search

gabstopper / smc-python

Forcepoint Security Management Center python library:(Moved to official Forcepoint repo)
https://github.com/Forcepoint/fp-NGFW-SMC-python
Apache License 2.0
29 stars 13 forks source link

Retrieve multiple and heterogeneous network-elements at a time #45

Closed sebbbastien closed 5 years ago

sebbbastien commented 5 years ago

Hi David,

Is there any method to retrieve multiple Elements from href in a single request?

For example I need to pull:

http://smc:8082/6.4/elements/host/5581
http://smc:8082/6.4/elements/host/5580
http://smc:8082/6.4/elements/host/5932
http://smc:8082/6.4/elements/group/6107
http://smc:8082/6.4/elements/tcp_service/459
[...]
http://smc:8082/6.4/elements/network/6079

Is it possible to retrieve all of this in one request ?

Best regards,

gabstopper commented 5 years ago

Hi Sebasstien, Not directly via SMC API. One possible option is that you keep a local cache and retrieve what you need through either through the smc-python collections interface or through direct fetching.

One other possibility since searching through smc-python/SMC API supports wildcards, you might consider that if these elements are "similar" in nature, that you use a common prefix or similar type naming convention. In addition, the comments field is searchable. Another option would be using tags to group these similar elements together.

In the case of common names (keep in mind when doing a search the comments field is also searched); the SMC API will return multiple elements based on matching in a wildcard way.

For example:

element = Search.objects.filter('foo')
print(list(element))

Returns:

[VulnerabilityDynamic(name=Zabbix-Authenticated-Remote-Command-Execution), DynamicNetlink(name=dynamic_netlink-foo-(IPv4)-Interface 0), ApplicationSituation(name=Mango), ApplicationSpecificTagDynamic(name=Dogfood CRM), URLCategory(name=Restaurants and Dining), ApplicationSituation(name=JustFoodERP), VulnerabilityDynamic(name=Dogfood-CRM-Remote-Command-Execution), ApplicationSituation(name=Etsy), Network(name=networkelement), ApplicationSituation(name=SLAManagement), ApplicationSituation(name=Cater2.me), ApplicationSituation(name=Zuppler), ApplicationSituation(name=amoCRM), InspectionSituation(name=Generic_CS-Botnet-Al3na.weakpatheticfool-Activity), ApplicationSituation(name=Extendr), ApplicationSituation(name=Snapfulfil), Category(name=foo), Category(name=foocategory), LogicalInterface(name=foointerface), InspectionSituation(name=Generic_SS-Botnet-Al3na.weakpatheticfool-Activity), Category(name=footag), Host(name=foobee), ApplicationSituation(name=Palerra), ExternalGateway(name=foogw2), Location(name=foobarlocation2), ExternalGateway(name=foogw), Location(name=foobarlocation54), ApplicationSituation(name=Eater), ApplicationSituation(name=SB-Nation), ApplicationSituation(name=Gourmondo), TlsMatchSituationDynamic(name=TLS-Match_Alfoo), Location(name=foobar), InspectionSituation(name=HTTP_CRL-Dogfood-CRM-Remote-Command-Execution), Location(name=foobarlocation), Host(name=hax0r), ApplicationSituation(name=Columbus), ApplicationSituation(name=Wufoo), InspectionSituation(name=foosituation), IPPrefixList(name=foo), ApplicationSituation(name=Metric-Stream), ApplicationSituation(name=Alfoo), ApplicationSituation(name=Fast-React-Systems), ApplicationSituation(name=Cambridgesoft), ApplicationSituation(name=Caterease), ApplicationSituation(name=ZeroCater), ApplicationSituation(name=Zappos), VulnerabilityDynamic(name=Al3na.weakpatheticfool-Botnet), ApplicationSituation(name=NIKE), ApplicationSituation(name=Foodspotting)]

Do any of these options make sense for your use case?

gabstopper commented 5 years ago

Hi Sebbastien, Does this solution work for you? If so, please close the issue.

sebbbastien commented 5 years ago

Hi David,

This is not the way I hoped, but I understand your proposal.

Thanks for your time.