msiempy.Event

class documentation

class msiempy.Event(NitroDict): (source)

Known subclasses: msiempy.GroupedEvent

View In Hierarchy

Dict-Like object. Represents an event in the SIEM.

This object handles 3 types of events objects:
  • created from the qryGetResults API method:

    Using EventManager or Event.

    Common keys: Rule.msg, Alert.LastTime, Alert.IPSIDAlertID And any other : dump the available fields and filters with dump_all_fields.py script.

  • created from the ipsGetAlertData API method:

    Using AlarmManager or Event

    Common keys for ipsGetAlertData events: ruleName, srcIp, destIp, protocol, lastTime, subtype, destPort, destMac, srcMac, srcPort, deviceName, sigId, normId, srcUser, destUser, normMessage, normDesc, host, domain, ipsId And others

  • created from the notifyGetTriggeredNotificationDetail API method (SIEM v11.x only):

    Using AlarmManager if events_details=False is passed to AlarmManager.load_data method

    All keys:

    ruleMessage, eventId, severity, eventCount, sourceIp, destIp, protocol, lastTime and eventSubType

For qryGetResults events:

We tried our best effort to match SIEM returned fields with initially requested fields. __getitem__ and __contains__, method have been rewrote in order to offer more straight-forward dict usage.

Exemple:

>>> e = EventManager(fields=["Web_Doamin","UserIDSrc","SrcIP"]).load_data()[0]

Then, the following expressions are equivalent:

>>> e["Alert.65613"]
 is the same as 
>>> e["Web_Doamin"]
 
>>> e["Alert.BIN(7)"]
 is the same as 
>>> e["UserIDSrc"]
 
>>> e["Alert.SrcIP"]
 is the same as 
>>> e["SrcIP"]
 
>>> "Alert.SrcIP" in e
 is the same as 
>>> "SrcIP" in e
Class Variable FIELDS_TABLES List of internal fields table : Rule,`Alert`,etc.
Class Variable DEFAULTS_EVENT_FIELDS No summary
Class Variable REGULAR_EVENT_FIELDS Offer a base list of regular fields that may be useful.
Class Variable SIEM_FIELDS_MAP_INTERNAL_NAME_TO_NICKNAME Fields name mapping.
Class Variable SIEM_FIELDS_MAP_NICKNAME_TO_INTERNAL_NAME Fields name mapping (reversed).
Method __init__ Create a new event representation
Method __getitem__ Use the fields name mapping to offer better dict usage
Method __delitem__ Use the fields name mapping to offer better dict usage
Method __contains__ Use the fields name mapping to offer better dict usage
Method __setitem__ Use the fields name mapping to offer better dict usage
Method get_id Get the event ID.
Method clear_notes Replace the notes by an empty string. Desctructive action.
Method set_note Set the event's note. Desctructive action.
Method data_from_id Load event's data.
Method refresh Re-load event's data.
Method _find_key Use the fields name mapping to resolve internal name based on nickname

Inherited from NitroDict:

Instance Variable data Underlying dict object
Method __str__ str(obj) -> return text string.
Method __repr__ repr(obj) -> return json string.
Method json JSON representation of a item
Method text Text list of item's values

Inherited from NitroObject (via NitroDict):

Class NitroJSONEncoder Custom JSON encoder that will use the approprtiate propertie depending of the type of NitroObject. TODO support json json dumping of QueryFilers, may be by making them inherits from NitroDict.
Instance Variable nitro msiempy.core.session.NitroSession object. Interface to the SIEM.
FIELDS_TABLES = (source)
List of internal fields table : Rule,`Alert`,etc.
(type: List[str])
DEFAULTS_EVENT_FIELDS = (source)
Always present when using msiempy.event.EventManager querying : Rule.msg Alert.LastTime Alert.IPSIDAlertID
(type: List[str])
REGULAR_EVENT_FIELDS = (source)

Offer a base list of regular fields that may be useful.

Rule.msg, Alert.SrcIP, Alert.DstIP, Alert.SrcMac, Alert.DstMac, Rule.NormID, HostID, UserIDSrc, ObjectID, Alert.Severity, Alert.LastTime, Alert.DSIDSigID, Alert.IPSIDAlertID

(type: List[str])
SIEM_FIELDS_MAP_INTERNAL_NAME_TO_NICKNAME = (source)
Fields name mapping.
(type: Dict[str, str])
SIEM_FIELDS_MAP_NICKNAME_TO_INTERNAL_NAME = (source)
Fields name mapping (reversed).
(type: Dict[str, str])
def __init__(self, *args, **kwargs): (source)
overrides msiempy.core.types.NitroDict.__init__

Create a new event representation

Arguments:
  • adict (dict): Event parameters
  • id (str): The event "IPSIDAlertID" to instanciate. Will load informations.
def _find_key(self, key): (source)
Use the fields name mapping to resolve internal name based on nickname
def __getitem__(self, key): (source)
Use the fields name mapping to offer better dict usage
def __delitem__(self, key): (source)
Use the fields name mapping to offer better dict usage
def __contains__(self, key): (source)
Use the fields name mapping to offer better dict usage
def __setitem__(self, key, value): (source)
Use the fields name mapping to offer better dict usage
def get_id(self): (source)
overrides msiempy.core.types.NitroDict.get_id

Get the event ID.

Return the full event ID or None.

def clear_notes(self): (source)
Replace the notes by an empty string. Desctructive action.
def set_note(self, note, no_date=(False)): (source)

Set the event's note. Desctructive action.

Note:
Uses the internal API method IPS_ADDALERTNOTE
def data_from_id(self, id, use_query=(False), extra_fields=[]): (source)
overrides msiempy.core.types.NitroDict.data_from_id

Load event's data.

Arguments:
  • id (str): The event ID. (i.e. : "144128388087414784|747122896")
  • use_query (bool): Uses the query module to retreive common event data. Only works with SIEM 11.2 or greater.
    Default behaviour will call ipsGetAlertData to retreive the complete event definition.
  • extra_fields (list): Only when use_query=True. Additionnal event fields to load in the query.
def refresh(self, use_query=None, extra_fields=None): (source)
overrides msiempy.core.types.NitroObject.refresh

Re-load event's data.

Arguments:
  • use_query (bool): Force the use of the query module to retreive the event data. Only works with SIEM 11.2 or greater.
    In contrario, if explicitly False, force the use of ipsGetAlertData to get the details. Default behaviour will use the query module if an 'Alert.IPSIDAlertID' keys exists.
  • extra_fields (list): Only when use_query=True or the Event is already a query event. Additionnal event fields to load in the query.
Warning:
Enforce use_query=True will reset the Events fields to whatever is passed to extra_fields
Raises:
AttributeError if the event ID has not been found.
API Documentation for msiempy, generated by pydoctor 20.7.1 at 2020-11-18 14:02:21.