Releases: mfesiem/msiempy
Releases · mfesiem/msiempy
msiempy 0.3.5
New:
- Documentation website !
- Change to
search()
method: applied to every list objects BUTDevTree
Thesearch()
method only takes one arguments as the searching pattern (DevTree
always only accepted one argument as the search pattern)
If you used something likesearch('term1', 'term2')
please usesearch('term1').search('term2')
.
Note: The changes announced in https://github.com/mfesiem/msiempy/releases/tag/0.3.4 has not been acted yet - Rename
get_watchlist_summary()
to_init_watchlist_summary()
cause it's not supposed to be called by the user
msiempy 0.3.4
New:
- Better alarm filtering #83
NitroList.search()
change: Comparing match values against dict values only.
Argumentmatch_prop
has beed removed.
Introducingfields
argument to search into specific fields only.
This change sets things up to unifyDevTree .search()
and other objectssearch()
return values and arguments in the future. Right nowDevTree.search()
returns a Datasource object or None andDevTree.search_ds_group()
returns agenerator
, this behaviour goes against what's defined inmsiempy.core.types.NitroList.search()
. All other objects returns alist
of items matching the search.
In the futureDevTree
will be deprecated and replaced by a another object that will behave just like DevTree except for the search method i.e.DataSourceManager
- Clearer docs regarding EventManager.load_data(max_query_depth), Event.refresh, and other utils methods
msiempy 0.3.3
New features:
- Grouped event queries !
- Implements remove watchlist values
- Transition all query calls to API v2
- Format code
Fixes:
- House kipping / Better docs
McAfee SIEM API Python wrapper 0.3.2
New features: - Retry requests once if network error Fixes: - Fixed load_events() process for the AlarmManager. Was broken sicne 0.3.0, events would just not at all when using AlarmMamager.
McAfee SIEM API Python wrapper 0.3.1
New features: - More simple imports (still 100% compatible with older code) Fixes: - Fixed backwards compatibility of objects imports - Adjust alarm filtering so it can filter on Alarms event even if events_details=False (only siem v11.x)
McAfee SIEM API Python wrapper 0.3.0
New features: - New core objects structure , external API should not have changed ! - PARAMS interpolation now are using Template strings for better documentation and safer processing. Using Template string allows us to programatically generate the liste of all possibles API calls registered in PARAMS mapping. - Use notifyGetTriggeredNotificationDetail when possible to load alarm details: this will only affect version 11.x. Event loaded from AlarmManager might have changed field names if you were using AlarmManager.load_data(events_details=False) - Better documentation site ! Fixes: - Typo in PARAMS
McAfee SIEM API Python wrapper 0.2.5
New features: None Fixes: Allow login method to be retried once
McAfee SIEM API Python wrapper 0.2.4
New features: None Fixes: #67 and #68 : Automatically retry once on any kind of NitroError when EventManager.qry_load_data() fails. This works arround random job engine errors.
McAfee SIEM API Python wrapper 0.2.3
New features: None Fixes: #65 Typo in PARAMS #66 Fixed possible duplicate keys when querying events and error handling Added ERROR_INVALID_SESSION to the re-login error handler Fixed JSONDecodeError or exotic systems like raspberries Restored Old behaviour of __getitem__ if new map doesn't have the info: Loop thought FIELDS_TABLES and try with table prefix
McAfee SIEM API Python wrapper 0.2.2
New features: - More comprehensive usage of Event dictionnary. This means that you can use Event object with the same keys you requested when doing a query. Before you had to add the table prefix like 'Alert.<field>', or event use a completely different key like 'Alert.BIN(7)' when you requested 'UserIDSrc', now you can use the same fields that you requested (hopefully) with the Event objects. Note that all matching is done statically with a very big mapping of all known fields, it may contain bug or be imcomplete... Methods __getitem__, __contains__, __setitem__ and __delitem__ have been rewrote in order to offer this feature. Fixes: - Event fields would not be queried as expected when using EventManager query splitting feature - Other minor event fixes