search

aw-mfe / gsuite2mfe

Send events from G Suite to McAfee SIEM
MIT License
14 stars 7 forks source link

Problem bookmark #2

Open hackjc opened 6 years ago

hackjc commented 6 years ago

Hi, I don't know if I'm missing something, but I'm getting this error

Jan 25 09:47:06 server gsuite2mfe: **DEBUG ENABLED** Jan 25 09:47:06 server gsuite2mfe: Log retrieval enabled for: ['login', 'admin', 'drive'] Jan 25 09:47:06 server gsuite2mfe: Null time provided: None Jan 25 09:47:06 server gsuite2mfe: Null time provided: None Jan 25 09:47:06 server gsuite2mfe: Jan 25 09:47:06 server gsuite2mfe: Processing actvity: 'login' Jan 25 09:47:06 server gsuite2mfe: Jan 25 09:47:06 server gsuite2mfe: Init bookmark object: login. Jan 25 09:47:06 server gsuite2mfe: Looking for bookmark file Jan 25 09:47:06 server gsuite2mfe: Bookmark file not found: .login.bookmark. Jan 25 09:47:06 server gsuite2mfe: Validating timestamp: 2018-01-25 09:17:06-05:00 Jan 25 09:47:06 server gsuite2mfe: Bookmark time generated: 2018-01-25T14:17:06Z Jan 25 09:47:06 server gsuite2mfe: Building cache for: login Jan 25 09:47:06 server gsuite2mfe: Authenticating to GSuite Jan 25 09:47:06 server gsuite2mfe: Retrieving login events from: 2018-01-25 09:17:06-05:00 to 2018-01-25 09:47:06-05:00 Jan 25 09:47:06 server gsuite2mfe: Call to deduplicate events. Processing: 129 Jan 25 09:47:06 server gsuite2mfe: Validating event times Jan 25 09:47:06 server gsuite2mfe: Validating timestamp: 2018-01-25 09:44:51-05:00 Traceback (most recent call last): File "gsuite2mfe.py", line 552, in main() File "gsuite2mfe.py", line 533, in main bookmark.update(events) File "gsuite2mfe.py", line 298, in update if self.evt_time_obj > validate_time('o', self.bookmark): AttributeError: 'Bookmark' object has no attribute 'bookmark'

Thank you for your help.

sebdooris commented 5 years ago

Did you ever find a solution ? Having the same issue here Apr 16 19:17:48 gsuite2mfe: **DEBUG ENABLED** Apr 16 19:17:48 gsuite2mfe: Log retrieval enabled for: ['login', 'admin'] Apr 16 19:17:48 gsuite2mfe: Null time provided: None Apr 16 19:17:48 gsuite2mfe: Null time provided: None Apr 16 19:17:48 gsuite2mfe: Apr 16 19:17:48 gsuite2mfe: Processing actvity: 'login' Apr 16 19:17:48 gsuite2mfe: Apr 16 19:17:48 gsuite2mfe: Init bookmark object: login. Apr 16 19:17:48 gsuite2mfe: Looking for bookmark file Apr 16 19:17:48 gsuite2mfe: Opening: .login.bookmark Apr 16 19:17:48 gsuite2mfe: File found. Reading timestamp: 2019-04-16 13:46:56-04:00 Apr 16 19:17:48 gsuite2mfe: Validating timestamp: 2019-04-16 13:46:56-04:00 Apr 16 19:17:48 gsuite2mfe: Bookmark time is valid Apr 16 19:17:48 gsuite2mfe: Building cache for: login Apr 16 19:17:48 gsuite2mfe: Authenticating to GSuite Apr 16 19:17:48 gsuite2mfe: Retrieving login events from: 2019-04-16 13:46:56-04:00 to 2019-04-16 14:17:48-04:00 Apr 16 19:17:49 gsuite2mfe: No events found for activity: login Apr 16 19:17:49 gsuite2mfe: No new timestamps. Bookmark remains unchanged Apr 16 19:17:49 gsuite2mfe: Cache file entries written: filename:cnt: .login.cache:12 Apr 16 19:17:49 gsuite2mfe: Caching disabled. Touching file: .login.cache Apr 16 19:17:49 gsuite2mfe: Apr 16 19:17:49 gsuite2mfe: Processing actvity: 'admin' Apr 16 19:17:49 gsuite2mfe: Apr 16 19:17:49 gsuite2mfe: Init bookmark object: admin. Apr 16 19:17:49 gsuite2mfe: Looking for bookmark file Apr 16 19:17:49 gsuite2mfe: Bookmark file not found: .admin.bookmark. Apr 16 19:17:49 gsuite2mfe: Validating timestamp: 2019-04-16 13:47:49-04:00 Apr 16 19:17:49 gsuite2mfe: Bookmark time generated: 2019-04-16T17:47:49Z Apr 16 19:17:49 gsuite2mfe: Building cache for: admin Apr 16 19:17:49 gsuite2mfe: Authenticating to GSuite Apr 16 19:17:49 gsuite2mfe: Retrieving admin events from: 2019-04-16 13:47:49-04:00 to 2019-04-16 14:17:48-04:00 Apr 16 19:17:49 gsuite2mfe: Call to deduplicate events. Processing: 1 Apr 16 19:17:49 gsuite2mfe: Validating event times Apr 16 19:17:49 gsuite2mfe: Validating timestamp: 2019-04-16 14:00:16.090000-04:00 Traceback (most recent call last): File "gsuite2mfe.py", line 553, in main() File "gsuite2mfe.py", line 534, in main bookmark.update(events) File "gsuite2mfe.py", line 299, in update if self.evt_time_obj > validate_time('o', self.bookmark): AttributeError: 'Bookmark' object has no attribute 'bookmark'

andywalden commented 5 years ago

Please try the latest release. Thanks.

sebdooris commented 4 years ago

Hi Andy, have tried the latest version and still the same issue. Just installed on fresh Ubuntu 18.04

sebdooris commented 4 years ago

Traceback (most recent call last): File "gsuite2mfe.py", line 559, in main() File "gsuite2mfe.py", line 540, in main bookmark.update(events) File "gsuite2mfe.py", line 306, in update if evt_time_obj > validate_time('o', self.bookmark): TypeError: '>' not supported between instances of 'datetime.datetime' and 'NoneType

Python 3.6.8 Linux mogato 4.15.0-54-generic #58-Ubuntu SMP Mon Jun 24 10:55:24 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

`

sebdooris commented 4 years ago

After a bit of digging it looks like it's the activities.

Working activities = login,mobile,saml,chat,gplus,rules,jamboard,user_accounts,access_transparency

Producing errors when including the following activities. admin,drive,calendar,token,groups,meet,groups_enterprise

andywalden commented 4 years ago

I have updated the script and I think this is fixed now. Thanks.