Skip to content

Commit d54bbb5

Browse files
omerazrDavide Schiera
authored andcommitted
Add metrics to the commands audit (#82)
To add the metrics param we need also to have from and to params in the API call. I'm adding default from/to params if needed.
1 parent a15376e commit d54bbb5

File tree

1 file changed

+19
-7
lines changed

1 file changed

+19
-7
lines changed

sdcclient/_secure.py

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
import json
33
import requests
44
import shutil
5+
import time
56
import os
67

78
from sdcclient._common import _SdcCommon
@@ -896,7 +897,7 @@ def get_compliance_results_csv(self, id):
896897

897898
return True, res.text
898899

899-
def list_commands_audit(self, from_sec=None, to_sec=None, scope_filter=None, command_filter=None, limit=100, offset=0):
900+
def list_commands_audit(self, from_sec=None, to_sec=None, scope_filter=None, command_filter=None, limit=100, offset=0, metrics=[]):
900901
'''**Description**
901902
List the commands audit.
902903
@@ -906,22 +907,29 @@ def list_commands_audit(self, from_sec=None, to_sec=None, scope_filter=None, com
906907
- scope_filter: this is a SysdigMonitor-like filter (e.g 'container.image=ubuntu'). When provided, commands are filtered by their scope, so only a subset will be returned (e.g. 'container.image=ubuntu' will provide only commands that have happened on an ubuntu container).
907908
- command_filter: this is a SysdigMonitor-like filter (e.g. command.comm="touch"). When provided, commands are filtered by some of their properties. Currently the supported set of filters is command.comm, command.cwd, command.pid, command.ppid, command.uid, command.loginshell.id, command.loginshell.distance
908909
- limit: Maximum number of commands in the response.
910+
- metrics: A list of metric values to include in the return.
909911
910912
**Success Return Value**
911913
A JSON representation of the commands audit.
912914
'''
913-
url = "{url}/api/commands?offset={offset}&limit={limit}{from_ts}{to_ts}{scope}{commandFilter}".format(
915+
if to_sec is None:
916+
to_sec = time.time()
917+
if from_sec is None:
918+
from_sec = to_sec - (24 * 60 * 60) # 1 day
919+
920+
url = "{url}/api/commands?from={frm}&to={to}&offset={offset}&limit={limit}{scope}{commandFilter}{metrics}".format(
914921
url=self.url,
915922
offset=offset,
916923
limit=limit,
917-
from_ts="&from_ts=%d" % (from_sec * 10**6) if from_sec else "",
918-
to_ts="&to_ts=%d" % (to_sec * 10**6) if to_sec else "",
924+
frm=int(from_sec * 10**6),
925+
to=int(to_sec * 10**6),
919926
scope="&scopeFilter=" + scope_filter if scope_filter else "",
920-
commandFilter="&commandFilter=" + command_filter if command_filter else "")
927+
commandFilter="&commandFilter=" + command_filter if command_filter else "",
928+
metrics="&metrics=" + json.dumps(metrics) if metrics else "")
921929
res = requests.get(url, headers=self.hdrs, verify=self.ssl_verify)
922930
return self._request_result(res)
923931

924-
def get_command_audit(self, id):
932+
def get_command_audit(self, id, metrics=[]):
925933
'''**Description**
926934
Get a command audit.
927935
@@ -931,6 +939,10 @@ def get_command_audit(self, id):
931939
**Success Return Value**
932940
A JSON representation of the command audit.
933941
'''
934-
url = "{url}/api/commands/{id}".format(url=self.url, id=id)
942+
url = "{url}/api/commands/{id}?from=0&to={to}{metrics}".format(
943+
url=self.url,
944+
id=id,
945+
to=int(time.time() * 10**6),
946+
metrics="&metrics=" + json.dumps(metrics) if metrics else "")
935947
res = requests.get(url, headers=self.hdrs, verify=self.ssl_verify)
936948
return self._request_result(res)

0 commit comments

Comments
 (0)