import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 # -*- coding: utf-8 -*- from CommonServerUserPython import * """ IMPORTS """ import json import random import string from datetime import datetime, timedelta import defusedxml.ElementTree as defused_ET import requests import urllib3 # Disable insecure warnings urllib3.disable_warnings() """ GLOBALS/PARAMS """ TOKEN = demisto.params().get("credentials_api_token", {}).get("password") or demisto.params().get("token", "") BASE_URL = demisto.params().get("url", "").strip("/") INSECURE = not demisto.params().get("insecure") CLUSTER_ID = demisto.params().get("cluster-id") ENTITY_ID = demisto.params().get("entity-id") # Headers to be sent in requests HEADERS = { "Authorization": "Bearer " + TOKEN, "Content-Type": "application/json", } HOSTS_HEADERS = [ "ID", "Name", "EntityId", "EntityName", "OS", "Status", "Location", "RiskLevel", "ThreatLevel", "ThreatLevelComments", "DateUpdated", "HostZone", ] LOGS_HEADERS = ["Level", "Computer", "Channel", "Keywords", "EventData"] PERSON_HEADERS = ["ID", "HostStatus", "IsAPIPerson", "FirstName", "LastName", "UserID", "UserLogin", "DateUpdated"] NETWORK_HEADERS = [ "ID", "BeganIP", "EndIP", "HostStatus", "Name", "RiskLevel", "EntityId", "EntityName", "Location", "ThreatLevel", "DateUpdated", "HostZone", ] ALARM_SUMMARY_HEADERS = ["PIFType", "DrillDownSummaryLogs"] USER_HEADERS = [ "ID", "DateUpdated", "HostStatus", "LastName", "FirstName", "UserType", "Entity", "Owner", "ReadAccess", "WriteAccess", ] LOGIN_HEADERS = ["Login", "UserProfileId", "UserId", "DefaultEntityId", "HostStatus", "DateUpdated", "DateCreated"] PROFILE_HEADERS = [ "ID", "Name", "ShortDescription", "LongDescription", "DataProcessorAccessMode", "SecurityRole", "ProfileType", "DateUpdated", "TotalAssociatedUsers", ] PIF_TYPES = { "1": "Direction", "2": "Priority", "3": "Normal Message Date", "4": "First Normal Message Date", "5": "Last Normal Message Date", "6": "Count", "7": "MessageDate", "8": "Entity", "9": "Log Source", "10": "Log Source Host", "11": "Log Source Type", "12": "Log Class Type", "13": "Log Class", "14": "Common Event", "15": "MPE Rule", "16": "Source", "17": "Destination", "18": "Service", "19": "Known Host", "20": "Known Host (Origin)", "21": "Known Host (Impacted)", "22": "Known Service", "23": "IP", "24": "IP Address (Origin)", "25": "IP Address (Impacted)", "26": "Host Name", "27": "Host Name (Origin)", "28": "Host Name (Impacted)", "29": "Port (Origin)", "30": "Port (Impacted)", "31": "Protocol", "32": "User (Origin)", "33": "User (Impacted)", "34": "Sender", "35": "Recipient", "36": "Subject", "37": "Object", "38": "Vendor Message ID", "39": "Vendor Message Name", "40": "Bytes In", "41": "Bytes Out", "42": "Items In", "43": "Items Out", "44": "Duration", "45": "Time Start", "46": "Time End", "47": "Process", "48": "Amount", "49": "Quantity", "50": "Rate", "51": "Size", "52": "Domain (Impacted)", "53": "Group", "54": "URL", "55": "Session", "56": "Sequence", "57": "Network (Origin)", "58": "Network (Impacted)", "59": "Location (Origin)", "60": "Country (Origin)", "61": "Region (Origin)", "62": "City (Origin)", "63": "Location (Impacted)", "64": "Country (Impacted)", "65": "Region (Impacted)", "66": "City (Impacted)", "67": "Entity (Origin)", "68": "Entity (Impacted)", "69": "Zone (Origin)", "70": "Zone (Impacted)", "72": "Zone", "73": "User", "74": "Address", "75": "MAC", "76": "NATIP", "77": "Interface", "78": "NATPort", "79": "Entity (Impacted or Origin)", "80": "RootEntity", "100": "Message", "200": "MediatorMsgID", "201": "MARCMsgID", "1040": "MAC (Origin)", "1041": "MAC (Impacted)", "1042": "NATIP (Origin)", "1043": "NATIP (Impacted)", "1044": "Interface (Origin)", "1045": "Interface (Impacted)", "1046": "PID", "1047": "Severity", "1048": "Version", "1049": "Command", "1050": "ObjectName", "1051": "NATPort (Origin)", "1052": "NATPort (Impacted)", "1053": "Domain (Origin)", "1054": "Hash", "1055": "Policy", "1056": "Vendor Info", "1057": "Result", "1058": "Object Type", "1059": "CVE", "1060": "UserAgent", "1061": "Parent Process Id", "1062": "Parent Process Name", "1063": "Parent Process Path", "1064": "Serial Number", "1065": "Reason", "1066": "Status", "1067": "Threat Id", "1068": "Threat Name", "1069": "Session Type", "1070": "Action", "1071": "Response Code", "1072": "User (Origin) Identity ID", "1073": "User (Impacted) Identity ID", "1074": "Sender Identity ID", "1075": "Recipient Identity ID", "1076": "User (Origin) Identity", "1077": "User (Impacted) Identity", "1078": "Sender Identity", "1079": "Recipient Identity", "1080": "User (Origin) Identity Domain", "1081": "User (Impacted) Identity Domain", "1082": "Sender Identity Domain", "1083": "Recipient Identity Domain", "1084": "User (Origin) Identity Company", "1085": "User (Impacted) Identity Company", "1086": "Sender Identity Company", "1087": "Recipient Identity Company", "1088": "User (Origin) Identity Department", "1089": "User (Impacted) Identity Department", "1090": "Sender Identity Department", "1091": "Recipient Identity Department", "1092": "User (Origin) Identity Title", "1093": "User (Impacted) Identity Title", "1094": "Sender Identity Title", "1095": "Recipient Identity Title", "10001": "Source Or Destination", "10002": "Port (Origin or Impacted)", "10003": "Network (Origin or Impacted)", "10004": "Location (Origin or Impacted)", "10005": "Country (Origin or Impacted)", "10006": "Region (Origin or Impacted)", "10007": "City (Origin or Impacted)", "10008": "Bytes In/Out", "10009": "Items In/Out", } ALARM_STATUS = { "0": "Waiting", "1": "In queue", "2": "Sent to SvcHost", "3": "Queued for retry", "4": "Completed", } # Mapping type and name fields SOURCE_TYPE_MAP = { "API_-_AWS_CloudTrail": 1000598, "API_-_AWS_CloudWatch_Alarm": 1000607, "API_-_AWS_Config_Event": 1000610, "API_-_AWS_S3_Flat_File": 1000703, "API_-_AWS_S3_Server_Access_Event": 1000575, "API_-_BeyondTrust_Retina_Vulnerability_Management": 1000299, "API_-_Box_Event": 1000633, "API_-_Cisco_IDS/IPS": 1000025, "API_-_Cradlepoint_ECM": 1000600, "API_-_IP360_Vulnerability_Scanner": 1000589, "API_-_Metasploit_Penetration_Scanner": 1000297, "API_-_Nessus_Vulnerability_Scanner": 1000237, "API_-_NetApp_CIFS_Security_Audit_Event_Log": 1000238, "API_-_NeXpose_Vulnerability_Scanner": 1000296, "API_-_Office_365_Management_Activity": 1000645, "API_-_Office_365_Message_Tracking": 1000730, "API_-_Okta_Event": 1000618, "API_-_Qualys_Vulnerability_Scanner": 1000232, "API_-_Salesforce_EventLogFile": 1000609, "API_-_Sourcefire_eStreamer": 1000298, "API_-_Tenable_SecurityCenter": 1000663, "API_-_Tenable.io_Scanner": 1000624, "Flat_File_-_ActivIdentity_CMS": 1000494, "Flat_File_-_Airwatch_MDM": 1000337, "Flat_File_-_Alfresco": 1000604, "Flat_File_-_AllScripts": 1000734, "Flat_File_-_Apache_Access_Log": 1000000001, "Flat_File_-_Apache_Error_Log": 80, "Flat_File_-_Apache_SSL_Access_Log": 1000000002, "Flat_File_-_Apache_SSL_Error_Log": 82, "Flat_File_-_Apache_Tomcat_Access_Log": 1000056, "Flat_File_-_Apache_Tomcat_Console_Log": 1000465, "Flat_File_-_Avaya_Secure_Access_Link_Remote_Access_Log": 1000474, "Flat_File_-_Avaya_Voice_Mail_Log": 131, "Flat_File_-_Axway_SFTP": 1000372, "Flat_File_-_Beacon_Endpoint_Profiler": 1000518, "Flat_File_-_Bind_9": 1000084, "Flat_File_-_BlackBerry_Enterprise_Server": 164, "Flat_File_-_Blue_Coat_Proxy_BCREPORTERMAIN_Format": 1000000006, "Flat_File_-_Blue_Coat_Proxy_CSV_Format": 95, "Flat_File_-_Blue_Coat_Proxy_SQUID-1_Format": 167, "Flat_File_-_Blue_Coat_Proxy_W3C_Format": 1000003, "Flat_File_-_Bro_IDS_Critical_Stack_Intel_Log": 1000611, "Flat_File_-_Broadcom_SiteMinder": 1000794, "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTDS": 1000379, "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTEL": 1000386, "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTJL": 1000385, "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTLL": 1000384, "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTNV": 1000383, "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTOM": 1000371, "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTPW": 1000380, "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTRL": 1000382, "Flat_File_-_CA_ACF2_for_z/OS_-_ACFRPTRV": 1000381, "Flat_File_-_CA_ControlMinder": 1000345, "Flat_File_-_Cerberus_FTP_Server": 1000417, "Flat_File_-_Cerner": 1000422, "Flat_File_-_Cisco_AMP_for_Endpoints": 1000744, "Flat_File_-_Cisco_Email_Security_Appliance": 1000615, "Flat_File_-_Cisco_LMS_(cwcli)": 1000212, "Flat_File_-_Cisco_LMS_(Syslog)": 1000207, "Flat_File_-_Cisco_NGFW": 1000107, "Flat_File_-_Cisco_Secure_ACS_CSV_File": 139, "Flat_File_-_Cisco_Security_Agent": 1000094, "Flat_File_-_Cisco_Umbrella_DNS": 1000705, "Flat_File_-_Cisco_Web_Security_aclog": 1000224, "Flat_File_-_Citrix_Access_Gateway_IIS_Format": 1000024, "Flat_File_-_Citrix_Access_Gateway_NCSA_Common_Format": 1000023, "Flat_File_-_Citrix_Access_Gateway_W3C_Format": 1000022, "Flat_File_-_Citrix_Presentation_Server": 1000086, "Flat_File_-_Citrix_Secure_Gateway": 1000440, "Flat_File_-_ClamAV_Anti-Virus": 1000052, "Flat_File_-_ColdFusion_Application_Log": 1000357, "Flat_File_-_ColdFusion_Exception_Log": 1000395, "Flat_File_-_ColdFusion_Mail_Log": 1000361, "Flat_File_-_ColdFusion_Mailsent_Log": 1000360, "Flat_File_-_ColdFusion_Server_Log": 1000355, "Flat_File_-_Cornerstone_Managed_File_Transfer": 1000374, "Flat_File_-_Coyote_Point_Equalizer": 1000214, "Flat_File_-_DB2_Audit_Log": 1000035, "Flat_File_-_DB2_via_BMC_Log_Master": 1000290, "Flat_File_-_Defender_Server": 1000151, "Flat_File_-_DocWorks": 1000424, "Flat_File_-_eClinicalWorks_Audit_Log": 1000748, "Flat_File_-_EMC_Isilon": 1000563, "Flat_File_-_Epicor_Coalition": 1000124, "Flat_File_-_FairWarning_Ready-For-Healthcare": 1000269, "Flat_File_-_FileZilla_System_Log": 1000564, "Flat_File_-_FireEye_Web_MPS": 1000310, "Flat_File_-_Forcepoint_Web_Security_CEF_Cloud_Format": 1000706, "Flat_File_-_Forescout_CounterACT": 1000501, "Flat_File_-_FoxT_BoKS_Server_Access_Control": 1000688, "Flat_File_-_FundsXpress": 1000517, "Flat_File_-_Gene6_FTP": 154, "Flat_File_-_GlobalSCAPE_EFT": 1000231, "Flat_File_-_Hadoop": 1000457, "Flat_File_-_HMC": 1000614, "Flat_File_-_HP-UX_Audit_Log": 115, "Flat_File_-_IBM_4690_POS": 1000109, "Flat_File_-_IBM_Informix_Application_Log": 1000169, "Flat_File_-_IBM_Informix_Audit_Log": 1000170, "Flat_File_-_IBM_Tivoli_Storage_Manager": 1000454, "Flat_File_-_IBM_WebSphere_App_Server_v7_Audit_Log": 1000179, "Flat_File_-_IBM_WebSphere_Cast_Iron_Cloud_Integration": 1000389, "Flat_File_-_IBM_ZOS_Batch_Decryption_Log": 146, "Flat_File_-_IBM_ZOS_CICS_Decryption_Log": 147, "Flat_File_-_IBM_ZOS_RACF_Access_Log": 148, "Flat_File_-_IBM_ZOS_RACF_SMF_Type_80": 175, "Flat_File_-_IPSwitch_WS_FTP": 1000777, "Flat_File_-_Irix_Audit_Logs": 1000117, "Flat_File_-_IT-CUBE_AgileSI": 1000316, "Flat_File_-_JBoss_Log_File": 134, "Flat_File_-_Juniper_Steel_Belted_Radius_Server": 1000261, "Flat_File_-_Kerio_Mail_Server": 1000115, "Flat_File_-_KERISYS_Doors_Event_Export_Format": 1000129, "Flat_File_-_Kippo_Honeypot": 1000522, "Flat_File_-_Linux_Audit_ASCII": 1000154, "Flat_File_-_Linux_Audit_Log": 1000123, "Flat_File_-_Linux_Host_Secure_Log": 1000507, "Flat_File_-_LOGbinder_EX": 1000623, "Flat_File_-_LogRhythm_Alarm_Reingest": 8, "Flat_File_-_LogRhythm_Data_Indexer_Monitor": 1000648, "Flat_File_-_LogRhythm_Oracle_Log": 1000716, "Flat_File_-_LogRhythm_System_Monitor": 17, "Flat_File_-_LogRhythm_System_Monitor_Log_File": 1000858, "Flat_File_-_LogRhythm_Trebek_Log": 1000717, "Flat_File_-_LogRhythm_Zeus_Log": 1000715, "Flat_File_-_Lotus_Domino_Client_Log": 1000041, "Flat_File_-_McAfee_Cloud_Proxy_do_not_use": 1000826, "Flat_File_-_McAfee_ePO_HIPS": 1000552, "Flat_File_-_McAfee_Foundstone": 1000049, "Flat_File_-_McAfee_Proxy_Cloud": 1000829, "Flat_File_-_McAfee_SaaS_Web_Protection": 1000638, "Flat_File_-_McAfee_Web_Gateway_Audit_Log": 1000685, "Flat_File_-_Merak": 1000312, "Flat_File_-_Meridian": 1000098, "Flat_File_-_Microsoft_ActiveSync_2010": 1000404, "Flat_File_-_Microsoft_CRM": 1000106, "Flat_File_-_Microsoft_DHCP_Server_Log": 122, "Flat_File_-_Microsoft_Forefront_TMG": 1000402, "Flat_File_-_Microsoft_Forefront_TMG_Web_Proxy": 1000586, "Flat_File_-_Microsoft_IIS_(IIS_Format)_File": 112, "Flat_File_-_Microsoft_IIS_7.x_W3C_Extended_Format": 1000655, "Flat_File_-_Microsoft_IIS_Error_Log_V6": 1000323, "Flat_File_-_Microsoft_IIS_FTP_IIS_Log_File_Format": 1000150, "Flat_File_-_Microsoft_IIS_FTP_W3C_Extended_Format": 161, "Flat_File_-_Microsoft_IIS_NCSA_Common_Format_File": 111, "Flat_File_-_Microsoft_IIS_SMTP_W3C_Format": 1000397, "Flat_File_-_Microsoft_IIS_URL_Scan_Log": 1000054, "Flat_File_-_Microsoft_IIS_W3C_File": 84, "Flat_File_-_Microsoft_ISA_Server_2004": 187, "Flat_File_-_Microsoft_ISA_Server_W3C_File": 21, "Flat_File_-_Microsoft_Netlogon": 1000579, "Flat_File_-_Microsoft_Port_Reporter_PR-PORTS_Log": 1000274, "Flat_File_-_Microsoft_Semantic_Logging": 1000582, "Flat_File_-_Microsoft_SQL_Server_2000_Error_Log": 40, "Flat_File_-_Microsoft_SQL_Server_2005_Error_Log": 1000172, "Flat_File_-_Microsoft_SQL_Server_2008_Error_Log": 1000181, "Flat_File_-_Microsoft_SQL_Server_2012_Error_Log": 1000479, "Flat_File_-_Microsoft_SQL_Server_2014_Error_Log": 1000637, "Flat_File_-_Microsoft_Windows_2003_DNS": 1000506, "Flat_File_-_Microsoft_Windows_2008_DNS": 1000276, "Flat_File_-_Microsoft_Windows_2012_DNS": 1000619, "Flat_File_-_Microsoft_Windows_Firewall": 119, "Flat_File_-_MicroStrategy": 1000535, "Flat_File_-_Mimecast_Audit": 1000721, "Flat_File_-_Mimecast_Email": 1000726, "Flat_File_-_Monetra": 1000288, "Flat_File_-_MongoDB": 185, "Flat_File_-_MS_Exchange_2003_Message_Tracking_Log": 1000000005, "Flat_File_-_MS_Exchange_2007_Message_Tracking_Log": 1000000004, "Flat_File_-_MS_Exchange_2010_Message_Tracking_Log": 1000000007, "Flat_File_-_MS_Exchange_2013_Message_Tracking_Log": 1000561, "Flat_File_-_MS_Exchange_2016_Message_Tracking_Log": 1000805, "Flat_File_-_MS_Exchange_RPC_Client_Access": 1000433, "Flat_File_-_MS_IAS/RAS_Server_NPS_DB_Log_Format": 121, "Flat_File_-_MS_IAS/RAS_Server_Standard_Log_Format": 1000168, "Flat_File_-_MS_ISA_Server_2006_ISA_All_Fields": 157, "Flat_File_-_MS_ISA_Server_2006_W3C_All_Fields": 156, "Flat_File_-_MS_SQL_Server_Reporting_Services_2008": 1000066, "Flat_File_-_MySQL": 1000247, "Flat_File_-_MySQL_error.log": 1000252, "Flat_File_-_MySQL_mysql.log": 1000256, "Flat_File_-_MySQL_mysql-slow.log": 1000253, "Flat_File_-_Nessus_System_Log": 1000220, "Flat_File_-_NetApp_Cluster": 1000593, "Flat_File_-_Nginx_Log": 1000718, "Flat_File_-_Novell_Audit": 1000110, "Flat_File_-_Novell_GroupWise": 1000429, "Flat_File_-_Novell_LDAP": 1000307, "Flat_File_-_ObserveIT_Enterprise": 1000363, "Flat_File_-_Office_365_Message_Tracking": 1000720, "Flat_File_-_OpenDJ": 1000455, "Flat_File_-_OpenVMS": 1000127, "Flat_File_-_OpenVPN": 1000311, "Flat_File_-_Oracle_11g_Fine_Grained_Audit_Trail": 1000227, "Flat_File_-_Oracle_9i": 1000007, "Flat_File_-_Oracle_BRM_CM_Log": 1000515, "Flat_File_-_Oracle_BRM_DM_Log": 1000514, "Flat_File_-_Oracle_Listener_Audit_Trail": 1000346, "Flat_File_-_Oracle_SunOne_Directory_Server": 1000278, "Flat_File_-_Oracle_SunOne_Web_Server_Access_Log": 1000277, "Flat_File_-_Oracle_Virtual_Directory": 1000315, "Flat_File_-_Oracle_WebLogic_11g_Access_Log": 1000471, "Flat_File_-_Other": 127, "Flat_File_-_PeopleSoft": 1000822, "Flat_File_-_PhpMyAdmin_Honeypot": 1000523, "Flat_File_-_Postfix": 1000294, "Flat_File_-_PowerBroker_Servers": 1000528, "Flat_File_-_Princeton_Card_Secure": 1000136, "Flat_File_-_ProFTPD": 1000087, "Flat_File_-_PureMessage_For_Exchange_SMTP_Log": 1000180, "Flat_File_-_PureMessage_For_UNIX_Blocklist_Log": 1000176, "Flat_File_-_PureMessage_For_UNIX_Message_Log": 1000177, "Flat_File_-_RACF_(SMF)": 1000033, "Flat_File_-_Radmin": 1000367, "Flat_File_-_Restic_Backup_Log": 14, "Flat_File_-_RL_Patient_Feedback": 1000349, "Flat_File_-_RSA_Adaptive_Authentication": 1000283, "Flat_File_-_RSA_Authentication_Manager_6.1": 1000226, "Flat_File_-_S2_Badge_Reader": 1000630, "Flat_File_-_Safenet": 1000714, "Flat_File_-_Sendmail_File": 133, "Flat_File_-_Sharepoint_ULS": 1000221, "Flat_File_-_ShoreTel_VOIP": 1000351, "Flat_File_-_Siemens_Radiology_Information_System": 1000091, "Flat_File_-_Snort_Fast_Alert_File": 37, "Flat_File_-_Solaris_-_Sulog": 1000043, "Flat_File_-_Solaris_Audit_Log": 1000116, "Flat_File_-_SpamAssassin": 1000047, "Flat_File_-_Squid_Proxy": 1000070, "Flat_File_-_Subversion": 1000516, "Flat_File_-_Sudo.Log": 1000373, "Flat_File_-_Swift_Alliance": 1000099, "Flat_File_-_Symantec_Antivirus_10.x_Corporate_Edtn": 176, "Flat_File_-_Symantec_Antivirus_12.x_Corporate_Edtn": 1000602, "Flat_File_-_Symitar_Episys_Console_Log": 1000466, "Flat_File_-_Symitar_Episys_Sysevent_Log": 1000450, "Flat_File_-_Tandem_EMSOUT_Log_File": 138, "Flat_File_-_Tandem_XYGATE": 1000306, "Flat_File_-_Tectia_SSH_Server": 1000476, "Flat_File_-_Trade_Innovations_CSCS": 1000114, "Flat_File_-_Trend_Micro_IMSS": 1000219, "Flat_File_-_Trend_Micro_Office_Scan": 1000244, "Flat_File_-_Tumbleweed_Mailgate_Server": 1000067, "Flat_File_-_Verint_Audit_Trail_File": 142, "Flat_File_-_VMWare_Virtual_Machine": 109, "Flat_File_-_Voltage_Securemail": 1000368, "Flat_File_-_Vormetric_Log_File": 135, "Flat_File_-_vsFTP_Daemon_Log": 1000042, "Flat_File_-_Vyatta_Firewall_Kernel_Log": 1000456, "Flat_File_-_WordPot_Honeypot": 1000524, "Flat_File_-_X-NetStat_Log": 38, "Flat_File_-_XPient_POS_CCA_Manager": 159, "Flat_File_-_XPIENT_POS_POSLOG": 1000275, "Flat_File_-_XPIENT_POS_Shell_Log": 1000287, "IPFIX_-_IP_Flow_Information_Export": 1000484, "J-Flow_-_Juniper_J-Flow_Version_5": 1000292, "J-Flow_-_Juniper_J-Flow_Version_9": 1000293, "LogRhythm_CloudAI": 1000678, "LogRhythm_Data_Loss_Defender": 1000044, "LogRhythm_Demo_File_-_Application_Server_Log": 1000186, "LogRhythm_Demo_File_-_Content_Inspection_Log": 1000190, "LogRhythm_Demo_File_-_Database_Audit_Log": 1000191, "LogRhythm_Demo_File_-_Ecom_Server_Log": 1000194, "LogRhythm_Demo_File_-_File_Server_Log": 1000184, "LogRhythm_Demo_File_-_Firewall_Log": 1000189, "LogRhythm_Demo_File_-_FTP_Log": 1000182, "LogRhythm_Demo_File_-_IDS_Alarms_Log": 1000188, "LogRhythm_Demo_File_-_Mail_Server_Log": 1000185, "LogRhythm_Demo_File_-_Netflow_Log": 1000193, "LogRhythm_Demo_File_-_Network_Device_Log": 1000192, "LogRhythm_Demo_File_-_Network_Server_Log": 1000183, "LogRhythm_Demo_File_-_VPN_Log": 1000195, "LogRhythm_Demo_File_-_Web_Access_Log": 1000187, "LogRhythm_File_Monitor_(AIX)": 8, "LogRhythm_File_Monitor_(HP-UX)": 1000137, "LogRhythm_File_Monitor_(Linux)": 2, "LogRhythm_File_Monitor_(Solaris)": 6, "LogRhythm_File_Monitor_(Windows)": 3, "LogRhythm_Filter": 1000695, "LogRhythm_Network_Connection_Monitor_(AIX)": 1000163, "LogRhythm_Network_Connection_Monitor_(HP-UX)": 1000164, "LogRhythm_Network_Connection_Monitor_(Linux)": 1000165, "LogRhythm_Network_Connection_Monitor_(Solaris)": 1000166, "LogRhythm_Network_Connection_Monitor_(Windows)": 1000162, "LogRhythm_Process_Monitor_(AIX)": 1000159, "LogRhythm_Process_Monitor_(HP-UX)": 1000160, "LogRhythm_Process_Monitor_(Linux)": 1000167, "LogRhythm_Process_Monitor_(Solaris)": 1000161, "LogRhythm_Process_Monitor_(Windows)": 1000158, "LogRhythm_Registry_Integrity_Monitor": 1000539, "LogRhythm_SQL_Server_2000_C2_Audit_Log": 1000202, "LogRhythm_SQL_Server_2005_C2_Audit_Log": 1000203, "LogRhythm_SQL_Server_2008_C2_Audit_Log": 1000204, "LogRhythm_SQL_Server_2012+_C2_Audit_Log": 1000475, "LogRhythm_User_Activity_Monitor_(AIX)": 1000062, "LogRhythm_User_Activity_Monitor_(HP-UX)": 1000138, "LogRhythm_User_Activity_Monitor_(Linux)": 1000060, "LogRhythm_User_Activity_Monitor_(Solaris)": 1000061, "LogRhythm_User_Activity_Monitor_(Windows)": 1000059, "MS_Event_Log_for_XP/2000/2003_-_Application": 31, "MS_Event_Log_for_XP/2000/2003_-_Application_-_Espaniol": 1000571, "MS_Event_Log_for_XP/2000/2003_-_BioPassword": 151, "MS_Event_Log_for_XP/2000/2003_-_DFS": 1000112, "MS_Event_Log_for_XP/2000/2003_-_Directory_Service": 32, "MS_Event_Log_for_XP/2000/2003_-_DNS": 76, "MS_Event_Log_for_XP/2000/2003_-_DotDefender": 1000083, "MS_Event_Log_for_XP/2000/2003_-_EMC_Celerra_NAS": 1000488, "MS_Event_Log_for_XP/2000/2003_-_File_Rep_Service": 33, "MS_Event_Log_for_XP/2000/2003_-_HA": 1000069, "MS_Event_Log_for_XP/2000/2003_-_Kaspersky": 1000102, "MS_Event_Log_for_XP/2000/2003_-_Micros_POS": 1000354, "MS_Event_Log_for_XP/2000/2003_-_PatchLink": 1000073, "MS_Event_Log_for_XP/2000/2003_-_SafeWord_2008": 199, "MS_Event_Log_for_XP/2000/2003_-_SCE": 1000173, "MS_Event_Log_for_XP/2000/2003_-_Security": 23, "MS_Event_Log_for_XP/2000/2003_-_Security_-_Espaniol": 1000569, "MS_Event_Log_for_XP/2000/2003_-_SMS_2003": 1000038, "MS_Event_Log_for_XP/2000/2003_-_System": 30, "MS_Event_Log_for_XP/2000/2003_-_System_-_Espaniol": 1000570, "MS_Event_Log_for_XP/2000/2003_-_Virtual_Server": 1000075, "MS_Windows_Event_Logging_-_ADFS_Admin": 1000661, "MS_Windows_Event_Logging_-_Application": 1000032, "MS_Windows_Event_Logging_-_AppLockerApp": 1000557, "MS_Windows_Event_Logging_-_Backup": 1000341, "MS_Windows_Event_Logging_-_Citrix_Delivery_Services": 1000526, "MS_Windows_Event_Logging_-_Citrix_XenApp": 1000701, "MS_Windows_Event_Logging_-_DFS": 1000121, "MS_Windows_Event_Logging_-_DHCP_Admin": 1000540, "MS_Windows_Event_Logging_-_DHCP_Operational": 1000537, "MS_Windows_Event_Logging_-_Diagnosis-PLA": 1000280, "MS_Windows_Event_Logging_-_Digital_Persona": 1000483, "MS_Windows_Event_Logging_-_Dir_Service": 1000119, "MS_Windows_Event_Logging_-_DNS": 1000120, "MS_Windows_Event_Logging_-_Dot_Defender": 1000303, "MS_Windows_Event_Logging_-_ESD_Data_Flow_Track": 1000583, "MS_Windows_Event_Logging_-_Exchange_Mailbox_DB_Failures": 1000446, "MS_Windows_Event_Logging_-_FailoverClustering/Operational": 1000447, "MS_Windows_Event_Logging_-_Firewall_With_Advanced_Security": 1000302, "MS_Windows_Event_Logging_-_Forefront_AV": 1000352, "MS_Windows_Event_Logging_-_Group_Policy_Operational": 1000301, "MS_Windows_Event_Logging_-_Hyper-V_Hvisor": 1000264, "MS_Windows_Event_Logging_-_Hyper-V_IMS": 1000263, "MS_Windows_Event_Logging_-_Hyper-V_Network": 1000265, "MS_Windows_Event_Logging_-_Hyper-V_SynthSt": 1000266, "MS_Windows_Event_Logging_-_Hyper-V_VMMS": 1000251, "MS_Windows_Event_Logging_-_Hyper-V_Worker": 1000262, "MS_Windows_Event_Logging_-_Kaspersky": 1000495, "MS_Windows_Event_Logging_-_Kernel_PnP_Configuration": 1000559, "MS_Windows_Event_Logging_-_Lync_Server": 1000628, "MS_Windows_Event_Logging_-_MSExchange_Management": 1000338, "MS_Windows_Event_Logging_-_Operations_Manager": 1000421, "MS_Windows_Event_Logging_-_PowerShell": 1000627, "MS_Windows_Event_Logging_-_Print_Services": 1000356, "MS_Windows_Event_Logging_-_Quest_ActiveRoles_EDM_Server": 1000577, "MS_Windows_Event_Logging_-_Replication": 1000122, "MS_Windows_Event_Logging_-_SafeWord_2008": 1000419, "MS_Windows_Event_Logging_-_Security": 1000030, "MS_Windows_Event_Logging_-_Setup": 1000281, "MS_Windows_Event_Logging_-_Sysmon": 1000558, "MS_Windows_Event_Logging_-_System": 1000031, "MS_Windows_Event_Logging_-_Task_Scheduler": 1000308, "MS_Windows_Event_Logging_-_TS_Gateway": 1000532, "MS_Windows_Event_Logging_-_TS_Licensing": 1000272, "MS_Windows_Event_Logging_-_TS_Local_Session_Manager": 1000271, "MS_Windows_Event_Logging_-_TS_Remote_Connection_Manager": 1000300, "MS_Windows_Event_Logging_-_TS_Session_Broker": 1000320, "MS_Windows_Event_Logging_-_TS_Session_Broker_Client": 1000309, "MS_Windows_Event_Logging_-_VisualSVN": 1000578, "MS_Windows_Event_Logging_:_Deutsch_-_Security": 1000470, "MS_Windows_Event_Logging_:_Espaniol_-_Application": 1000566, "MS_Windows_Event_Logging_:_Espaniol_-_Security": 1000565, "MS_Windows_Event_Logging_:_Espaniol_-_System": 1000568, "MS_Windows_Event_Logging_:_Francais_-_System": 1000468, "MS_Windows_Event_Logging_:Francais_-_Security": 1000469, "MS_Windows_Event_Logging_XML_-_ADFS": 1000868, "MS_Windows_Event_Logging_XML_-_Application": 1000562, "MS_Windows_Event_Logging_XML_-_Forwarded_Events": 1000746, "MS_Windows_Event_Logging_XML_-_Generic": 1000738, "MS_Windows_Event_Logging_XML_-_LRTracer": 1000784, "MS_Windows_Event_Logging_XML_-_Microsoft-Windows-NTLM/Operational": 1000781, "MS_Windows_Event_Logging_XML_-_Security": 1000639, "MS_Windows_Event_Logging_XML_-_Sysmon": 1000862, "MS_Windows_Event_Logging_XML_-_Sysmon_7.01": 1000724, "MS_Windows_Event_Logging_XML_-_Sysmon_8/9/10": 1000745, "MS_Windows_Event_Logging_XML_-_System": 1000662, "MS_Windows_Event_Logging_XML_-_Unisys_Stealth": 1000681, "MS_Windows_Event_Logging_XML_-_Windows_Defender": 1000856, "Netflow_-_Cisco_Netflow_Version_1": 101, "Netflow_-_Cisco_Netflow_Version_5": 102, "Netflow_-_Cisco_Netflow_Version_9": 1000174, "Netflow_-_Palo_Alto_Version_9": 191, "Netflow_-_SonicWALL_Version_5": 1000436, "Netflow_-_SonicWALL_Version_9": 1000437, "OPSEC_LEA_-_Checkpoint_Firewall": 125, "OPSEC_LEA_-_Checkpoint_Firewall_Audit_Log": 1000304, "OPSEC_LEA_-_Checkpoint_For_LR_7.4.1+": 1000741, "OPSEC_LEA_-_Checkpoint_Log_Server": 126, "sFlow_-_Version_5": 1000239, "SNMP_Trap_-_Audiolog": 1000259, "SNMP_Trap_-_Autoregistered": 1000149, "SNMP_Trap_-_Brocade_Switch": 1000599, "SNMP_Trap_-_Cisco_5508_Wireless_Controller": 1000545, "SNMP_Trap_-_Cisco_IP_SLA": 1000572, "SNMP_Trap_-_Cisco_Prime": 1000629, "SNMP_Trap_-_Cisco_Router-Switch": 1000327, "SNMP_Trap_-_CyberArk": 1000240, "SNMP_Trap_-_Dell_OpenManage": 1000322, "SNMP_Trap_-_HP_Network_Node_Manager": 1000377, "SNMP_Trap_-_IBM_TS3000_Series_Tape_Drive": 1000258, "SNMP_Trap_-_Riverbed_SteelCentral_NetShark": 1000508, "SNMP_Trap_-_RSA_Authentication_Manager": 1000248, "SNMP_Trap_-_Swift_Alliance": 1000405, "SNMP_Trap_-_Trend_Micro_Control_Manager": 1000413, "Syslog_-_3Com_Switch": 1000329, "Syslog_-_A10_Networks_AX1000_Load_Balancer": 1000268, "Syslog_-_A10_Networks_Web_Application_Firewall": 1000785, "Syslog_-_Accellion_Secure_File_Transfer_Application": 1000665, "Syslog_-_Active_Scout_IPS": 128, "Syslog_-_Adallom": 1000585, "Syslog_-_Adtran_Switch": 1000284, "Syslog_-_Aerohive_Access_Point": 1000467, "Syslog_-_Aerohive_Firewall": 1000677, "Syslog_-_AIMIA_Tomcat": 1000635, "Syslog_-_AirDefense_Enterprise": 182, "Syslog_-_Airmagnet_Wireless_IDS": 177, "Syslog_-_AirTight_IDS/IPS": 145, "Syslog_-_AirWatch_MDM": 1000594, "Syslog_-_Airwave_Management_System_Log": 150, "Syslog_-_AIX_Host": 90, "Syslog_-_Alcatel-Lucent_Switch": 1000756, "Syslog_-_Alcatel-Lucent_Wireless_Controller": 1000425, "Syslog_-_AlertLogic": 1000742, "Syslog_-_AMX_AV_Controller": 27, "Syslog_-_Apache_Access_Log": 1000255, "Syslog_-_Apache_Error_Log": 1000254, "Syslog_-_Apache_Tomcat_Request_Parameters": 110, "Syslog_-_Apache_Tomcat_Service_Clients_Log": 1000418, "Syslog_-_APC_ATS": 1000400, "Syslog_-_APC_NetBotz_Environmental_Monitoring": 1000348, "Syslog_-_APC_PDU": 1000416, "Syslog_-_APC_UPS": 1000200, "Syslog_-_Apcon_Network_Monitor": 1000491, "Syslog_-_Apex_One": 1000832, "Syslog_-_Arbor_Networks_Peakflow": 1000477, "Syslog_-_Arbor_Networks_Spectrum": 1000708, "Syslog_-_Arbor_Pravail_APS": 1000464, "Syslog_-_Arista_Switch": 1000410, "Syslog_-_Array_TMX_Load_Balancer": 1000525, "Syslog_-_Arris_CMTS": 1000230, "Syslog_-_Aruba_Clear_Pass": 1000502, "Syslog_-_Aruba_Mobility_Controller": 144, "Syslog_-_Aruba_Wireless_Access_Point": 1000529, "Syslog_-_AS/400_via_Powertech_Interact": 178, "Syslog_-_Asus_WRT_Router": 1000679, "Syslog_-_Avatier_Identity_Management_Suite_(AIMS)": 1000780, "Syslog_-_Avaya_Communications_Manager": 1000459, "Syslog_-_Avaya_Ethernet_Routing_Switch": 1000482, "Syslog_-_Avaya_G450_Media_Gateway": 1000680, "Syslog_-_Avaya_Router": 1000581, "Syslog_-_Aventail_SSL/VPN": 1000132, "Syslog_-_Avocent_Cyclades_Terminal_Server": 1000396, "Syslog_-_Azul_Java_Appliance": 1000217, "Syslog_-_Barracuda_Load_Balancer": 1000370, "Syslog_-_Barracuda_Mail_Archiver": 1000492, "Syslog_-_Barracuda_NG_Firewall": 1000442, "Syslog_-_Barracuda_NG_Firewall_6.x": 1000613, "Syslog_-_Barracuda_Spam_Firewall": 132, "Syslog_-_Barracuda_Web_Application_Firewall": 1000342, "Syslog_-_Barracuda_Webfilter": 140, "Syslog_-_BeyondTrust_BeyondInsight_LEEF": 1000778, "Syslog_-_Bind_DNS": 1000621, "Syslog_-_Bit9_Parity_Suite": 1000215, "Syslog_-_Bit9_Security_Platform_CEF": 1000622, "Syslog_-_Bit9+Carbon_Black_(Deprecated)": 1000620, "Syslog_-_BitDefender": 1000597, "Syslog_-_Black_Diamond_Switch": 1000004, "Syslog_-_Blue_Coat_CAS": 1000739, "Syslog_-_Blue_Coat_Forward_Proxy": 1000509, "Syslog_-_Blue_Coat_PacketShaper": 1000392, "Syslog_-_Blue_Coat_ProxyAV_ISA_W3C_Format": 1000126, "Syslog_-_Blue_Coat_ProxyAV_MS_Proxy_2.0_Format": 1000143, "Syslog_-_Blue_Coat_ProxySG": 166, "Syslog_-_Blue_Socket_Wireless_Controller": 1000451, "Syslog_-_Bluecat_Adonis": 1000438, "Syslog_-_BlueCedar": 1000753, "Syslog_-_BluVector": 1000769, "Syslog_-_Bomgar": 1000347, "Syslog_-_Bradford_Networks_NAC": 1000553, "Syslog_-_Bradford_Remediation_&_Registration_Svr": 155, "Syslog_-_Bro_IDS": 1000723, "Syslog_-_Brocade_Switch": 183, "Syslog_-_Bromium_vSentry_CEF": 1000513, "Syslog_-_BSD_Host": 117, "Syslog_-_CA_Privileged_Access_Manager": 1000808, "Syslog_-_Cb_Defense_CEF": 1000702, "Syslog_-_Cb_Protection_CEF": 1000420, "Syslog_-_Cb_Response_LEEF": 1000651, "Syslog_-_Cell_Relay": 1000407, "Syslog_-_Certes_Networks_CEP": 1000445, "Syslog_-_Check_Point_Log_Exporter": 1000806, "Syslog_-_Checkpoint_Site-to-Site_VPN": 1000376, "Syslog_-_Cisco_ACS": 1000063, "Syslog_-_Cisco_Aironet_WAP": 1000002, "Syslog_-_Cisco_APIC": 1000764, "Syslog_-_Cisco_Application_Control_Engine": 1000130, "Syslog_-_Cisco_ASA": 5, "Syslog_-_Cisco_Clean_Access_(CCA)_Appliance": 1000201, "Syslog_-_Cisco_CSS_Load_Balancer": 1000064, "Syslog_-_Cisco_Email_Security_Appliance": 1000021, "Syslog_-_Cisco_FirePOWER": 1000683, "Syslog_-_Cisco_Firepower_Threat_Defense": 18, "Syslog_-_Cisco_FireSIGHT": 1000595, "Syslog_-_Cisco_FWSM": 163, "Syslog_-_Cisco_Global_Site_Selector": 1000068, "Syslog_-_Cisco_ISE": 1000369, "Syslog_-_Cisco_Meraki": 1000530, "Syslog_-_Cisco_Nexus_Switch": 1000225, "Syslog_-_Cisco_PIX": 1000000003, "Syslog_-_Cisco_Prime_Infrastructure": 1000500, "Syslog_-_Cisco_Router": 86, "Syslog_-_Cisco_Secure_ACS_5": 1000206, "Syslog_-_Cisco_Session_Border_Controller": 11, "Syslog_-_Cisco_Switch": 85, "Syslog_-_Cisco_Telepresence_Video_Communications_Server": 1000657, "Syslog_-_Cisco_UCS": 1000391, "Syslog_-_Cisco_Unified_Comm_Mgr_(Call_Mgr)": 1000133, "Syslog_-_Cisco_VPN_Concentrator": 116, "Syslog_-_Cisco_WAAS": 1000333, "Syslog_-_Cisco_Web_Security": 1000390, "Syslog_-_Cisco_Wireless_Access_Point": 1000394, "Syslog_-_Cisco_Wireless_Control_System": 1000101, "Syslog_-_CiscoWorks": 1000260, "Syslog_-_Citrix_Access_Gateway_Server": 1000403, "Syslog_-_Citrix_Netscaler": 25, "Syslog_-_Citrix_XenServer": 1000257, "Syslog_-_Claroty_CTD_CEF": 1000801, "Syslog_-_Clearswift_Secure_Email_Gateway": 1000747, "Syslog_-_CloudLock": 1000659, "Syslog_-_CodeGreen_Data_Loss_Prevention": 1000097, "Syslog_-_Cofense_Triage_CEF": 1000632, "Syslog_-_Consentry_NAC": 165, "Syslog_-_Corero_IPS": 1000431, "Syslog_-_Corero_SmartWall_DDoS": 22, "Syslog_-_CoyotePoint_Equalizer": 1000289, "Syslog_-_Crowdstrike_Falconhost_CEF": 1000682, "Syslog_-_CyberArk": 1000325, "Syslog_-_CyberArk_Privileged_Threat_Analytics": 1000652, "Syslog_-_Cylance_CEF": 1000813, "Syslog_-_CylancePROTECT": 1000625, "Syslog_-_DarkTrace_CEF": 1000710, "Syslog_-_Dell_Force_10": 1000423, "Syslog_-_Dell_PowerConnect_Switch": 1000118, "Syslog_-_Dell_Remote_Access_Controller": 1000324, "Syslog_-_Dell_SecureWorks_iSensor_IPS": 1000554, "Syslog_-_Dialogic_Media_Gateway": 1000125, "Syslog_-_Digital_Guardian_CEF": 1000800, "Syslog_-_D-Link_Switch": 1000504, "Syslog_-_Don_not_use": 1000827, "Syslog_-_Dragos_Platform_CEF": 1000852, "Syslog_-_Ecessa_ShieldLink": 1000282, "Syslog_-_EfficientIP": 7, "Syslog_-_EMC_Avamar": 1000556, "Syslog_-_EMC_Centera": 1000490, "Syslog_-_EMC_Data_Domain": 1000551, "Syslog_-_EMC_Isilon": 20, "Syslog_-_EMC_Unity_Array": 1000751, "Syslog_-_EMC_VNX": 1000432, "Syslog_-_Ensilo_NGAV": 1000830, "Syslog_-_Enterasys_Dragon_IDS": 1000131, "Syslog_-_Enterasys_Router": 123, "Syslog_-_Enterasys_Switch": 124, "Syslog_-_Entrust_Entelligence_Messaging_Server": 1000462, "Syslog_-_Entrust_IdentityGuard": 1000234, "Syslog_-_Epic_Hyperspace_CEF": 1000668, "Syslog_-_EqualLogic_SAN": 189, "Syslog_-_eSafe_Email_Security": 1000366, "Syslog_-_ESET_Remote_Administrator_(ERA)_LEEF": 1000754, "Syslog_-_Event_Reporter_(Win_2000/XP/2003)": 1000046, "Syslog_-_Exabeam": 3, "Syslog_-_Exchange_Message_Tracking": 6, "Syslog_-_ExtraHop": 1000795, "Syslog_-_Extreme_Wireless_LAN": 1000058, "Syslog_-_ExtremeWare": 1000318, "Syslog_-_ExtremeXOS": 1000317, "Syslog_-_F5_BIG-IP_Access_Policy_Manager": 1000676, "Syslog_-_F5_BIG-IP_AFM": 1000771, "Syslog_-_F5_BIG-IP_ASM": 1000236, "Syslog_-_F5_BIG-IP_ASM_Key-Value_Pairs": 1000749, "Syslog_-_F5_BIG-IP_ASM_v12": 1000709, "Syslog_-_F5_Big-IP_GTM_&_DNS": 188, "Syslog_-_F5_Big-IP_LTM": 1000335, "Syslog_-_F5_FirePass_Firewall": 179, "Syslog_-_F5_Silverline_DDoS_Protection": 1000799, "Syslog_-_Fargo_HDP_Card_Printer_and_Encoder": 1000358, "Syslog_-_Fat_Pipe_Load_Balancer": 1000807, "Syslog_-_Fidelis_XPS": 1000104, "Syslog_-_FireEye_E-Mail_MPS": 1000542, "Syslog_-_FireEye_EX": 1000831, "Syslog_-_FireEye_Web_MPS/CMS/ETP/HX": 1000359, "Syslog_-_Forcepoint_DLP": 1000321, "Syslog_-_Forcepoint_Email_Security_Gateway": 1000591, "Syslog_-_Forcepoint_Stonesoft_NGFW": 1000675, "Syslog_-_Forcepoint_SureView_Insider_Threat": 1000660, "Syslog_-_Forcepoint_Web_Security": 1000375, "Syslog_-_Forcepoint_Web_Security_CEF_Format": 1000452, "Syslog_-_Forescout_CounterACT_NAC": 1000157, "Syslog_-_Fortinet_FortiAnalyzer": 1000811, "Syslog_-_Fortinet_FortiAuthenticator": 1000846, "Syslog_-_Fortinet_FortiDDoS": 1000782, "Syslog_-_Fortinet_FortiGate": 130, "Syslog_-_Fortinet_FortiGate_v4.0": 1000199, "Syslog_-_Fortinet_FortiGate_v5.0": 1000426, "Syslog_-_Fortinet_FortiGate_v5.2": 1000567, "Syslog_-_Fortinet_FortiGate_v5.4/v5.6": 1000700, "Syslog_-_Fortinet_FortiGate_v5.6_CEF": 1000722, "Syslog_-_Fortinet_Fortigate_v6.0": 1000774, "Syslog_-_Fortinet_FortiMail": 1000536, "Syslog_-_Fortinet_FortiWeb": 1000493, "Syslog_-_Foundry_Switch": 1000050, "Syslog_-_Gene6_FTP": 153, "Syslog_-_Generic_CEF": 1000725, "Syslog_-_Generic_ISC_DHCP": 1000088, "Syslog_-_Generic_LEEF": 1000728, "Syslog_-_Guardium_Database_Activity_Monitor": 1000326, "Syslog_-_H3C_Router": 1000243, "Syslog_-_Hitachi_Universal_Storage_Platform": 1000398, "Syslog_-_HP_BladeSystem": 1000439, "Syslog_-_HP_iLO": 1000616, "Syslog_-_HP_Procurve_Switch": 160, "Syslog_-_HP_Router": 1000057, "Syslog_-_HP_Switch": 1000444, "Syslog_-_HP_Unix_Tru64": 1000096, "Syslog_-_HP_Virtual_Connect_Switch": 1000350, "Syslog_-_HP-UX_Host": 89, "Syslog_-_Huawei_Access_Router": 1000541, "Syslog_-_IBM_Blade_Center": 1000401, "Syslog_-_IBM_Security_Network_Protection": 1000521, "Syslog_-_IBM_Virtual_Tape_Library_Server": 1000511, "Syslog_-_IBM_WebSphere_DataPower_Integration": 1000441, "Syslog_-_IBM_zSecure_Alert_for_ACF2_2.1.0": 1000590, "Syslog_-_IceWarp_Server": 1000267, "Syslog_-_Imperva_Incapsula_CEF": 1000763, "Syslog_-_Imperva_SecureSphere": 1000135, "Syslog_-_Imprivata_OneSign_SSO": 1000693, "Syslog_-_InfoBlox": 1000089, "Syslog_-_Invincea_(LEEF)": 1000626, "Syslog_-_iPrism_Proxy_Log": 1000095, "Syslog_-_IPSWITCH_MOVEit_Server": 1000573, "Syslog_-_IPTables": 1000364, "Syslog_-_IRIX_Host": 118, "Syslog_-_iSeries_via_Powertech_Interact": 184, "Syslog_-_Ivanti_FileDirector": 16, "Syslog_-_JetNexus_Load_Balancer": 1000332, "Syslog_-_Juniper_DX_Application_Accelerator": 1000147, "Syslog_-_Juniper_Firewall": 1000045, "Syslog_-_Juniper_Firewall_3400": 1000601, "Syslog_-_Juniper_Host_Checker": 1000082, "Syslog_-_Juniper_IDP": 1000053, "Syslog_-_Juniper_NSM": 1000242, "Syslog_-_Juniper_Router": 1000026, "Syslog_-_Juniper_SSL_VPN": 186, "Syslog_-_Juniper_SSL_VPN_WELF_Format": 1000111, "Syslog_-_Juniper_Switch": 1000037, "Syslog_-_Juniper_Trapeze": 1000343, "Syslog_-_Juniper_vGW_Virtual_Gateway": 1000448, "Syslog_-_Kaspersky_Security_Center": 1000797, "Syslog_-_Kea_DHCP_Server": 10, "Syslog_-_Kemp_Load_Balancer": 1000412, "Syslog_-_KFSensor_Honeypot": 1000672, "Syslog_-_KFSensor_Honeypot_CEF": 1000691, "Syslog_-_Lancope_StealthWatch": 1000393, "Syslog_-_Lancope_StealthWatch_CEF": 1000698, "Syslog_-_Layer_7_SecureSpan_SOA_Gateway": 1000427, "Syslog_-_Legacy_Checkpoint_Firewall_(Not_Log_Exporter)": 1000434, "Syslog_-_Legacy_Checkpoint_IPS_(Not_Log_Exporter)": 1000103, "Syslog_-_Lieberman_Enterprise_Random_Password_Manager": 1000353, "Syslog_-_Linux_Audit": 1000139, "Syslog_-_Linux_Host": 13, "Syslog_-_Linux_TACACS_Plus": 23, "Syslog_-_LOGbinder_EX": 1000533, "Syslog_-_LOGbinder_SP": 1000408, "Syslog_-_LOGbinder_SQL": 1000555, "Syslog_-_LogRhythm_Data_Indexer_Monitor": 1000653, "Syslog_-_LogRhythm_Inter_Deployment_Data_Sharing": 1000815, "Syslog_-_LogRhythm_Log_Distribution_Services": 1000840, "Syslog_-_LogRhythm_Network_Monitor": 197, "Syslog_-_LogRhythm_Syslog_Generator": 105, "Syslog_-_Lumension": 1000608, "Syslog_-_MacOS_X": 1000144, "Syslog_-_Malwarebytes_Endpoint_Security_CEF": 1000773, "Syslog_-_Mandiant_MIR": 1000489, "Syslog_-_McAfee_Advanced_Threat_Defense": 1000617, "Syslog_-_McAfee_Email_And_Web_Security": 1000051, "Syslog_-_McAfee_ePO": 1000866, "Syslog_-_McAfee_Firewall_Enterprise": 1000001, "Syslog_-_McAfee_Network_Security_Manager": 1000036, "Syslog_-_McAfee_Secure_Internet_Gateway": 136, "Syslog_-_McAfee_SecureMail": 1000092, "Syslog_-_McAfee_Skyhigh_for_Shadow_IT_LEEF": 1000644, "Syslog_-_McAfee_Web_Gateway": 1000612, "Syslog_-_mGuard_Firewall": 1000711, "Syslog_-_Microsoft_Advanced_Threat_Analytics_(ATA)_CEF": 1000731, "Syslog_-_Microsoft_Azure_Log_Integration": 1000733, "Syslog_-_Microsoft_Azure_MFA": 1000707, "Syslog_-_Microsoft_Forefront_UAG": 1000461, "Syslog_-_Mirapoint": 1000228, "Syslog_-_MobileIron": 1000497, "Syslog_-_Motorola_Access_Point": 1000313, "Syslog_-_MS_IIS_Web_Log_W3C_Format_(Snare)": 1000027, "Syslog_-_MS_Windows_Event_Logging_XML_-_Application": 1000783, "Syslog_-_MS_Windows_Event_Logging_XML_-_Security": 1000669, "Syslog_-_MS_Windows_Event_Logging_XML_-_System": 1000671, "Syslog_-_Nagios": 1000319, "Syslog_-_nCircle_Configuration_Compliance_Manager": 1000430, "Syslog_-_NetApp_Filer": 1000108, "Syslog_-_NETASQ_Firewall": 1000485, "Syslog_-_NetGate_Router": 1000527, "Syslog_-_NetMotion_VPN": 1000592, "Syslog_-_Netscout_nGenius_InfiniStream": 1000481, "Syslog_-_NetScreen_Firewall": 107, "Syslog_-_Netskope": 1000736, "Syslog_-_Netskope_CEF": 1000853, "Syslog_-_Network_Chemistry_RFprotect": 108, "Syslog_-_Nginx_Web_Log": 1000584, "Syslog_-_Nimble_Storage": 1000727, "Syslog_-_Nortel_8600_Switch": 1000081, "Syslog_-_Nortel_BayStack_Switch": 171, "Syslog_-_Nortel_Contivity": 1000153, "Syslog_-_Nortel_Firewall": 168, "Syslog_-_Nortel_IP_1220": 1000205, "Syslog_-_Nortel_Passport_Switch": 169, "Syslog_-_Nozomi_Networks_Guardian_CEF": 1000819, "Syslog_-_NuSecure_Gateway": 1000198, "Syslog_-_Nutanix": 26, "Syslog_-_Open_Collector": 1000759, "Syslog_-_Open_Collector_-_AWS_CloudTrail": 1000786, "Syslog_-_Open_Collector_-_AWS_CloudWatch": 1000789, "Syslog_-_Open_Collector_-_AWS_Config_Events": 1000790, "Syslog_-_Open_Collector_-_AWS_Guard_Duty": 1000791, "Syslog_-_Open_Collector_-_AWS_S3": 1000802, "Syslog_-_Open_Collector_-_Azure_Event_Hub": 1000772, "Syslog_-_Open_Collector_-_Carbon_Black_Cloud": 1000861, "Syslog_-_Open_Collector_-_CarbonBlackBeat_Heartbeat": 1000864, "Syslog_-_Open_Collector_-_Cisco_AMP": 1000842, "Syslog_-_Open_Collector_-_Cisco_Umbrella": 1000787, "Syslog_-_Open_Collector_-_CiscoAMPBeat_Heartbeat": 1000843, "Syslog_-_Open_Collector_-_Duo_Authentication_Security": 1000854, "Syslog_-_Open_Collector_-_DuoBeat_Heartbeat": 1000855, "Syslog_-_Open_Collector_-_EventHubBeat_Heartbeat": 1000833, "Syslog_-_Open_Collector_-_GCP_Audit": 1000817, "Syslog_-_Open_Collector_-_GCP_Cloud_Key_Management_Service": 1000820, "Syslog_-_Open_Collector_-_GCP_Http_Load_Balancer": 1000839, "Syslog_-_Open_Collector_-_GCP_Pub_Sub": 1000812, "Syslog_-_Open_Collector_-_GCP_Security_Command_Center": 1000816, "Syslog_-_Open_Collector_-_GCP_Virtual_Private_Cloud": 1000821, "Syslog_-_Open_Collector_-_Gmail_Message_Tracking": 1000823, "Syslog_-_Open_Collector_-_GMTBeat_Heartbeat": 1000834, "Syslog_-_Open_Collector_-_GSuite": 1000758, "Syslog_-_Open_Collector_-_GSuiteBeat_Heartbeat": 1000838, "Syslog_-_Open_Collector_-_Metricbeat": 1000841, "Syslog_-_Open_Collector_-_Okta_System_Log": 1000863, "Syslog_-_Open_Collector_-_OktaSystemLogBeat_Heartbeat": 1000865, "Syslog_-_Open_Collector_-_PubSubBeat_Heartbeat": 1000836, "Syslog_-_Open_Collector_-_S3Beat_Heartbeat": 1000835, "Syslog_-_Open_Collector_-_Sophos_Central": 1000814, "Syslog_-_Open_Collector_-_SophosCentralBeat_Heartbeat": 1000837, "Syslog_-_Open_Collector_-_Webhook": 1000850, "Syslog_-_Open_Collector_-_Webhook_OneLogin": 1000848, "Syslog_-_Open_Collector_-_Webhook_Zoom": 1000849, "Syslog_-_Open_Collector_-_WebhookBeat_Heartbeat": 1000851, "Syslog_-_Opengear_Console": 28, "Syslog_-_OpenLDAP": 1000305, "Syslog_-_Oracle_10g_Audit_Trail": 1000071, "Syslog_-_Oracle_11g_Audit_Trail": 1000223, "Syslog_-_OSSEC_Alerts": 1000218, "Syslog_-_Other": 92, "Syslog_-_Outpost24": 1000414, "Syslog_-_Palo_Alto_Cortex_XDR": 1000867, "Syslog_-_Palo_Alto_Custom_Pipe": 15, "Syslog_-_Palo_Alto_Firewall": 1000134, "Syslog_-_Palo_Alto_Traps_CEF": 1000729, "Syslog_-_Palo_Alto_Traps_Management_Service": 1000796, "Syslog_-_Password_Manager_Pro": 21, "Syslog_-_pfSense_Firewall": 1000740, "Syslog_-_PingFederate_7.2": 1000631, "Syslog_-_PingFederate_CEF": 1000770, "Syslog_-_Polycom": 1000362, "Syslog_-_Postfix": 1000105, "Syslog_-_Procera_PacketLogic": 9, "Syslog_-_Proofpoint_Spam_Firewall": 141, "Syslog_-_Protegrity_Defiance_DPS": 1000085, "Syslog_-_QLogic_Infiniband_Switch": 1000449, "Syslog_-_Quest_Defender": 1000328, "Syslog_-_Radiator_Radius": 4, "Syslog_-_RADiFlow_3180_Switch": 1000498, "Syslog_-_Radware_Alteon_Load_Balancer": 1000245, "Syslog_-_Radware_DefensePro": 1000241, "Syslog_-_Radware_Web_Server_Director_Audit_Log": 1000344, "Syslog_-_Raritan_KVM": 1000279, "Syslog_-_Raz-Lee": 1000428, "Syslog_-_RedSeal": 1000547, "Syslog_-_Riverbed": 1000156, "Syslog_-_RSA_ACE": 190, "Syslog_-_RSA_Authentication_Manager_v7.1": 1000233, "Syslog_-_RSA_Authentication_Manager_v8.x": 1000656, "Syslog_-_RSA_Web_Threat_Detection": 1000512, "Syslog_-_RSA_Web_Threat_Detection_5.1": 1000574, "Syslog_-_RuggedRouter": 1000093, "Syslog_-_Safenet": 1000074, "Syslog_-_Sailpoint": 1000640, "Syslog_-_Sauce_Labs": 1000704, "Syslog_-_SecureAuth_IdP": 1000443, "Syslog_-_SecureAuth_IdP_v9": 1000713, "Syslog_-_SecureLink": 1000793, "Syslog_-_SecureTrack": 1000249, "Syslog_-_SEL_3610_Port_Switch": 1000273, "Syslog_-_SEL_3620_Ethernet_Security_Gateway": 1000246, "Syslog_-_Sentinel_IPS": 1000460, "Syslog_-_SentinelOne_CEF": 1000712, "Syslog_-_Sguil": 1000719, "Syslog_-_Siemens_Scalance_X400": 1000473, "Syslog_-_Smoothwall_Firewall": 1000435, "Syslog_-_SnapGear_Firewall": 1000409, "Syslog_-_Snare_Windows_2003_Event_Log": 1000028, "Syslog_-_Snare_Windows_2008_Event_Log": 19, "Syslog_-_Snort_IDS": 1000019, "Syslog_-_Solaris_(Snare)": 120, "Syslog_-_Solaris_Host": 91, "Syslog_-_SonicWALL": 106, "Syslog_-_SonicWALL_SSL-VPN": 137, "Syslog_-_Sophos_Email_Encryption_Appliance": 1000336, "Syslog_-_Sophos_UTM": 113, "Syslog_-_Sophos_Web_Proxy": 1000399, "Syslog_-_Sophos_XG_Firewall": 1000792, "Syslog_-_Sourcefire_IDS_3D": 1000080, "Syslog_-_Sourcefire_RNA": 1000340, "Syslog_-_Spectracom_Network_Time_Server": 1000463, "Syslog_-_Splunk_API_-_Checkpoint_Firewall": 1000689, "Syslog_-_Splunk_API_-_Cisco_Netflow_V9": 1000697, "Syslog_-_Splunk_API_-_Nessus_Vulnerability_Scanner": 1000692, "Syslog_-_Squid_Proxy": 2, "Syslog_-_StealthBits_Activity_Monitor": 1000844, "Syslog_-_STEALTHbits_StealthINTERCEPT": 1000737, "Syslog_-_StoneGate_Firewall": 1000291, "Syslog_-_Stonesoft_IPS": 1000480, "Syslog_-_Stormshield_Network_Security_Firewall": 1000650, "Syslog_-_Sycamore_Networks_DNX-88": 1000588, "Syslog_-_Sygate_Firewall": 180, "Syslog_-_Symantec_Advanced_Threat_Protection_(ATP)_CEF": 1000798, "Syslog_-_Symantec_DLP_CEF": 181, "Syslog_-_Symantec_Endpoint_Server": 1000077, "Syslog_-_Symantec_Messaging_Gateway": 1000828, "Syslog_-_Symantec_PGP_Gateway": 1000387, "Syslog_-_Symbol_Wireless_Access_Point": 114, "Syslog_-_Tanium": 1000674, "Syslog_-_Temporary_LST-2": 1000699, "Syslog_-_Tenable_SecurityCenter": 1000534, "Syslog_-_Thycotic_Secret_Server": 1000519, "Syslog_-_Tipping_Point_IPS": 143, "Syslog_-_Tipping_Point_SSL_Reverse_Proxy": 1000339, "Syslog_-_Top_Layer_IPS": 1000048, "Syslog_-_Townsend_Alliance_LogAgent": 1000213, "Syslog_-_Trend_Micro_Control_Manager_CEF": 1000750, "Syslog_-_Trend_Micro_Deep_Discovery_Inspector": 1000580, "Syslog_-_Trend_Micro_Deep_Security_CEF": 1000388, "Syslog_-_Trend_Micro_Deep_Security_LEEF": 1000804, "Syslog_-_Trend_Micro_IWSVA": 1000330, "Syslog_-_Trend_Micro_Vulnerability_Protection_Manager": 1000803, "Syslog_-_Tripwire": 192, "Syslog_-_Trustwave_NAC": 1000596, "Syslog_-_Trustwave_Secure_Web_Gateway": 1000499, "Syslog_-_Trustwave_Web_Application_Firewall": 1000065, "Syslog_-_Tufin": 1000684, "Syslog_-_Tumbleweed_Mailgate_Server": 1000078, "Syslog_-_Ubiquiti_UniFi_Security_Gateway": 1000760, "Syslog_-_Ubiquiti_UniFi_Switch": 1000757, "Syslog_-_Ubiquiti_UniFi_WAP": 1000762, "Syslog_-_Untangle": 1000365, "Syslog_-_Vamsoft_ORF": 1000458, "Syslog_-_Vanguard_Active_Alerts": 1000694, "Syslog_-_Varonis_DatAlert": 1000544, "Syslog_-_Vasco_Digipass_Identikey_Server": 1000503, "Syslog_-_Vectra_Networks": 1000779, "Syslog_-_Versa_Networks_SD-WAN": 1000824, "Syslog_-_VMWare_ESX/ESXi_Server": 1000000, "Syslog_-_VMware_Horizon_View": 1000603, "Syslog_-_VMWare_NSX/NSX-T": 1000768, "Syslog_-_VMWare_Unified_Access_Gateway": 1000871, "Syslog_-_VMWare_vCenter_Server": 1000752, "Syslog_-_VMWare_vShield": 1000487, "Syslog_-_Voltage_Securemail": 1000543, "Syslog_-_Vormetric_CoreGuard": 1000210, "Syslog_-_Vormetric_Data_Security_Manager": 1000486, "Syslog_-_WALLIX_Bastion": 1000765, "Syslog_-_Watchguard_FireBox": 129, "Syslog_-_WS2000_Wireless_Access_Point": 1000076, "Syslog_-_Wurldtech_SmartFirewall": 198, "Syslog_-_Xirrus_Wireless_Array": 1000197, "Syslog_-_Zimbra_System_Log": 1000100, "Syslog_-_Zix_E-mail_Encryption": 1000654, "Syslog_-_Zscaler_Nano_Streaming_Service": 1000546, "Syslog_-_ZXT_Load_Balancer": 1000411, "Syslog_-_ZyWALL_VPN_Firewall": 1000666, "Syslog_Avaya_G450_Media_Gateway": 1000670, "Syslog_File_-_AIX_Host": 1000006, "Syslog_File_-_BSD_Format": 35, "Syslog_File_-_HP-UX_Host": 1000145, "Syslog_File_-_IRIX_Host": 1000295, "Syslog_File_-_Linux_Host": 103, "Syslog_File_-_LogRhythm_Syslog_Generator": 13, "Syslog_File_-_MS_2003_Event_Log_(Snare)": 1000039, "Syslog_File_-_Oracle_10g_Audit_Trail": 1000072, "Syslog_File_-_Oracle_11g_Audit_Trail": 1000222, "Syslog_File_-_Solaris_Host": 104, "UDLA_-_CA_Single_Sign-On": 1000636, "UDLA_-_Deepnet_DualShield": 1000286, "UDLA_-_Drupal": 1000496, "UDLA_-_Finacle_Core": 1000196, "UDLA_-_Finacle_Treasury_Logs": 1000178, "UDLA_-_Forcepoint": 1000020, "UDLA_-_Gallagher_Command_Centre": 1000810, "UDLA_-_iManage_Worksite": 1000732, "UDLA_-_ISS_Proventia_SiteProtector_-_IPS": 1000034, "UDLA_-_LogRhythm_Enterprise_Monitoring_Solution": 1000314, "UDLA_-_LREnhancedAudit": 1000548, "UDLA_-_McAfee_ePolicy_Orchestrator_-_Universal_ePOEvents": 1000788, "UDLA_-_McAfee_ePolicy_Orchestrator_3.6_-_Events": 158, "UDLA_-_McAfee_ePolicy_Orchestrator_4.0_-_ePOEvents": 1000079, "UDLA_-_McAfee_ePolicy_Orchestrator_4.5_-_ePOEvents": 1000175, "UDLA_-_McAfee_ePolicy_Orchestrator_5.0_-_ePOEvents": 1000531, "UDLA_-_McAfee_ePolicy_Orchestrator_5.1_-_ePOEvents": 1000550, "UDLA_-_McAfee_ePolicy_Orchestrator_5.3_-_ePOEvents": 1000696, "UDLA_-_McAfee_ePolicy_Orchestrator_5.9_-_ePOEvents": 1000761, "UDLA_-_McAfee_Network_Access_Control": 1000055, "UDLA_-_McAfee_Network_Security_Manager": 1000453, "UDLA_-_Microsoft_System_Center_2012_Endpoint_Protection": 1000587, "UDLA_-_ObserveIT": 1000605, "UDLA_-_Oracle_10g_Audit_Trail": 152, "UDLA_-_Oracle_11g_Audit_Trail": 1000171, "UDLA_-_Oracle_12C_Unified_Auditing": 1000658, "UDLA_-_Oracle_9i_Audit_Trail": 1000040, "UDLA_-_Other": 1000576, "UDLA_-_SEL_3530_RTAC": 1000285, "UDLA_-_SharePoint_2007_AuditData": 1000208, "UDLA_-_SharePoint_2010_EventData": 1000415, "UDLA_-_SharePoint_2013_EventData": 1000606, "UDLA_-_Siemens_Invision": 1000229, "UDLA_-_Sophos_Anti-Virus": 1000090, "UDLA_-_Sophos_Endpoint_Security_and_Control": 1000735, "UDLA_-_Symantec_CSP": 1000505, "UDLA_-_Symantec_SEP": 1000520, "UDLA_-_Symmetry_Access_Control": 1000270, "UDLA_-_VMWare_vCenter_Server": 1000378, "UDLA_-_VMWare_vCloud": 1000538, "VLS_-_Syslog_-_Infoblox_-_DNS_RPZ": 1000643, "VLS_-_Syslog_-_Infoblox_-_Threat_Protection": 1000642, } """ HELPER FUNCTIONS """ def fix_date_values(item): date_keys = ["normalDateMin", "normalDate", "normalMsgDateMax", "logDate"] for key in date_keys: if item.get(key): item[key] = datetime.fromtimestamp(item.get(key) / 1000.0).strftime("%Y-%m-%d %H:%M:%S") def fix_location_value(items): for item in items: location_val = str(item.get("location")) if location_val == "{u'id': -1}": item["location"] = "NA" return items def get_time_frame(time_frame, start_arg, end_arg): start = datetime.now() end = datetime.now() if time_frame == "Today": start = datetime(end.year, end.month, end.day) elif time_frame == "Last2Days": start = end - timedelta(days=2) elif time_frame == "LastWeek": start = end - timedelta(days=7) elif time_frame == "LastMonth": start = end - timedelta(days=30) elif time_frame == "Custom": if not start_arg: return_error("start-date argument is missing") if not end_arg: return_error("end-date argument is missing") start = datetime.strptime(start_arg, "%Y-%m-%d") end = datetime.strptime(end_arg, "%Y-%m-%d") return start, end def http_request(method, url_suffix, data=None, headers=HEADERS): try: res = requests.request(method, urljoin(BASE_URL, url_suffix), headers=headers, verify=INSECURE, data=data) except Exception as e: return_error(e) # Handle error responses gracefully if "application/json" not in res.headers.get("Content-Type", []) and res.status_code != 204: LOG(f"response status code is: {res.status_code}") return_error("invalid url or port: " + BASE_URL) if res.status_code == 404: if res.json().get("message"): return_error(res.json().get("message")) else: return_error("No data returned") if res.status_code not in {200, 201, 202, 204, 207}: return_error( "Error in API call to {}, status code: {}, reason: {}".format( BASE_URL + "/" + url_suffix, res.status_code, res.json()["message"] ) ) if res.status_code == 204: return {} return res.json() def get_host_by_id(host_id): res = http_request("GET", "lr-admin-api/hosts/" + host_id) return fix_location_value([res]) def update_hosts_keys(hosts): new_hosts = [] for host in hosts: tmp_host = { "EntityId": host.get("entity").get("id"), "EntityName": host.get("entity").get("name"), "OS": host.get("os"), "ThreatLevel": host.get("threatLevel"), "UseEventlogCredentials": host.get("useEventlogCredentials"), "Name": host.get("name"), "DateUpdated": host.get("dateUpdated"), "HostZone": host.get("hostZone"), "RiskLevel": host.get("riskLevel"), "Location": host.get("location"), "Status": host.get("recordStatusName"), "ThreatLevelComments": host.get("threatLevelComments"), "ID": host.get("id"), "OSType": host.get("osType"), } new_hosts.append(tmp_host) return new_hosts def update_networks_keys(networks): new_networks = [] for network in networks: tmp_network = { "EndIP": network.get("eip"), "HostStatus": network.get("recordStatusName"), "Name": network.get("name"), "RiskLevel": network.get("riskLevel"), "EntityId": network.get("entity").get("id"), "EntityName": network.get("entity").get("name"), "Location": network.get("location"), "ThreatLevel": network.get("threatLevel"), "DateUpdated": network.get("dateUpdated"), "HostZone": network.get("hostZone"), "ID": network.get("id"), "BeganIP": network.get("bip"), } new_networks.append(tmp_network) return new_networks def update_users_keys(users): new_users = [] for user in users: tmp_user = { "ID": user.get("id"), "DateUpdated": user.get("dateUpdated"), "HostStatus": user.get("recordStatusName"), "LastName": user.get("lastName"), "FirstName": user.get("firstName"), "UserType": user.get("userType"), "Entity": user.get("objectPermissions").get("entity"), "Owner": user.get("objectPermissions").get("owner"), "ReadAccess": user.get("objectPermissions").get("readAccess"), "WriteAccess": user.get("objectPermissions").get("writeAccess"), } new_users.append(tmp_user) return new_users def update_logins_keys(logins): new_logins = [] for login in logins: tmp_login = { "Login": login.get("login"), "UserProfileId": login.get("userProfileId"), "UserId": login.get("userId"), "DefaultEntityId": login.get("defaultEntityId"), "HostStatus": login.get("recordStatusName"), "DateUpdated": login.get("dateUpdated"), "DateCreated": login.get("dateCreated"), "Entities": login.get("entities"), } new_logins.append(tmp_login) return new_logins def update_profiles_keys(profiles): new_profiles = [] for profile in profiles: tmp_profile = { "ID": profile.get("id"), "Name": profile.get("name"), "ShortDescription": profile.get("shortDescription"), "LongDescription": profile.get("longDescription"), "DataProcessorAccessMode": profile.get("dataProcessorAccessMode"), "SecurityRole": profile.get("securityRole"), "ProfileType": profile.get("ProfileType"), "DateUpdated": profile.get("dateUpdated"), "TotalAssociatedUsers": profile.get("totalAssociatedUsers"), "NotificationGroupsPermissions": profile.get("notificationGroupsPermissions"), "ADGroupsPermissions": profile.get("adGroupsPermissions"), "EntityPermissions": profile.get("entityPermissions"), "DataProcessorsPermissions": profile.get("dataProcessorsPermissions"), "LogsourceListPermissions": profile.get("logsourceListPermissions"), "LogSourcePermissions": profile.get("logSourcePermissions"), "Privileges": profile.get("privileges"), "SmartResponsePluginsPermissions": profile.get("smartResponsePluginsPermissions"), } new_profiles.append(tmp_profile) return new_profiles def update_persons_keys(persons): new_persons = [] for person in persons: tmp_person = { "ID": person.get("id"), "DateUpdated": person.get("dateUpdated"), "HostStatus": person.get("recordStatusName"), "LastName": person.get("lastName"), "FirstName": person.get("firstName"), "IsAPIPerson": person.get("isAPIPerson"), "UserID": person.get("user").get("id"), "UserLogin": person.get("user").get("login"), } new_persons.append(tmp_person) return new_persons def generate_query_value(valueType, value): if valueType == 2: return int(value) elif valueType == 5: return str(value) else: return {"value": value, "matchType": 2} def generate_query_item(filterType, valueType, value): query = { "filterItemType": 0, "fieldOperator": 1, "filterMode": 1, "values": [{"filterType": filterType, "valueType": valueType, "value": generate_query_value(valueType, value)}], } return query """ COMMANDS + REQUESTS FUNCTIONS """ def test_module(): http_request("GET", "lr-admin-api/hosts") demisto.results("ok") def add_host(data_args): data = { "id": -1, "entity": {"id": int(data_args.get("entity-id")), "name": data_args.get("entity-name")}, "name": data_args.get("name"), "shortDesc": data_args.get("short-description"), "longDesc": data_args.get("long-description"), "riskLevel": data_args.get("risk-level"), "threatLevel": data_args.get("threat-level"), "threatLevelComments": data_args.get("threat-level-comments"), "recordStatusName": data_args.get("host-status"), "hostZone": data_args.get("host-zone"), "os": data_args.get("os"), "useEventlogCredentials": bool(data_args.get("use-eventlog-credentials")), "osType": data_args.get("os-type"), } res = http_request("POST", "lr-admin-api/hosts/", json.dumps(data)) res = fix_location_value([res]) context = createContext(update_hosts_keys(res), removeNull=True) outputs = {"Logrhythm.Host(val.ID === obj.ID)": context} return_outputs( readable_output=data_args.get("name") + " added successfully to " + data_args.get("entity-name"), outputs=outputs, raw_response=res, ) def get_hosts_by_entity(data_args): res = http_request("GET", "lr-admin-api/hosts?entity=" + data_args["entity-name"] + "&count=" + data_args["count"]) res = fix_location_value(res) res = update_hosts_keys(res) context = createContext(res, removeNull=True) human_readable = tableToMarkdown("Hosts for " + data_args.get("entity-name"), res, HOSTS_HEADERS) outputs = {"Logrhythm.Host(val.Name && val.ID === obj.ID)": context} return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def get_hosts(data_args): id = data_args.get("host-id") if id: res = get_host_by_id(id) else: res = http_request("GET", "lr-admin-api/hosts?count=" + data_args["count"]) res = fix_location_value(res) res = update_hosts_keys(res) context = createContext(res, removeNull=True) human_readable = tableToMarkdown("Hosts information:", res, HOSTS_HEADERS) outputs = {"Logrhythm.Host(val.Name && val.ID === obj.ID)": context} return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def change_status(data_args): data = [{"hostId": int(data_args.get("host-id")), "status": data_args.get("status")}] res = http_request("PUT", "lr-admin-api/hosts/status", json.dumps(data)) host_info = get_host_by_id(data_args.get("host-id")) context = createContext(update_hosts_keys(host_info), removeNull=True) outputs = {"Logrhythm.Host(val.ID === obj.ID)": context} return_outputs(readable_output="Status updated to " + data_args.get("status"), outputs=outputs, raw_response=res) def execute_query(data_args): # generate random string for request id req_id = "".join(random.choice(string.ascii_letters) for x in range(8)) start, end = get_time_frame(data_args.get("time-frame"), data_args.get("start-date"), data_args.get("end-date")) delta = end - start dates = [] for i in range(delta.days + 1): dates.append((start + timedelta(days=i)).strftime("logs-%Y-%m-%d")) data = { "indices": dates, "searchType": "DFS_QUERY_THEN_FETCH", "source": { "size": data_args.get("page-size"), "query": {"query_string": {"default_field": "logMessage", "query": data_args.get("keyword")}}, "stored_fields": "logMessage", "sort": [{"normalDate": {"order": "asc"}}], }, } headers = dict(HEADERS) headers["Content-Type"] = "application/json" headers["Request-Id"] = req_id headers["Request-Origin-Date"] = str(datetime.now()) headers["x-gateway-route-to-tag"] = CLUSTER_ID res = http_request("POST", "lr-legacy-search-api/esquery", json.dumps(data), headers) logs = res["hits"]["hits"] logs_response = [] xml_ns = ".//{http://schemas.microsoft.com/win/2004/08/events/event}" for log in logs: message = str(log["fields"]["logMessage"]) message = message[3:-2] try: root = defused_ET.fromstring(message) log_item = { "EventID": str(root.find(xml_ns + "EventID").text), # type: ignore "Level": str(root.find(xml_ns + "Level").text), # type: ignore "Task": str(root.find(xml_ns + "Task").text), # type: ignore "Opcode": str(root.find(xml_ns + "Opcode").text), # type: ignore "Keywords": str(root.find(xml_ns + "Keywords").text), # type: ignore "Channel": str(root.find(xml_ns + "Channel").text), # type: ignore "Computer": str(root.find(xml_ns + "Computer").text), # type: ignore "EventData": str(root.find(xml_ns + "EventData").text) # type: ignore .replace("\\r\\n", "\n") .replace("\\t", "\t"), } logs_response.append(log_item) except Exception: continue context = createContext(logs_response, removeNull=True) human_readable = tableToMarkdown("logs results", logs_response, LOGS_HEADERS) outputs = {"Logrhythm.Log": context} return_outputs(readable_output=human_readable, outputs=outputs, raw_response=logs_response) def get_persons(data_args): id = data_args.get("person-id") if id: res = [http_request("GET", "lr-admin-api/persons/" + id)] else: res = http_request("GET", "lr-admin-api/persons?count=" + data_args["count"]) res = update_persons_keys(res) context = createContext(res, removeNull=True) outputs = {"Logrhythm.Person(val.ID === obj.ID)": context} human_readable = tableToMarkdown("Persons information", context, PERSON_HEADERS) return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def get_users(data_args): id = data_args.get("user_id") if id: res = [http_request("GET", "lr-admin-api/users/" + id)] else: res = http_request("GET", "lr-admin-api/users?count=" + data_args["count"]) res = update_users_keys(res) context = createContext(res, removeNull=True) outputs = {"Logrhythm.User(val.ID === obj.ID)": context} human_readable = tableToMarkdown("Users information", context, USER_HEADERS) return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def add_user(data_args): data = {"userType": "Individual", "firstName": data_args.get("first_name"), "lastName": data_args.get("last_name")} if not data_args.get("abbreviation"): data["abbreviation"] = f"{data_args.get('first_name')[0]}{data_args.get('last_name')}".lower() else: data["abbreviation"] = data_args.get("abbreviation") res = [http_request("POST", "lr-admin-api/users/", json.dumps(data))] res = update_users_keys(res) context = createContext(res, removeNull=True) outputs = {"Logrhythm.User(val.ID === obj.ID)": context} human_readable = tableToMarkdown("User added", context, USER_HEADERS) return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def get_logins(data_args): id = data_args.get("user_id") if id: res = [http_request("GET", "lr-admin-api/users/" + id + "/login/")] else: res = http_request("GET", "lr-admin-api/users/user-logins?count=" + data_args["count"]) res = update_logins_keys(res) context = createContext(res, removeNull=True) outputs = {"Logrhythm.Login(val.Login === obj.Login)": context} human_readable = tableToMarkdown("Logins information", context, LOGIN_HEADERS) return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def add_login(data_args): id = data_args.get("user_id") data = { "login": data_args.get("login"), "userProfileId": arg_to_number(data_args.get("profile_id")), "defaultEntityId": arg_to_number(data_args.get("entity_id")), "password": data_args.get("password"), } res = [http_request("POST", "lr-admin-api/users/" + id + "/login/", json.dumps(data))] res = update_logins_keys(res) context = createContext(res, removeNull=True) outputs = {"Logrhythm.User(val.ID === obj.ID)": context} human_readable = tableToMarkdown("Login added", context, LOGIN_HEADERS) return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def get_privileges(data_args): id = data_args.get("user_id") res = http_request( "GET", "lr-admin-api/users/" + id + "/privileges?offset=" + data_args["offset"] + "&count=" + data_args["count"] ) res = {"ID": id, "Privileges": res} context = createContext(res, removeNull=True) outputs = {"Logrhythm.Privileges(val.ID === obj.ID)": context} human_readable = tableToMarkdown("Privileges information", context, ["Privileges"]) return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def get_profiles(data_args): id = data_args.get("profile_id") if id: res = [http_request("GET", "lr-admin-api/user-profiles/" + id)] else: res = http_request("GET", "lr-admin-api/user-profiles?count=" + data_args["count"]) res = update_profiles_keys(res) context = createContext(res, removeNull=True) outputs = {"Logrhythm.Profile(val.ID === obj.ID)": context} human_readable = tableToMarkdown("Users information", context, PROFILE_HEADERS) return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def get_networks(data_args): id = data_args.get("network-id") if id: res = [http_request("GET", "lr-admin-api/networks/" + id)] else: res = http_request("GET", "lr-admin-api/networks?count=" + data_args["count"]) res = fix_location_value(res) res = update_networks_keys(res) context = createContext(res, removeNull=True) outputs = {"Logrhythm.Network(val.ID === obj.ID)": context} human_readable = tableToMarkdown("Networks information", context, NETWORK_HEADERS) return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def get_alarm_data(data_args): id = data_args.get("alarm-id") res = http_request("GET", "lr-drilldown-cache-api/drilldown/" + id) if not res: return_outputs(readable_output=f"No data was found for alarm with ID {id}.") alarm_data = res["Data"]["DrillDownResults"] alarm_summaries = res["Data"]["DrillDownResults"]["RuleBlocks"] del alarm_data["RuleBlocks"] aie_message = xml2json(str(alarm_data.get("AIEMsgXml"))).replace('"@', '"') alarm_data["AIEMsgXml"] = json.loads(aie_message).get("aie") alarm_data["Status"] = ALARM_STATUS[str(alarm_data["Status"])] alarm_data["ID"] = alarm_data["AlarmID"] del alarm_data["AlarmID"] dds_summaries = [] for block in alarm_summaries: for item in block["DDSummaries"]: item["PIFType"] = PIF_TYPES[str(item["PIFType"])] m = re.findall(r'"field": "(([^"]|\\")*)"', item["DrillDownSummaryLogs"]) fields = [k[0] for k in m] item["DrillDownSummaryLogs"] = ", ".join(fields) del item["DefaultValue"] dds_summaries.append(item) alarm_data["Summary"] = dds_summaries context = createContext(alarm_data, removeNull=True) outputs = {"Logrhythm.Alarm(val.ID === obj.ID)": context} del alarm_data["AIEMsgXml"] del alarm_data["Summary"] human_readable = tableToMarkdown("Alarm information for alarm id " + id, alarm_data) + tableToMarkdown( "Alarm summaries", dds_summaries, ALARM_SUMMARY_HEADERS ) return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def get_alarm_events(data_args): id = data_args.get("alarm-id") count = data_args.get("count") count = int(data_args.get("count")) fields = data_args.get("fields") show_log_message = data_args.get("get-log-message") == "True" res = http_request("GET", "lr-drilldown-cache-api/drilldown/" + id) if not res: return_outputs(readable_output=f"No events were found for alarm with ID {id}") res = res["Data"]["DrillDownResults"]["RuleBlocks"] events = [] for block in res: if not block.get("DrillDownLogs"): continue logs = json.loads(block["DrillDownLogs"]) for log in logs: fix_date_values(log) if not show_log_message: del log["logMessage"] events.append(log) events = events[:count] human_readable = tableToMarkdown("Events information for alarm " + id, events) if fields: fields = fields.split(",") for event in events: for key in event: if key not in fields: del event[key] ec = {"ID": int(id), "Event": events} context = createContext(ec, removeNull=True) outputs = {"Logrhythm.Alarm(val.ID === obj.ID)": context} return_outputs(readable_output=human_readable, outputs=outputs, raw_response=res) def fetch_incidents(): headers = dict(HEADERS) last_run = demisto.getLastRun() # Check if first run. If not, continue running from the last case dateCreated field. if last_run and "start_time" in last_run: start_time = last_run.get("start_time") headers["createdAfter"] = start_time # print(start_time) else: headers["createdBefore"] = datetime.now().strftime("%Y-%m-%dT%H:%M:%SZ") # Get list of cases if ENTITY_ID: cases = http_request("GET", "lr-case-api/cases?entityNumber=" + str(ENTITY_ID), headers=headers) else: cases = http_request("GET", "lr-case-api/cases", headers=headers) # Set Last Run to the last case dateCreated field if cases: demisto.setLastRun({"start_time": cases[len(cases) - 1]["dateCreated"]}) # Generate incidents incidents = [] for case in cases: incident = { "name": "Case #" + str(case["number"]) + " " + str(case["name"]), "occurred": str(case["dateCreated"]), "rawJSON": json.dumps(case), } incidents.append(incident) demisto.incidents(incidents) def lr_get_case_evidence(data_args): case_id = data_args.get("case_id") case = http_request("GET", "lr-case-api/cases/" + case_id + "/evidence") result = CommandResults( outputs_prefix="Logrhythm.Evidence", outputs=case, readable_output=tableToMarkdown("Evidences for case " + case_id, case, headerTransform=string_to_table_header), raw_response=case, outputs_key_field="number", ) return_results(result) def lr_execute_search_query(data_args): number_of_days = data_args.get("number_of_days") source_type = data_args.get("source_type") host_name = data_args.get("host_name") username = data_args.get("username") subject = data_args.get("subject") sender = data_args.get("sender") recipient = data_args.get("recipient") hash = data_args.get("hash") url = data_args.get("URL") process_name = data_args.get("process_name") object = data_args.get("object") ipaddress = data_args.get("ip_address") max_message = data_args.get("max_massage") query_timeout = data_args.get("query_timeout") # Create filter query query = [] if host_name: query.append(generate_query_item(filterType=23, valueType=4, value=str(host_name))) if ENTITY_ID: query.append(generate_query_item(filterType=136, valueType=2, value=int(ENTITY_ID))) if source_type and source_type != "all": query.append(generate_query_item(filterType=9, valueType=2, value=SOURCE_TYPE_MAP[source_type])) if username: query.append(generate_query_item(filterType=43, valueType=4, value=str(username))) if subject: query.append(generate_query_item(filterType=33, valueType=4, value=str(subject))) if sender: query.append(generate_query_item(filterType=31, valueType=4, value=str(sender))) if recipient: query.append(generate_query_item(filterType=32, valueType=4, value=str(recipient))) if hash: query.append(generate_query_item(filterType=138, valueType=4, value=str(hash))) if url: query.append(generate_query_item(filterType=42, valueType=4, value=str(url))) if process_name: query.append(generate_query_item(filterType=41, valueType=4, value=str(process_name))) if object: query.append(generate_query_item(filterType=34, valueType=4, value=str(object))) if ipaddress: query.append(generate_query_item(filterType=17, valueType=5, value=str(ipaddress))) # Search and get TaskID querybody = { "maxMsgsToQuery": int(max_message), "logCacheSize": 10000, "queryTimeout": int(query_timeout), "queryRawLog": True, "queryEventManager": False, "dateCriteria": {"useInsertedDate": False, "lastIntervalValue": int(number_of_days), "lastIntervalUnit": 4}, "queryLogSources": [], "queryFilter": { "msgFilterType": 2, "isSavedFilter": False, "filterGroup": { "filterItemType": 1, "fieldOperator": 1, "filterMode": 1, "filterGroupOperator": 0, "filterItems": query, }, }, } headers = HEADERS headers["Content-Type"] = "application/json" search_task = http_request("POST", "lr-search-api/actions/search-task", json.dumps(querybody), headers) task_id = search_task.get("TaskId") results = CommandResults( outputs={"TaskID": task_id}, outputs_prefix="Logrhythm.Search.Task", outputs_key_field="taskID", raw_response=search_task, readable_output="New search query created, Task ID=" + task_id, ) return_results(results) def lr_get_query_result(data_args): task_id = data_args.get("task_id") queryresult = json.dumps( {"data": {"searchGuid": task_id, "search": {"sort": [], "fields": []}, "paginator": {"origin": 0, "page_size": 50}}} ) headers = HEADERS headers["Content-Type"] = "application/json" search_result = http_request("POST", "lr-search-api/actions/search-result", queryresult, headers) context = {"TaskID": task_id, "TaskStatus": search_result["TaskStatus"], "Items": search_result["Items"]} if search_result["TaskStatus"] == "Completed: No Results": message = "#### No results, please modify your search" elif search_result["TaskStatus"] == "Searching": message = "#### Searching" elif search_result["TaskStatus"] == "Search Failed": message = "#### The search is timed out, please try again or modify your search" elif search_result["Items"]: for log in search_result["Items"]: log.pop("logMessage", None) message = tableToMarkdown( "Search results for task " + task_id, search_result["Items"], headerTransform=string_to_table_header ) else: message = "#### Please try again later" results = CommandResults( readable_output=message, outputs=context, outputs_key_field="TaskID", outputs_prefix="Logrhythm.Search.Results", raw_response=search_result, ) return_results(results) """ COMMANDS MANAGER / SWITCH PANEL """ def main(): LOG(f"Command being called is {demisto.command()}") if not TOKEN: raise DemistoException("API token must be provided.") try: handle_proxy() if demisto.command() == "test-module": # This is the call made when pressing the integration test button. test_module() elif demisto.command() == "lr-add-host": add_host(demisto.args()) elif demisto.command() == "lr-get-hosts-by-entity": get_hosts_by_entity(demisto.args()) elif demisto.command() == "lr-get-hosts": get_hosts(demisto.args()) elif demisto.command() == "lr-execute-query": execute_query(demisto.args()) elif demisto.command() == "lr-update-host-status": change_status(demisto.args()) elif demisto.command() == "lr-get-persons": get_persons(demisto.args()) elif demisto.command() == "lr-get-users": get_users(demisto.args()) elif demisto.command() == "lr-get-logins": get_logins(demisto.args()) elif demisto.command() == "lr-get-privileges": get_privileges(demisto.args()) elif demisto.command() == "lr-get-profiles": get_profiles(demisto.args()) elif demisto.command() == "lr-get-networks": get_networks(demisto.args()) elif demisto.command() == "lr-get-alarm-data": get_alarm_data(demisto.args()) elif demisto.command() == "lr-get-alarm-events": get_alarm_events(demisto.args()) elif demisto.command() == "fetch-incidents": fetch_incidents() elif demisto.command() == "lr-execute-search-query": lr_execute_search_query(demisto.args()) elif demisto.command() == "lr-get-query-result": lr_get_query_result(demisto.args()) elif demisto.command() == "lr-get-case-evidence": lr_get_case_evidence(demisto.args()) elif demisto.command() == "lr-add-user": add_user(demisto.args()) elif demisto.command() == "lr-add-login": add_login(demisto.args()) except Exception as e: return_error(f"error has occurred: {e!s}") # python2 uses __builtin__ python3 uses builtins if __name__ in ("__main__", "__builtin__", "builtins"): # pragma: no cover main()