aw-mfe / gsuite2mfe

Send events from G Suite to McAfee SIEM
MIT License
14 stars 7 forks source link

Problem with gsuite api #7

Open nortonxita opened 5 years ago

nortonxita commented 5 years ago

Dear Andy,

I update with the last release but I have a problem with the Google API. The link have a redirect to http://localhost:8080/ and not finish the authentication. It is a problem in the python code that generate the link or it is necessary to do a different procedure?

Could you please help me with this problem? Thanks for the best script.

andywalden commented 5 years ago

Hi - there isn't anything in the script that directs you to 8080 - might those be your proxy settings? May want to try with proxy disabled. Thanks.

nortonxita commented 5 years ago

Dear Andy, it is not a script, yesterday I see the credential.json and the redirect is present in this file. I think is a configuration in the google credential.json. it is necesssary a specific configuration in this version on google?

andywalden commented 5 years ago

I think the google auth process is redirecting you towards your account so you can click that box that gives the script permission to access your google acount. When this is done on in a shell where no browser is available it gives you a code to validate at a url, but if it thinks you have a browser on your machine it tries to use it to connect to google. If this browser cannot connect to google the process would fail.

Could you help me recreate your issue? What OS, python version and other details? Could you provide a screenshot? Thanks.

nortonxita commented 5 years ago

Dear Andy, I resolve the problem with authentication. It is necessary to change the line 222:

self.creds = flow.run_local_server()

with:

self.creds = flow.run_console()

Now the credential file was created and the authentication work. But I have this error on the script run:

(gsuite2mfe) xxxxx@xxxxxx:~/gsuite2mfe# python3 gsuite2mfe.py Traceback (most recent call last): File "gsuite2mfe.py", line 559, in main() File "gsuite2mfe.py", line 540, in main bookmark.update(events) File "gsuite2mfe.py", line 306, in update if evt_time_obj > validate_time('o', self.bookmark): TypeError: '>' not supported between instances of 'datetime.datetime' and 'NoneType'

The python version is 3.6

Could you help me?

chuyendang commented 4 years ago

I have the same problem. @nortonxita did you find out any thing?

andywalden commented 4 years ago

I have updated the script and this should be fixed. Thanks.

chuyendang commented 4 years ago

I still got the problem

ug 19 20:57:43 srv-docker-1 gsuite2mfe: Init bookmark object: calendar.
Aug 19 20:57:43 srv-docker-1 gsuite2mfe: Looking for bookmark file
Aug 19 20:57:43 srv-docker-1 gsuite2mfe: Bookmark file not found: .calendar.bookmark.
Aug 19 20:57:43 srv-docker-1 gsuite2mfe: Validating timestamp: 2019-08-19 20:27:43-04:00
Aug 19 20:57:43 srv-docker-1 gsuite2mfe: Bookmark time generated: 2019-08-20T00:27:43Z
Aug 19 20:57:43 srv-docker-1 gsuite2mfe: Building cache for: calendar
Aug 19 20:57:43 srv-docker-1 gsuite2mfe: Authenticating to GSuite
Aug 19 20:57:43 srv-docker-1 gsuite2mfe: Retrieving calendar events from: 2019-08-19 20:27:43-04:00 to 2019-08-19 20:57:43-04:00
Aug 19 20:57:44 srv-docker-1 gsuite2mfe: Deduplicating events. Processing: 6 events.
Aug 19 20:57:44 srv-docker-1 gsuite2mfe: Validating event times
Aug 19 20:57:44 srv-docker-1 gsuite2mfe: Validating timestamp: 2019-08-19 20:51:29.637000-04:00
Aug 19 20:57:44 srv-docker-1 gsuite2mfe: Invalid time format: 2019-08-20 00:27:43+00:00.  Null time returned.
Traceback (most recent call last):
  File "gsuite2mfe.py", line 559, in <module>
    main()
  File "gsuite2mfe.py", line 540, in main
    bookmark.update(events)
  File "gsuite2mfe.py", line 306, in update
    if evt_time_obj > validate_time('o', self.bookmark):
TypeError: '>' not supported between instances of 'datetime.datetime' and 'NoneType'
andywalden commented 4 years ago

Thank you for testing it. Could you please try once more with the latest version?

chuyendang commented 4 years ago

I got this message:

(gsuite2mfe) [docker@srv-docker-1 gsuite2mfe]$ python gsuite2mfe.py -l debug Traceback (most recent call last): File "gsuite2mfe.py", line 3, in import dateparser ModuleNotFoundError: No module named 'dateparser'

Got it fixed by install pip install dateparser However, still got another problem:

Aug 22 10:44:52 srv-docker-1 gsuite2mfe: Processing actvity: calendar Aug 22 10:44:52 srv-docker-1 gsuite2mfe: ***** Aug 22 10:44:52 srv-docker-1 gsuite2mfe: Init bookmark object: calendar. Aug 22 10:44:52 srv-docker-1 gsuite2mfe: Looking for bookmark file. Aug 22 10:44:52 srv-docker-1 gsuite2mfe: Bookmark file not found: .calendar.bookmark. Aug 22 10:44:52 srv-docker-1 gsuite2mfe: Building cache for: calendar Aug 22 10:44:52 srv-docker-1 gsuite2mfe: Authenticating to GSuite Aug 22 10:44:52 srv-docker-1 gsuite2mfe: Retrieving calendar events from: 2019-08-22T14:14:52Z to 2019-08-22T14:44:52Z Aug 22 10:44:53 srv-docker-1 gsuite2mfe: Deduplicating Events. Traceback (most recent call last): File "gsuite2mfe.py", line 586, in main() File "gsuite2mfe.py", line 570, in main events = cache.dedup_events(events) File "gsuite2mfe.py", line 383, in dedup_events logging.debug('Deduplicating events. Processing: %s events.', len(new_events)) NameError: name 'new_events' is not defined

chuyendang commented 4 years ago

Edit: If I change new_events to events in line 383 , activities work, but I need to use starttime, otherwise, I get these messages

Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Validating timestamp: 2019-08-22T15:22:02.942Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Validating timestamp: 2019-08-22T14:52:13Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Event time > Bookmark time: 2019-08-22T15:22:02.942Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Validating timestamp: 2019-08-22T15:22:04.827Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Validating timestamp: 2019-08-22T14:52:13Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Event time > Bookmark time: 2019-08-22T15:22:04.827Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Validating timestamp: 2019-08-22T15:22:05.990Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Validating timestamp: 2019-08-22T14:52:13Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Event time > Bookmark time: 2019-08-22T15:22:05.990Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Validating timestamp: 2019-08-22T15:22:11.267Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Validating timestamp: 2019-08-22T14:52:13Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Event time > Bookmark time: 2019-08-22T15:22:11.267Z Aug 22 11:22:14 srv-docker-1 gsuite2mfe: Writing bookmark. Traceback (most recent call last): File "gsuite2mfe.py", line 586, in main() File "gsuite2mfe.py", line 573, in main bookmark.write() File "gsuite2mfe.py", line 325, in write self.new_bookmark_p1 = self.new_bookmark + timedelta(0,1) TypeError: must be str, not datetime.timedelta

andywalden commented 4 years ago

Please try the latest update. Thanks!

chuyendang commented 4 years ago

Great, it works...

FYI, I need to modify

if pargs.s_time: s_time = dateparser.parse(pargs.s_time) use_bookmark = False if pargs.e_time: e_time = dateparser.parse(pargs.e_time)

to

if pargs.s_time: s_time = pargs.s_time use_bookmark = False if pargs.e_time: e_time = pargs.e_time

Otherwise, it does not work when I set start/end time. python gsuite2mfe.py -l debug -s 2019-08-24T00:00:00.000Z

Aug 24 10:32:13 srv-docker-1 gsuite2mfe: Processing actvity: admin Aug 24 10:32:13 srv-docker-1 gsuite2mfe: ***** Aug 24 10:32:13 srv-docker-1 gsuite2mfe: Authenticating to GSuite Aug 24 10:32:13 srv-docker-1 gsuite2mfe: Retrieving admin events from: 2019-08-24 00:00:00+00:00 to 2019-08-24T03:32:13Z Traceback (most recent call last): File "gsuite2mfe.py", line 613, in main() File "gsuite2mfe.py", line 590, in main events = gsuite.execute() File "gsuite2mfe.py", line 281, in execute maxResults=self.max, File "/home/docker/gsuite2mfe/lib/python3.6/site-packages/googleapiclient/discovery.py", line 739, in method for pvalue in pvalues: TypeError: 'datetime.datetime' object is not iterable