-
Notifications
You must be signed in to change notification settings - Fork 0
/
put_sensor.py
executable file
·145 lines (114 loc) · 4.29 KB
/
put_sensor.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
#!/usr/bin/env python3
import tanrest, json, time, sys, base64
from pprint import pprint as pp
from time import sleep
import getpass
import getopt
import subprocess
import configparser
config = configparser.ConfigParser()
config.readfp(open('content.cfg'))
def git_revision_hash():
return subprocess.getoutput('git rev-parse HEAD')
def usage():
print("""
Usage:
put_sensor.py [options]
Description:
Takes a sensor file and uploads it to a Tanium server with the following changes:
- adding default platform scripts from content.cfg
- tagging with current git commit hash
Options:
-h, --help display this help and exit
-s, --sensor [required] name of the tanium sensor to get
--server [required] tanium server (ip address or dns name) [required]
--username user name to connect to tanium with (defaults to logged in user)
--password password to connect to tanium with (will prompt if not provided)
Example:
./put_sensor.py --server 139.181.111.21 --username tanium --sensor 'Chuck Norris Fact'
""")
def main(argv):
#print(argv)
global loglevel
creds = {}
try:
opts, args = getopt.getopt(argv,"d:hs:p:q:",["debug:","help","sensor=", "package=", "server=", "username=", "password="])
except getopt.GetoptError:
usage()
sys.exit(2)
for opt, arg in opts:
if opt in ('-h', '--help'):
usage()
sys.exit(2)
if opt in ('-s', '--sensor'):
sensorname = arg
if opt in ('d', '--debug'):
loglevel = arg
if opt in ('--server'):
creds['server'] = arg
if opt in ('--username'):
creds['username'] = arg
if opt in ('--password'):
creds['password'] = arg
try:
sensorname
except NameError:
print("--sensor parameter required")
usage()
sys.exit(2)
if 'server' not in creds:
print("--server parameter required")
usage()
sys.exit(2)
else:
if 'http' not in creds['server']:
creds['server'] = 'https://' + creds['server']
if '/api/v2' not in creds['server']:
creds['server'] = creds['server'] + '/api/v2'
if 'username' not in creds:
creds['username'] = getpass.getuser()
if 'password' not in creds:
creds['password'] = getpass.getpass()
#print(tan.get_session())
##
# load the JSON and make some additions to it before sending to tanium.
with open('sensor/'+sensorname+'.json') as json_data:
sensor = json.load(json_data)
json_data.close()
if not sensor:
print('error getting sensor')
sys.exit(3)
tan = tanrest.server(creds)
tan.quiet = True
sensor_id = tan.get_sensor_id(sensorname)
tan.quiet = False
##
# map of what platform script type to use to auto-add "NA on platform" responses.
platforms = {'Windows': 'VBScript','Linux': 'UnixShell', 'Mac': 'UnixShell', 'Solaris': 'UnixShell', 'AIX': 'UnixShell'}
for platform in platforms:
platformscript = [script for script in sensor["queries"] if script['platform'] == platform ]
##
# if a script for platform is not in the sensor add the "NA on platform" response.
if len(platformscript) == 0:
print("Adding default " + platform + " script.")
defaultscript = {
'platform': platform,
'script_type': platforms[platform],
'script': config.get('platform_default_sensors', platform)
}
sensor["queries"].append(defaultscript)
description = ""
for descriptionline in sensor["description"].splitlines():
if not descriptionline.startswith("commit="):
description+=descriptionline + "\n"
description+="commit="+str(git_revision_hash())
sensor["description"]=description
if sensor_id:
if tan.update_sensor(sensor_id, sensor):
print('updated existing sensor: ' + sensor["name"] + ' (' + str(sensor_id) + ')')
else:
resp = tan.create_sensor(sensor)
if resp:
print('created new sensor: ' + sensor["name"] + ' (' + str(resp['data']['id']) + ')')
if __name__ == "__main__":
main(sys.argv[1:])