67 lines
2.2 KiB
Python
Executable File
67 lines
2.2 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
#
|
|
# Copyright 2019, Mischa Peters <mischa AT netskope DOT com>, Netskope.
|
|
# Version 1.0 - 20191028
|
|
#
|
|
# Requires:
|
|
# - Python 3.x
|
|
#
|
|
import json
|
|
import urllib.request
|
|
import argparse
|
|
from collections import Counter
|
|
from operator import itemgetter
|
|
|
|
parser = argparse.ArgumentParser(description="Get all events from Netskope API", epilog="2019 (c) Netskope")
|
|
parser.add_argument("tenant", type=str, help="Tenant Name (eg. ams.eu)")
|
|
parser.add_argument("token", type=str, help="Tenat API Token")
|
|
parser.add_argument("-t", "--timeperiod", type=int, default='604800', help="Timeperiod 3600 | 86400 | 604800 | 2592000 (default: 604800)")
|
|
parser.add_argument("-r", "--rows", type=int, default='0', help="Number of rows (default display all)")
|
|
parser.add_argument("-s", "--show", action='store_true', help="Show category hits")
|
|
|
|
try:
|
|
args = parser.parse_args()
|
|
tenant = args.tenant
|
|
token = args.token
|
|
timeperiod = args.timeperiod
|
|
rows = args.rows
|
|
show = args.show
|
|
|
|
except argparse.ArgumentError as e:
|
|
print(str(e))
|
|
|
|
base_url = "https://{}.goskope.com/api/v1/events?token={}&type=application&timeperiod={}".format(tenant, token, timeperiod)
|
|
|
|
req = urllib.request.Request(base_url)
|
|
with urllib.request.urlopen(req) as response:
|
|
content = response.read()
|
|
json_content = json.loads(content)
|
|
|
|
domain_count = Counter()
|
|
domain_category = {}
|
|
category_count = Counter()
|
|
rows = None if rows == 0 else rows
|
|
|
|
for i in range (0, len (json_content['data'])):
|
|
domain = json_content["data"][i]["domain"]
|
|
ccl = json_content["data"][i]["ccl"]
|
|
category = json_content["data"][i]["category"]
|
|
domain_count[domain] += 1
|
|
domain_category[domain] = category
|
|
category_count[category] += 1
|
|
|
|
top_domains = domain_count.most_common(rows)
|
|
print ("{:<40s}{:>5s} - {}".format("Domain", "Hits", "Category"))
|
|
print ("################################################################################")
|
|
for i in top_domains:
|
|
print ("{:<40s}{:5d} - {}".format(i[0], i[1], domain_category[i[0]]))
|
|
|
|
print ("")
|
|
if show:
|
|
top_categories = category_count.most_common()
|
|
print ("{:<40s}{:>5s}".format("Category", "Hits"))
|
|
print ("################################################################################")
|
|
for i in top_categories:
|
|
print ("{:<40s}{:5d}".format(i[0], i[1]))
|
|
|