diff --git a/bin/akamai-etp b/bin/akamai-etp index 0dc4928..9d20b3e 100755 --- a/bin/akamai-etp +++ b/bin/akamai-etp @@ -40,7 +40,7 @@ from requests.compat import urljoin from akamai.edgegrid import EdgeGridAuth, EdgeRc from config import EdgeGridConfig -__version__ = "0.4.1" +__version__ = "0.4.2" #: Window span in ad-hoc mode, default is 3 min span_duration_min = 3 @@ -232,6 +232,8 @@ def input2feed(event_type): api_eventtype = "dns-activities" elif event_type == "proxy": api_eventtype = "proxy-traffic/transactions" + elif event_type == "netcon": + api_eventtype = "network-traffic/connections" if api_eventtype is None: raise ValueError(f'event_type provided is support supported: {event_type}') return api_eventtype diff --git a/bin/config.py b/bin/config.py index f65751e..3c3efa5 100644 --- a/bin/config.py +++ b/bin/config.py @@ -45,8 +45,10 @@ def __init__(self, config_values, configuration, flags=None): event_parser = subparsers.add_parser("event", help="Fetch last events (from 30 min ago to 3 min ago)", epilog=epilog, formatter_class=argparse.RawTextHelpFormatter) event_parser.add_argument('event_type', nargs='?', default="threat", - choices=['threat', 'aup', 'dns', 'proxy'], help="Event type, Threat, Acceptable User " - "Policy (AUP), DNS or Proxy") + choices=['threat', 'aup', 'dns', 'proxy', 'netcon'], + help="Event type: Threat, Acceptable User " + "Policy (AUP), DNS, Proxy or " + "Network traffic connections details") event_parser.add_argument('--start', '-s', type=int, help="Start datetime (EPOCH),\nDefault is 30 min ago") event_parser.add_argument('--end', '-e', type=int, help="End datetime (EPOCH),\nDefault is now - 3 min") event_parser.add_argument('--output', '-o', help="Output file, default is stdout. Encoding is utf-8.") diff --git a/cli.json b/cli.json index 6139aec..b294759 100755 --- a/cli.json +++ b/cli.json @@ -5,7 +5,7 @@ "commands": [ { "name": "etp", - "version": "0.4.1", + "version": "0.4.2", "description": "Akamai CLI for Secure Internet Access Enterprise (f.k.a. Enterprise Threat Protector)" } ] diff --git a/test/test.py b/test/test.py index c8cbe14..bb21fce 100644 --- a/test/test.py +++ b/test/test.py @@ -130,6 +130,18 @@ def test_event_aup_file(self): if os.path.isfile(output_filename): os.remove(output_filename) + def test_event_netcon(self): + """ + Fetch Network Connection Details events + """ + cmd = self.cli_run("event", "netcon", "--start", self.after, "--end", self.before) + stdout, stderr = cmd.communicate(timeout=120) + events = stdout.decode(encoding) + event_count = len(events.splitlines()) + self.assertGreater(event_count, 0, "We expect at least one Network Connections Details event") + self.assertEqual(cmd.returncode, 0, 'return code must be 0') + + class TestCliETP(CliETPTest):