Compare commits

..

No commits in common. "cd9c6d535e88c84238717e18a103e793e8b97648" and "c7b4e8ef85b53bfb56290608e2d70710db66a75f" have entirely different histories.

4 changed files with 46 additions and 221 deletions

12
inex.py
View File

@ -1,20 +1,23 @@
import pyodbc
import os
import logging
import datetime
import tomllib
from inexLogging import inexLog
import inexConnect
from inexDataModel import dataTemplate
from inexDataProcessing import processData
import json
import decimal
import requests
import inexEncoder
import inexSqlquery
class Inex:
def __init__(self):
"""Initilize config, calls functions from inex-connect.py and inex-logging.py"""
# assign libraries
self.db = pyodbc
self.tm = datetime
self.il = logging
self.ic = inexConnect
self.r = requests
@ -22,7 +25,6 @@ class Inex:
self.os = os
self.j = json
self.e = inexEncoder.Encoder
self.sq = inexSqlquery
if self.os.path.exists('./config.toml'):
config_file_path = './config.toml'
@ -61,11 +63,9 @@ class Inex:
inexLog(self)
# create the connection to the database
self.cursor = self.ic.inexSql.connectDatabase(self, self.db, self.dbDriver, self.dbServer, self.dbDatabase, self.dbUser, self.dbPassword)
self.cursor = self.ic.connectDatabase(self, self.db, self.dbDriver, self.dbServer, self.dbDatabase, self.dbUser, self.dbPassword)
# self.data = self.ic.inexSql.databaseQuery(self, self.cursor, self.dbQuery)
self.data = self.ic.inexSql.databaseQuery(self, self.cursor, self.sq.sqlQuerymodel.queryData())
self.data = self.ic.databaseQuery(self, self.cursor, self.dbQuery)
self.modifiedData = processData(self.data, dataTemplate, prd_instance_id=self.prdInstanceID,\
product_guid=self.productGUID,product_name=self.productName,product_version=self.productVersion)

View File

@ -1,5 +1,4 @@
class inexSql:
def connectDatabase(self, lib, driver, server, database, user, password):
def connectDatabase(self, lib, driver, server, database, user, password):
"""Connects to the database. Requires a windows driver to do so.
Typically there is one installed by default"""
@ -19,7 +18,7 @@ class inexSql:
return cursor
def databaseQuery(self, cursor, query, args=()):
def databaseQuery(self, cursor, query, args=()):
if self.useLog:
self.il.debug(f"Query:")
self.il.debug(query)

View File

@ -46,166 +46,3 @@ def dataTemplate(**kwargs):
}
return template
FileUploaded = {
"bytes" : 2490,
"dst_endpoint": {
"port": 22,
"ip": "10.91.160.77",
"type": "SFTP"
},
"duration": 200,
"file": {
"created_time": 1722485724000,
"size": 2490,
"name": "Case9.vbs",
"path": "\\\\10.255.255.9\\shared\\HASite\\InetPub\\EFTRoot\\MySite\\Usr\\Ivan //<PhysicalFolderName>"
},
"guid": "48D9C7A3-2DC6-11EF-AA59-00155D641204",
"node_name":"PERF01-S2019-77",
"prd_ext_tenant_id": "e71851c2-593f-4f49-9c07-91727b1be94b",
"product_name": "GlobalScape EFT",
"prd_ext_tenant_name": "GlobalScape EFT",
"classifications": [{
"ref_id": "globalscape:48D9C7A3-2DC6-11EF-AA59-00155D641204",
"time":1722485724000,
}],
"session": {
"created_time":1722485724000,
"uid": "3615136"
},
"src_endpoint": {
"port": 58868,
"ip": "10.91.160.45",
"type":"SFTP"
},
"tenant": "e71851c2-593f-4f49-9c07-91727b1be94b",
"tenant_name":"GlobalScape",
"time":1722485724000,
"status_code":226,
"status_detail":"Upload Successful",
"user": {
"home_directory": "/Usr/Ivan/",
"uuid":"48D9C7A3-2DC6-11EF-AA59-00155D641204",
"uid": "3978403",
"type": "User",
"name": "Ivan"
},
"utype": "file_uploaded"
}
FileDownloaded = {
"bytes" : 4891,
"dst_endpoint": {
"port": 443,
"ip": "10.91.160.77",
"type": "HTTPS"
},
"duration": 200,
"file": {
"created_time": 1722518124000,
"size": 4891,
"name": "FileDownload1.exe",
"path": "\\\\10.255.255.9\\shared\\HASite\\InetPub\\EFTRoot\\MySite\\Usr\\Ivan //<PhysicalFolderName>"
},
"guid": "48D9C7A3-2DC6-11EF-AA59-00155D641205",
"node_name":"PERF01-S2019-77",
"prd_ext_tenant_id": "e71851c2-593f-4f49-9c07-91727b1be94b",
"product_name": "GlobalScape EFT",
"prd_ext_tenant_name": "GlobalScape EFT",
"classifications": [{
"ref_id": "globalscape:48D9C7A3-2DC6-11EF-AA59-00155D641205",
"time":1722518124000,
}],
"session": {
"created_time":1722518124000,
"uid": "3615137"
},
"src_endpoint": {
"port": 443,
"ip": "10.91.160.45",
"type":"HTTPS"
},
"tenant": "e71851c2-593f-4f49-9c07-91727b1be94b",
"tenant_name":"GlobalScape",
"time":1722518124000,
"status_code":226,
"status_detail":"Download Successful",
"user": {
"home_directory": "/Usr/Ivan/",
"uuid":"48D9C7A3-2DC6-11EF-AA59-00155D641205",
"uid": "3978404",
"type": "User",
"name": "Ivan"
},
"utype": "file_downloaded"}
FileDeleted = {
"file": {
"size": 304673,
"path": "\\\\10.255.255.9\\shared\\HASite\\InetPub\\EFTRoot\\MySite\\Usr\\Ivan",
"name": "DeleteME.txt"
},
"guid": "48D9C7A3-2DC6-11EF-AA59-00155D641207",
"classifications": [{
"ref_id": "globalscape:48D9C7A3-2DC6-11EF-AA59-00155D641207",
"time":1722515664000,
}],
"prd_ext_tenant_name": "Globalscape EFT",
"prd_ext_tenant_id": "e71851c2-593f-4f49-9c07-91727b1be94b",
"product_name": "Globalscape EFT",
"session": {
"created_time":1722515664000,
"uid": "3615138"
},
"src_endpoint": {
"port": 443,
"ip": "10.91.160.45",
"type":"HTTPS"
},
"dst_endpoint": {
"port": 443,
"ip": "10.91.160.77",
"type": "HTTPS"
},
"time": 1722515664000,
"user": {
"home_directory": "/Usr/Ivan/",
"uuid":"48D9C7A3-2DC6-11EF-AA59-00155D641207",
"uid": "3978406",
"type": "User",
"name": "Ivan"
},
"utype": "file_deleted"
}
Logon ={
"classifications": [{
"ref_id": "globalscape:48D9C7A3-2DC6-11EF-AA59-00155D641206",
"time": 1722510924000,
}],
"dst_endpoint": {
"port": 443,
"ip": "10.91.160.77",
"type": "HTTPS"
},
"guid": "48D9C7A3-2DC6-11EF-AA59-00155D641206",
"prd_ext_tenant_id": "e71851c2-593f-4f49-9c07-91727b1be94b",
"product_name": "GlobalScape EFT",
"prd_ext_tenant_name": "GlobalScape EFT",
"src_endpoint": {
"port": 443,
"ip": "10.91.160.45",
"type":"HTTPS"
},
"time": 1722510924000,
"user": {
"home_directory": "/Usr/Ivan/",
"uuid":"48D9C7A3-2DC6-11EF-AA59-00155D641206",
"uid": "3978405",
"type": "User",
"name": "Ivan"
},
"utype": "user_logged_on"
}

View File

@ -1,11 +0,0 @@
class sqlQuerymodel:
def queryData():
"""Embedded query data"""
q ="""DECLARE @stopTime DATETIME2
SET @stopTime=DATEADD(DAY, -30, GETDATE())
SELECT p.ProtocolCommandID, t.Time_stamp, p.RemoteIP, p.RemotePort, p.LocalIP, p.LocalPort, p.Protocol, p.SiteName, p.Command, p.CommandParameters, p.FileName, p.VirtualFolderName, p.PhysicalFolderName, p.IsInternal, p.FileSize, p.TransferTime, p.BytesTransferred, p.ResultID, t.TransactionID, p.Description, p.Actor, t.ParentTransactionID, t.TransactionObject, t.NodeName, t.TransactionGUID, a.Protocol user_type
FROM tbl_Transactions t
Full JOIN tbl_ProtocolCommands p ON(t.TransactionID=p.TransactionID)
Full join tbl_Authentications a ON(t.TransactionID=a.TransactionID)
WHERE p.Time_stamp>@stopTime"""
return q