#!/usr/bin/env python3 # # Copyright 2019, Mischa Peters , Netskope. # Version 1.0 - 20191028 # # Requires: # - Python 3.x # import json import urllib.request import argparse import collections from operator import itemgetter parser = argparse.ArgumentParser(description="Get all events from Netskope API", epilog="2019 (c) Netskope") parser.add_argument("tenant", type=str, help="Tenant Name (eg. ams.eu)") parser.add_argument("token", type=str, help="Tenat API Token") parser.add_argument("-t", "--timeperiod", type=int, default='604800', help="Timeperiod 3600 | 86400 | 604800 | 2592000 (default: 604800)") parser.add_argument("-r", "--rows", type=int, default='0', help="Number of rows (default display all)") parser.add_argument("-s", "--show", action='store_true', help="Show category hits") try: args = parser.parse_args() tenant = args.tenant token = args.token timeperiod = args.timeperiod rows = args.rows show = args.show except argparse.ArgumentError as e: print(str(e)) base_url = "https://{}.goskope.com/api/v1/events?token={}&type=page&timeperiod={}".format(tenant, token, timeperiod) req = urllib.request.Request(base_url) with urllib.request.urlopen(req) as response: content = response.read() json_content = json.loads(content) #site = {'data': []} site = collections.defaultdict(list); rows = None if rows == 0 else rows for i in range (0, len (json_content['data'])): json_site = json_content["data"][i]["site"] json_domain = json_content["data"][i]["domain"] if json_domain not in site[json_site]: site[json_site].append(json_domain) #print (json_site, "-", json_domain) print (site) for key, value in sorted(site.items(), key = itemgetter(0), reverse = False): print ("{:<35s}".format(key), end="") for i in value: print ("{},".format(i), end="") print ("") #top_domains = domain_count.most_common(rows) #print ("{:<40s}{:>5s} - {}".format("Domain", "Hits", "Category")) #print ("################################################################################") #for i in top_domains: #print ("{:<40s}{:5d} - {}".format(i[0], i[1], domain_category[i[0]]))