mfesiem / msiempy

McAfee SIEM API Python wrapper
https://mfesiem.github.io/docs/msiempy/msiempy.html
MIT License
23 stars 9 forks source link

Implement grouped queries #69

Closed tristanlatr closed 3 years ago

tristanlatr commented 4 years ago

Describe We should be able to handle grouped queries as offed by the API

Additional context We could access a new object: GroupedEventManager(FilteredQueryList)

GroupedEventManager(field, filters)

Reminder of the API documentation

qryExecuteGrouped Description Execute a grouped query giving the count and sum

Parameters queryType Type: EsmGroupedQueryType Description: Query type Accepted Values: EVENT FLOW config Type: EsmGroupedQueryConfig Description: The parameters to apply to the query including filters, time range, field, etc Return Value ("return" JSON root element IS returned) Type: EsmRunningQuery Description: The active query information, created as a result of executing the query successfully. Example REST Call (with JSON if applicable) https://URL:4443/rs/esm/qryExecuteGrouped?queryType=EVENT

Example JSON Content:

{"config": {
    "filters": [{
        "type": "EsmFieldFilter",
        "field": {"name": "(name)"},
        "operator": "IN",
        "values": [{
            "type": "EsmWatchlistValue",
            "watchlist": {"value": 0}
        }]
    }],
    "field": {"name": "(name)"},
    "timeRange": "CUSTOM",
    "customStart": "2020-03-11T11:30:12.595Z",
    "customEnd": "2020-03-11T11:30:12.596Z"
}}