77
88
99# Notes on this script:
10- # - based on https://github.com/carbonblack/cbapi-python/blob/master/examples/defense/list_events.py with 2 primary changes
10+ # - based on https://github.com/carbonblack/cbapi-python/blob/master/examples/defense/list_events.py
11+ # with 2 primary changes
1112# 1. this script outputs the command line of the main process process
1213# 2. this script places a '|' delimiter between fields so it can be read into a spreadsheet
1314# - can only pull up to 2 weeks of events at one time ( this is an API limitation)
@@ -48,8 +49,8 @@ def main():
4849 if args .hostname :
4950 events = list (cb .select (Event ).where ("hostNameExact:{0}" .format (args .hostname )))
5051 elif args .start and args .end :
51- # flipped the start and end arguments around so script can be called with the start date being the earliest date.
52- # it's just easier on the eyes for most folks.
52+ # flipped the start and end arguments around so script can be called with the start date
53+ # being the earliest date. it's just easier on the eyes for most folks.
5354
5455 events = list (cb .select (Event ).where ("startTime:{0}" .format (args .end ))) and (
5556 cb .select (Event ).where ("endTime:{0}" .format (args .start )))
@@ -65,21 +66,20 @@ def main():
6566 create_time = str (convert_time (event .eventTime ))
6667
6768 # stripping HTML tags out of the long description
68- long_description = unicodedata .normalize ('NFD' ,strip_html (event .longDescription ))
69+ long_description = unicodedata .normalize ('NFD' , strip_html (event .longDescription ))
6970
7071 if event .processDetails :
7172 # stripping out the command line arguments from the processDetails field
7273 processDetails = str (event .processDetails )
7374 start_cmdline = processDetails .find ("u'commandLine'" )
7475 end_cmdline = processDetails .find (", u'parentName'" )
75- commandline = processDetails [start_cmdline + 18 : end_cmdline - 1 ]
76- print ("{0}|{1}|{2}|{3}|{4}|{5}" .format (event_time , event .eventId , create_time , event .eventType , long_description , commandline ))
76+ commandline = processDetails [start_cmdline + 18 : end_cmdline - 1 ]
77+ print ("{0}|{1}|{2}|{3}|{4}|{5}" .format (event_time , event .eventId , create_time , event .eventType ,
78+ long_description , commandline ))
7779 else :
78- print ("{0}|{1}|{2}|{3}|{4}" .format (event_time , event .eventId , create_time , event .eventType , long_description ))
80+ print ("{0}|{1}|{2}|{3}|{4}" .format (event_time , event .eventId , create_time , event .eventType ,
81+ long_description ))
7982 # format and print out the event time, Event ID, Creation time, Event type and Description
80-
81-
82-
8383
8484
8585if __name__ == "__main__" :
0 commit comments