PWObservationPcapDownload Deprecated

Deprecated. No available replacement.

python · ProtectWise

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401
from time import sleep


res = []
dArgs = demisto.args()
burstSize = demisto.get(dArgs, 'burstsize')
burstSize = int(burstSize) if burstSize else 10
remaining = burstSize
waitSeconds = demisto.get(dArgs, 'waitms')
waitSeconds = float(waitSeconds) / 1000.0 if waitSeconds else 1.0
dArgs["using-brand"] = "ProtectWise"
obIDs = argToList(demisto.get(dArgs, 'id'))
sensorIDs = demisto.get(dArgs, 'sensorId')
sensorList = [sensorIDs] if isinstance(sensorIDs, int) else argToList(sensorIDs)
for sensorId in sensorList:
    dArgs['sensorId'] = sensorId
    for oid in obIDs:
        dArgs['id'] = oid
        dArgs['filename'] = oid + '.pcap'
        if remaining:
            remaining -= 1
        else:
            sleep(waitSeconds)  # pylint: disable=sleep-exists
            remaining = burstSize
        resCmd = demisto.executeCommand("protectwise-observation-pcap-download", dArgs)
        try:
            res += resCmd
        except Exception as ex:
            res.append({"Type": entryTypes["error"], "ContentsFormat": formats["text"],
                        "Contents": "Error occurred while parsing output from command. Exception info:\n"
                        + str(ex) + "\n\nInvalid output:\n" + str(resCmd)})
demisto.results(res)

README

Downloads PCAPs related to the specified observations. This supports rate throttling.

Script Data


Name Description
Script Type python
Tags protectwise

Dependencies


This script uses the following commands and scripts.

  • observation-pcap-download

Inputs


Argument Name Description
id The observation ID. Can be, a comma-separated list of IDs.
sensorId The sensor ID. Can be, a comma-separated list of IDs.
filename The filename provided for the download.
burstsize The download burstsize files every time, and wait waitms milliseconds each time. The defaults are 10 files and 1 second.
waitms The download burstsize files every time, and wait waitms milliseconds each time. The defaults are 10 files and 1 second.

Outputs


There are no outputs for this script.