SP REST API Cookbook
SP v8.4
API v4

from __future__ import print_function
import requests
from datetime import datetime, timedelta
from sys import stderr
from time import mktime, strptime
from urllib import urlencode
from urlparse import urlparse, parse_qs

CERT_FILE = "./certfile"
TIMEFMT = "%a %b %d %H:%M:%S %Y"


def get_mitigations(leader, key, start,
                    end, page=1, perPage=50):
    """Recursively get pages of mitigations until
    the start date is reached or the last page is
    reached

    """

    # set up the query string keys and values
    qs = dict()
    if page:
        qs['page'] = page
    if perPage:
        qs['perPage'] = perPage

    # build the URL
    MITIGATION_URI = '/api/sp/mitigations/?'
    URL = "https://" + leader + MITIGATION_URI
    URL += urlencode(qs)

    # make the API request
    api_response = requests.get(
        URL,
        headers={'X-Arbux-APIToken':
                 key},
        verify=CERT_FILE)

    # check the API response
    if api_response.status_code != requests.codes.ok:
        print("[ERROR] API responded with this error: "
              "{}\n(url: {})".
              format(api_response.reason, URL),
              file=stderr)
        return []

    # convert the response to JSON and
    # get the 'data' element
    api_response = api_response.json()
    data = api_response['data']

    # check if we're done or if we need
    # to call ourselves again
    specified_start = string_to_date(start)
    oldest_mit_on_this_page = None
    if 'start' in data[-1]['attributes']:
        oldest_mit_on_this_page = data[-1]['attributes']['start']
        oldest_mit_on_this_page = string_to_date(
            oldest_mit_on_this_page)

    if (oldest_mit_on_this_page is None
        or oldest_mit_on_this_page > specified_start):
        #
        # parse out the last page from the links section
        #
        last_page = None
        if ('links' in api_response and
            'last' in api_response['links']):
            last_page = int(
                parse_qs(
                    urlparse(
                        api_response['links']['last']).query
                )['page'][0]
            )
        if last_page is not None and page < last_page:
            page += 1
            # call ourselves again to get the next page
            d = get_mitigations(leader, key, start, end, page)
            data += d

    return data


def get_alerts_from_mits(mits):
    """Not all mitigations have alerts, those
    will just be skipped, otherwise the alerts
    will be retrieved and a dictionary with
    mitigation information and alert start
    time will be populated and returned

    """
    alerts = {}

    for mit in mits:
        if 'relationships' not in mit or 'alert' not in mit['relationships']:
            continue  # there is no alert related to this mitigation
        if 'start' not in mit['attributes']:
            continue  # mitigation was created but never started
        alert_id = mit[
            'relationships']['alert']['data']['id']
        if alert_id not in alerts:
            alerts[alert_id] = {}
            mit_start_time = string_to_date(
                mit['attributes']['start'])

            alerts[alert_id][
                'mit_start_time'] = mit_start_time
            alerts[alert_id][
                'mit_type'] = mit['attributes']['subtype']
            alerts[alert_id][
                'started_by'] = mit['attributes']['user']

    return alerts


def print_report(alerts, mitigations, sp_leader, start, end):
    """ print a simplistic report with a table of alerts """

    print ("The time range for the report is")
    print ("                 from:",
           start.strftime(TIMEFMT))
    print ("                   to:",
           end.strftime(TIMEFMT))

    print ("Out of {} mitigations on {}, "
           "{} have associated alerts".
           format(
               len(mitigations),
               sp_leader,
               len(alerts.keys())
           ))

    # re-organize alerts for printing
    by_user_type_time = {}
    for alert in alerts:
        started_by = alerts[alert]['started_by']
        mit_type = alerts[alert]['mit_type']
        a_to_m_secs = alerts[alert]['alert_to_mit_seconds']
        if started_by not in by_user_type_time:
            by_user_type_time[started_by] = {}
        if mit_type not in by_user_type_time[started_by]:
            by_user_type_time[started_by][mit_type] = {}
        if a_to_m_secs not in by_user_type_time[started_by][mit_type]:
            by_user_type_time[started_by][mit_type][a_to_m_secs] = []

        by_user_type_time[started_by][mit_type][a_to_m_secs].append(alert)

    # print the header row
    print ("{0:>20} | {1:<10} | {2:11} | {3}".format(
        "Mit. Started By",
        "Mit. Type",
        "Secs to Mit",
        "Alert Ids")
    )
    print ("{0:>20} | {1:<10} | {2:11} | {3}".format(
        "-"*20,
        "-"*10,
        "-"*11,
        "-"*18)
    )
    # Step through the re-organized data and print it
    for started_by in sorted(by_user_type_time):
        tmp_user = started_by
        for mit_type in sorted(by_user_type_time[started_by]):
            tmp_mit_type = mit_type
            for a_to_m_secs in sorted(
                    by_user_type_time[started_by][mit_type]):
                print ("{0:>20} | {1:<10} | {2:11} | {3}".
                       format(
                           tmp_user,
                           tmp_mit_type,
                           a_to_m_secs,
                           ", ".join(by_user_type_time[
                               started_by][
                                   mit_type][
                                       a_to_m_secs])))
                tmp_mit_type = ''
                tmp_user = ''


def get_alert_start_time(leader, key, alert):
    """Get an individual alert via the API and return its start time in
    python datetime format

    """

    ALERT_URI = '/api/sp/alerts/'
    URL = "https://" + leader + ALERT_URI + alert

    api_response = requests.get(
        URL,
        headers={'X-Arbux-APIToken':
                 key},
        verify=CERT_FILE)

    if api_response.status_code != requests.codes.ok:
        print("[WARNING] In retrieving information "
              "about alert {}, the API responded `{}'".
              format(api_response.reason, alert),
              file=stderr)
        return None

    api_response = api_response.json()

    alert_start_time = string_to_date(
        api_response['data']['attributes']['start_time'])

    return alert_start_time


def string_to_date(date_string):
    """Convert a string in the format YYYY-MM-DDThh:mm:ss to a Python
    datetime format

    """

    if type(date_string) is datetime:
        return date_string
    # drop the time offset; if you are using different time zones,
    # don't do this
    date_string = date_string.split('+')[0]
    date_string = date_string.split('.')[0]
    # convert the time string into a Python datetime object
    date_string = strptime(date_string,
                           "%Y-%m-%dT%H:%M:%S")
    date_string = datetime.fromtimestamp(
        mktime(date_string)
    )
    return date_string


if __name__ == '__main__':
    #
    # Set the start time to two weeks ago
    # and the end time to now
    #
    END_TIME = datetime.now()
    START_TIME = END_TIME + timedelta(-14)

    #
    # set the SP leader hostname and API key
    #
    SP_LEADER = 'leader.example.com'
    API_KEY = 'eFvokphdyGHA_M4oLlLtfDnlIf9bpjFnn0mWlDqw'

    mitigations = get_mitigations(SP_LEADER, API_KEY,
                                  START_TIME, END_TIME)
    if not mitigations:
        exit

    #
    # Create a dictionary of alert IDs that contains mitigation start
    # time and (later) the alert start time, the JSON of which would
    # look like:
    #   { "<alert_id>":
    #      { "mit_start_time": "<mitigation_start_time>",
    #        "alert_start_time": "<alert_start_time>",
    #        "mit_type": "{tms,blackhole,flowspec}"
    #      }
    #   }
    #
    alerts = get_alerts_from_mits(mitigations)

    alerts_to_remove = list()

    for alert in alerts:
        # Get the alert start time for each alert that appears in a
        # mitigation
        alerts[alert]['alert_start_time'] = get_alert_start_time(
            SP_LEADER,
            API_KEY,
            alert
        )
        alert_start_time = alerts[alert]['alert_start_time']
        if not alert_start_time:
            alerts[alert]['alert_to_mit_seconds'] = 'n/a'
            continue
        alert_start_time = string_to_date(alert_start_time)
        if alert_start_time < START_TIME or alert_start_time > END_TIME:
            alerts_to_remove.append(alert)
            # alerts[alert]['alert_to_mit_seconds'] = 'n/a'
            continue
        # Get the different in seconds between the
        # alert start and the mitigation start
        alerts[alert]['alert_to_mit_seconds'] = (
            alerts[alert]['mit_start_time'] -
            alerts[alert]['alert_start_time']
        ).total_seconds()

    # delete alerts from the list that are outside of the specific
    # time; this is needed because the mitigations come back in pages,
    # not necessarily scoped to the specified time frame
    for alert in alerts_to_remove:
        del alerts[alert]

    print_report(alerts,
                 mitigations,
                 SP_LEADER,
                 START_TIME,
                 END_TIME)

"""Example SP API script to retrieve and summarize device system alerts."""
from __future__ import print_function
import arrow     # version: 0.10.0
import sys
import re
import requests  # version: 2.18.4
import urllib    # version: 1.17

CERT_FILE = './https_active.crt'


def get_page_from_link(link):
    """Extract a page number from an API link."""
    match = re.search(r'page=(\d+)', link)
    return int(match.group(1)) if match else None


def api_request(url, key, body=None):
    """General function for making GET and POST requests.

    Response codes falling within 'requests.codes.ok' are assumed
    to have completed successfully. Supplying the optional 'body'
    parameter will change the request type to POST.

    Args:
        url (str): Valid URL to make request to.
        key (str): API key generated on the given SP leader.
        body (str): JSON formatted string containing
            post body content.

    Returns:
        dict: 'data' keyvalue of a requests.Response object.
        dict: 'meta' keyvalue of a requests.Response object.
        dict: 'links' keyvalue of a requests.Response object.
    """
    headers = {'X-Arbux-APIToken': key,
               'Content-Type': 'application/vnd.api+json'}
    if body is None:
        api_response = requests.get(
            url,
            headers=headers,
            verify=CERT_FILE)
    else:
        api_response = requests.post(
            url,
            data=body,
            headers=headers,
            verify=CERT_FILE)

    # Handle any API error responses.
    if (api_response.status_code != requests.codes.ok):
        print("API responded with this error: \n{}".format(
            api_response.text),
            file=sys.stderr)
        return ([], {}, {})

    # Convert the response to JSON and return it
    api_response = api_response.json()
    return (api_response['data'], api_response['meta'], api_response['links'])


def get_alerts(leader, key, start_time):
    """Retrieve alerts from an SP leader.

    Args:
        leader (str): SP leader from which the alerts originated
        key (str): API key generated on the given SP leader
        start_time (obj): arrow time object to be used
            a start_time filter for alerts.

    Returns:
        list: Alerts from the SP leader.
    """
    alerts = list()

    # Retrieve the first page of data.
    (first_page, meta, links) = get_alerts_page(leader, key, start_time, 1)
    alerts.extend(first_page)

    # Retrieve first and last page numbers from the returned links.
    last_page_number = get_page_from_link(links["last"])
    current_page_number = get_page_from_link(links["self"])

    # Get all remaining pages, add the data
    while (current_page_number != last_page_number):
        current_page_number = current_page_number + 1
        (current_page, meta, links) = get_alerts_page(leader, key,
                                                      start_time,
                                                      current_page_number)
        alerts.extend(current_page)

    return alerts


def get_alerts_page(leader, key, start_time, page=1):
    """Retrieve a specific page of alerts from an SP leader.

    Args:
        leader (str): SP leader from which the alerts originated
        key (str): API key generated on the given SP leader
        start_time (obj): arrow time object to be used
            a start_time filter for alerts.
        page (int): The specific page of alerts to request.

    Returns:
        list: A specific page of alerts from the leader.
    """
    # Craft the URL components. Filter on alert class and starting time.
    alert_uri = '/api/sp/v3/alerts/'
    filter_value = ("/data/attributes/alert_class = system AND "
                    "/data/attributes/start_time > {0}".format(
                        start_time.format('YYYY-MM-DD:HH:mm:ss')))

    # Percent-encode our filter query.
    filter_value = urllib.quote(filter_value, safe='')

    # Add the parameters to the request url.
    params = list()
    filter_param = "filter={0}".format(filter_value)
    page_param = "page={0}".format(page)
    params = [filter_param, page_param]

    url = "https://{0}{1}?{2}".format(leader, alert_uri, "&".join(params))

    # Make the api request and return its results.
    return api_request(url, key)


def get_devices(leader, key):
    """Retrieve devices from an SP leader.

    Args:
        leader (str): SP leader to retrieve devices from.
        key (str): API key generated on the given SP leader

    Returns:
        list: Device data from the leader.
    """
    device_uri = '/api/sp/v3/devices/'

    url = "https://{0}{1}".format(leader, device_uri)

    # Make the api request and return its results.
    (devices, meta, links) = api_request(url, key)
    return devices


def main():
    """Print a list of devices sorted by system alert count."""
    SP_LEADER = 'leader.example.com'
    API_KEY = 'jrqRzJBV5Ua4t88YWuoTJ8TJsnHBe4qR1phcCvcD'

    # Create a start date one week before the current time.
    arrow_now = arrow.utcnow()
    start_time = arrow_now.shift(weeks=-1)

    # Get a list of all the system alerts starting later than
    # one week ago.
    alerts = get_alerts(SP_LEADER, API_KEY, start_time)

    # Get a list of all devices on the leader.
    devices = get_devices(SP_LEADER, API_KEY)

    # Transform the list into a dictionary keyed by device id.
    device_dict = {device["id"]: device["attributes"] for device in devices}

    # Create a dict keyed by device id containing a count
    # of system errors associated with that device.
    # We will use this data when displaying our list of collectors.
    alert_counts = {}
    for alert in alerts:
        try:
            device_id = alert["relationships"]["device"]["data"]["id"]
        except KeyError:
            continue

        alert_counts[device_id] = (
            alert_counts[device_id] + 1 if device_id in alert_counts else 1)

    # Transform the dict into list of dicts containing id
    # and alert_count for each device.
    alert_count_list = [{"id": key, "alert_count": value}
                        for key, value in alert_counts.iteritems()]

    # Sort the list in decending order by alert count.
    alert_count_list.sort(reverse=True,
                          cmp=lambda x, y: cmp(x["alert_count"],
                                               y["alert_count"]))

    # Display a report of collectors sorted by the number of system alerts
    # found on each collector.
    header_format_string = (
        "==== {alert_count:=<24} {name:=<20} "
        "{device_type:=<20} {ip_address:=<20}")

    # Display a header.
    print(header_format_string.format(alert_count="System Alert Count ",
                                      name="Device Name ",
                                      device_type="Device Type ",
                                      ip_address="IP Address "))

    format_string = (
        "     {alert_count:<24} {name:20} "
        "{device_type:20} {ip_address:20}")

    # Display a row for each device with alerts.
    for device in alert_count_list:
        # Roll in our previously retrieved device data.
        device.update(device_dict[device["id"]])
        print(format_string.format(**device))

if __name__ == "__main__":
    main()

from __future__ import print_function
from sys import stderr
import requests  # version 2.18.4
import arrow  # version 0.10.0
import datetime
import matplotlib  # version 2.0.2
matplotlib.use('Agg')
from matplotlib import pyplot as plt
from matplotlib.dates import DayLocator, HourLocator, DateFormatter, drange

ALERT_ID = 870


def render_matplotlib_png(alert_router_id, points, start, end, step):
    """Render a graph PNG based on timeseries data using matplotlib.

    Args:
        alert_router_id: a alert_id-router_gid string
        points: timeseries traffic data points
        start: arrow object representing the start time of the alert
        end: arrow object reprsenting the end time of the alert
        step: the time period each entry in the timeseries data spans
    """
    # every day
    days = DayLocator()
    # every hour
    hours = HourLocator(interval=9)
    delta = datetime.timedelta(seconds=step)
    # calculate x axis points based on step and start time
    dates = drange(start, end, delta)

    # using AGG
    fig = plt.figure(figsize=(10, 6))
    ax = fig.add_subplot(111)
    ax.plot_date(dates, points, '.-')
    ax.grid(True)
    ax.xaxis.set_major_locator(days)
    ax.xaxis.set_minor_locator(hours)
    ax.xaxis.set_major_formatter(DateFormatter('%a'))
    ax.xaxis.set_minor_formatter(DateFormatter('%H:%M'))
    ax.set_xlabel('time')
    ax.set_ylabel('bps')
    ax.set_title('Router Traffic - {}'.format(alert_router_id))
    fig.autofmt_xdate()
    fig.savefig('{}.png'.format(alert_router_id))


def api_get_request(url, api_key):
    """Build an API GET request.

    Args:
        url: a valid SP box url to make the request
        api_key: API token used to access and use the SP API

    Returns:
        Dict value for 'data' entry of JSON response
    """
    api_response = None
    api_response = requests.get(
            url,
            headers={
                'X-Arbux-APIToken': api_key,
                'Content-Type': 'application/vnd.api+json'
            },
            verify=False
        )

    # Handle API error responses
    if (api_response.status_code < requests.codes.ok or
            api_response.status_code >= requests.codes.multiple_choices):
        print("API responded with this error: \n{}".format(api_response.text),
              file=stderr)
        return []

    # Convert the response to JSON and return
    api_response = api_response.json()
    return api_response['data']


def get_alert_traffic_data_router(sp_leader, api_key, alert_id):
    """Get router interface Traffic for alert.

    Args:
        sp_leader: a valid SP box domain name
        api_key: API token used to access and use the SP API

    Returns:
        The API response
    """
    alert_uri = "/api/sp/alerts/{}/router_traffic/".format(alert_id)
    url = "https://" + sp_leader + alert_uri

    # Make API request and reutrn results
    api_response = api_get_request(url, api_key)
    return api_response


def graph_timeseries_data_per_router(router_traffic):
    """Grab appropriate data from API response then build graph.

    Args:
        router_traffic: the dict value for 'data' entry of JSON response
    """
    if not router_traffic:
        return

    for router in router_traffic:
        data = router['attributes']['view']['network']['unit']['bps']

        step = data['step']
        # Find the end time. Create arrow datetime objects for start and end.
        start_time = arrow.get(data['timeseries_start'])
        seconds_after = (step * len(data['timeseries']))
        start, end = start_time.span('second', count=seconds_after)

        # Build timeseries graph
        render_matplotlib_png(router['id'], data['timeseries'], start, end,
                              step)
    return


if __name__ == '__main__':
    sp_leader = 'leader.example.com'
    api_key = 'JskW5QLVUMkNn4ruVwXOM0hQdyXCtOwnpkOjOev4'
    print("Getting traffic data for alert {} ...".format(ALERT_ID))
    # get router traffic timeseries
    router_traffic = get_alert_traffic_data_router(sp_leader, api_key, ALERT_ID)
    print("Rendering graph PNGs...")
    graph_timeseries_data_per_router(router_traffic)
    print("Done.")

{
    "relationships": {
        "packet_size_distribution": {
            "data": {
                "id": "packet-size-distribution-<alert_id>",
                "type": "alert_packet_size_distribution"
            },
            "links": {
                "related": "https://spleader.example.com/api/sp/v4/alerts/<alert_id>/packet_size_distribution"
            }
        },
        "patterns": {
            "links": {
                "related": "https://spleader.example.com/api/sp/v4/alerts/<alert_id>/patterns/"
            }
        },
        "router_traffic": {
            "links": {
                "related": "https://spleader.example.com/api/sp/v4/alerts/<alert_id>/router_traffic/"
            }
        },
        "source_ip_addresses": {
            "data": {
                "id": "source-ip-addresses-<alert_id>",
                "type": "alert_source_ip_addresses"
            },
            "links": {
                "related": "https://spleader.example.com/api/sp/v4/alerts/<alert_id>/source_ip_addresses"
            }
        },
        "thresholds": {
            "links": {
                "related": "https://spleader.example.com/api/sp/v4/alerts/<alert_id>/misuse_types_thresholds/"
            }
        },
        "traffic": {
            "data": {
                "id": "alert-traffic-<alert_id>",
                "type": "alert_traffic"
            },
            "links": {
                "related": "https://spleader.example.com/api/sp/v4/alerts/<alert_id>/traffic"
            }
        }
    }
}

{
    "included": [
        {
            "relationships": {
                "router": {
                    "data": {
                        "type": "router",
                        "id": "<router_id>"
                    },
                    "links": {
                        "related": "<link_to_router>"
                    }
                },
                "parent": {
                    "data": {
                        "type": "alert",
                        "id": "<alert_id>"
                    },
                    "links": {
                        "related": "<alert_id_url>"
                    }
                }
            },
            "attributes": {
                "content": "<alert_pattern_data>"
            },
            "type": "alert_patterns",
            "id": "<alert_id>-router:<router_id+cidr_port",
            "links": {
                "self": "<self_link>"
            }
        },
        {
                "router": {
                    "data": {
                        "type": "router",
                        "id": "<router_id>"
                    },
                    "links": {
                        "related": "<link_to_router>"
                    }
                },
                "parent": {
                    "data": {
                        "type": "alert",
                        "id": "<alert_id>"
                    },
                    "links": {
                        "related": "<alert_id_url>"
                    }
                }
            "type": "alert_patterns",
            "id": "<alert_id>-router:<router_id+cidr_port",
            "links": {
                "self": "<self_link>"
            }
        }
    ]
}

#!/usr/bin/env python
"""An example program that collects data on alerts and plots radar (or
spider) plots with that data

This makes use of the expanded alert data that was added in SP 8.4 APIv4

"""
from __future__ import print_function
import requests
import sys
import matplotlib.pyplot as plt
import pandas as pd
from math import pi, ceil

LEADER = 'spleader.example.com'
APITOKEN = 'mYsEcReTkEy007'
PER_PAGE = 12
ONGOING = True
INCLUDE = ['source_ip_addresses']
FILTER = 'filter=/data/attributes/alert_class=dos'
RADAR_FIELDS = ['impact_bps', 'impact_pps', 'severity_percent',
                'misuse_types', 'source_ips']


def get_alerts(leader, apitoken, per_page, ongoing, include):
    """Return alerts and included data

    Fetch `per_page` alerts via the API provided by `leader` using
    `apitoken`.  If `ongoing` is true, only get ongoing alerts.  If
    there are elements in the `include` list, include those in the
    output making use of the `include` URL parameter to retrieve that
    data in one HTTP GET request
    """

    url = 'https://{}/api/sp/alerts/?perPage={}&{}'.format(
        leader, per_page, FILTER
    )
    if ONGOING:
        url += 'AND /data/attributes/ongoing=True'
    if include:
        url += '&include={}'.format(",".join(include))

    results = requests.get(
        url,
        headers={
            "X-Arbux-APIToken": apitoken,
            "Content-Type": "application/vnd.api+json"
        },
        verify="./certfile"
    )

    if results.status_code != requests.codes.ok:
        print ("Results: {} ({})".format(
            results.reason,
            results.status_code), file=sys.stderr)
        return None

    return (results.json())


def make_included_dictionary(alerts):
    """reorganize the data included with the alert

    extract the data from included into a dict of dicts that looks
    like:

        alert_1:
            included_field_1: list
            included_field_2: list
        alert_2:
            included_field_1: list
            included_field_2: list

    this is one recommended way of using `include`d data: put it into a
    dictionary by alert ID so later it can be easily related to the
    alert
    """
    included = dict()
    for alert in alerts['included']:
        id = alert['relationships']['parent']['data']['id']
        included[id] = dict()
        for type in alert['attributes']:
            included[id][type] = alert['attributes'][type]

    return included


def make_spiders(df):
    """Take a dataframe, produce a file called plot.pdf

    Use the data in the dataframe and turn it into an array of radar
    plots and write it to a file; with much thanks to
    https://python-graph-gallery.com/392-use-faceting-for-radar-chart/
    """
    max_cols = 3
    my_dpi = 96
    plt.figure(figsize=(1000/my_dpi, 1200/my_dpi), dpi=my_dpi)
    plt.subplots_adjust(left=0.125, bottom=0.1, right=0.9,
                        top=0.9, wspace=0.6, hspace=0.2)
    my_palette = plt.cm.get_cmap("Set2", len(list(df)))

    # number of variable
    categories = df.index
    N = len(categories)
    rows = ceil(float(len(list(df))) / max_cols)
    # print ("N: {}; rows: {}".format(N, rows))

    # What will be the angle of each axis in the plot? (we divide the
    # plot / number of variable)
    angles = [n / float(N) * 2 * pi for n in range(N)]
    angles += angles[:1]

    # loop starts here, probably
    row = 0
    for axkey in [str(m) for m in sorted([int(n) for n in df.keys()],
                                         reverse=True)]:
        # print ("{}: {}".format(
        #     axkey, df[axkey].values.flatten().tolist()))

        # Initialise the spider plot
        ax = plt.subplot(rows, max_cols, row+1, polar=True, )

        # If you want the first axis to be on top:
        ax.set_theta_offset(pi / 2)
        ax.set_theta_direction(-1)

        # Draw one axe per variable + add labels labels yet
        plt.xticks(angles[:-1], categories, color='grey', size=8)

        # Draw ylabels
        ax.set_rlabel_position(0)
        plt.yticks([20, 40, 60, 80, 100],
                   ["20", "40", "60", "80", "100"],
                   color="grey", size=7)
        plt.ylim(0, 100)

        # Ind1
        # values = df.loc[row].drop('group').values.flatten().tolist()
        values = df[axkey].values.flatten().tolist()
        values += values[:1]
        ax.plot(angles, values, color=my_palette(row),
                linewidth=2, linestyle='solid')
        ax.fill(angles, values, color=my_palette(row), alpha=0.4)

        # Add a title
        title = "Alert {}".format(axkey)
        plt.title(title, size=11, color=my_palette(row), y=1.1)

        row += 1

    plt.savefig('radar.pdf')


def get_radar_fractions(data):
    """ normalize data across the alert properties
    """
    maxval = dict()
    for alert_id in data:
        for key in data[alert_id].keys():
            if key not in maxval or data[alert_id][key] > maxval[key]:
                maxval[key] = data[alert_id][key]

    frac_data = dict()
    for alert_id in data:
        frac_data[alert_id] = dict()
        for key in data[alert_id].keys():
            frac_data[alert_id][key] = (float(data[alert_id][key]) /
                                        maxval[key]) * 100.
    return frac_data


def get_radar_data(alerts, fields):
    """given a list of alerts from the API and a list of fields extract
    the data from each field of each alert and put it into a
    dictionary with two sub-keys for each field: one with the raw
    value and one with the value relative to all of the others in the
    list

    """

    data = dict()

    included = make_included_dictionary(alerts)

    for alert in alerts['data']:
        alert_id = alert['id']
        data[alert_id] = dict()
        for field in fields:
            if field in alert['attributes']:
                data[alert_id][field] = alert['attributes'][field]
            elif field in alert['attributes']['subobject']:
                data[alert_id][field] = alert['attributes']['subobject'][field]
            elif alert_id in included and field in included[alert_id]:
                data[alert_id][field] = included[alert_id][field]
            else:
                data[alert_id][field] = 0
            # for alert attributes that are not values but are lists of things,
            # report the length of the list
            if type(data[alert_id][field]) is list:
                data[alert_id][field] = len(data[alert_id][field])

    return data


if __name__ == '__main__':

    print ("Retrieving alert data", file=sys.stderr)
    alerts = get_alerts(
        LEADER, APITOKEN, PER_PAGE, ONGOING, INCLUDE)

    if not alerts:
        print ("Did not retrieve any valid DoS "
               "alerts from most recent {} alerts".format(PER_PAGE),
               file=sys.stderr)
        sys.exit(0)

    print ("Processing radar data for {} alerts".format(
        len(alerts['data'])), file=sys.stderr)
    radar_data = get_radar_data(alerts, RADAR_FIELDS)

    radar_fractions = get_radar_fractions(radar_data)

    df = pd.DataFrame(radar_fractions)

    print ("Plotting radar data", file=sys.stderr)
    make_spiders(df)

    print ("Done")

#!/usr/bin/env python
""" Report on number of attacks by CIDR block

This program has some constants defined at the bottom of it that set the SP
Leader, the SP REST API Token for that leader, the path to the SSL certificate
file, the start and end times for finding alerts, and the netmask lengths for
IPv4 networks and IPv6 networks.

It then pages through the SP REST API's /alerts/ endpoint and collects
addresses from the alert information.  Those addresses are then collected in to
CIDR blocks and a simple table is printed.

"""

from __future__ import print_function
import ipaddress
import requests
import sys
from datetime import datetime


def iso8601_to_datetime(iso8601_string):
    """annoyingly, Python can produce but not read ISO8601 datestamps

    this function does some pretty dumb things to convert that format
    back into a Python datetime object
    """
    return datetime.strptime(
        iso8601_string.split('+')[0],
        '%Y-%m-%dT%H:%M:%S')


def get_attacked_addresses(leader, token, cert,
                           start, end,
                           page=1, addrs=[]):
    """Get the `host_address` field from alerts between start and end

    Page through the `/alerts/` endpoint and gather up the
    `host_address` addresses into a list, this function calls itself
    until the last alert in the list started before the `start` time
    """

    url = 'https://{}/api/sp/v2/alerts/?page={}'.format(leader, page)
    start_dt = iso8601_to_datetime(start)
    end_dt = iso8601_to_datetime(end)

    r = requests.get(url,
                     headers={
                         "X-Arbux-APIToken": token,
                         "Content-Type": 'application/vnd.json+api'
                         },
                     verify=cert)

    if r.status_code is not requests.codes.ok:
        print("API request for alerts returned {} ({})".format(
            r.reason, r.status_code), file=sys.stderr)
        return None

    alerts = r.json()

    for alert in alerts['data']:
        if 'attributes' in alert and 'subobject' in alert['attributes']:
            if 'host_address' in alert['attributes']['subobject']:
                alert_time = iso8601_to_datetime(
                    alerts['data'][-1]['attributes']['start_time']
                    )
                if alert_time > start_dt and alert_time < end_dt:
                    addrs.append(
                        alert['attributes']['subobject']['host_address']
                        )

    last_alert = iso8601_to_datetime(
        alerts['data'][-1]['attributes']['start_time'])
    if last_alert > start_dt:
        print ("paging to page {}; # addresses so far: {}".format(
            page+1, len(addrs)))
        get_attacked_addresses(leader, token, cert, start,
                               end, page+1, addrs)

    return addrs


def bundle_addresses(addrs, netmasks):
    """Use the ipaddress library to put addresses into CIDR blocks

    coerce the address into a CIDR block with the correct netmask for
    its IP version (4 or 6), and then put that CIDR into a dictionary
    where occurances are counted.  See
    https://github.com/phihag/ipaddress and/or `pip install ipaddress`
    """
    networks = {}
    for addr in addrs:
        addr = ipaddress.ip_address(addr)
        network = str(addr)+"/"+netmasks[str(addr.version)]
        network = ipaddress.ip_network(network, strict=False)
        if str(network) in networks:
            networks[str(network)] += 1
        else:
            networks[str(network)] = 1

    return networks


if __name__ == '__main__':
    SPLEADER = 'spleader.example.com'
    APITOKEN = 'MySecretAPItoken'
    CERTFILE = './certfile'

    START_DATE = '2018-05-23T12:00:00+00:00'
    END_DATE = '2018-05-23T23:00:00+00:00'

    IPv4_MASK = '24'
    IPv6_MASK = '116'

    addresses = get_attacked_addresses(SPLEADER,
                                       APITOKEN,
                                       CERTFILE,
                                       START_DATE,
                                       END_DATE)
    print ("# addresses found between {} and {}: {}".format(
        START_DATE,
        END_DATE,
        len(addresses)))

    cidrs = bundle_addresses(addresses, {'4': IPv4_MASK,
                                         '6': IPv6_MASK})

    print("{:>25}-+-{}".format("-"*25, "---------"))
    print("{:>25} | {}".format("Subnet", "# Attacks"))
    print("{:>25}-+-{}".format("-"*25, "---------"))
    for cidr in sorted(cidrs):
        print("{:>25} | {:>8}".format(cidr, cidrs[cidr]))

services aaa local apitoken generate mssp_user "mssp user - 26May2018"

#!/usr/bin/env python
"""Demonstrate different results depending on the user

The user of the API is identified by the token that is used, so with SP
configured with two different tokens for two different users may return
different data.  This example produces a simple report of alert types and
related managed objects for two diferent user, demonstrating the different
results for each user"""

from __future__ import print_function
import os
import sys
import requests



def get_some_alerts(leader, token, cert):
    """Get some alerts

    For the purposes of this demonstration, we will just get one page
    of alerts and return them as json"""

    url = 'https://{}/api/sp/alerts/?perPage=15'.format(leader)

    r = requests.get(url,
                     headers={
                         "X-Arbux-APIToken": token,
                         "Content-Type": 'application/vnd.json+api'
                         },
                     verify=cert)

    if r.status_code is not requests.codes.ok:
        print("API request for alerts returned {} ({})".format(
            r.reason, r.status_code), file=sys.stderr)
        return None

    return r.json()


def alert_report(alerts):
    """Print a summary of alerts

    The summary has IDs and types, and (if available) the misuse types
    """

    print_nl = False
    for alert in alerts['data']:
        print ("{}".format(alert['id']), end="")
        if 'alert_type' in alert['attributes']:
            print ("\t{}".format(
                alert['attributes']['alert_type']), end="")
        else:
            print_nl = True
        if ('subobject' in alert['attributes'] and
                'misuse_types' in alert['attributes']['subobject']):
            print ("\t{}".format(
                ", ".join(alert['attributes']['subobject']['misuse_types'])
                ))
        else:
            print_nl = True

        if print_nl:
            print("")

    return None


if __name__ == '__main__':
    SP_LEADER = os.getenv('SPLEADER')
    API_TOKEN = {}
    API_TOKEN['admin'] = os.getenv('ADMIN_TOKEN')
    API_TOKEN['mssp_user'] = os.getenv('MSSP_TOKEN')
    CERT_FILE = './certfile'
    for token in API_TOKEN:
        print ("Getting alerts for the {} account".format(token))
        alerts = get_some_alerts(SP_LEADER,
                                 API_TOKEN[token],
                                 CERT_FILE)
        if alerts is not None:
            alert_report(alerts)

from __future__ import print_function
import csv
import json
import requests  # version: 2.18.4
import sys

CERTFILE="../certfile"

def api_request(URL, key, body=None):
    """ Creates and makes a post request to an SP
    api service

    Args:
        URL: A URL including an SP leader and
             SP resource
        key: An api key generated on the given
             SP leader
        body: JSON formatted string to be supplied
              as the request's body

    Returns:
        'data' value of an SP api response
    """

    headers = {
        'X-Arbux-APIToken': key,
        'Content-Type': 'application/vnd.api+json'
    }

    api_response = requests.post(
        URL,
        data=body,
        headers=headers,
        verify=CERTFILE
    )

    try:
        api_response.raise_for_status()
    except requests.exceptions.HTTPError as err:
        print(
            'An HTTP {} Error Occured:{}'.format(
                str(err),
                api_response.text),
            file=sys.stderr
        )

        return api_response.json()

    try:
        return api_response.json()['data']
    except ValueError as err:
        return {}


def get_request_body(managed_object):
    """Map a row in a csv to a nested dictionary
    that SP will accept as a managed object

    Args:
        managed_object: flat dictionary from csv
        representing a single managed object

    Returns:
        Nested dictionary representing a
        managed object in SP

    """

    return {
        'data': {
            'attributes': {
                'name': managed_object['name'],
                'family': 'customer',
                'match_type': 'cidr_block',
                'match': managed_object['prefix'],
                'tags': ['api']
            },
            'relationships': {
                'mitigation_template': {
                    'data': {
                        'id': '2',
                        'type': 'mitigation_template'
                    }
                }
            }
        }
    }


def get_managed_objects_from_csv(filename):
    """ Get a handler for managed object data
    from a csv file

    Args:
        filename: path / name for a csv file
        containing managed_object configurations.
        The first line of the csv is a header,
        containing "name,prefix". Similarly,
        subsequent lines represent managed objects.
        E.g., "Wind,74.182.59.3/32".

    Returns:
        A generator returning managed objects in
        nested dict form
    """

    with open(filename) as listings:
        for row in csv.DictReader(listings):
            yield get_request_body(row)


def create_managed_object(leader, key, managed_object):
    """ Crafts and makes an api request to create
    an SP managed object

    Args:
        leader: hostname of an SP leader
        key: api key, as generated by the
             SP leader
        managed_object: nested dict representing
                        the managed_object being
                        created

    Returns:
        Id as string of new managed object, or
        None if request was unsuccessful
    """

    object_json = json.dumps(managed_object)

    response = api_request(
        'https://{}/api/sp/managed_objects/'.format(leader),
        key,
        object_json
    )

    if 'errors' in response:
        print(
            'Could not create managed object...',
            file=sys.stderr
        )
        return None

    return response["id"]


def commit_config(leader, key):
    """ Crafts and makes an api request to commit an
        SP configuration

    Args:
        leader: hostname of an SP leader
        key: api key, as generated by said SP leader

    Returns:
        boolean indicating the success of the
        operation
    """
    print ("Committing configuration.")
    commit_msg = json.dumps({
        'data': {
            'attributes': {
                'commit_log_message':
                    'Added managed objects to deployment via SP API'
            }
        }
    })

    response = api_request(
        'https://{}/api/sp/config/'.format(leader),
        key,
        commit_msg
    )

    if 'errors' in response:
        print(
            "Could not commit configuration...",
            file=sys.stderr
        )
        return False

    print("Committed configuration.")
    return True


def main():
    LEADER = "leader.example.com"
    KEY = "eFvokphdyGHA_M4oLlLtfDnlIf9bpjFnn0mWlDqw"

    for listing in get_managed_objects_from_csv('main.csv'):
        create_managed_object(LEADER, KEY, listing)

    commit_config(LEADER, KEY)


if __name__ == "__main__":
    main()

from __future__ import print_function
import sys
import requests  # version: 2.18.4
import json  # version: 2.0.9

CERT_FILE = './https_active.crt'


def api_request(URL, key, body=None):
    """ General function for making GET and PATCH requests

    Response codes falling within 'requests.codes.ok' are assumed
    to have completed successfully. Supplying the optional 'body'
    parameter will change the request type to PATCH.

    Args:
        URL: valid URL to make request to
        key: API key generated on the given SP leader
        body (optional): JSON formatted string containing
            patch body content

    Returns:
        'Data' keyvalue of a requests.Response object
    """

    headers = {'X-Arbux-APIToken': key,
               'Content-Type': 'application/vnd.api+json'}
    if body is None:
        api_response = requests.get(
            URL,
            headers=headers,
            verify=CERT_FILE)
    else:
        api_response = requests.patch(
            URL,
            data=body,
            headers=headers,
            verify=CERT_FILE)

    # Handle any API error responses
    if (api_response.status_code != requests.codes.ok):
        print("API responded with this error: \n{}".format(
            api_response.text),
            file=sys.stderr)
        return []

    # Convert the response to JSON and return it
    api_response = api_response.json()
    return api_response['data']


def get_appliances(leader, key):
    """Retrieve appliances from an SP leader

    Args:
        leader: SP leader from which the appliances exist
        key: API key generated on the given SP leader

    Returns:
        List of appliances from the SP leader
    """

    print("Retrieving appliances from {}".format(leader))

    # Craft the URL components
    APPLIANCE_URI = '/api/sp/devices/'
    URL = "https://" + leader + APPLIANCE_URI

    # Make the api request and return its results
    api_response = api_request(URL, key)
    return api_response


def set_limits(leader, key, appliances):
    """ Configure the provided appliances with limits

    Args:
        leader: SP leader from which the appliances exist
        key: API key generated on the given SP leader
        appliances: List of appliances
    """

    for appliance in appliances:
        LIMIT = 'metrics_items_tracked_per_day_limit'
        LIMIT_VALUE = 15
        if LIMIT not in appliance['attributes']:
            patch = {
                "data": {
                    "attributes": {
                        LIMIT: LIMIT_VALUE
                    }
                }
            }

            # Create a unique URL for the appliance
            DEVICE_URI = ("/api/sp/devices/{}".format(
                appliance['id']))
            URL = "https://" + leader + DEVICE_URI

            # PATCH the appliance
            api_response = api_request(URL, key, json.dumps(patch))

            # Handle any API response
            if api_response:
                print("Device {id}: {limit} configured".format(
                    id=appliance['id'], limit=LIMIT))
            else:
                print("Could not configure device {}".format(
                    appliance['id']),
                    file=sys.stderr)

        else:
            print("Device {id}: {limit} is already configured".format(
                id=appliance['id'], limit=LIMIT))


#####################
# Start the Program #
#####################


def main():
    SP_LEADER = 'leader.example.com'
    API_KEY = 'okw_TF2PLL20ojZ1ptzazGh6TPS0C2MlqpO3LDzv'

    print('Starting appliance-limiting script')
    appliances = get_appliances(SP_LEADER, API_KEY)
    if appliances:
        print('Appliances retrieved. Configuring limits')
        set_limits(SP_LEADER, API_KEY, appliances)

    print('Done')

if __name__ == "__main__":
    main()

[
    {
        "v4": "cust01_v4",
        "v6": "cust01_v6"
    },
    {
        "v4": "cust02",
        "v6": "cust02_v6"
    },
    {
        "v4": "cust03-4",
        "v6": "cust04"
    },
    {
        "v4": "cust-04",
        "v6": "cust6-04"
    },
    {
        "v4": "cust4-05",
        "v6": "cust6-05"
    }
]

#!/usr/bin/env python

"""show how to use the new keys / functionality provided by CoMO

Because MOs are a licensed quantity in SP, it can be helpful to make the best
possible use of the MOs, and with the Combined IPv4/IPv6 Managed Objects
available in SP8.4 MOs that were previously separate to support IPv4 and IPv6
match criteria can now be combined.

Look for IPv6 matches, determine that no functionality is lost, and produce the
JSON for a PATCH to cust02 to move the IPv6 stuff into it. (e.g., if cust02_v6
and cusot02 both exist, can they safely be merged? What would be new MO look
like?) Take a list of MOs that looks like:

     [
         {
             "v4": "cust01_v4",
             "v6": "cust01_v6"
         },
         {
             "v4": "cust02",
             "v6": "cust02_v6"
         },
         {
             "v4": "cust03-4",
             "v6": "cust04"
         },
         {
             "v4": "cust-04",
             "v6": "cust6-04"
         },
         {
             "v4": "cust4-05",
             "v6": "cust6-05"
         }
     ]

and see if the MOs tagged "v6" can be merged into the MO tagged v4 """

from __future__ import print_function
import json
import os
import sys
import requests
from copy import deepcopy


def get_mos(leader, apikey, certfile, page=1, mos=[]):
    """gather up all of the MOs on the deployment and return them"""

    url = "https://{}/api/sp/managed_objects/?page={}".format(
        leader, page)

    response = requests.get(
        url,
        headers={"X-Arbux-APIToken": apikey,
                 "Content-Type": "application/vnd.json+api"},
        verify=certfile)

    if response.status_code is not requests.codes.ok:
        print("API request for alerts returned {} ({})".format(
            response.reason, response.status_code),
            file=sys.stderr)
        return None

    response = response.json()

    mos = response['data']

    if 'next' in response['links']:
        print ("Getting page {} from the "
               "managed_objects endpoint".format(page+1))
        mos += get_mos(leader, apikey, certfile, page+1, mos)

    return mos


def get_mos_to_check(MOS_FILE):
    """Load the MOs to check from a file or print MO names

    Try to load the MOs from a JSON file called "./mos_to_check.json";
    if that file doesn't exist, then just print a list of MOs and
    exit.
    """
    if not os.path.isfile(MOS_FILE):
        msg = """
Please create a file called %s and populate it with
a JSON-formatted list of names of MOs to evaluate for
combining.
The list should look like:
[
    {
        "v4": "mo1_name_v4",
        "v6": "mo1_name_v6"
    },
    {
        "v4": "mo2_name_v4",
        "v6": "mo2_name_v6"
    }
]"""
        print (msg % (MOS_FILE))
        print ("Your MOs are:")
        for (t, n) in sorted(type_and_name):
            print ("{:<15} {}".format(t, n))

        sys.exit(0)

    # no error checking. live fast, leave a beautiful traceback
    with open(MOS_FILE, "rb") as f:
        mos_to_check = json.load(f)

    return mos_to_check


def get_type_and_name(mos):
    """parse the MO json from SP and return type and name for each one

    This is just for reporting to the console what is happening, and for
    some basic error checking
    """
    type_and_name = []
    for mo in mos:
        if 'match_type' in mo['attributes']:
            match_type = mo['attributes']['match_type']
            if (match_type == 'cidr_blocks' or
                    match_type == 'cidr_v6_blocks'):
                type_and_name.append([mo['attributes']['match_type'],
                                      mo['attributes']['name']])

    num_v6 = 0
    for (t, n) in type_and_name:
        if t == 'cidr_v6_blocks':
            num_v6 += 1

    return type_and_name, num_v6


def check_mos(mos, mos_to_check):
    """Make sure the MOs to check from the file actually exist"""
    mo_names = [mo['attributes']['name'] for mo in mos]

    matched_mos = []
    for mo in mos_to_check:
        if mo['v4'] in mo_names and mo['v6'] in mo_names:
            matched_mos.append(mo)
        else:
            print ('<'*70)
            print ("The following MO will not be evaluated "
                   "for combining because one ")
            print ("or both of the MO names is not configured "
                   "on the SP system.")
            print (json.dumps(mo, indent=4))
            print ('>'*70)

    return matched_mos


def index_mos_by_name(mos):
    """It is useful to have MOs indexed by name, so do that"""
    mos_by_name = {}
    for mo in mos:
        mos_by_name[mo['attributes']['name']] = mo

    return mos_by_name


def diff_mos(mos_by_name, mos_to_check):
    """Look for differences in pairs of v4 and v6 MOs

    The differences that will be highlighted are: 1. Different shared
    host detection sets; 2. Different family types

    You should be very careful to add other things to check here; this
    function is probably incomplete for your network and should be
    augmented to compare things between MOs that you need to make sure
    are OK to combine
    """

    results = {}
    for mo_name in mos_to_check:
        # Store results keys by combined MO names
        key = (mo_name['v4'], mo_name['v6'])
        if key not in results:
            results[key] = []
        # Check for matching family types
        if (mos_by_name[mo_name['v4']]['attributes']['family'] !=
                mos_by_name[mo_name['v6']]['attributes']['family']):
            results[key].append("Family types do not match")
        # Check for matching shared host detection sets
        v4_shds = mos_by_name[mo_name['v4']]['relationships'][
            'shared_host_detection_settings']['data']['id']
        v6_shds = mos_by_name[mo_name['v6']]['relationships'][
            'shared_host_detection_settings']['data']['id']
        if (v4_shds != v6_shds):
            results[key].append("Shared Host Detection Sets do not match")
        #
        # You will want to add other relevant checks here, to make sure that
        # your combined managed object makes sense in your network
        #
    return results


def combine_mos(mov4, mov6):
    """put v6 match values and v6 mit templs into cidr_block-match MO

    take the two MOs that can be combined and return the JSON for an MO
    that can be combined; create a name, comment, and tag that
    represents this, set the match values to all of the match values
    from both MOs, and set the v4/v6 auto/manual mitigation templates to
    the values from each of the initial MOs

    You should be very careful to add other things to combine here; this
    function is probably incomplete for your network and should be
    augmented to combine things between MOs that you need to make sure
    are needed in a combined managed object
    """
    mov4['attributes']['match'] += " " + mov6['attributes']['match']
    mov4['attributes']['name'] = "{} + {}".format(
        mov4['attributes']['name'],
        mov6['attributes']['name'])
    mov4['attributes']['description'] += " ---Combined Managed Object--- "
    mov4['attributes']['tags'].append("auto-combined")
    mov4['relationships']['mitigation_templates_manual_ipv6'] = (
        mov6['relationships']['mitigation_templates_manual_ipv6'])
    mov4['relationships']['mitigation_templates_auto_ipv6'] = (
        mov6['relationships']['mitigation_templates_auto_ipv6'])
    #
    # You will want to add other relevant combinaitions here, to make sure that
    # your combined managed object makes sense in your network
    #

    mo = {}
    mo['data'] = deepcopy(mov4)
    mo['data'].pop("links", None)
    mo['data'].pop("id", None)

    return mo


if __name__ == '__main__':

    LEADER = os.getenv('SPLEADER')
    APIKEY = os.getenv('SPAPIKEY')
    CERTFILE = './certfile'
    MOS_FILE = 'mos_to_merge.json'

    print("Collecting information on managed "
          "objects from {}.".format(LEADER))

    mos = get_mos(LEADER, APIKEY, CERTFILE)
    if mos is None:
        sys.exit(1)

    print ("There are {} MOs.".format(len(mos)))

    type_and_name, num_v6 = get_type_and_name(mos)

    if num_v6 == 0:
        print ("There aren't any IPv6 matches, so "
               "there is nothing to combine.")
        sys.exit(0)
    else:
        print ("There are {} out of {} MOs with CIDR matches "
               "that are IPv6 matches.".format(
                   num_v6, len(type_and_name)))

    mos_by_name = index_mos_by_name(mos)

    mos_to_check = get_mos_to_check(MOS_FILE)

    mos_to_check = check_mos(mos, mos_to_check)

    differences = diff_mos(mos_by_name, mos_to_check)

    uncombinable_mos = [mo for mo in differences if len(differences[mo]) > 0]
    for mo in uncombinable_mos:
        print ("{}:".format(mo))
        for diff in differences[mo]:
            print ("  - {}".format(diff))

    mos_to_combine = [mo for mo in differences if len(differences[mo]) == 0]

    print ("MOs that can be combined: {}".format(mos_to_combine))

    combined_mo = {}
    for mo in mos_to_combine:
        combined_mo[mo] = combine_mos(
            mos_by_name[mo[0]],
            mos_by_name[mo[1]])
        for name in mo:
            print ('DELETE http://{}/api/sp/managed_objects/{}'.format(
                LEADER,
                mos_by_name[name]['id']
                ))
        print ('POST http://{}/api/sp/managed_objects << \n{}'.format(
            LEADER,
            json.dumps(combined_mo[mo], indent=4)))

from __future__ import print_function
from datetime import datetime, timedelta
from sys import stderr
import requests
import json
import urllib

CERT_FILE = './certfile'


def api_request(URL, key, body=None):
    """Define a function for making API GET
    Requests If body is supplied,
    request type will be POST

    """

    api_response = None
    if body is None:
        api_response = requests.get(
            URL,
            headers={'X-Arbux-APIToken':
                     key,
                     'Content-Type':
                     'application/vnd.api+json'},
            verify=CERT_FILE)
    else:
        api_response = requests.post(
            URL,
            data=body,
            headers={'X-Arbux-APIToken':
                     key,
                     'Content-Type':
                     'application/vnd.api+json'},
            verify=CERT_FILE)

    # Handle any API error responses
    if (api_response.status_code < requests.codes.ok or
            api_response.status_code >= requests.codes.multiple_choices):
        print("API responded with this error: \n{}"
              .format(
                  api_response.text),
              file=stderr)

        return []

    # Convert the response to JSON and return it
    api_response = api_response.json()
    return api_response['data']


def get_alerts(leader, key, period):
    """Define a function for retrieving
    alerts from an SP Leader

    """

    timefmt = '%a %b %d %H:%M:%S %Y'
    time = period.strftime(timefmt)
    iso_time = period.isoformat()

    print("Fetching alerts from {} onwards"
          .format(time))

    # Craft the URL components, filtering
    # based on time period

    ALERT_URI = "/api/sp/alerts/?filter="
    FILTER = "/data/attributes/start_time > " + iso_time

    # Percent-encode our filter query and combine URL components
    FILTER = urllib.quote(FILTER, safe='')
    URL = "https://" + leader + ALERT_URI + FILTER

    # Make the api request and return its results
    api_response = api_request(URL, key)
    return api_response


def apply_rules(alerts):
    """Define a function for filtering
    alerts based on rules

    """

    filtered_alerts = []

    # Return alerts that match the following rules:
    # Importance = High, Ongoing = True, Alert Type = DOS
    for alert in alerts:
        attributes = alert['attributes']
        if (attributes['importance'] == 2 and
                attributes['ongoing'] is True and
                attributes['alert_type'] == 'dos_host_detection'):
            filtered_alerts.append(alert)

    print("{} alert(s) match mitigation criterion"
          .format(len(filtered_alerts)))
    return filtered_alerts


def extract_mitigation_attr(alert):
    """Define a function for extracting
    mitigation attributes from alerts

    """

    # Configure mitigation information for the current alert
    name = "Alert {} Auto-API-Mitigation".format(
        alert['id'])
    description = "Mitigation triggered by script via REST API"
    ongoing = True
    ip_version = alert['attributes']['subobject']['ip_version']
    protection_cidr = '/32'
    if ip_version == 6:
        protection_cidr = '/128'
    subobject = {
        'bgp_announce': False,
        'protection_prefixes':
            [alert['attributes']['subobject']['host_address'] +
             protection_cidr]
    }
    subtype = 'tms'
    attributes = {
        "name": name,
        "description": description,
        "ongoing": ongoing,
        "ip_version": ip_version,
        "subobject": subobject,
        "subtype": subtype
    }

    return attributes


def mitigate(leader, key, alerts):
    """Define a function for mitigating alerts"""

    mitigations = []
    # Create a POST body for each mitigation to make
    for alert in alerts:
        attributes = extract_mitigation_attr(alert)
        post = {
            "data": {
                "attributes": attributes,
                "alert": {
                    "data": {
                        "id": alert['id'],
                        "type": "alert"
                    }
                },
                "relationships": {
                    "tms_group": {
                        "data": {
                            "id": "3",
                            "type": "tms_group"
                        }
                    }
                }
            }
        }
        mitigations.append(post)

    MIT_URI = '/api/sp/mitigations/'
    URL = "https://" + leader + MIT_URI
    # POST mitigations for each POST body created
    for mitigation in mitigations:
        api_response = api_request(URL,
                                   key,
                                   json.dumps(mitigation))

        # Handle any API responses
        if len(api_response) > 0:
            print("{} started"
                  .format(mitigation['data']['attributes']['name']))
        else:
            print("Could not start mitigation: {}"
                  .format(mitigation['data']['attributes']['name']))

###################
# Start the program #
###################
SP_LEADER = 'leader.example.com
API_KEY = 'viZqKYlEPKSWSpvzftr3Bs8Lqu_7u7_l8yiwxaD9'

TIMEFRAME = datetime.now() - timedelta(minutes=15)

print("Starting auto-mitigation script")
alerts = get_alerts(SP_LEADER, API_KEY, TIMEFRAME)
if len(alerts) > 0:
    print("Alerts retrieved. Filtering on configured ruleset")
    target_alerts = apply_rules(alerts)

    if len(target_alerts) > 0:
        print("Mitigating alerts")
        mitigate(SP_LEADER, API_KEY, target_alerts)
        print("Done")
else:
    print("No alerts were found in the requested period")

{
    "meta": {
        "sp_version": "8.3",
        "api": "SP",
        "api_version": "3",
        "sp_build_id": "HIT4"
    },
    "data": [
        {
            "attributes": {
                "text": "Impact on boundary 'rtr1.nyc'; Impact in bps: 10558611; Impact in pps: 1707;",
                "added": "2017-09-25T19:34:12+00:00",
                "author": "API-Client"
            },
            "type": "alert_annotation",
            "id": "21168"
        },
        {
            "attributes": {
                "text": "Impact on boundary 'rtr1.nyc'; Impact in bps: 10558611; Impact in pps: 1707;",
                "added": "2017-09-25T19:33:34+00:00",
                "author": "API-Client"
            },
            "type": "alert_annotation",
            "id": "21157"
        },
        {
            "attributes": {
                "text": "The \"TCP NULL\" host alert signature severity rate configured for \"Customer\" has been exceeded for 2 minutes, changing Severity Level from medium to high  (expected rate: 1.00 Kpps, observed rate: 1.70 Kpps)",
                "added": "2017-09-25T19:18:45+00:00",
                "author": "auto-annotation"
            },
            "type": "alert_annotation",
            "id": "21155"
        }
    ],
    "links": {
        "self": "https://leader.example.com/api/sp/v3/alerts/8067/annotations/"
    }
}

from __future__ import print_function
from datetime import datetime, timedelta
import sys
import requests  # version: 2.18.4
import json  # version: 2.0.9
import urllib  # version: 1.17

CERT_FILE = './https_active.crt'


def api_request(URL, key, body=None):
    """ General function for making GET and POST requests

    Response codes falling within 'requests.codes.ok' are assumed
    to have completed successfully. Supplying the optional 'body'
    parameter will change the request type to POST.

    Args:
        URL: valid URL to make request to
        key: API key generated on the given SP leader
        body (optional): JSON formatted string containing
            post body content

    Returns:
        'Data' keyvalue of a requests.Response object
    """

    headers = {'X-Arbux-APIToken': key,
               'Content-Type': 'application/vnd.api+json'}
    if body is None:
        api_response = requests.get(
            URL,
            headers=headers,
            verify=CERT_FILE)
    else:
        api_response = requests.post(
            URL,
            data=body,
            headers=headers,
            verify=CERT_FILE)

    # Handle any API error responses
    if (api_response.status_code != requests.codes.ok):
        print("API responded with this error: \n{}".format(
            api_response.text),
            file=sys.stderr)
        return []

    # Convert the response to JSON and return it
    api_response = api_response.json()
    return api_response['data']


def get_alerts(leader, key):
    """ Retrieve alerts from an SP leader

    Args:
        leader: SP leader from which the alerts originated
        key: API key generated on the given SP leader

    Returns:
        List of impact data containing alerts
    """

    print("Fetching ongoing alerts from {}".format(leader))

    # Craft the URL components, filtering based on ongoing dos alerts
    ALERT_URI = '/api/sp/alerts/?filter='
    FILTER = ("/data/attributes/ongoing = true AND " +
              "/data/attributes/alert_class = dos")

    # Percent-encode our filter query and combine URL components
    FILTER = urllib.quote(FILTER, safe='')
    URL = "https://" + leader + ALERT_URI + FILTER

    # Make the api request and return its results
    api_response = api_request(URL, key)
    return api_response


def create_annotation_msg(impact_data):
    """ Create an annotation message for impact data

    Args:
        impact_data: dict containing impact data in the form of,
        {
            'bps': bps,
            'pps': pps,
            'impact_boundary (optional)': boundary
        }

    Returns:
        String describing alert impact
    """

    # Add impact rates to annotation message
    msg = ("Impact in bps: {impact_bps}; " +
           "Impact in pps: {impact_pps};").format(
        impact_bps=impact_data['bps'],
        impact_pps=impact_data['pps'])

    # If alert data contains boundary info, include that as well
    if 'boundary' in impact_data:
        msg = ("Impact on boundary '{}'; {}").format(
            impact_data['boundary'],
            msg)

    return msg


def extract_impact_info(alert):
    """ Extract impact information from an alert

    Args:
        alert: alert in dict form that contains impact data

    Returns:
        dict containing impact data in the form of,
        {
            'bps',
            'pps',
            'impact_boundary' (depending on alert)
        }
    """

    # Pull impact information out of alert data
    attributes = alert['attributes']
    impact = {
        'bps': attributes['subobject']['impact_bps'],
        'pps': attributes['subobject']['impact_pps']
    }

    if 'impact_boundary' in attributes['subobject']:
        impact['boundary'] = attributes['subobject']['impact_boundary']

    return impact


def annotate(leader, key, alerts):
    """ Annotate a series of alerts from a given SP leader

    Each alert is annotated with its own impact data

    Args:
        leader: SP leader from which the alerts originated
        key: API key generated on the given SP leader
        alerts: list of impact data containing alerts to be annotated
    """

    print("Annotating {} ongoing alerts with impact data".format(
        len(alerts)))

    for alert in alerts:

        # Create the POST body for each annotation
        impact = extract_impact_info(alert)
        msg = create_annotation_msg(impact)
        post = {
            "data": {
                "attributes": {
                    "author": "API-Client",
                    "text": msg
                }
            }
        }

        # Create a unique URL for each annotation
        # Each one must reference the alert from which impact data
        # is being retreived
        ALERT_URI = ("/api/sp/alerts/{}/annotations/").format(
            alert['id'])
        URL = "https://" + leader + ALERT_URI

        # POST annotation
        api_response = api_request(
            URL, key, json.dumps(post))

        # Handle any API response
        if api_response:
            print("Alert {} annotated".format(
                alert['id']))
        else:
            print("Could not annotate Alert {}".format(
                alert['id']),
                file=sys.stderr)


#####################
# Start the Program #
#####################


def main():
    SP_LEADER = 'leader.example.com'
    API_KEY = 'okw_TF2PLL20ojZ1ptzazGh6TPS0C2MlqpO3LDzv'

    print('Starting auto-annotation script')
    alerts = get_alerts(SP_LEADER, API_KEY)
    if alerts:
        print('Alerts retrieved. Auto-annotating impact data')
        annotate(SP_LEADER, API_KEY, alerts)

    print('Done')

if __name__ == "__main__":
    main()

{
    "start": "<start>",
    "end": "<end>",
    "dimensions": [
        "IP_Protocol",
        "Source_IPv4_Address",
        "Source_Port",
        "Destination_IPv4_Address",
        "Destination_Port"
    ],
    "limit": "<num_records>",
    "perspective": "<perspective>",
    "view": "<view>"
}

"filters": {
    "fields": [
        {
            "facet": "Destination_Port",
            "type": "selector",
            "value": "80"
        },
        {
            "facet": "Destination_Port",
            "type": "selector",
            "value": "443"
        }
    ],
    "type": "or"
}

from __future__ import print_function
import argparse
import requests
import json
import sys
from datetime import datetime
from dateutil.parser import parse


def parse_cmdline_args():
    """Parse the command line options and set some useful defaults"""
    parser = argparse.ArgumentParser(
        description='Download raw flows from SP Insight to a CSV file',
        formatter_class=argparse.ArgumentDefaultsHelpFormatter)
    parser.add_argument(
        '-s', '--start_time',
        dest='start',
        required=True,
        help='Start date and time for rawflows')
    parser.add_argument(
        '-e', '--end_time',
        dest='end',
        required=True,
        help='End date and time for rawflows')
    parser.add_argument(
        '-l', '--sp_leader',
        dest='leader',
        required=True,
        help='Hostname or IP address of the SP leader')
    parser.add_argument(
        '-k', '--api_key',
        dest='apikey',
        required=True,
        help='SP REST API key for the leader')
    parser.add_argument(
        '-n', '--number_of_raw_flow_records',
        type=int,
        default=5000,
        dest='num_records',
        help='Maximum number of raw flows records to return')
    parser.add_argument(
        '-p', '--perspective',
        default='network',
        dest='perspective',
        help='Perspective from which to get the raw flows')
    parser.add_argument(
        '-v', '--view',
        default='Network',
        dest='view',
        help='View from which to get the raw flows')
    parser.add_argument(
        '-o', '--output_file',
        default='raw_flows.csv',
        dest='output_file',
        help='Path and filename for rawflows CSV data')
    parser.add_argument(
        '-c', '--cert_file',
        default='/Users/acaird/certfile',
        dest='certfile',
        help='Path to and name of the SSL certificate file')

    return parser.parse_args()


if __name__ == '__main__':

    args = parse_cmdline_args()

    leaderurl = 'https://{}/api/sp/insight/rawflows'.format(args.leader)

    # Use Python's parse/fuzzy date interpreter to try to get useful dates
    try:
        start = parse(args.start, fuzzy=True).isoformat()
        end = parse(args.end, fuzzy=True).isoformat()
    except ValueError:
        print ("ERROR: I couldn't parse the dates you provided ("
               "start: {}, end: {}), please try another format.".format(
                   args.start, args.end))
        sys.exit(1)

    query = {
        "start": start,
        "end": end,
        "dimensions": [
            "IP_Protocol",
            "Source_IPv4_Address",
            "Source_Port",
            "Destination_IPv4_Address",
            "Destination_Port"
        ],
        "limit": args.num_records,
        "perspective": args.perspective,
        "view": args.view
    }

    print ("  Querying {} for {} raw flows records between {} and {}...".
           format(
               args.leader,
               args.num_records,
               start,
               end))

    query_start = datetime.now()
    answer = requests.post(leaderurl,
                           headers={"X-Arbux-APIToken": args.apikey,
                                    "Content-Type": "application/vnd.api+json",
                                    "Accept": "text/csv"},
                           data=json.dumps(query), verify=args.certfile,
                           stream=True)
    query_end = datetime.now()
    with open(args.output_file, "wb") as f:
        for i, chunk in enumerate(answer.iter_content(chunk_size=262144)):
            print ("  Writing chunk #{} to {}".format(i, args.output_file),
                   end='\r')
            f.write(chunk)

    write_end = datetime.now()

    # Print some timing information
    print ('')
    print ("Query time: {0:10.1f} seconds".format(
        ((query_end-query_start).total_seconds())))
    print ("Write time: {0:10.1f} seconds".format(
        ((write_end-query_end).total_seconds())))
    print ("Total time: {0:10.1f} seconds".format(
        ((write_end-query_start).total_seconds())))

python download-insight-rawflows.py -s 2018-22-03 -e 2018-04-24 \
       -l leader.example.com \
       -k MySecretAPIkey \
       -n 1000000

{
    "limit": 10,
    "groupby": [
        "Source_IPv4_Address",
        "Source_Port",
        "Destination_Port",
        "Destination_IPv4_Address"
    ],
    "filters": {
        "type": "or",
        "fields": [
            {
                "type": "selector",
                "facet": "Destination_Port",
                "value": "80"
            },
            {
                "type": "selector",
                "facet": "Destination_Port",
                "value": "443"
            },
            {
                "type": "selector",
                "facet": "Destination_Port",
                "value": "25"
            },
            {
                "type": "selector",
                "facet": "Destination_Port",
                "value": "53"
            }
        ]
    },
    "start": "2018-05-20T16:44:00.000Z",
    "end": "2018-05-20T16:52:00.000Z",
    "view": "Network",
    "metric": "bps",
    "calculation": "average"
}

[
    {
        "Destination_IPv4_Address": "216.175.102.23",
        "Destination_Port": "80",
        "Source_IPv4_Address": "163.193.0.1",
        "Source_Port": "44456",
        "bps": {
            "average": {
                "in": 2500,
                "out": 0,
                "total": 2500
            }
        }
    },
    {
        "Destination_IPv4_Address": "216.175.102.23",
        "Destination_Port": "80",
        "Source_IPv4_Address": "163.193.0.2",
        "Source_Port": "45666",
        "bps": {
            "average": {
                "in": 500,
                "out": 0,
                "total": 500
            }
        }
    }
]

#!/usr/bin/env python
"""Produce a Sankey-like graph from Insight `topn` data using Graphviz dot

This program reads the environment variables `INSIGHT_PI` and `API_TOKEN`, then
contacts the Insight PI and runs a query against the `topn` endpoint to get
data that can be used to build the relationship between Source IP address,
Source Port, Destination Port, and Destination IP address with traffic flow
rates represented on each link.

The two non-standard Python packages required are:
  - requests; http://docs.python-requests.org/
  - networkx: https://networkx.github.io/

And you will need the `dot` package from Graphviz (http://graphviz.org/) to
convert the output of this script into a graphical representation of the
traffic """

from __future__ import print_function
import requests
import json
import networkx as nx
import sys
import os
from networkx.drawing.nx_pydot import write_dot


if __name__ == '__main__':
    # Set up some useful variables for keys and labels and hosts and tokens and
    # get the Insight PI And API Token from the shell environment (or you can
    # set them here if you want)
    insight_pi = os.getenv('INSIGHT_PI')
    api_token = os.getenv('API_TOKEN')
    relationships_lr = [
        "Source_IPv4_Address",
        "Source_Port",
        "Destination_Port",
        "Destination_IPv4_Address",
    ]
    labels_lr = ["Src IP", "Src Port", "Dst Port", "Dst IP"]

    # Set the query for our example; the limit is intentionally small, but can
    # be made larger
    query = {
        "limit": 25,
        "groupby": relationships_lr,
        "filters": {
            "type": "or",
            "fields": [
                {
                    "type": "selector",
                    "facet": "Destination_Port",
                    "value": "80"
                },
                {
                    "type": "selector",
                    "facet": "Destination_Port",
                    "value": "25"
                },
                {
                    "type": "selector",
                    "facet": "Destination_Port",
                    "value": "53"
                },
                {
                    "type": "selector",
                    "facet": "Destination_Port",
                    "value": "443"
                }
            ]
        },
        "start": "2018-05-20T16:44:00.000Z",
        "end": "2018-05-20T16:52:00.000Z",
        "view": "Network",
        "metric": "bps",
        "calculation": "average"
    }

    # create the URL for our Insight UI device
    url = 'https://{}/api/sp/insight/topn'.format(insight_pi)

    # POST the query and get the results
    r = requests.post(
        url,
        headers={
            "X-Arbux-APIToken": api_token,
            "Content-Type": 'application/json'
        },
        json=query,
        verify='./certfile')

    # make sure we got results, otherwise print what the error to the screen
    if r.status_code != requests.codes.ok:
        print(json.dumps(r.json()))
        sys.exit(1)

    # Convert the results to json
    rj = r.json()

    # Set up a directed graph using networkx
    G = nx.DiGraph()

    # Go through the results JSON and look at each key in it that is also in
    # the `relationships_lr` list, creating a FROM and a TO node, label them
    # with their type (from the `labels` list), create the edge between them
    # with either a new weight (traffic rate) or add to the existing weight
    # (traffic rate)
    node_shape = "box"
    for rel in rj['data']:
        for edge_num in range(len(relationships_lr)-1):
            from_ = (relationships_lr[edge_num] + "_" +
                     rel[relationships_lr[edge_num]])
            to = (relationships_lr[edge_num+1] + "_" +
                  rel[relationships_lr[edge_num+1]])
            G.add_node(from_, label="{}\n{}".format(
                labels_lr[edge_num],
                rel[relationships_lr[edge_num]]),
                shape=node_shape)
            G.add_node(to, label="{}\n{}".format(
                labels_lr[edge_num+1],
                rel[relationships_lr[edge_num+1]]),
                shape=node_shape)
            if G.has_edge(from_, to):
                G[from_][to]['weight'] += rel['bps']['average']['total']
            else:
                G.add_edge(from_, to, weight=rel['bps']['average']['total'])

    # compute the line widths based on the edge weights and the thickest
    # allowed line
    max_weight = max([G[e[0]][e[1]]['weight'] for e in G.edges])
    max_edge_width = 8
    for e in G.edges:
        G[e[0]][e[1]]['penwidth'] = max(
            1,
            int(((G[e[0]][e[1]]['weight']/max_weight)*max_edge_width)+0.5))
        G[e[0]][e[1]]['label'] = "{}bps".format(G[e[0]][e[1]]['weight'])
    # Set the graph to go left to right
    G.graph['graph'] = {'rankdir': 'LR'}
    # write out the graphviz/dot file to `thing.dot`
    write_dot(G, "./traffic-flow.dot")

    # print some information to the screen
    print ("Insight PI: {}".format(insight_pi))
    print ("There are {} things in the response".format(len(rj['data'])))
    print ("Start Time: {}".format(query['start']))
    print ("  End Time: {}".format(query['end']))

keytool -import -alias ca -file https_active.crt -keystore cacerts -storepass changeit

import java.io.BufferedReader;
import java.io.FileInputStream;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
import java.security.cert.CertificateException;
import java.security.KeyStore;
import java.security.SecureRandom;
import java.security.cert.X509Certificate;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;
import org.json.simple.JSONArray;  // json-simple-1.1.1.jar
import org.json.simple.JSONObject;  // json-simple-1.1.1.jar
import org.json.simple.parser.JSONParser;  // json-simple-1.1.1.jar


public class SystemEventClient {

    // Format to put data in table format based on how the UI presents the
    // information
    private static String alignFormat = "| %-4s | %-10s | %-20s | %-6s | %-7s | %-24s | %-24s | %-11s |%n";

    // Key to access the SP Leader
    private static String token = "bufFhFCg4f01z4iwLtvhtqhhHetVJlwyXdzlJeVl";

    /** Get annotation for given alert if it has one. */
    private static String get_annotation(JSONObject obj) throws Exception{
        // If the given alert has relationships
        JSONObject relationships = (JSONObject) obj.get("relationships");
        if(relationships != null) {
            JSONObject annotation_relationship = (
                (JSONObject) relationships.get("annotations"));

            // If there is a related annotation
            if(annotation_relationship != null) {
                String link = (String) ((JSONObject) (
                    annotation_relationship.get("links"))).get("related");

                // Query the related annotation's link
                JSONObject response = convert_to_json(request(link));
                JSONObject temp = (JSONObject) (
                    (JSONArray) response.get("data")).get(0);

                // Return the annotation
                return (String) ((JSONObject) temp.get("attributes")).get("text");
            }
        }

        // If there is no annotation return None
        return "None";
    }

    /** Parse JSON and print it according to how the UI presents it. */
    private static void print_ui(JSONObject json) throws Exception {
        // For each object in the array of results
        for (Object raw_json : (JSONArray) json.get("data")) {
            JSONObject obj = (JSONObject) raw_json;
            JSONObject attributes = (JSONObject) obj.get("attributes");

            // If the given alert is a System Event get information
            if((attributes.get("alert_class")).equals("system_event")) {
                String stop_time = "Ongoing";
                if(!(boolean) attributes.get("ongoing")) {
                    stop_time = (String) attributes.get("stop_time");
                }

                // Get the subobject for use getting the username and version
                JSONObject subobject = (
                    (JSONObject) attributes.get("subobject"));

                // Turn the given integer into a human-readable string for
                // importance
                String human_readable_importance[] = {"Low", "Medium", "High"};
                String string_importance = human_readable_importance[
                    (int) (long) attributes.get("importance")
                ];

                // Format results using alignFormat into table format
                System.out.format(alignFormat,
                    obj.get("id"),
                    string_importance,
                    "System Configuration Update",
                    subobject.get("username"),
                    subobject.get("version"),
                    attributes.get("start_time"),
                    stop_time,
                    get_annotation(obj));
            }
        }
    }

    /** Convert received content from connection to JSONObject. */
    private static JSONObject convert_to_json(HttpsURLConnection con) throws Exception {
        if (con == null || con.getResponseCode() != HttpsURLConnection.HTTP_OK) {
            return null;
        }

        // Get input from connection and parse it into json
        try (BufferedReader br = new BufferedReader(
                new InputStreamReader(con.getInputStream()))) {
            final JSONParser parser = new JSONParser();
            return (JSONObject) parser.parse(br);

        } catch (IOException e) {
            e.printStackTrace();
        }
        return null;
    }

    /** Create Empty Trust Manager. */
    private static class DefaultTrustManager implements X509TrustManager {
        @Override
        public void checkClientTrusted(X509Certificate[] arg0, String arg1)
            throws CertificateException {}

        @Override
        public void checkServerTrusted(X509Certificate[] arg0, String arg1)
            throws CertificateException {}

        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return null;
        }
    }

    /** Set up Https Connection with given SSL Certificate. */
    private static HttpsURLConnection request(String httpUrl) throws Exception {
        // Pass certificate to connection
        InputStream trustStream = new FileInputStream("./cacerts.jks");
        char[] password = null;
        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        trustStore.load(trustStream, password);

        // Set up TrustManager to pass to SSL Context
        TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(
            TrustManagerFactory.getDefaultAlgorithm());
        trustFactory.init(trustStore);
        TrustManager[] trustManagers = { new DefaultTrustManager() };

        // Set up SSL Context
        SSLContext sslContext = SSLContext.getInstance("SSL");
        sslContext.init(null, trustManagers, new SecureRandom());
        SSLContext.setDefault(sslContext);

        // Open Connection to given url
        URL url;
        try {
            url = new URL(httpUrl);
            HttpsURLConnection con = (
                (HttpsURLConnection) url.openConnection());

            // Pass API Token and type to accept to the connection
            con.setRequestProperty("X-Arbux-APIToken", token);
            con.setRequestProperty("Accept", "application/json");

            // Return connection
            return con;

        } catch (MalformedURLException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }
        return null;
    }

    /** Main: Trigger request for every page. */
    public static void main(String[] args) throws Exception {
        // Url to hit
        String httpUrl = "https://leader.example.com/api/sp/alerts/";

        // Print table headers
        System.out.format("+-------+------------+-----------------------------+--------+---------+---------------------------+---------------------------+-------------+%n");
        System.out.format("|  ID   | Importance |            Alert            |  User  | Version |        Start_Time         |        End_Time           | Annotations |%n");
        System.out.format("+-------+------------+-----------------------------+--------+---------+---------------------------+---------------------------+-------------+%n");

        // Loop through all pages of data
        HttpsURLConnection connection;
        JSONObject json;
        while (httpUrl !=  null) {
            // Make the query to the API with the given url
            connection = request(httpUrl);

            // Convert the response from the API into json
            json = convert_to_json(connection);

            // If there are no results break out of loop
            if (json == null) {
                break;
            }

            // Print the results formatted in table format
            print_ui(json);

            // Get `next` link if there is one in the pagination links (there
            // are more results)
            httpUrl = (String) ((JSONObject) json.get("links")).get("next");
        }

        // Print bottom of table
        System.out.format("+-------+------------+-----------------------------+--------+---------+---------------------------+---------------------------+-------------+%n");
    }
}

#!/usr/bin/env bash
#
# Grabs ongoing SP alerts from the last day and outputs in json form.
#
# Options:
#   -t: Output alerts in tsv form
#   -c: Output alerts in csv form
#

# current ISO date - 24 hours
DATE=`date -v-1d +%Y-%m-%dT%H:%M:%S%z`

LEADER="leader.example.com"
TOKEN="i9fESeDtZTnBRI_ruE76K_Zg2FdJRvtwapxkN1_t"
CERTFILE="../certfile"
QUERY_PARAMS="?filter=%2Fdata%2Fattributes%2Fongoing%3Dtrue+AND+%2Fdata%2Fattributes%2Fstart_time%3E$DATE"


# query SP for ongoing alerts from the past 24 hours and filter down to type,
# start time, and description.
JSON=$(
        curl --cacert $CERTFILE --ssl --silent -X GET \
                https://$LEADER/api/sp/alerts/$QUERY_PARAMS \
                -H "Content-Type: application/vnd.api+json" \
                -H "x-arbux-apitoken: $TOKEN" \
        | jq "[.data[]?.attributes | {\
                                        alert_type: .alert_type,\
                                        start_time: .start_time,\
                                        description: .subobject.description\
                                }]"
)


# gets a delimeter separated value form of the API return.
#
# Arguments:
#   $1: The original JSON response
#   $2: 'c' or 't', for comma or tab delimeted values
get_dsv () {
  echo $1 | jq -r "\
    [\"type\", \"start\", \"description\"], \
    (.[] | [.alert_type, .start_time, .description]) \
    | @${2}sv"
}


# Gather options passed in command line
while getopts ":tc" opt; do
        case $opt in
                [tc])
                        get_dsv "$JSON" $opt
                        exit 0
                        ;;
                \?)
                        echo "Invalid option: -$OPTARG" >&2
                        exit 2
                        ;;
        esac
done


# Simply return JSON if no options have been passed
echo "$JSON"

type    start   description
tms_fault       2017-09-22T16:26:26+00:00       Hardware Sensor 'Power Draw (PS2)' is 'Critical' (Triggering value: 0 Watts)
tms_fault       2017-09-22T16:25:26+00:00       Hardware Device 'Power Supply PS2' is 'Error' (Presence detected, Power Supply AC lost)
collector_down  2017-09-21T19:39:21+00:00

| Port Name | Port Type | TMS                   | TMS Model | TMS Deployment Type |
| tms0      | physical  | tms002                | TMS-2500  |                     |
| tms1      | physical  | tms002                | TMS-2500  |                     |
| tms2      | physical  | tms002                | TMS-2500  |                     |
| tms3      | physical  | tms002                | TMS-2500  |                     |
| tms4      | physical  | tms002                | TMS-2500  |                     |
| tms5      | physical  | tms002                | TMS-2500  |                     |
| tmsx0.0   | physical  | tms001                | TMS-3100  | inline              |
| tmsx0.1   | physical  | tms001                | TMS-3100  | inline              |

<?php

/**
 * Make an API request GET or POST (default method GET).
 *
 * @param[in] $url a URL including an SP leader and SP resource
 * @param[in] $key an api key used to access the SP api
 * @param[in] $body json post data if any
 * @param[in] $method HTTP method is GET by default
 *
 * @return json decoded response
 */
function makeRequest($url, $key, $body = false, $method = "GET") {
    // Initialize curl handle
    $curl = curl_init($url);

    // Set HTTP headers
    $headers = [
        "X-Arbux-APIToken: " . $key,
        "Content-Type: application/vnd.api+json"
    ];
    curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);

    // Set request type (GET/POST)
    curl_setopt($curl, CURLOPT_CUSTOMREQUEST, $method);
    if ($body) {
        curl_setopt($curl, CURLOPT_POSTFIELD);
    }
    // return result instead of outputting it.
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE);

    // use arbor cert
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, TRUE);
    curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2);
    curl_setopt($curl, CURLOPT_CAPATH, getcwd() . "/https_active.crt");

    // Grab result and close cURL session
    $result = curl_exec($curl);
    curl_close($curl);

    return json_decode($result, TRUE);
}

/**
 * Print a table of information about TMS ports
 */
function listTmsPortsInfo() {
    $api_key = 'JskW5QLVUMkNn4ruVwXOM0hQdyXCtOwnpkOjOev4';
    $sp_leader = 'https://leader.example.com/api/sp/tms_ports/';
    $json = makeRequest($sp_leader, $api_key);

    // Grab data from response and print table
    $table_format = "|%-10s |%-10.50s | %-25s | %-10s | %-20s |\n";
    printf(
        $table_format,
        'Port Name',
        'Port Type',
        'TMS',
        'TMS Model',
        'TMS Deployment Type'
    );

    foreach ($json['data'] as $tms_port) {
        $port_attributes = $tms_port['attributes'];
        $port_name = $port_attributes['name'];
        $port_type = $port_attributes['port_type'];
        // Use relationship link to get more information about the related TMS
        $tms_link = $tms_port['relationships']['tms']['links']['related'];
        $tms_json = makeRequest($tms_link, $api_key);
        $tms_attributes = $tms_json['data']['attributes'];
        $tms_name = $tms_attributes['name'];
        $tms_full_model = $tms_attributes['full_model'];
        $tms_deployment_type = $tms_attributes['deployment_type'];
        // Print data table
        printf(
            $table_format,
            $port_name,
            $port_type,
            $tms_name,
            $tms_full_model,
            $tms_deployment_type
        );
    }
}

listTmsPortsInfo();
?>

#include <curl/curl.h>
#include <jansson.h>
#include <stdio.h>
#include <string.h>

/*
 * Retrieve information on managed objects using the SP REST API and
 * print a table of some of the fields
 *
 * This program requires two libraries:
 *  - jansson from http://www.digip.org/jansson/
 *  - libcurl from https://curl.haxx.se/
 *  - compile about like:
 *    gcc -I ... -L ... mo-listing.c -l jansson -l curl -o molisting
 *    replacing "..." with the include and library paths for your
 *    system
 */

#define REPORT_WIDTH 92
#define IS_CHILD_STRLEN 4

struct curlMemoryStruct {
  char *memory;
  size_t size;
};

static json_t *load_json(char *);
static void print_mo_list(json_t *);
static void do_curl(struct curlMemoryStruct *,
                    const char *,
                    char *);
static size_t storeCurlData(void *, size_t,
                            size_t, void *);
static void extract_and_print(json_t *);
static void format_mo(json_t *, char *,
                      json_t *, json_t *);

/**
 * take a Jansson JSON data structure and print it out
 *
 * @param[in] json_t *root; the root of the Jansson data
 *
 */
static void print_mo_list(json_t *root) {
  json_t *data;
  size_t array_index;
  json_t *array_value;

  if (root == NULL) {
    fprintf(stderr, "[ERROR] No JSON data processed.\n");
    return;
  }
  data = json_object_get(root, "data");
  if (data == NULL) {
    fprintf(stderr, "[ERROR] No 'data' element in JSON from API\n");
    return;
  }

  if (json_typeof(data) == JSON_OBJECT) {
    extract_and_print(data);
  } else if (json_typeof(data) == JSON_ARRAY) {
    json_array_foreach(data, array_index, array_value) {
      extract_and_print(array_value);
    }
  }
  return;
}

/**
 * Pick out the parts of the managed object JSON structure that we
 * want and send them to the printing function.
 *
 * @param[in] json_t *mo; a JSON object from the SP REST API
 *                        representing a SP managed object
 *
 */
static void extract_and_print(json_t *mo) {
  json_t *name, *parent_name, *match_type, *match_value, *attributes;
  char is_child[10];

  attributes = json_object_get(mo, "attributes");
  if (attributes != NULL && json_typeof(attributes) == JSON_OBJECT) {
    name = json_object_get(attributes, "name");
    parent_name = json_object_get(attributes, "parent_name");
    if (parent_name != NULL) {
      strlcpy(is_child, "Yes", IS_CHILD_STRLEN);
    } else {
      strlcpy(is_child, "", IS_CHILD_STRLEN);
    }
    match_type = json_object_get(attributes, "match_type");
    match_value = json_object_get(attributes, "match");

    format_mo(name, is_child, match_type, match_value);
  }
}

/**
 * Print the name, child status, match type, and match value of a
 * managed object in a formatted way.
 *
 * @param[in] json_t *name; a Jansson json_t with the name of the MO
 * @param[in] char *is_chile; a string that is "Child" or ""
 * representing whether or not the MO is a child MO
 * @param[in] json_t *match_type; a Jansson json_t with the match
 * type setting for the MO
 * @param[in] json_t *match_value; a Jansson json_t with the match
 * value for the MO
 */
static void format_mo(json_t *name, char *is_child, json_t *match_type,
               json_t *match_value) {
  printf("| %25.25s | ", json_string_value(name));
  printf("%6.6s | ", is_child);
  printf("%15.15s | ", json_string_value(match_type));
  printf("%33.33s | ", json_string_value(match_value));
  printf("\n");
}

/**
 * The callback function for storing data retrieved via
 * curl_easy_perform()
 *
 * this is pretty much taken exactly from
 * https://curl.haxx.se/libcurl/c/getinmemory.html, as suggested by
 * the man pages for these two `CURLOPT_` parameters
 *
 * @param[in] void *content; a pointer to the cURL data structure
 * @param[in] size_t size; size information of the retrieved data
 * @param[in] size_t nmemb; size information of the retrieved data
 * @param[in] void *userp; what the cURL docs say to have
 * @param[out] size_t realsize; the size of the data successfully
 * stored
 */
static size_t storeCurlData(void *contents, size_t size, size_t nmemb, void *userp) {
  size_t realsize = size * nmemb;
  struct curlMemoryStruct *mem = (struct curlMemoryStruct *)userp;

  /* Make space in our char struct element for the new contents. */
  mem->memory = realloc(mem->memory, mem->size + realsize + 1);
  if (mem->memory == NULL) {
    fprintf(stderr, "[ERROR] Not enough memory to store data "
            "from cURL (realloc returned NULL)\n");
    return 0;
  }

  /*
   *  Put the data in `contents` into our char struct element to save
   * it for later, and update the size of the overall struct
   */
  memcpy(&(mem->memory[mem->size]), contents, realsize);
  mem->size += realsize;
  mem->memory[mem->size] = 0;

  return realsize;
}

/**
 * Make the HTTP request to the API endpoint.
 *
 * @param[in] curlMemoryStruct *chunk; the cURL memory for the
 * results
 * @param[in] const char *url; the URL to retrieve
 * @param[in] char *api_key; the API key string, including the
 * "X-Arbux-Token" component
 *
 */
void do_curl(struct curlMemoryStruct *chunk, const char *url, char *api_key) {
  struct curl_slist *list = NULL;
  CURLcode results;
  CURL *curl;

  curl = curl_easy_init();

  if (curl) {
    /* Set the URL we want to retrieve. */
    curl_easy_setopt(curl, CURLOPT_URL, url);

    /* Add to the list that we'll use as headers. */
    list = curl_slist_append(list, api_key);

    /* Set the headers to be the things in the list we made. */
    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, list);

    /* Point to an Arbor certificate file */
    curl_easy_setopt(curl, CURLOPT_CAINFO,
                     "./certfile");

    /*
     * Set the callback function and the data structure for the data,
     * this is pretty much taken exactly from
     * https://curl.haxx.se/libcurl/c/getinmemory.html, as suggested
     * by the man pages for these two `CURLOPT_` parameters
     */
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, storeCurlData);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)chunk);

    /* Do the HTTP GET. */
    results = curl_easy_perform(curl);

    /* Clean everything up. */
    curl_slist_free_all(list);
    curl_easy_cleanup(curl);

    /* Print the curl return code integer if there is an error. */
    if (results != CURLE_OK) {
      fprintf(stderr,
              "\n[ERROR] cURL return status: `%s' (%d)\n",
              curl_easy_strerror(results),
              results);
    }
  }

  return;
}

int main() {
  json_t *rootOfJsonTree, *links;
  json_error_t error;
  const char *url =
      "https://leader.example.com/api/sp/managed_objects/?perPage=15";
  char *apikey = "X-Arbux-APIToken:eFvokphdyGHA_M4oLlLtfDnlIf9bpjFnn0mWlDqw";
  struct curlMemoryStruct dataFromCurl;
  json_t *meta, *api_version, *sp_version;

  printf("| %25.25s | ", " Name ");
  printf("%6.6s | ", "Child?");
  printf("%15.15s | ", " Match Type ");
  printf("%33.33s | ", " Match Values ");
  printf("\n");
  for (int i = 0; i < REPORT_WIDTH; i++) {
    printf("-");
  }
  printf("\n");

  while (url != NULL) {

    /*
     * The memory element will be increased as the data from curl is
     * retrieved, so 1 byte is sufficient for now.
     */
    dataFromCurl.memory = malloc(1);
    /* We don't have any data at this point, so the size is 0. */
    dataFromCurl.size = 0;

    do_curl(&dataFromCurl, url, apikey);

    /*
     * Take the JSON returned from curl and parse it into a Jansson
     * data structure.
     */
    if (dataFromCurl.size < 1) {
      fprintf(stderr, "[ERROR] No data was returned from cURL, exiting.\n");
      exit(1);
    }
    rootOfJsonTree = json_loads(dataFromCurl.memory, 0, &error);
    if (rootOfJsonTree == NULL) {
      fprintf(stderr, "[ERROR] JSON decode error message: %s\n",
              error.text);
      exit(1);
    }
    /*
     * Do something with the results; in this case, just print them
     * out; storing them for later processing is also a good idea.
     */
    print_mo_list(rootOfJsonTree);
    /*
     * Check for more data to get by looking for the 'next' key in the
     * 'links' section.
     */
    links = json_object_get(rootOfJsonTree, "links");
    if (links == NULL) {
      fprintf(stderr, "[ERROR] The 'links' element in the "
              "returned JSON is null\n");
      url = NULL;
    } else {
      url = json_string_value(json_object_get(links, "next"));
    }
  }
  /*
   * Print a table footer and the version of the SP API that was
   * used.
   */

  meta = json_object_get(rootOfJsonTree, "meta");
  api_version = json_object_get(meta, "api_version");
  sp_version = json_object_get(meta, "sp_version");
  for (int i = 0; i < REPORT_WIDTH; i++) {
    printf("-");
  }
  printf("\n");
  printf("%80s SP%s/APIv%s\n",
         "SP REST API version:", json_string_value(sp_version),
         json_string_value(api_version));
  /*
   * Free (or at least decrement the references to) the json data
   * structure.
   */
  json_decref(rootOfJsonTree);
  exit(0);
}

#! /usr/bin/env node

// Requires a node version of at least 8.4.0

// This NodeJS program uses the SP REST API to configure a
// DNS Filter List built from a DNS zone transfer initiated
// by SP.

// The four `const`s `LEADER`, `API_TOKEN`, `NAMESERVER`,
// and `DNS_ZONE` should be changed to match your environment.


'use strict';

const https = require('https');
const fs = require('fs');

const LEADER = 'arbor.example.com';
const API_TOKEN = 'my_SeCrEt_ApI_ToKeN';
const NAMESERVER = 'nameserver.example.com';
const DNS_ZONE = 'zone-to-block.example.com';

/*
 * Wrap https.request to make API calls a bit simpler
 */
class HttpsClient {
  constructor(leader, apiToken) {
    this.leader = leader;
    this.apiToken = apiToken;
  }

  _craftOptions(method, endpoint, headers = {}) {
    return {
      hostname: this.leader,
      port: 443,
      method: method.toUpperCase(),
      path: `/api/sp/${endpoint}`,
      ca: [ fs.readFileSync('path/to/certfile') ],
      headers: {
        'X-Arbux-APIToken': this.apiToken,
        ...headers
      }
    }
  }

  _makeRequest(options, body) {
    return new Promise((resolve, reject) => {
      let responseData = '';

      const request = https.request(options, res => {
        res.setEncoding('utf-8');

        res.on('data', chunk => {
          responseData += chunk.toString();
        });

        res.on('end', () => resolve(responseData));
      });

      request.on('error', err => {
        console.error(
          `Error with ${options.method} request to ${options.path}: ${err}`
        );

        reject(err);
      });

      if (body) {
        request.write(body);
      }

      request.end();
    });
  }

  async post(path, body) {
    const options = this._craftOptions(
      'POST',
      path,
      {
        'Content-Type': 'application/vnd.api+json',
        'Content-Length': Buffer.byteLength(body)
      }
    );

    return await this._makeRequest(options, body);
  }

  async get(path) {
    const options = this._craftOptions(
      'GET',
      path,
      { Accept: 'application/json' }
    );

    return await this._makeRequest(options);
  }
};

async function genDnsZoneFlist(client, server, zone) {
  /*
   * Request SP create a DNS filter list from the records within a managed DNS
   * zone
   */
  const endpoint = 'tms_filter_list_requests/';
  const requestResponse = await client.post(
    endpoint,
    JSON.stringify({
      data: {
        attributes: {
          request_type: 'generate_dns_filter_list',
          details: { server, zone }
        }
      }
    })
  );

  const requestId = JSON.parse(requestResponse).data.id;

  let isComplete = false;
  let attributes;

  /*
   *  Query for request status every few moments until SP is done processing it
   */
  while (!isComplete) {
    await new Promise(res => setTimeout(res, 1500));

    attributes = JSON.parse(await client.get(
      `${endpoint}${requestId}`,
    )).data.attributes;

    if (attributes.error) {
      throw new Error(attributes.error);
    }

    isComplete = attributes.completed;
  }

  return attributes.result;
}

(async () => {
  const apiClient = new HttpsClient(LEADER, API_TOKEN);

  console.log(await genDnsZoneFlist(apiClient, NAMESERVER, DNS_ZONE));
})();

{
    "meta": {
        "sp_version": "8.3",
        "api": "SP",
        "api_version": "3",
        "sp_build_id": "HIT4"
    }
}

{
    "meta": {
        "sp_build_id": "HIT4",
        "sp_version": "8.3",
        "api": "SP",
        "api_version": "1",
        "sp_api_version": "1.0.0"
    }
}