GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → sophos-cybersecurity → sophos-central-api-connector

sophos-cybersecurity / sophos-central-api-connector

Licence: GPL-3.0 License
Leverage Sophos Central API

Programming Languages

python
139335 projects - #7 most used programming language

Labels

iocapi-wrapperthreat-huntingsophossophos-centralsophos-central-apilive-discoverioc-hunt

Projects that are alternatives of or similar to sophos-central-api-connector

YAFRA
YAFRA is a semi-automated framework for analyzing and representing reports about IT Security incidents.
Stars: ✭ 22 (+29.41%)
Mutual labels:  ioc, threat-hunting
Threatingestor
Extract and aggregate threat intelligence.
Stars: ✭ 439 (+2482.35%)
Mutual labels:  ioc, threat-hunting
Patrowlmanager
PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform
Stars: ✭ 363 (+2035.29%)
Mutual labels:  ioc, threat-hunting
Detections
This repository contains all public indicators identified by 401trg during the course of our investigations. It also includes relevant yara rules and ids signatures to detect these indicators.
Stars: ✭ 95 (+458.82%)
Mutual labels:  ioc, threat-hunting
Patrowldocs
PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform
Stars: ✭ 105 (+517.65%)
Mutual labels:  ioc, threat-hunting
Awesome Yara
A curated list of awesome YARA rules, tools, and people.
Stars: ✭ 1,394 (+8100%)
Mutual labels:  ioc, threat-hunting
Signature Base
Signature base for my scanner tools
Stars: ✭ 1,212 (+7029.41%)
Mutual labels:  ioc, threat-hunting
Intelowl
Intel Owl: analyze files, domains, IPs in multiple ways from a single API at scale
Stars: ✭ 2,114 (+12335.29%)
Mutual labels:  ioc, threat-hunting
Patrowlengines
PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform
Stars: ✭ 162 (+852.94%)
Mutual labels:  ioc, threat-hunting
sleeper-api-wrapper
A Python wrapper for the Sleeper Fantasy Football API.
Stars: ✭ 41 (+141.18%)
Mutual labels:  api-wrapper
IronNetTR
Threat research and reporting from IronNet's Threat Research Teams
Stars: ✭ 36 (+111.76%)
Mutual labels:  threat-hunting
COVID19Py
A tiny Python package for easy access to up-to-date Coronavirus (COVID-19, SARS-CoV-2) cases data.
Stars: ✭ 86 (+405.88%)
Mutual labels:  api-wrapper
cablecuttr
An R wrapper for CanIStream.It API
Stars: ✭ 17 (+0%)
Mutual labels:  api-wrapper
OSINT-Brazuca
Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.
Stars: ✭ 508 (+2888.24%)
Mutual labels:  threat-hunting
github-api-plugin
This plugin packages stock github-api library
Stars: ✭ 20 (+17.65%)
Mutual labels:  api-wrapper
fusion
A simple automated dependency injection library for TypeScript, supporting React class and functional components.
Stars: ✭ 18 (+5.88%)
Mutual labels:  ioc
ir scripts
incident response scripts
Stars: ✭ 17 (+0%)
Mutual labels:  threat-hunting
csharp-ovh
Thin wrapper around OVH's APIs. Handles all the hard work including credential creation and requests signing
Stars: ✭ 21 (+23.53%)
Mutual labels:  api-wrapper
GraphiPy
GraphiPy: Universal Social Data Extractor
Stars: ✭ 61 (+258.82%)
Mutual labels:  api-wrapper
doccano-client
A simple client wrapper for doccano API.
Stars: ✭ 52 (+205.88%)
Mutual labels:  api-wrapper
View All Similar Projects ➔

Sophos Central API Connector

Python library to utilise many of the features in Sophos Central API across multiple or single tenants

Python License: GPL v3 Generic badge

Table of contents:

Features

All features can be run against single or multiple tenants

  • Gather tenant system inventory
    • Output to stdout, json, Splunk
  • Gather alerts
    • Alert polling
    • Output to stdout, json, Splunk
  • Local Sites
    • Clean up Global exclusions
      • Compare exclusions to SophosLabs Intelix
    • Generate report
  • IOC Hunting - Utilising Live Discover or XDR DataLake
    • MISP Attribute hunting (eventId, tags)
    • RAW JSON input
    • Saved search

Quick start

Want to test as quickly as possible? Follow the below quick start steps to begin looking at your Sophos Central data!

  1. Install latest version of Python 3

  2. Create a folder e.g "sophos_test"

  3. Open a command prompt/terminal

  4. Create a Python Virtual Environment:

    python -m venv <folder_name>

  5. Activate the Python Virtual Environment:

    <path_to_folder>\Scripts\activate

  6. Install the Sophos Central API Connector (this will also install the requirements):

    pip install sophos-central-api-connector

  7. Once it has finished installing browse to:

    cd <path_to_folder>\Lib\site-packages\sophos_central_api_connector

  8. Run the following command to view help to begin:

    python sophos_central_main.py --help

  9. Add your Sophos Central API id and secret to the sophos_config.ini under the folder: \Lib\site-packages\sophos_central_api_connector\config

    Important!

    We would recommend that the static entry is only used for testing purposes and the token is stored and accessed securely. Please reference the authentication section

Prerequisites

In order to use the package you will require a valid API key from your Sophos Central tenant. To obtain a valid API key please reference the documentation here

Install

pip install --user sophos_central_api_connector

Authentication

There are two options for authentication, the setting used here will be used for all areas of authentication. As mentioned under the configuration section we recommend using the AWS Secrets Manager for storing these credentials. Only use the static credentials for testing purposes.

Static Credentials

To specify using the static credentials which are in the *config.ini files you can use the following: python3 sophos_central_main.py --auth static

AWS Secrets Manager

To specify using the AWS settings which are in the *config.ini files to retrieve the secrets and token you can use the following: python3 sophos_central_main.py --auth aws

Basic Examples

Help

To get information on the CLI commands when using the sophos_central_main.py run:

python sophos_central_main.py --help

Tenants List

To get a list of tenants:

python sophos_central_main.py --auth <auth_option> --get tenants

Inventory

To get inventory data:

python sophos_central_main.py --auth <auth_option> --get inventory --output <output_option>

Alerts/Event Information

To get alert data:

python sophos_central_main.py --auth <auth_option> --get alerts --days <integer: 1-90> --output <output_option>

Local Site

To get a list of local site data:

python sophos_central_main.py --auth <auth_option> --get local-sites --output <output_option>

Output Options

There are four output options available for the inventory, simply add one of the following after --output:

  • stdout: Print the information to the console.
  • json: Save the output of the request to a json file
  • splunk: This will send the data to Splunk with no changes made. This will apply the settings made in the transform files.
  • splunk_trans: Using this output will apply the information set in the splunk_config.ini for the host, source and sourcetype. This will overrun the settings in the transform files in Splunk but not the Index that the data should be sent to.

Troubleshooting

All logging is done via the python logging library. Valid logging levels are:

  • INFO
  • DEBUG
  • CRITICAL
  • WARNING
  • ERROR

For basic feedback set the logging level to INFO

Structure

Below is the structure after installing through pip:

sophos_central_api_connector
|   .gitignore
|   LICENSE
|   MANIFEST.in
|   README.md
|   requirements.txt
|   setup.py
|___docs
|       alerts.md
|       intelix.md
|       intelix_configuration.md
|       inventory.md
|       ioc_hunter.md
|       local_sites.md
|       misp_configuration.md
|       sophos_configuration.md
|       splunk_configuration.md
|___queries
|       |___live_discover_queries
|               ld_ioc_hunter.sql
|       |___xdr_queries
|               xdr_ioc_hunter.sql
|___sophos_central_api_connector
|       ioc_hunter.py
|       sophos_central_api_live_discover.py
|       sophos_central_api_auth.py
|       sophos_central_api_awssecrets.py
|       sophos_central_api_connector_utils.py
|       sophos_central_api_delete_data.py
|       sophos_central_api_get_data.py
|       sophos_central_api_intelix.py
|       sophos_central_api_output.py
|       sophos_central_api_polling.py
|       sophos_central_api_tenants.py
|       sophos_central_api_hec_splunk.py
|       sophos_central_main.py
|___config
|       intelix_config.ini
|       misp_config.ini
|       sophos_central_api_config.py
|       sophos_config.ini
|       splunk_config.ini

Below is the structure with all the files that are created through different mechanisms:

sophos_central_api_connector
|   .gitignore
|   LICENSE
|   MANIFEST.in
|   README.md
|   requirements.txt
|   setup.py
|___sophos_central_api_connector
|   |___docs
|   |       alerts.md
|   |       intelix.md
|   |       intelix_configuration.md
|   |       inventory.md
|   |       ioc_hunter.md
|   |       local_sites.md
|   |       misp_configuration.md
|   |       sophos_configuration.md
|   |       splunk_configuration.md
|___queries
|       |___live_discover_queries
|               ld_ioc_hunter.sql
|       |___xdr_queries
|               xdr_ioc_hunter.sql
|       ioc_hunter.py
|       sophos_central_api_live_discover.py
|       sophos_central_api_auth.py
|       sophos_central_api_awssecrets.py
|       sophos_central_api_connector_utils.py
|       sophos_central_api_delete_data.py
|       sophos_central_api_get_data.py
|       sophos_central_api_intelix.py
|       sophos_central_api_output.py
|       sophos_central_api_polling.py
|       sophos_central_api_tenants.py
|       sophos_central_api_hec_splunk.py
|       sophos_central_main.py
|___config
|       intelix_config.ini
|       misp_config.ini
|       sophos_central_api_config.py
|       sophos_config.ini
|       splunk_config.ini
|___logs
|       failed_events.json
|___output
|   |___get_alerts
|   |       <tenant_name>_<tenant_id>.json
|   |       ...
|   |___get_inventory
|           <tenant_name>_<tenant_id>.json
|   |___get_local_sites
|           <tenant_name>_<tenant_id>.json
|           ...
|   |___intelix
|       |___delete_local_sites
|           <date>_<time>_deletion_details.json
|           <date>_<time>_deletion_report.json
|           ...
|       <date>_<time>_intelix_results.json
|       <date>_<time>_results_combined.json
|       <tenant_id>_<date>_<time>_<risk_level>_dry_run_report.json
|       ...
|   |___query_results
|       <xdr_datalake/live-discover>_query_list.json
|       <xdr_datalake/live-discover>_search_data_<timestamp>.json
|       <xdr_datalake/live-discover>_result_data_<timestamp>.json
|       live-discover_endpoint_data_<timestamp>.json
|___polling
|       poll_config.json
|       alert_ids.json
|       temp_alert_ids.json
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].