Example to add all users to Secure Operations team

Author: Phil Rzewski

examples/add_users_to_secure.py

@@ -0,0 +1,82 @@
+#!/usr/bin/env python
+#
+# Make sure all users are members of the Secure Operations team.
+#
+# As of when this script was written, there is only one team for
+# all Secure users. Newly-created users that land in the default
+# team for Monitor (such as those created via the API) will
+# therefore not be in the Secure Operations team. If you have an
+# environment where you want all users to have both Monitor and
+# Secure access by default, you could run this script periodically
+# (e.g. as a cron job) to make sure any such users are made part
+# of the Secure Operations team as well.
+#
+
+import os
+import sys
+import json
+import logging
+sys.path.insert(0, os.path.join(os.path.dirname(os.path.realpath(sys.argv[0])), '..'))
+from sdcclient import SdcClient
+
+#
+# Parse arguments
+#
+if len(sys.argv) != 2:
+    print 'usage: %s <sysdig-token>' % sys.argv[0]
+    print 'You can find your token at https://app.sysdigcloud.com/#/settings/user'
+    sys.exit(1)
+
+sdc_token = sys.argv[1]
+
+SECURE_TEAM_NAME = 'Secure Operations'
+
+#
+# As of when this script was written, the Secure Operations team does
+# not have the concepts of RBAC roles like "Read User" vs. "Edit User".
+# Rather, all members of the Secure team have full visibility within
+# Secure, which is associated with ROLE_TEAM_EDIT.
+#
+SECURE_TEAM_ROLE = 'ROLE_TEAM_EDIT'
+
+#
+# Instantiate the SDC client
+#
+sdclient = SdcClient(sdc_token, sdc_url='https://app.sysdigcloud.com')
+
+res = sdclient.get_teams(SECURE_TEAM_NAME)
+
+if res[0] == False:
+    print 'Unable to get teams: ', res[1]
+    sys.exit(1)
+memberships = {}
+for secure_team_user in res[1][0]['userRoles']:
+    memberships[secure_team_user['userId']] = secure_team_user['role']
+
+res = sdclient.get_users()
+
+if res[0] == False:
+    print 'Unable to get users: ', res[1]
+    sys.exit(1)
+all_users = res[1]
+
+#
+# The memberships passed into edit_team() are based on username
+# rather than ID, so convert the IDs.
+#
+for user in all_users:
+    if user['id'] in memberships:
+        print 'Will preserve existing membership for: ' + user['username']
+        memberships[user['username']] = memberships.pop(user['id'])
+    else:
+        print 'Will add new member: ' + user['username']
+        memberships[user['username']] = SECURE_TEAM_ROLE
+
+res = sdclient.edit_team(SECURE_TEAM_NAME, memberships=memberships)
+if res[0] == False:
+    print 'Could not edit team:', res[1], '. Exiting.'
+    sys.exit(1)
+else:
+    print 'Finished syncing memberships of "' + SECURE_TEAM_NAME + '" team'
+
+sys.exit(0)