inex.py

@@ -1,23 +1,20 @@
 import pyodbc
 import os
 import logging
-import datetime
 import tomllib
 from inexLogging import inexLog
 import inexConnect
 from inexDataModel import dataTemplate
 from inexDataProcessing import processData
 import json
-import decimal
 import requests
 import inexEncoder
-
+import inexSqlquery
 class Inex:
     def __init__(self):
         """Initilize config, calls functions from inex-connect.py and inex-logging.py"""
         # assign libraries
         self.db = pyodbc
-        self.tm = datetime
         self.il = logging
         self.ic = inexConnect
         self.r = requests
@@ -25,6 +22,7 @@ class Inex:
         self.os = os
         self.j = json
         self.e = inexEncoder.Encoder
+        self.sq = inexSqlquery
 
         if self.os.path.exists('./config.toml'):
             config_file_path = './config.toml'
@@ -63,9 +61,11 @@ class Inex:
         inexLog(self)
 
         # create the connection to the database
-        self.cursor = self.ic.connectDatabase(self, self.db, self.dbDriver, self.dbServer, self.dbDatabase, self.dbUser, self.dbPassword)
+        self.cursor = self.ic.inexSql.connectDatabase(self, self.db, self.dbDriver, self.dbServer, self.dbDatabase, self.dbUser, self.dbPassword)
 
-        self.data = self.ic.databaseQuery(self, self.cursor, self.dbQuery)
+        # self.data = self.ic.inexSql.databaseQuery(self, self.cursor, self.dbQuery)
+
+        self.data = self.ic.inexSql.databaseQuery(self, self.cursor, self.sq.sqlQuerymodel.queryData())
 
         self.modifiedData = processData(self.data, dataTemplate, prd_instance_id=self.prdInstanceID,\
                                          product_guid=self.productGUID,product_name=self.productName,product_version=self.productVersion)

inexConnect.py

@@ -1,4 +1,5 @@
-def connectDatabase(self, lib, driver, server, database, user, password):
+class inexSql:
+    def connectDatabase(self, lib, driver, server, database, user, password):
         """Connects to the database. Requires a windows driver to do so.
         Typically there is one installed by default"""
 
@@ -18,7 +19,7 @@ def connectDatabase(self, lib, driver, server, database, user, password):
 
         return  cursor
 
-def databaseQuery(self, cursor, query, args=()):
+    def databaseQuery(self, cursor, query, args=()):
         if self.useLog:
             self.il.debug(f"Query:")
             self.il.debug(query)

inexDataModel.py

@@ -46,3 +46,166 @@ def dataTemplate(**kwargs):
     }
 
     return template
+
+FileUploaded = {
+    "bytes" : 2490,
+    "dst_endpoint": { 
+        "port": 22,
+        "ip": "10.91.160.77",
+        "type": "SFTP"
+    },
+    "duration": 200,
+    "file": {
+        "created_time": 1722485724000,
+        "size": 2490,
+        "name": "Case9.vbs",
+        "path": "\\\\10.255.255.9\\shared\\HASite\\InetPub\\EFTRoot\\MySite\\Usr\\Ivan //<PhysicalFolderName>"
+    },
+    "guid": "48D9C7A3-2DC6-11EF-AA59-00155D641204",
+    "node_name":"PERF01-S2019-77",
+    "prd_ext_tenant_id": "e71851c2-593f-4f49-9c07-91727b1be94b",
+    "product_name": "GlobalScape EFT",
+    "prd_ext_tenant_name": "GlobalScape EFT",
+    "classifications": [{
+        "ref_id": "globalscape:48D9C7A3-2DC6-11EF-AA59-00155D641204",
+        "time":1722485724000,
+    }],
+    "session": {
+       "created_time":1722485724000,
+       "uid": "3615136"
+    },
+    "src_endpoint": {
+        "port": 58868,
+        "ip": "10.91.160.45",
+        "type":"SFTP"
+    },
+    "tenant": "e71851c2-593f-4f49-9c07-91727b1be94b",
+    "tenant_name":"GlobalScape",
+    "time":1722485724000,
+    "status_code":226,
+    "status_detail":"Upload Successful",
+    "user": {
+        "home_directory": "/Usr/Ivan/",
+        "uuid":"48D9C7A3-2DC6-11EF-AA59-00155D641204",
+        "uid": "3978403",
+        "type": "User",
+        "name": "Ivan"
+    },
+    "utype": "file_uploaded"
+}
+
+FileDownloaded = {
+"bytes" : 4891,
+"dst_endpoint": {
+    "port": 443,
+    "ip": "10.91.160.77",
+    "type": "HTTPS"
+},
+"duration": 200,
+"file": {
+    "created_time": 1722518124000,
+    "size": 4891,
+    "name": "FileDownload1.exe",
+    "path": "\\\\10.255.255.9\\shared\\HASite\\InetPub\\EFTRoot\\MySite\\Usr\\Ivan //<PhysicalFolderName>"
+},
+"guid": "48D9C7A3-2DC6-11EF-AA59-00155D641205",
+"node_name":"PERF01-S2019-77",
+"prd_ext_tenant_id": "e71851c2-593f-4f49-9c07-91727b1be94b",
+"product_name": "GlobalScape EFT",
+"prd_ext_tenant_name": "GlobalScape EFT",
+"classifications": [{
+    "ref_id": "globalscape:48D9C7A3-2DC6-11EF-AA59-00155D641205",
+    "time":1722518124000,
+}],
+"session": {
+   "created_time":1722518124000,
+   "uid": "3615137"
+},
+"src_endpoint": {
+    "port": 443,
+    "ip": "10.91.160.45",
+    "type":"HTTPS"
+},
+"tenant": "e71851c2-593f-4f49-9c07-91727b1be94b",
+"tenant_name":"GlobalScape",
+"time":1722518124000,
+"status_code":226,
+"status_detail":"Download Successful",
+"user": {
+    "home_directory": "/Usr/Ivan/",
+    "uuid":"48D9C7A3-2DC6-11EF-AA59-00155D641205",
+    "uid": "3978404",
+    "type": "User",
+    "name": "Ivan" 
+},
+"utype": "file_downloaded"}
+
+FileDeleted = {
+        "file": {
+        "size": 304673,
+        "path": "\\\\10.255.255.9\\shared\\HASite\\InetPub\\EFTRoot\\MySite\\Usr\\Ivan",
+"name": "DeleteME.txt"
+},
+"guid": "48D9C7A3-2DC6-11EF-AA59-00155D641207",
+"classifications": [{
+    "ref_id": "globalscape:48D9C7A3-2DC6-11EF-AA59-00155D641207",
+    "time":1722515664000,
+}],
+"prd_ext_tenant_name": "Globalscape EFT",
+"prd_ext_tenant_id": "e71851c2-593f-4f49-9c07-91727b1be94b",
+"product_name": "Globalscape EFT",
+"session": {
+   "created_time":1722515664000,
+   "uid": "3615138"
+},
+"src_endpoint": {
+    "port": 443,
+    "ip": "10.91.160.45",
+    "type":"HTTPS"
+},
+"dst_endpoint": {
+    "port": 443,
+    "ip": "10.91.160.77",
+    "type": "HTTPS"
+},
+"time": 1722515664000,
+"user": {
+    "home_directory": "/Usr/Ivan/",
+    "uuid":"48D9C7A3-2DC6-11EF-AA59-00155D641207",
+    "uid": "3978406",
+    "type": "User",
+    "name": "Ivan"
+},
+"utype": "file_deleted"
+}
+
+Logon ={
+"classifications": [{
+    "ref_id": "globalscape:48D9C7A3-2DC6-11EF-AA59-00155D641206",
+    "time": 1722510924000,
+    
+}],
+"dst_endpoint": {
+    "port": 443,
+    "ip": "10.91.160.77",
+    "type": "HTTPS"
+},
+"guid": "48D9C7A3-2DC6-11EF-AA59-00155D641206",
+"prd_ext_tenant_id": "e71851c2-593f-4f49-9c07-91727b1be94b",
+"product_name": "GlobalScape EFT",
+"prd_ext_tenant_name": "GlobalScape EFT",
+"src_endpoint": {
+    "port": 443,
+    "ip": "10.91.160.45",
+    "type":"HTTPS"
+},
+"time": 1722510924000,
+"user": {
+    "home_directory": "/Usr/Ivan/",
+    "uuid":"48D9C7A3-2DC6-11EF-AA59-00155D641206",
+    "uid": "3978405",
+    "type": "User",
+    "name": "Ivan"
+},
+"utype": "user_logged_on"
+}

inexSqlquery.py

@@ -0,0 +1,11 @@
+class sqlQuerymodel:
+    def queryData():
+        """Embedded query data"""
+        q ="""DECLARE @stopTime DATETIME2
+        SET @stopTime=DATEADD(DAY, -30, GETDATE())
+        SELECT p.ProtocolCommandID, t.Time_stamp, p.RemoteIP, p.RemotePort, p.LocalIP, p.LocalPort, p.Protocol, p.SiteName, p.Command, p.CommandParameters, p.FileName, p.VirtualFolderName, p.PhysicalFolderName, p.IsInternal, p.FileSize, p.TransferTime, p.BytesTransferred, p.ResultID, t.TransactionID, p.Description, p.Actor, t.ParentTransactionID, t.TransactionObject, t.NodeName, t.TransactionGUID, a.Protocol user_type
+        FROM tbl_Transactions t
+             Full JOIN tbl_ProtocolCommands p ON(t.TransactionID=p.TransactionID)
+             Full join tbl_Authentications a ON(t.TransactionID=a.TransactionID)
+        WHERE p.Time_stamp>@stopTime"""
+        return q