Skip to content

Commit

Permalink
Merge branch 'release/5.0.1'
Browse files Browse the repository at this point in the history
  • Loading branch information
btorresgil committed Feb 3, 2016
2 parents 50ef5d8 + e355f38 commit 1d782d0
Show file tree
Hide file tree
Showing 17 changed files with 532 additions and 61 deletions.
1 change: 0 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
Expand Down
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ Palo Alto Networks App for Splunk

* **App Homepage:** https://splunkbase.splunk.com/app/491
* **Author:** Brian Torres-Gil - Palo Alto Networks
* **App Version:** 5.0.0
* **Required Add-on (TA) Version:** Splunk_TA_paloalto 3.5.1 or higher
* **App Version:** 5.0.1
* **Required Add-on (TA) Version:** Splunk_TA_paloalto 3.5.2 or higher
Note: The TA is included with this App, and does **not** have to be installed separately.

### Documentation ###
Expand Down
29 changes: 8 additions & 21 deletions bin/lib/common.py
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,7 @@ def get_firewall_credentials(session_key):
logger.debug("Getting firewall credentials from Splunk")
entities = entity.getEntities(['admin', 'passwords'], namespace=APPNAME, owner='nobody', sessionKey=session_key)
except Exception as e:
import traceback
logger.warn(traceback.format_exc())
raise Exception("Could not get %s credentials from splunk. Error: %s" % (APPNAME, str(e)))
exit_with_error("Could not get %s credentials from splunk. Error: %s" % (APPNAME, str(e)))
# return first set of credentials
for i, c in entities.items():
if c['username'] != 'wildfire_api_key':
Expand All @@ -90,28 +88,22 @@ def get_wildfire_apikey(session_key):
try:
entities = entity.getEntities(['admin', 'passwords'], namespace=APPNAME, owner='nobody', sessionKey=session_key)
except Exception as e:
stack = traceback.format_exc()
logger.warn(stack)
logger.warn("entity exception")
raise Exception("Could not get %s credentials from splunk. Error: %s" % (APPNAME, str(e)))
exit_with_error("Could not get %s credentials from splunk. Error: %s" % (APPNAME, str(e)))
# return first set of credentials
for i, c in entities.items():
if c['username'] == 'wildfire_api_key':
return c['clear_password']
logger.warn(
"There are Palo Alto Networks WildFire malware events, but no WildFire API Key found, please set the API key in the SplunkforPaloAltoNetworks App set up page")
raise NoCredentialsFound("No Wildfire API key is set")
exit_with_error("No Wildfire API key is set, set apikey in App configuration.")


def get_firewall_apikey(session_key):
"""Given a splunk session_key returns a clear text API Key from a splunk password container"""
try:
entities = entity.getEntities(['admin', 'passwords'], namespace=APPNAME, owner='nobody', sessionKey=session_key)
except Exception as e:
stack = traceback.format_exc()
logger.warn(stack)
logger.warn("entity exception")
raise Exception("Could not get %s credentials from splunk. Error: %s" % (APPNAME, str(e)))
exit_with_error("Could not get %s credentials from splunk. Error: %s" % (APPNAME, str(e)))
for i, c in entities.items():
if c['username'] == 'firewall_api_key':
return c['clear_password']
Expand All @@ -130,7 +122,7 @@ def set_firewall_apikey(session_key, apikey):
stack = traceback.format_exc()
logger.warn(stack)
logger.warn("entity exception")
raise Exception("Could not set %s firewall apikey from splunk. Error: %s" % (APPNAME, str(e)))
exit_with_error("Could not set %s firewall apikey from splunk. Error: %s" % (APPNAME, str(e)))


def delete_firewall_apikey(session_key):
Expand All @@ -140,10 +132,7 @@ def delete_firewall_apikey(session_key):
except ResourceNotFound:
pass
except Exception as e:
stack = traceback.format_exc()
logger.warn(stack)
logger.warn("entity exception")
raise Exception("Could not delete %s firewall apikey from splunk. Error: %s" % (APPNAME, str(e)))
exit_with_error("Could not delete %s firewall apikey from splunk. Error: %s" % (APPNAME, str(e)))


def apikey(sessionKey, hostname, debug=False):
Expand Down Expand Up @@ -172,11 +161,9 @@ def apikey(sessionKey, hostname, debug=False):
set_firewall_apikey(sessionKey, apikey)
return apikey
except NoCredentialsFound as e:
logger.error("No Firewall/Panorama credentials for searchbar command. Please set the username and password in the App set up page.")
exit_with_error(str(e))
exit_with_error("No Firewall/Panorama credentials for searchbar command. Please set the username and password in the App set up page.")
except Exception as e:
logger.error("Unable to get apikey")
exit_with_error(str(e))
exit_with_error("Unable to get apikey from firewall: %s" % str(e))


def check_debug(arguments):
Expand Down
Loading

0 comments on commit 1d782d0

Please sign in to comment.