Skip to content

Commit 82f89ad

Browse files
omerazrDavide Schiera
authored andcommitted
Add support to commands audit (#80)
1 parent 6bfd743 commit 82f89ad

File tree

1 file changed

+39
-0
lines changed

1 file changed

+39
-0
lines changed

sdcclient/_secure.py

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -895,3 +895,42 @@ def get_compliance_results_csv(self, id):
895895
return False, self.lasterr
896896

897897
return True, res.text
898+
899+
def list_commands_audit(self, from_sec=None, to_sec=None, scope_filter=None, command_filter=None, limit=100, offset=0):
900+
'''**Description**
901+
List the commands audit.
902+
903+
**Arguments**
904+
- from_sec: the start of the timerange for which to get commands audit.
905+
- end_sec: the end of the timerange for which to get commands audit.
906+
- scope_filter: this is a SysdigMonitor-like filter (e.g 'container.image=ubuntu'). When provided, commands are filtered by their scope, so only a subset will be returned (e.g. 'container.image=ubuntu' will provide only commands that have happened on an ubuntu container).
907+
- command_filter: this is a SysdigMonitor-like filter (e.g. command.comm="touch"). When provided, commands are filtered by some of their properties. Currently the supported set of filters is command.comm, command.cwd, command.pid, command.ppid, command.uid, command.loginshell.id, command.loginshell.distance
908+
- limit: Maximum number of commands in the response.
909+
910+
**Success Return Value**
911+
A JSON representation of the commands audit.
912+
'''
913+
url = "{url}/api/commands?offset={offset}&limit={limit}{from_ts}{to_ts}{scope}{commandFilter}".format(
914+
url=self.url,
915+
offset=offset,
916+
limit=limit,
917+
from_ts="&from_ts=%d" % (from_sec * 10**6) if from_sec else "",
918+
to_ts="&to_ts=%d" % (to_sec * 10**6) if to_sec else "",
919+
scope="&scopeFilter=" + scope_filter if scope_filter else "",
920+
commandFilter="&commandFilter=" + command_filter if command_filter else "")
921+
res = requests.get(url, headers=self.hdrs, verify=self.ssl_verify)
922+
return self._request_result(res)
923+
924+
def get_command_audit(self, id):
925+
'''**Description**
926+
Get a command audit.
927+
928+
**Arguments**
929+
- id: the id of the command audit to get.
930+
931+
**Success Return Value**
932+
A JSON representation of the command audit.
933+
'''
934+
url = "{url}/api/commands/{id}".format(url=self.url, id=id)
935+
res = requests.get(url, headers=self.hdrs, verify=self.ssl_verify)
936+
return self._request_result(res)

0 commit comments

Comments
 (0)