var username = params.credentials.identifier; var password = params.credentials.password; var server = params.server.replace(/[\/]+$/, ''); var insecure = params.insecure; var proxy = params.proxy; var url = server + '/webservice/Manager'; var responseDict = { 'authenticate': /(.*)<\/authenticateReturn/, 'hostRetrieveAll': /((.|\n)*)<\/soapenv:Body>/, 'endSession': /<\/soapenv:Body>/, 'systemEventRetrieve': /((.|\n)*)<\/systemEventRetrieveResponse>/, 'antiMalwareEventRetrieve':/((.|\n)*)<\/antiMalwareEventRetrieveResponse>/, 'hostAntiMalwareScan':/((.|\n)*)<\/soapenv:Body>/, 'alertStatusRetrieve':/((.|\n)*)<\/soapenv:Body>/, 'securityProfileRetrieveAll': /((.|\n)*)<\/soapenv:Body>/, 'securityProfileAssignToHost': /((.|\n)*)<\/soapenv:Body>/ }; var commandToMethod = { 'trendmicro-host-antimalware-scan': 'hostAntiMalwareScan', 'trendmicro-host-retrieve-all': 'hostRetrieveAll', 'trendmicro-system-event-retrieve': 'systemEventRetrieve', 'trendmicro-anti-malware-event-retrieve': 'antiMalwareEventRetrieve', 'trendmicro-alert-status': 'alertStatusRetrieve', 'trendmicro-security-profile-retrieve-all': 'securityProfileRetrieveAll', 'trendmicro-security-profile-assign-to-host': 'securityProfileAssignToHost' }; var sessionData = '%sessionId%'; var methodDict = { 'authenticate': '%username%%password%', 'endSession': '' + sessionData + '', 'hostRetrieveAll': '' + sessionData + '', 'systemEventRetrieve': '%timeFilter%%hostFilter%%eventIdFilter%%includeNonHostEvents%'+ sessionData +'', 'antiMalwareEventRetrieve': '%timeFilter%%hostFilter%%eventIdFilter%'+ sessionData +'', 'hostAntiMalwareScan': '%hostIDs%' + sessionData + '', 'alertStatusRetrieve': '%count%' + sessionData + '', 'securityProfileRetrieveAll': '' + sessionData + '', 'securityProfileAssignToHost':'%securityProfileID%%hostIDs%' + sessionData + '' }; var filterDict = { 'timeFilter': '%timeFilter%', 'hostFilter': '%hostFilter%', 'eventIdFilter': '%eventIdFilter%' }; var hostFilterDict = { 'hostGroupID': '%hostGroupID%', 'hostID': '%hostID%', 'securityProfileID': '%securityProfileID%', 'hostFilterType': '%hostFilterType%' }; var timeFilterDict = { 'rangeFrom': '%rangeFrom%', 'rangeTo': '%rangeTo%', 'specificTime': '%specificTime%', 'timeFilterType': '%timeFilterType%' }; var eventIdFilterDict = { 'eventID': '%eventID%', 'eventFilterOperator': '%eventFilterOperator%' }; var filterContentDict = { 'hostFilter': hostFilterDict, 'timeFilter': timeFilterDict, 'eventIdFilter': eventIdFilterDict }; // Wrap host IDs array if exists if ('hostIDs' in args) { args.hostIDs = '' + args.hostIDs.split(',').join('') + ''; } function getFilterContent(filterName, args) { var filterContent = ''; filterArgsDict = filterContentDict[filterName]; var argNames = Object.keys(args); for (var i = 0; i < argNames.length; i++) { if (argNames[i] in filterArgsDict){ filterContent += filterArgsDict[argNames[i]]; } } if (!filterContent) { return ''; } var filterContents = {}; filterContents[filterName] = filterContent; return replaceInTemplates(filterDict[filterName], filterContents); } // In requests with optional filters, the command arguemnts will determine which filters to add function AddFiltersIfNeeded(reqTemplate, args) { var filtersForRequest = {}; var filterNames = Object.keys(filterDict); for (var i = 0; i < filterNames.length; i++) { var patt = new RegExp(filterNames[i]); if (patt.exec(reqTemplate)) { var filterContent = getFilterContent(filterNames[i], args); filtersForRequest[filterNames[i]] = filterContent; } } return replaceInTemplates(reqTemplate, filtersForRequest); } function createSOAPRequest(methodName, args) { var request = '%content%'; var bodyWithFilters = AddFiltersIfNeeded(methodDict[methodName], args); request = replaceInTemplates(request, {'content': bodyWithFilters}); // add body to request request = replaceInTemplates(request, args); // fill arguemnts return request; } function sendSOAPRequest(methodName, args) { var req = createSOAPRequest(methodName, args); var res = http( url, { Method: 'POST', Headers: { SOAPAction: [""] }, Body: req }, insecure, proxy ); if (res.StatusCode < 200 || res.StatusCode >= 300) { throw 'Failed to ' + methodName + ', request status code: ' + res.StatusCode + ' and Body: ' + res.Body + '.'; } return res.Body; } function sendAndParse(method, args) { var responseXML = sendSOAPRequest(method, args); var match = responseDict[method].exec(responseXML); if (match && match[1]) { return match[1]; } throw method +' failed'; } function createIncidentFromAlert(singleAlert) { var keys = Object.keys(singleAlert); var labels = []; for (var i = 0; i < keys.length; i++) { labels.push({'type': keys[i], 'value': String(singleAlert[keys[i]])}); } var alertTime = new Date(singleAlert.alertDate); return { "name": singleAlert.alertType, "occurred": alertTime, "labels": labels, "rawJSON": JSON.stringify(singleAlert) } } function fetchIncidents() { var lastRun = getLastRun(); var startTime = lastRun && lastRun.startTime ? lastRun.startTime : 0; var maxTime = startTime; args.sessionId = sendAndParse('authenticate', {username: username, password: password}); args.count = 1000; var res = JSON.parse(x2j(sendAndParse('alertStatusRetrieve', args))); sendAndParse('endSession',args); var incidents = []; if (res && res.alertStatusRetrieveResponse){ var alertsDict = res.alertStatusRetrieveResponse.alertStatusRetrieveReturn; for (var i in alertsDict) { var alertTime = new Date(alertsDict[i].alertDate); if (alertTime > startTime) { incidents.push(createIncidentFromAlert(alertsDict[i])); maxTime = Math.max(alertTime, maxTime); } } } setLastRun({startTime: maxTime}); return JSON.stringify(incidents); } switch (command) { case 'test-module': if (sendAndParse('authenticate', {username: username, password: password})) { return 'ok'; } return 'something is wrong'; case 'fetch-incidents': return fetchIncidents(); default: args.sessionId = sendAndParse('authenticate', {username: username, password: password}); var res = JSON.parse(x2j(sendAndParse(commandToMethod[command], args))); sendAndParse('endSession',args); return res; }