o
    i%                     @   s   d Z ddlmZ ddlZddlZddlmZ ddlmZm	Z	m
Z
 ddlmZ ddlmZ ddlmZ dd	lmZ d
d ZG dd deZdS )z7
Security Monitoring client - dogshell implementation.
    )print_functionNwraps)report_errorsreport_warnings	print_err)SecurityMonitoringRule)SecurityMonitoringSignal)pretty_json)apic                    s   t   fdd}|S )z5
    Decorator for security monitoring commands.
    c              
      s   | j t_| j}z- | }|du rW dS t|st|rW dS |dkr+tt| W dS tt	| W dS  t
yP } ztdt| W Y d}~dS d}~ww )z?
        A decorator that reports errors and warnings.
        Nr      prettyz	ERROR: {})timeoutr   _timeoutformatr   r   printr
   jsondumps	Exceptionr   str)argsr   resef X/home/ubuntu/.local/lib/python3.10/site-packages/datadog/dogshell/security_monitoring.pywrapper   s$   zapi_cmd.<locals>.wrapperr   )r   r   r   r   r   api_cmd   s   r   c                   @   s|   e Zd ZdZedd Zedd Zedd Zedd	 Zed
d Z	edd Z
edd Zedd Zedd ZdS )SecurityMonitoringClientzH
    SecurityMonitoring client implementing the dogshell interface.
    c                 C   sf  |j ddd}|jdtddd |jdd	d
}d|_|j ddd}|jddd
}d|_|j ddd}|jddtdd |jdddd |j| jd |j ddd}|jddd |j| jd |j ddd}|jd d!d"dd#d$ |j| jd |j d%d&d}	|	jddd |	jd d!d"dd#d$ |	j| j	d |j d'd(d}
|
jddd |
j| j
d |j d)d*d}|jdd+d
}d|_|j dd,d}|jd-d.d/d |jd0d1d2d |jd3d4d5d |jd6d7d8d |jddtd9d |jd:d;d<d |j| jd |j dd=d}|jd>d?d |j| jd |j d@dAd}|jd>d?d |jdBdCdg dDdEdF |j| jd dS )GzR
        Set up the command line parser for security monitoring commands.
        zsecurity-monitoringz,Manage security monitoring rules and signals)helpz	--timeoutNzTimeout in seconds)typedefaultr    Commandssub_command)titledestTrulesz Manage security monitoring rulesrule_commandlistz"List all security monitoring rulesz--page-size	page_sizez7Size for a given page. The maximum allowed value is 100)r&   r!   r    z--page-numberpage_numberzSpecific page number to return)r&   r    )funcgetzGet a security monitoring rulerule_idzRule IDcreatez!Create a security monitoring rulez--filez-ffilezJSON file with rule definition)r&   requiredr    updatez!Update a security monitoring ruledeletez!Delete a security monitoring rulesignalsz"Manage security monitoring signalssignal_commandz List security monitoring signalsz--queryqueryzQuery to filter signalsz--from	from_timez*From timestamp (e.g., 'now-1h', timestamp)z--toto_timez%To timestamp (e.g., 'now', timestamp)z--sortsortzSort order (e.g., '-timestamp')zNumber of results per pagez--page-cursorpage_cursorzCursor for paginationz Get a security monitoring signal	signal_idz	Signal IDtriagez'Change triage state of security signalsz--statestate)openarchivedunder_reviewz/New triage state (open, archived, under_review))r&   r1   choicesr    )
add_parseradd_argumentintadd_subparsersr1   set_defaults_show_all_rules
_show_rule_create_rule_update_rule_delete_rule_list_signals_get_signal_change_triage_state)cls
subparsersparsersub_parsersrule_parserrule_sub_parsersrule_list_parserrule_get_parserrule_create_parserrule_update_parserrule_delete_parsersignal_parsersignal_sub_parserssignal_list_parsersignal_get_parsersignal_triage_parserr   r   r   setup_parser5   s   

z%SecurityMonitoringClient.setup_parserc                 C      t dd }||S )Nc                 S      t | jS N)r   r-   r.   r   r   r   r   show_rule_cmd      z:SecurityMonitoringClient._show_rule.<locals>.show_rule_cmdr   )rO   r   rd   r   r   r   rH      s   
z#SecurityMonitoringClient._show_rulec                 C   r`   )Nc                 S   s4   i }| j r
| j |d< | jr| j|d< tjdi |S )N
page[size]zpage[number]r   )r*   r+   r   get_allr   paramsr   r   r   show_all_rules_cmd   s   

zDSecurityMonitoringClient._show_all_rules.<locals>.show_all_rules_cmdrf   )rO   r   rk   r   r   r   rG      s   
	z(SecurityMonitoringClient._show_all_rulesc                 C   r`   )z4
        Create a security monitoring rule.
        c              
   S   s   zt | jd}t|}W d    n1 sw   Y  W n  ty= } ztdt|tj	d i W  Y d }~S d }~ww t
jdi |S )NrError reading rule file: {}r0   r   )r>   r0   r   loadr   r   r   r   sysstderrr   r/   r   r   	rule_datar   r   r   r   create_rule_cmd   s   z>SecurityMonitoringClient._create_rule.<locals>.create_rule_cmdrf   )rO   r   rt   r   r   r   rI         
	z%SecurityMonitoringClient._create_rulec                 C   r`   )z4
        Update a security monitoring rule.
        c              
   S   s   zt | jd}t|}W d    n1 sw   Y  W n  ty= } ztdt|tj	d i W  Y d }~S d }~ww t
j| jfi |S )Nrl   rm   rn   )r>   r0   r   ro   r   r   r   r   rp   rq   r   r2   r.   rr   r   r   r   update_rule_cmd   s   z>SecurityMonitoringClient._update_rule.<locals>.update_rule_cmdrf   )rO   r   rv   r   r   r   rJ      ru   z%SecurityMonitoringClient._update_rulec                 C   r`   )z4
        Delete a security monitoring rule.
        c                 S   ra   rb   )r   r3   r.   rc   r   r   r   delete_rule_cmd   re   z>SecurityMonitoringClient._delete_rule.<locals>.delete_rule_cmdrf   )rO   r   rw   r   r   r   rK         
z%SecurityMonitoringClient._delete_rulec                 C   r`   )z3
        List security monitoring signals.
        c                 S   st   i }| j r
| j |d< | jr| j|d< | jr| j|d< | jr"| j|d< | jr*| j|d< | jr2| j|d< tjdi |S )Nzfilter[query]zfilter[from]z
filter[to]r9   rg   zpage[cursor]r   )r6   r7   r8   r9   r*   r:   r	   rh   ri   r   r   r   list_signals_cmd   s   





z@SecurityMonitoringClient._list_signals.<locals>.list_signals_cmdrf   )rO   r   ry   r   r   r   rL      s   
z&SecurityMonitoringClient._list_signalsc                 C   r`   )z3
        Get a security monitoring signal.
        c                 S   ra   rb   )r	   r-   r;   rc   r   r   r   get_signal_cmd   re   z<SecurityMonitoringClient._get_signal.<locals>.get_signal_cmdrf   )rO   r   rz   r   r   r   rM      rx   z$SecurityMonitoringClient._get_signalc                 C   r`   )z:
        Change triage state of security signals.
        c                 S   s   t | j| jS rb   )r	   change_triage_stater;   r=   rc   r   r   r   change_triage_state_cmd  s   zNSecurityMonitoringClient._change_triage_state.<locals>.change_triage_state_cmdrf   )rO   r   r|   r   r   r   rN      rx   z-SecurityMonitoringClient._change_triage_stateN)__name__
__module____qualname____doc__classmethodr_   rH   rG   rI   rJ   rK   rL   rM   rN   r   r   r   r   r   0   s(    
f




	

	r   )r   
__future__r   r   rp   	functoolsr   datadog.dogshell.commonr   r   r   %datadog.api.security_monitoring_rulesr   'datadog.api.security_monitoring_signalsr	   datadog.util.formatr
   datadogr   r   objectr   r   r   r   r   <module>   s   