Skip to content

Commit

Permalink
Fixed if statement, requirements and indentation
Browse files Browse the repository at this point in the history
  • Loading branch information
3c7 committed Apr 16, 2019
1 parent e4cf132 commit 4dd2ed6
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 17 deletions.
37 changes: 21 additions & 16 deletions responders/QRadarAutoClose/QRadarAutoClose.py
Original file line number Diff line number Diff line change
@@ -1,36 +1,41 @@
#!/usr/bin/env python
# encoding: utf-8

#QRadarAutoClose
#Author: Florian Perret (@cyber_pescadito)
# QRadarAutoClose
# Author: Florian Perret (@cyber_pescadito)

from cortexutils.responder import Responder
import requests


class QRadarAutoClose(Responder):
def __init__(self):
Responder.__init__(self)
self.QRadar_URL = self.get_param('config.QRadar_Url', None, "QRadar URL is Missing")
self.QRadar_API_Key = self.get_param('config.QRadar_API_Key', None, "QRadar API Key is Missing")
self.Offense_Id = self.get_param('data.customFields.externalReferences', None, "QRadar Offense ID is Missing")
self.Cert_Path = self.get_param('config.Cert_Path')
self.Cert_Path = self.get_param('config.Cert_Path')

def run(self):
Responder.run(self)
h = {'content-type': 'application/json'}
h['Version'] = '9.1'
h['SEC'] = str(self.QRadar_API_Key)
payload = self.Offense_Id['string'] + '?closing_reason_id=3&status=CLOSED'

if self.Cert_Path == '':
r=requests.post(self.QRadar_URL + payload, headers=h)
h = {
'content-type': 'application/json',
'Version': '9.1',
'SEC': str(self.QRadar_API_Key)
}
payload = self.Offense_Id['string'] + '?closing_reason_id=3&status=CLOSED'

if self.Cert_Path == '':
r = requests.post(self.QRadar_URL + payload, headers=h)
else:
r=requests.post(self.QRadar_URL + payload, headers=h, verify=self.Cert_Path)
r = requests.post(self.QRadar_URL + payload, headers=h, verify=self.Cert_Path)

if r.status_code == 200 or 202 or 409:
self.report({'message': 'QRadar Offense succesfully closed !'})
if r.status_code == 200 or \
r.status_code == 202 or \
r.status_code == 409:
self.report({'message': 'QRadar Offense succesfully closed !'})
else:
self.error({'message': r.status_code})
self.error({'message': r.status_code})


if __name__ == '__main__':
QRadarAutoClose().run()
QRadarAutoClose().run()
2 changes: 1 addition & 1 deletion responders/QRadarAutoClose/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
cortexutils.responder
cortexutils
requests

0 comments on commit 4dd2ed6

Please sign in to comment.