Server IP : 85.214.239.14 / Your IP : 3.15.1.45 Web Server : Apache/2.4.62 (Debian) System : Linux h2886529.stratoserver.net 4.9.0 #1 SMP Mon Sep 30 15:36:27 MSK 2024 x86_64 User : www-data ( 33) PHP Version : 7.4.18 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, MySQL : OFF | cURL : OFF | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : OFF Directory : /lib/python3/dist-packages/ansible_collections/ibm/qradar/plugins/modules/ |
Upload File : |
#!/usr/bin/python # -*- coding: utf-8 -*- # (c) 2019, Adam Miller (admiller@redhat.com) # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) from __future__ import absolute_import, division, print_function __metaclass__ = type DOCUMENTATION = """ --- module: offense_note short_description: Create or update a QRadar Offense Note description: - This module allows to create a QRadar Offense note version_added: "1.0.0" options: id: description: - Offense ID to operate on required: true type: int note_text: description: The note's text contents required: true type: str author: Ansible Security Automation Team (@maxamillion) <https://github.com/ansible-security> """ """ # FIXME - WOULD LIKE TO QUERY BY NAME BUT HOW TO ACCOMPLISH THAT IS NON-OBVIOUS # offense_name: # description: # - Name of Offense # required: true # type: str # FIXME - WOULD LIKE TO MANAGE STATE # state: # description: Define state of the note: present or absent # required: false # choices: ["present", "absent"] # default: "present" """ EXAMPLES = """ - name: Add a note to QRadar Offense ID 1 ibm.qradar.offense_note: id: 1 note_text: This an example note entry that should be made on offense id 1 """ from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.six.moves.urllib.parse import quote from ansible_collections.ibm.qradar.plugins.module_utils.qradar import ( QRadarRequest, ) def set_offense_values(module, qradar_request): if module.params["closing_reason"]: code, found_closing_reason = qradar_request.get( "/api/siem/offense_closing_reasons?filter={0}".format( quote('text="{0}"'.format(module.params["closing_reason"])) ) ) if found_closing_reason: module.params["closing_reason_id"] = found_closing_reason[0]["id"] else: module.fail_json( "Unable to find closing_reason text: {0}".format( module.params["closing_reason"] ) ) if module.params["status"]: module.params["status"] = module.params["status"].upper() def main(): argspec = dict( # state=dict(required=False, choices=["present", "absent"], type='str', default="present"), id=dict(required=True, type="int"), note_text=dict(required=True, type="str"), ) module = AnsibleModule(argument_spec=argspec, supports_check_mode=True) qradar_request = QRadarRequest( module, not_rest_data_keys=["state", "id"], ) # if module.params['name']: # # FIXME - QUERY HERE BY NAME # found_offense = qradar_request.get('/api/siem/offenses?filter={0}'.format(module.params['name'])) # FIXME - once this is sorted, add it to module_utils code, found_notes = qradar_request.get( "/api/siem/offenses/{0}/notes?filter={1}".format( module.params["id"], quote('note_text="{0}"'.format(module.params["note_text"])), ) ) # if module.params['state'] == 'present': if found_notes: # The note we want exists either by ID or by text name, verify note = found_notes[0] if note["note_text"] == module.params["note_text"]: module.exit_json( msg="No changes necessary. Nothing to do.", changed=False ) else: if module.check_mode: module.exit_json( msg="A change would have occured but did not because Check Mode", changed=True, ) qradar_return_data = qradar_request.post_by_path( "api/siem/offenses/{0}/notes?note_text={1}".format( module.params["id"], quote("{0}".format(module.params["note_text"])), ), data=False, ) module.exit_json( msg="Successfully created Offense Note ID: {0}".format( qradar_return_data["id"] ), qradar_return_data=qradar_return_data, changed=False, ) else: if module.check_mode: module.exit_json( msg="A change would have occured but did not because Check Mode", changed=True, ) qradar_return_data = qradar_request.post_by_path( "api/siem/offenses/{0}/notes?note_text={1}".format( module.params["id"], quote("{0}".format(module.params["note_text"])), ), data=False, ) module.exit_json( msg="Successfully created Offense Note ID: {0}".format( qradar_return_data["id"] ), qradar_return_data=qradar_return_data, changed=True, ) module.exit_json(msg="No changes necessary. Nothing to do.", changed=False) # FIXME FIXME FIXME - can we actually delete these via the REST API? # if module.params['state'] == 'absent': # if not found_notes: # module.exit_json(msg="No changes necessary. Nothing to do.", changed=False) # else: # if module.check_mode: # module.exit_json(msg="A change would have occured but did not because Check Mode", changed=True) # # FIXME: fix the POST here to actually delete # qradar_return_data = qradar_request.post_by_path( # 'api/siem/offenses/{0}/notes?note_text={1}'.format( # module.params['id'], # quote("{0}".format(module.params['note_text'])), # ), # data=False # ) # module.exit_json( # msg="Successfully created Offense Note ID: {0}".format(qradar_return_data['id']), # qradar_return_data=qradar_return_data, # changed=True # ) if __name__ == "__main__": main()