-
Notifications
You must be signed in to change notification settings - Fork 3
/
search.go
85 lines (74 loc) · 1.75 KB
/
search.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
package main
import (
"context"
"crypto/tls"
"encoding/csv"
"flag"
"fmt"
"log"
"net/http"
"os"
"strings"
qradar "github.com/ilyaglow/go-qradar"
)
var (
qradarLocation = flag.String("u", "", "QRadar Location URL")
seckey = flag.String("k", "", "SEC key to access the QRadar API")
query = flag.String("q", "", "Ariel SQL query")
fieldsCSV = flag.String("f", "-", "Fields to get (comma separated) as CSV data")
window = flag.Int("w", 500, "Number of events to search in batch")
insecure = flag.Bool("insecure", false, "Allow insecure TLS configuration")
)
func main() {
flag.Parse()
if *qradarLocation == "" || *seckey == "" || *query == "" {
flag.PrintDefaults()
os.Exit(1)
}
qr, err := qradar.NewClient(
*qradarLocation,
qradar.SetSECKey(*seckey),
qradar.SetHTTPClient(&http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{
InsecureSkipVerify: *insecure,
},
},
}),
)
if err != nil {
log.Fatal(err)
}
qradar.SearchResultsWindow = *window
scroller, _, err := qr.Ariel.ScrollByQuery(
context.Background(),
*query,
)
if err != nil {
log.Fatal(err)
}
fields := []string{}
if *fieldsCSV != "-" {
fields = strings.Split(*fieldsCSV, ",")
}
if len(fields) == 0 {
for scroller.Next(context.Background()) {
fmt.Println(scroller.Result())
}
return
}
w := csv.NewWriter(os.Stdout)
w.WriteAll([][]string{fields})
for scroller.Next(context.Background()) {
result := scroller.Result()
var selected []string
for _, f := range fields {
v, ok := result[f]
if !ok {
log.Fatalf("no value for %s in results %v", f, result)
}
selected = append(selected, strings.TrimSuffix(fmt.Sprintf("%v", v), "\n"))
}
w.WriteAll([][]string{selected})
}
}