason_id"]:
query_strs.append(
quote("closing_reason_id={0}".format(
module.params["closing_reason_id"])))
if module.params["follow_up"] is not None:
query_strs.append(
quote("follow_up={0}".format(module.params["follow_up"])))
if module.params["protected"] is not None:
query_strs.append(
quote("protected={0}".format(module.params["protected"])))
if query_strs:
offenses = qradar_request.get_by_path(
"api/siem/offenses?filter={0}".format("&".join(query_strs)))
else:
offenses = qradar_request.get_by_path("api/siem/offenses")
if module.params["name"]:
named_offense = find_dict_in_list(offenses, "description",
module.params["name"])
if named_offense:
offenses = named_offense
else:
offenses = []
module.exit_json(offenses=offenses, changed=False)
def main():
argspec = dict(
name=dict(required=True, type="str"),
state=dict(choices=["present", "absent"], required=True),
type_name=dict(required=False, type="str"),
type_id=dict(required=False, type="int"),
identifier=dict(required=True, type="str"),
protocol_type_id=dict(required=False, type="int"),
description=dict(required=True, type="str"),
)
module = AnsibleModule(
argument_spec=argspec,
required_one_of=[("type_name", "type_id")],
mutually_exclusive=[("type_name", "type_id")],
supports_check_mode=True,
)
qradar_request = QRadarRequest(
module,
headers={
"Content-Type": "application/json",
"Version": "9.1"
},
not_rest_data_keys=["state", "type_name", "identifier"],
)
log_source_exists = qradar_request.get_by_path(
"api/config/event_sources/log_source_management/log_sources?filter={0}"
.format(quote('name="{0}"'.format(module.params["name"]))))
if log_source_exists:
if module.params["state"] == "present":
existing_log_source_protocol_identifier, _elspi_index = find_dict_in_list(
log_source_exists[0]["protocol_parameters"], "name",
"identifier")
set_log_source_values(module, qradar_request)
comparison_map = [
existing_log_source_protocol_identifier["value"] ==
module.params["identifier"],
log_source_exists[0]["name"] == module.params["name"],
log_source_exists[0]["type_id"] == module.params["type_id"],
to_text(log_source_exists[0]["description"]) == to_text(
module.params["description"]),
]
if all(comparison_map):
module.exit_json(changed=False, msg="Nothing to do.")
else:
log_source_exists[0]["protocol_parameters"][
_elspi_index] = module.params["protocol_parameters"][0]
log_source_exists[0]["name"] = module.params["name"]
log_source_exists[0]["type_id"] = module.params["type_id"]
log_source_exists[0]["description"] = module.params[
"description"]
if module.check_mode:
qradar_return_data = {
"EMPTY": "IN CHECK MODE, NO TRANSACTION TOOK PLACE"
}
else:
qradar_return_data = qradar_request.create_update(
"api/config/event_sources/log_source_management/log_sources",
data=json.dumps(log_source_exists),
)
module.exit_json(
msg="Successfully updated log source: {0}".format(
module.params["name"]),
qradar_return_data=qradar_return_data,
changed=True,
)
if module.params["state"] == "absent":
if module.check_mode:
qradar_return_data = {
"EMPTY": "IN CHECK MODE, NO TRANSACTION TOOK PLACE"
}
else:
qradar_return_data = qradar_request.delete_by_path(
"api/config/event_sources/log_source_management/log_sources/{0}"
.format(log_source_exists[0]["id"]))
module.exit_json(
msg="Successfully deleted log source: {0}".format(
module.params["name"]),
qradar_return_data=qradar_return_data,
changed=True,
)
else:
if module.params["state"] == "present":
set_log_source_values(module, qradar_request)
if module.check_mode:
qradar_return_data = {
"EMPTY": "IN CHECK MODE, NO TRANSACTION TOOK PLACE"
}
else:
qradar_return_data = qradar_request.create_update(
"api/config/event_sources/log_source_management/log_sources",
data=json.dumps([qradar_request.get_data()]),
)
module.exit_json(
msg="Successfully created log source: {0}".format(
module.params["name"]),
qradar_return_data=qradar_return_data,
changed=True,
)
if module.params["state"] == "absent":
module.exit_json(changed=False, msg="Nothing to do.")