#!/usr/bin/env python3
#
# Copyright 2019, Mischa Peters <mischa AT netskope DOT com>, Netskope.
# Version 1.0 - 20191028
#
# Requires:
#   - Python 3.x
#       
import json
import urllib.request
import argparse
from collections import Counter
from operator import itemgetter

parser = argparse.ArgumentParser(description="Get all events from Netskope API", epilog="2019 (c) Netskope")
parser.add_argument("tenant", type=str, help="Tenant Name (eg. ams.eu)")
parser.add_argument("token", type=str, help="Tenat API Token")
parser.add_argument("-t", "--timeperiod", type=int, default='604800', help="Timeperiod 3600 | 86400 | 604800 | 2592000 (default: 604800)")
parser.add_argument("-r", "--rows", type=int, default='0', help="Number of rows (default display all)")
parser.add_argument("-s", "--show", action='store_true', help="Show category hits")

try:
	args = parser.parse_args()
	tenant = args.tenant
	token = args.token
	timeperiod = args.timeperiod
	rows = args.rows
	show = args.show

except argparse.ArgumentError as e:
	print(str(e))

base_url = "https://{}.goskope.com/api/v1/events?token={}&type=application&timeperiod={}".format(tenant, token, timeperiod)

req = urllib.request.Request(base_url)
with urllib.request.urlopen(req) as response:
	content = response.read()
json_content = json.loads(content)

domain_count = Counter()
domain_category = {}
category_count = Counter()
rows = None if rows == 0 else rows

for i in range (0, len (json_content['data'])):
	domain = json_content["data"][i]["domain"]
	ccl = json_content["data"][i]["ccl"]
	category = json_content["data"][i]["category"]
	domain_count[domain] += 1
	domain_category[domain] = category
	category_count[category] += 1

top_domains = domain_count.most_common(rows)
print ("{:<40s}{:>5s} - {}".format("Domain", "Hits", "Category"))
print ("################################################################################")
for i in top_domains: 
	print ("{:<40s}{:5d} - {}".format(i[0], i[1], domain_category[i[0]]))

print ("")
if show:
	top_categories = category_count.most_common()
	print ("{:<40s}{:>5s}".format("Category", "Hits"))
	print ("################################################################################")
	for i in top_categories: 
		print ("{:<40s}{:5d}".format(i[0], i[1]))