Splunk对接卓豪API接口获取CMDB数据-Python脚本

Splunk

zoho-getCI-Router.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# coding=utf-8
import requests
import json

CINameValue = []
url = "http://192.168.10.5:8080/api/cmdb/ci"
tocken = "470CD3BC-31AB-4044-A022-BCD53C3E4CC7"
input_data = """<?xml version="1.0" encoding="UTF-8"?>
<API version="1.0" locale="en">
    <citype>
    <name>Router</name>
        <criterias>
            <criteria>
                <parameter>
                    <name compOperator="CONTAINS">CI Name</name>
                    <value>*</value>
                </parameter>
            </criteria>
        </criterias>
        <returnFields>
            <name>CI Name</name>
        </returnFields>
        <range>
        <startindex>1</startindex>
        <limit>100000</limit>
        </range>
    </citype>
</API>"""

argsCIName = {
    'OPERATION_NAME': 'read',
    'format': 'json',
    "TECHNICIAN_KEY": tocken,
    "INPUT_DATA": input_data
}
response = requests.post(url, params=argsCIName)
#print response.text
response = json.loads(response.text)

for CINamevalueData in response['API']['response']['operation']['Details']['field-values']['record']:
    CINameDataList = CINamevalueData.values()
    CINameValue.append(CINameDataList[0])

for CINAME in CINameValue:  ### 获取到ciname信息
    input_data = '''<?xml version="1.0" encoding="UTF-8"?>
    <API version="1.0">   
            <citype>
                <name>Router</name>
                <criterias>
                    <criteria>
                        <parameter>
                            <name compOperator="IS">CI Name</name>
                            <value>%s</value>
                        </parameter>
                    </criteria>
                </criterias>
                <returnFields>
                 <name>IP Address</name>
                  <name>CI Name</name>
                  <name>Mac Address</name>
                  <name>Department</name>
                  <name>Business Impact</name>
                  <name>Site</name>
                  <name>CI Type</name>
                </returnFields>
                <sortFields sortOrder="desc">
                    <name>Product Name</name>
                </sortFields>
            </citype>
</API>''' % CINAME

    argsDetailed = {
        'OPERATION_NAME': 'read',
        'format': 'json',
        "TECHNICIAN_KEY": tocken,
        "INPUT_DATA": input_data
    }
    response = requests.post(url=url, params=argsDetailed)
    #print response.text
    response = json.loads(response.text)
    IP = ""
    Mac = ""
    try:
        totalSubRecords = response['API']['response']['operation']['Details']['field-values']['record']['value'][5]['totalSubRecords']
        SubRecord = response['API']['response']['operation']['Details']['field-values']['record']['value'][5]['SubRecord']

    except TypeError:
        SubRecord = None
        totalSubRecords = None
    DataKey = ["CI Name", "CI Type", "Site", "Business Impact", "Department", "Mac Address", "IP Address"]
    DataValue = response['API']['response']['operation']['Details']['field-values']['record']['value'][0:5]

    if type(SubRecord) == list:
        for SubRecordValue in SubRecord:
            IP = IP + "|" + SubRecordValue['value'][1]
            Mac = Mac + "|" + SubRecordValue['value'][0]
        DataValue.append(Mac.strip("|"))
        DataValue.append(IP.strip("|"))
    elif type(SubRecord) == dict:
        IP = SubRecord['value'][1]
        Mac = SubRecord['value'][0]
        DataValue.append(Mac)
        DataValue.append(IP)
    else:
        IP = None
        Mac = None
        DataValue.append(Mac)
        DataValue.append(IP)
    i = 0
    Dict = {}
    while i < 7:
        Dict[DataKey[i]] = DataValue[i]
        i += 1
    DataValueJSON = json.dumps(Dict, ensure_ascii=False, encoding='utf-8')
    print DataValueJSON

zoho-getCI-StorageDevice.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# coding=utf-8
import requests
import json

CINameValue = []
CINamevalueData = {}
url = "http://192.168.10.5:8080/api/cmdb/ci"
tocken = "470CD3BC-31AB-4044-A022-BCD53C3E4CC7"
input_data = """<?xml version="1.0" encoding="UTF-8"?>
<API version="1.0" locale="en">
    <citype>
    <name>Storage Device</name>
        <criterias>
            <criteria>
                <parameter>
                    <name compOperator="CONTAINS">CI Name</name>
                    <value>*</value>
                </parameter>
            </criteria>
        </criterias>
        <returnFields>
            <name>CI Name</name>
        </returnFields>
        <range>
        <startindex>1</startindex>
        <limit>100000</limit>
        </range>
    </citype>
</API>"""

argsCIName = {
    'OPERATION_NAME': 'read',
    'format': 'json',
    "TECHNICIAN_KEY": tocken,
    "INPUT_DATA": input_data
}
response = requests.post(url, params=argsCIName)
response = json.loads(response.text)


for CINamevalueData in response['API']['response']['operation']['Details']['field-values']['record']:
    CINameDataList = CINamevalueData.values()
    CINameValue.append(CINameDataList[0])

for CINAME in CINameValue:  ### 获取到ciname信息
    input_data = '''<?xml version="1.0" encoding="UTF-8"?>
    <API version="1.0">   
            <citype>
                <name>Storage Device</name>
                <criterias>
                    <criteria>
                        <parameter>
                            <name compOperator="IS">CI Name</name>
                            <value>%s</value>
                        </parameter>
                    </criteria>
                </criterias>
                <returnFields>
                  <name>IP Address</name>
                  <name>CI Name</name>
                  <name>Mac Address</name>
                  <name>Department</name>
                  <name>Business Impact</name>
                  <name>Site</name>
                  <name>CI Type</name>

                </returnFields>
                <sortFields sortOrder="desc">
                    <name>Product Name</name>
                </sortFields>
            </citype>
</API>''' % CINAME

    argsDetailed = {
        'OPERATION_NAME': 'read',
        'format': 'json',
        "TECHNICIAN_KEY": tocken,
        "INPUT_DATA": input_data
    }
    response = requests.post(url=url, params=argsDetailed)
    response = json.loads(response.text)
    # API.response.operation.Details.field-names.name[0].content
    DateKey = response['API']['response']['operation']['Details']['field-names']['name']
    DataValue = response['API']['response']['operation']['Details']['field-values']['record']['value']
    i = 0
    Dict = {}
    while i < 6:
        Dict[DateKey[i]['content']] = DataValue[i]
        i += 1
    DataValueJSON = json.dumps(Dict, ensure_ascii=False, encoding='utf-8')
    print DataValueJSON

zoho-getCI-Switch.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
# coding=utf-8
import requests
import json

CINameValue = []
url = "http://192.168.10.5:8080/api/cmdb/ci"
tocken = "470CD3BC-31AB-4044-A022-BCD53C3E4CC7"
input_data = """<?xml version="1.0" encoding="UTF-8"?>
<API version="1.0" locale="en">
    <citype>
    <name>Switch</name>
        <criterias>
            <criteria>
                <parameter>
                    <name compOperator="CONTAINS">CI Name</name>
                    <value>*</value>
                </parameter>
            </criteria>
        </criterias>
        <returnFields>
            <name>CI Name</name>
        </returnFields>
        <range>
        <startindex>1</startindex>
        <limit>100000</limit>
        </range>
    </citype>
</API>"""

argsCIName = {
    'OPERATION_NAME': 'read',
    'format': 'json',
    "TECHNICIAN_KEY": tocken,
    "INPUT_DATA": input_data
}
response = requests.post(url, params=argsCIName)
#print response.text
response = json.loads(response.text)

for CINamevalueData in response['API']['response']['operation']['Details']['field-values']['record']:
    CINameDataList = CINamevalueData.values()
    CINameValue.append(CINameDataList[0])

for CINAME in CINameValue:  ### 获取到ciname信息
    input_data = '''<?xml version="1.0" encoding="UTF-8"?>
    <API version="1.0">   
            <citype>
                <name>Switch</name>
                <criterias>
                    <criteria>
                        <parameter>
                            <name compOperator="IS">CI Name</name>
                            <value>%s</value>
                        </parameter>
                    </criteria>
                </criterias>
                <returnFields>
                 <name>IP Address</name>
                  <name>CI Name</name>
                  <name>Mac Address</name>
                  <name>Department</name>
                  <name>Business Impact</name>
                  <name>Site</name>
                  <name>CI Type</name>
                </returnFields>
                <sortFields sortOrder="desc">
                    <name>Product Name</name>
                </sortFields>
            </citype>
</API>''' % CINAME

    argsDetailed = {
        'OPERATION_NAME': 'read',
        'format': 'json',
        "TECHNICIAN_KEY": tocken,
        "INPUT_DATA": input_data
    }
    response = requests.post(url=url, params=argsDetailed)
    print response.text
    response = json.loads(response.text)
    IP = ""
    Mac = ""
    try:
        totalSubRecords = response['API']['response']['operation']['Details']['field-values']['record']['value'][5]['totalSubRecords']
        SubRecord = response['API']['response']['operation']['Details']['field-values']['record']['value'][5]['SubRecord']

    except TypeError:
        SubRecord = None
        totalSubRecords = None
    DataKey = ["CI Name", "CI Type", "Site", "Business Impact", "Department", "Mac Address", "IP Address"]
    DataValue = response['API']['response']['operation']['Details']['field-values']['record']['value'][0:5]

    if type(SubRecord) == list:
        for SubRecordValue in SubRecord:
            IP = IP + "|" + SubRecordValue['value'][1]
            Mac = Mac + "|" + SubRecordValue['value'][0]
        DataValue.append(Mac.strip("|"))
        DataValue.append(IP.strip("|"))
    elif type(SubRecord) == dict:
        IP = SubRecord['value'][1]
        Mac = SubRecord['value'][0]
        DataValue.append(Mac)
        DataValue.append(IP)
    else:
        IP = None
        Mac = None
        DataValue.append(Mac)
        DataValue.append(IP)
    i = 0
    Dict = {}
    while i < 7:
        Dict[DataKey[i]] = DataValue[i]
        i += 1
    DataValueJSON = json.dumps(Dict, ensure_ascii=False, encoding='utf-8')
    print DataValueJSON

zoho-getCI-IPS.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# coding=utf-8
import requests
import json

CINameValue = []
url = "http://192.168.10.5:8080/api/cmdb/ci"
tocken = "470CD3BC-31AB-4044-A022-BCD53C3E4CC7"
input_data = """<?xml version="1.0" encoding="UTF-8"?>
<API version="1.0" locale="en">
    <citype>
    <name>IPS</name>
        <criterias>
            <criteria>
                <parameter>
                    <name compOperator="CONTAINS">CI Name</name>
                    <value>*</value>
                </parameter>
            </criteria>
        </criterias>
        <returnFields>
            <name>CI Name</name>
        </returnFields>
        <range>
        <startindex>1</startindex>
        <limit>100000</limit>
        </range>
    </citype>
</API>"""

argsCIName = {
    'OPERATION_NAME': 'read',
    'format': 'json',
    "TECHNICIAN_KEY": tocken,
    "INPUT_DATA": input_data
}
response = requests.post(url, params=argsCIName)
response = json.loads(response.text)

for CINamevalueData in response['API']['response']['operation']['Details']['field-values']['record']:
    CINameDataList = CINamevalueData.values()
    CINameValue.append(CINameDataList[0])

for CINAME in CINameValue:  ### 获取到ciname信息
    input_data = '''<?xml version="1.0" encoding="UTF-8"?>
    <API version="1.0">   
            <citype>
                <name>IPS</name>
                <criterias>
                    <criteria>
                        <parameter>
                            <name compOperator="IS">CI Name</name>
                            <value>%s</value>
                        </parameter>
                    </criteria>
                </criterias>
                <returnFields>
                  <name>IP Address</name>
                  <name>CI Name</name>
                  <name>Mac Address</name>
                  <name>Department</name>
                  <name>Business Impact</name>
                  <name>Site</name>
                  <name>CI Type</name>

                </returnFields>
                <sortFields sortOrder="desc">
                    <name>Product Name</name>
                </sortFields>
            </citype>
</API>''' % CINAME

    argsDetailed = {
        'OPERATION_NAME': 'read',
        'format': 'json',
        "TECHNICIAN_KEY": tocken,
        "INPUT_DATA": input_data
    }
    response = requests.post(url=url, params=argsDetailed)
    response = json.loads(response.text)
    # API.response.operation.Details.field-names.name[0].content
    DateKey = response['API']['response']['operation']['Details']['field-names']['name']
    DataValue = response['API']['response']['operation']['Details']['field-values']['record']['value']
    i = 0
    Dict = {}
    while i < 6:
        Dict[DateKey[i]['content']] = DataValue[i]
        i += 1
    DataValueJSON = json.dumps(Dict, ensure_ascii=False, encoding='utf-8')
    print DataValueJSON

zoho-getCI-Firewall.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# coding=utf-8
import requests
import json

CINameValue = []
url = "http://192.168.10.5:8080/api/cmdb/ci"
tocken = "470CD3BC-31AB-4044-A022-BCD53C3E4CC7"
input_data = """<?xml version="1.0" encoding="UTF-8"?>
<API version="1.0" locale="en">
    <citype>
    <name>Firewall</name>
        <criterias>
            <criteria>
                <parameter>
                    <name compOperator="CONTAINS">CI Name</name>
                    <value>*</value>
                </parameter>
            </criteria>
        </criterias>
        <returnFields>
            <name>CI Name</name>
        </returnFields>
        <range>
        <startindex>1</startindex>
        <limit>100000</limit>
        </range>
    </citype>
</API>"""

argsCIName = {
    'OPERATION_NAME': 'read',
    'format': 'json',
    "TECHNICIAN_KEY": tocken,
    "INPUT_DATA": input_data
}
response = requests.post(url, params=argsCIName)
response = json.loads(response.text)

for CINamevalueData in response['API']['response']['operation']['Details']['field-values']['record']:
    CINameDataList = CINamevalueData.values()
    CINameValue.append(CINameDataList[0])

for CINAME in CINameValue:  ### 获取到ciname信息
    input_data = '''<?xml version="1.0" encoding="UTF-8"?>
    <API version="1.0">   
            <citype>
                <name>Firewall</name>
                <criterias>
                    <criteria>
                        <parameter>
                            <name compOperator="IS">CI Name</name>
                            <value>%s</value>
                        </parameter>
                    </criteria>
                </criterias>
                <returnFields>
                  <name>IP Address</name>
                  <name>CI Name</name>
                  <name>Mac Address</name>
                  <name>Department</name>
                  <name>Business Impact</name>
                  <name>Site</name>
                  <name>CI Type</name>

                </returnFields>
                <sortFields sortOrder="desc">
                    <name>Product Name</name>
                </sortFields>
            </citype>
</API>''' % CINAME

    argsDetailed = {
        'OPERATION_NAME': 'read',
        'format': 'json',
        "TECHNICIAN_KEY": tocken,
        "INPUT_DATA": input_data
    }
    response = requests.post(url=url, params=argsDetailed)
    response = json.loads(response.text)
    # API.response.operation.Details.field-names.name[0].content
    DateKey = response['API']['response']['operation']['Details']['field-names']['name']
    DataValue = response['API']['response']['operation']['Details']['field-values']['record']['value']
    i = 0
    Dict = {}
    while i < 6:
        Dict[DateKey[i]['content']] = DataValue[i]
        i += 1
    DataValueJSON = json.dumps(Dict, ensure_ascii=False, encoding='utf-8')
    print DataValueJSON

zoho-getCI-Workstation.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# coding=utf-8
import requests
import json

CINameValue = []
url = "http://192.168.10.5:8080/api/cmdb/ci"
tocken = "470CD3BC-31AB-4044-A022-BCD53C3E4CC7"
input_data = """<?xml version="1.0" encoding="UTF-8"?>
<API version="1.0" locale="en">
    <citype>
    <name>Workstation</name>
        <criterias>
            <criteria>
                <parameter>
                    <name compOperator="CONTAINS">CI Name</name>
                    <value>*</value>
                </parameter>
            </criteria>
        </criterias>
        <returnFields>
            <name>CI Name</name>
        </returnFields>
        <range>
        <startindex>1</startindex>
        <limit>100</limit>
        </range>
    </citype>
</API>"""

argsCIName = {
    'OPERATION_NAME': 'read',
    'format': 'json',
    "TECHNICIAN_KEY": tocken,
    "INPUT_DATA": input_data
}
response = requests.post(url, params=argsCIName)
#print response.text
response = json.loads(response.text)

for CINamevalueData in response['API']['response']['operation']['Details']['field-values']['record']:
    CINameDataList = CINamevalueData.values()
    CINameValue.append(CINameDataList[0])

for CINAME in CINameValue:  ### 获取到ciname信息
    input_data = '''<?xml version="1.0" encoding="UTF-8"?>
    <API version="1.0">   
            <citype>
                <name>Workstation</name>
                <criterias>
                    <criteria>
                        <parameter>
                            <name compOperator="IS">CI Name</name>
                            <value>%s</value>
                        </parameter>
                    </criteria>
                </criterias>
                <returnFields>
                 <name>IP Address</name>
                  <name>CI Name</name>
                  <name>Mac Address</name>
                  <name>Department</name>
                  <name>Business Impact</name>
                  <name>Site</name>
                  <name>CI Type</name>
                </returnFields>
                <sortFields sortOrder="desc">
                    <name>Product Name</name>
                </sortFields>
            </citype>
</API>''' % CINAME

    argsDetailed = {
        'OPERATION_NAME': 'read',
        'format': 'json',
        "TECHNICIAN_KEY": tocken,
        "INPUT_DATA": input_data
    }
    response = requests.post(url=url, params=argsDetailed)
    #print response.text
    response = json.loads(response.text)
    IP = ""
    Mac = ""
    try:
        totalSubRecords = response['API']['response']['operation']['Details']['field-values']['record']['value'][5]['totalSubRecords']
        SubRecord = response['API']['response']['operation']['Details']['field-values']['record']['value'][5]['SubRecord']

    except TypeError:
        SubRecord = None
        totalSubRecords = None
    DataKey = ["CI Name", "CI Type", "Site", "Business Impact", "Department", "Mac Address", "IP Address"]
    DataValue = response['API']['response']['operation']['Details']['field-values']['record']['value'][0:5]

    if type(SubRecord) == list:
        for SubRecordValue in SubRecord:
            IP = IP + "|" + SubRecordValue['value'][1]
            Mac = Mac + "|" + SubRecordValue['value'][0]
        DataValue.append(IP.strip("|"))
        DataValue.append(Mac.strip("|"))
    elif type(SubRecord) == dict:
        DataValue.append(SubRecord['value'][1])
        DataValue.append(SubRecord['value'][0])
    else:
        IP = None
        Mac = None
        DataValue.append(IP)
        DataValue.append(Mac)
    i = 0
    Dict = {}
    while i < 7:
        Dict[DataKey[i]] = DataValue[i]
        i += 1
    DataValueJSON = json.dumps(Dict)
    print DataValueJSON

zoho-getCI-Server.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# coding=utf-8
import requests
import json

CINameValue = []
url = "http://192.168.10.5:8080/api/cmdb/ci"
tocken = "470CD3BC-31AB-4044-A022-BCD53C3E4CC7"
input_data = """<?xml version="1.0" encoding="UTF-8"?>
<API version="1.0" locale="en">
    <citype>
    <name>Server</name>
        <criterias>
            <criteria>
                <parameter>
                    <name compOperator="CONTAINS">CI Name</name>
                    <value>*</value>
                </parameter>
            </criteria>
        </criterias>
        <returnFields>
            <name>CI Name</name>
        </returnFields>
        <range>
        <startindex>1</startindex>
        <limit>100</limit>
        </range>
    </citype>
</API>"""

argsCIName = {
    'OPERATION_NAME': 'read',
    'format': 'json',
    "TECHNICIAN_KEY": tocken,
    "INPUT_DATA": input_data
}
response = requests.post(url, params=argsCIName)
response = json.loads(response.text)

for CINamevalueData in response['API']['response']['operation']['Details']['field-values']['record']:
    CINameDataList = CINamevalueData.values()
    CINameValue.append(CINameDataList[0])

for CINAME in CINameValue:  ### 获取到ciname信息
    input_data = '''<?xml version="1.0" encoding="UTF-8"?>
    <API version="1.0">   
            <citype>
                <name>Server</name>
                <criterias>
                    <criteria>
                        <parameter>
                            <name compOperator="IS">CI Name</name>
                            <value>%s</value>
                        </parameter>
                    </criteria>
                </criterias>
                <returnFields>
                  <name>IP Address</name>
                  <name>CI Name</name>
                  <name>Mac Address</name>
                  <name>Department</name>
                  <name>Business Impact</name>
                  <name>Site</name>
                  <name>CI Type</name>

                </returnFields>
                <sortFields sortOrder="desc">
                    <name>Product Name</name>
                </sortFields>
            </citype>
</API>''' % CINAME

    argsDetailed = {
        'OPERATION_NAME': 'read',
        'format': 'json',
        "TECHNICIAN_KEY": tocken,
        "INPUT_DATA": input_data
    }
    response = requests.post(url=url, params=argsDetailed)
    response = json.loads(response.text)
    DateKey = response['API']['response']['operation']['Details']['field-names']['name']
    DataValue = response['API']['response']['operation']['Details']['field-values']['record']['value']
    i = 0
    Dict = {}
    while i < 6:
        Dict[DateKey[i]['content']] = DataValue[i]
        i += 1
    DataValueJSON = json.dumps(Dict)
    print DataValueJSON

threatbook_tip.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
# -*- coding: utf-8 -*-

import urllib2
import json
import sys
import logging

reload(sys);
sys.setdefaultencoding("utf8")

level = logging.DEBUG
DATE_FORMAT = '[%(asctime)s] %(levelname)s %(message)s'
LOG_FORMAT = '%Y-%m-%d %H:%M:%S'
filename = "/data/rizhiyi/logs/splserver/threat_ip_query.log"
logging.basicConfig(filename=filename,level=level,filemode='a',format=DATE_FORMAT,datefmt=LOG_FORMAT)

apikey = "1d5feb0fa35f47659d07b01292d5f696d3c941a36ae240498777777a5a40a828"
apiurl = "https://api.threatbook.cn/v3/ip/query"


def TiSearch(data):
    url = apiurl+"?apikey="+apikey+"&resource="+data
    proxy = urllib2.ProxyHandler({"http":"proxyinygsc.huawei.com:8080","https":"proxyin.gsc.huawei.com:8080"})
    opener = urllib2.build_opener(proxy)
    urllib2.install_opener(opener)
    req = urllib2.Request(url)
    conn = urllib2.urlopen(req)
    ti = conn.read()
    logging.info("query ip:"+data+",query source:siem")
    result = json.loads(ti)
    ti = {}
    if result["response_code"] == 0:
        content = []
        data = {}
        ip = result['data'].keys()[0]
        data['ip'] = ip
        result['data'][ip]['judgments'] = ",".join(result['data'][ip]['judgments'])
        data['data'] = result['data'][ip]
        content.append(data)
        ti['content'] = content

    else:
        content = []
        data = {}
        data['response_code'] = result['response_code']
        data['verbose_msg'] = result['verbose_msg']
        content.append(data)
        ti['content'] = content
    return ti
if __name__ == '__main__':
    query_data = sys.argv[1]
    result = TiSearch(query_data)
    print json.dumps(result)

sdpassetPythonCode.tar

[splunklib]
(https://www.hesc.info/upload/2020/11/splunklib-46c6cfb2c20e4c6dbd028cdb562f1689.tgz)

Splunk > 卓豪 > Python
#Splunk #Python #API接口 #CMDB
Splunk对接卓豪API接口获取CMDB数据-Python脚本
https://hesc.info/8ebdebfe8272/
作者
需要哈气的纸飞机
发布于
2021年5月7日
许可协议