Skip to content

Commit 5153591

Browse files
SeaBloomsSeaBlooms
authored
Merge pull request #31 from JupiterOne/KNO-483
added alert rule management methods - v1.2.0
2 parents 537de37 + 2f92c09 commit 5153591

File tree

4 files changed

+410
-30
lines changed

4 files changed

+410
-30
lines changed

‎README.md‎

Lines changed: 86 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ j1.update_entity(
9999
#### Delete an entity:
100100

101101
```python
102-
j1.delete_entity(entit_id='<id-of-entity-to-delete>')
102+
j1.delete_entity(entity_id='<id-of-entity-to-delete>')
103103
```
104104

105105
##### Create a relationship
@@ -300,14 +300,96 @@ j1.evaluate_smartclass(smartclass_id='<id-of-smartclass>')
300300
j1.get_smartclass_details(smartclass_id='<id-of-smartclass>')
301301
```
302302

303+
##### Generate J1QL from Natural Language Prompt
304+
305+
```python
306+
j1.generate_j1ql(natural_language_prompt='<natural-language-input-text>')
307+
```
308+
303309
##### List Alert Rules
304310

305311
```python
306-
j1.list_configured_alert_rules()
312+
j1.list_alert_rules()
307313
```
308314

309-
##### Generate J1QL from Natural Language Prompt
315+
##### Get Alert Rule Details
310316

311317
```python
312-
j1.generate_j1ql(natural_language_prompt='<natural-language-input-text>')
318+
j1.get_alert_rule_details(rule_id='<id-of-alert-rule>')
319+
```
320+
321+
##### Create Alert Rule
322+
323+
```python
324+
# polling_interval can be DISABLED, THIRTY_MINUTES, ONE_HOUR, FOUR_HOURS, EIGHT_HOURS, TWELVE_HOURS, ONE_DAY, or ONE_WEEK
325+
# severity can be INFO, LOW, MEDIUM, HIGH, or CRITICAL
326+
327+
j1.create_alert_rule(name="create_alert_rule-name",
328+
description="create_alert_rule-description",
329+
tags=['tag1', 'tag2'],
330+
polling_interval="DISABLED",
331+
severity="INFO",
332+
j1ql="find jupiterone_user")
333+
```
334+
335+
##### Create Alert Rule with Action Config
336+
337+
```python
338+
339+
webhook_action_config = {
340+
"type": "WEBHOOK",
341+
"endpoint": "https://webhook.domain.here/endpoint",
342+
"headers": {
343+
"Authorization": "Bearer <SECRET>",
344+
},
345+
"method": "POST",
346+
"body": {
347+
"queryData": "{{queries.query0.data}}"
348+
}
349+
}
350+
351+
j1.create_alert_rule(name="create_alert_rule-name",
352+
description="create_alert_rule-description",
353+
tags=['tag1', 'tag2'],
354+
polling_interval="DISABLED",
355+
severity="INFO",
356+
j1ql="find jupiterone_user",
357+
action_configs=webhook_action_config)
358+
359+
```
360+
361+
##### Delete Alert Rule
362+
363+
```python
364+
365+
j1.delete_alert_rule(rule_id='<id-of-alert-rule')
313366
```
367+
368+
##### Update Alert Rule
369+
370+
```python
371+
372+
# polling_interval can be DISABLED, THIRTY_MINUTES, ONE_HOUR, FOUR_HOURS, EIGHT_HOURS, TWELVE_HOURS, ONE_DAY, and ONE_WEEK
373+
# tag_op can be OVERWRITE or APPEND
374+
375+
j1.update_alert_rule(rule_id='<id-of-alert-rule',
376+
j1ql="find jupiterone_user as i return i._key",
377+
polling_interval="ONE_WEEK",
378+
tags=['new_tag1', 'new_tag2'])
379+
380+
j1.update_alert_rule(rule_id='<id-of-alert-rule',
381+
tags=['newTag1', 'newTag1'],
382+
tag_op="OVERWRITE")
383+
384+
j1.update_alert_rule(rule_id='<id-of-alert-rule',
385+
tags=['additionalTag1', 'additionalTag2'],
386+
tag_op="APPEND")
387+
```
388+
389+
##### Evaluate Alert Rule
390+
391+
```python
392+
393+
j1.evaluate_alert_rule(rule_id='<id-of-alert-rule')
394+
395+
```

‎examples/examples.py‎

Lines changed: 90 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,11 @@
109109
print("fetch_all_entity_tags()")
110110
print(fetch_all_entity_tags_r)
111111

112+
# fetch_entity_raw_data
113+
fetch_entity_raw_data_r = j1.fetch_entity_raw_data(entity_id="<GUID>")
114+
print("fetch_entity_raw_data()")
115+
print(json.dumps(fetch_entity_raw_data_r, indent=1))
116+
112117
# create_integration_instance
113118
create_integration_instance_r = j1.create_integration_instance(instance_name="pythonclient-customintegration",
114119
instance_description="dev-testing")
@@ -118,11 +123,19 @@
118123
integration_instance_id = "<GUID>"
119124

120125
# start_sync_job
121-
start_sync_job_r = j1.start_sync_job(instance_id=integration_instance_id)
126+
# sync_mode can be "DIFF", "CREATE_OR_UPDATE", or "PATCH"
127+
start_sync_job_r = j1.start_sync_job(instance_id=integration_instance_id,
128+
sync_mode='CREATE_OR_UPDATE',
129+
source='integration-external')
122130
print("start_sync_job()")
123131
print(start_sync_job_r)
124132

125133
# upload_entities_batch_json
134+
rand_val_range = [x / 10.0 for x in range(0, 100)]
135+
rand_val = random.choice(rand_val_range)
136+
137+
epoch_now = round(time.time() * 1000)
138+
126139
entity_payload = [
127140
{
128141
"_key": "1",
@@ -131,20 +144,18 @@
131144
"displayName": "pythonclient1",
132145
"propertyName": "value",
133146
"relationshipProperty": "source",
147+
"value": rand_val,
148+
"bulkUploadedOn": epoch_now
134149
},
135150
{
136151
"_key": "2",
137152
"_type": "pythonclient",
138153
"_class": "API",
139154
"displayName": "pythonclient2",
140-
"propertyName": "value"
141-
},
142-
{
143-
"_key": "3",
144-
"_type": "pythonclient",
145-
"_class": "API",
146-
"displayName": "pythonclient3",
147-
"propertyName": "value"
155+
"propertyName": "value",
156+
"relationshipProperty": "source",
157+
"value": rand_val,
158+
"bulkUploadedOn": epoch_now
148159
}
149160
]
150161

@@ -188,22 +199,21 @@
188199
"_type": "pythonclient",
189200
"_class": "API",
190201
"displayName": "pythonclient4",
191-
"propertyName": "value",
192-
"relationshipProperty": "source",
202+
"enrichProp": "value1"
193203
},
194204
{
195205
"_key": "5",
196206
"_type": "pythonclient",
197207
"_class": "API",
198208
"displayName": "pythonclient5",
199-
"propertyName": "value"
209+
"enrichProp": "value2"
200210
},
201211
{
202212
"_key": "6",
203213
"_type": "pythonclient",
204214
"_class": "API",
205215
"displayName": "pythonclient6",
206-
"propertyName": "value"
216+
"enrichProp": "value3"
207217
}
208218
],
209219
"relationships": [
@@ -278,12 +288,74 @@
278288
print("get_smartclass_details()")
279289
print(get_smartclass_details_r)
280290

281-
# list_configured_alert_rules
282-
list_configured_alert_rules_r = j1.list_configured_alert_rules()
283-
print("list_configured_alert_rules()")
284-
print(list_configured_alert_rules_r)
285-
286291
# generate_j1ql
287292
generate_j1ql_r = j1.generate_j1ql(natural_language_prompt="show me all Users containing 'jupiterone' in their email address")
288293
print("generate_j1ql()")
289294
print(generate_j1ql_r)
295+
296+
# list_alert_rules
297+
list_alert_rules_r = j1.list_alert_rules()
298+
print("list_configured_alert_rules()")
299+
print(list_alert_rules_r)
300+
print(len(list_alert_rules_r))
301+
302+
# get_alert_rule_details
303+
get_alert_rule_details_r = j1.get_alert_rule_details(rule_id="<GUID>")
304+
print("get_alert_rule_details()")
305+
print(get_alert_rule_details_r)
306+
307+
# create_alert_rule
308+
# polling_interval can be DISABLED, THIRTY_MINUTES, ONE_HOUR, FOUR_HOURS, EIGHT_HOURS, TWELVE_HOURS, ONE_DAY, and ONE_WEEK
309+
webhook_token = "<SECRET>"
310+
311+
webhook_action_config = {
312+
"type": "WEBHOOK",
313+
"endpoint": "https://webhook.domain.here/endpoint",
314+
"headers": {
315+
"Authorization": "Bearer {}".format(webhook_token),
316+
},
317+
"method": "POST",
318+
"body": {
319+
"queryData": "{{queries.query0.data}}"
320+
}
321+
}
322+
323+
tag_entities_action_config = {
324+
"type": "TAG_ENTITIES",
325+
"entities": "{{queries.query0.data}}",
326+
"tags": [
327+
{
328+
"name": "tagKey",
329+
"value": "tagValue"
330+
}
331+
]
332+
}
333+
334+
create_alert_rule_r = j1.create_alert_rule(name="create_alert_rule-name",
335+
description="create_alert_rule-description",
336+
tags=['tag1', 'tag2'],
337+
polling_interval="DISABLED",
338+
severity="INFO",
339+
j1ql="find jupiterone_user")
340+
print("create_alert_rule()")
341+
print(create_alert_rule_r)
342+
343+
# delete_alert_rule
344+
delete_alert_rule_r = j1.delete_alert_rule(rule_id="<GUID>")
345+
print("delete_alert_rule()")
346+
print(delete_alert_rule_r)
347+
348+
# update_alert_rule
349+
update_alert_rule_r = j1.update_alert_rule(rule_id="<GUID>",
350+
j1ql="find jupiterone_user as i return i._key",
351+
polling_interval="ONE_WEEK",
352+
tags=['new_tag1', 'new_tag2'])
353+
print("update_alert_rule()")
354+
print(json.dumps(update_alert_rule_r, indent=1))
355+
356+
# evaluate_alert_rule
357+
evaluate_alert_rule_r = j1.evaluate_alert_rule(rule_id="<GUID>")
358+
print("evaluate_alert_rule()")
359+
print(json.dumps(evaluate_alert_rule_r, indent=1))
360+
361+

0 commit comments

Comments
 (0)