|
1 | | -# c42sec |
| 1 | +# The Code42 CLI |
2 | 2 |
|
3 | | -The c42seceventcli AED module contains a CLI tool for extracting AED events as well as an optional state manager |
4 | | -for recording timestamps. The state manager records timestamps so that on future runs, |
5 | | -you only extract events you did not previously extract. |
| 3 | +Use the `code42` command to interact with your Code42 environment. |
| 4 | +`code42 securitydata` is a CLI tool for extracting AED events. |
| 5 | +Additionally, `code42 securitydata` can record a checkpoint so that you only get events you have not previously gotten. |
6 | 6 |
|
7 | 7 | ## Requirements |
8 | 8 |
|
9 | 9 | - Python 2.7.x or 3.5.0+ |
10 | 10 | - Code42 Server 6.8.x+ |
11 | 11 |
|
12 | 12 | ## Installation |
13 | | -Install `c42sec` using: |
| 13 | +Install the `code42` CLI using: |
14 | 14 |
|
15 | 15 | ```bash |
16 | 16 | $ python setup.py install |
17 | 17 | ``` |
18 | 18 |
|
19 | 19 | ## Usage |
20 | 20 |
|
21 | | -First, set your profile |
22 | | - |
| 21 | +First, set your profile: |
23 | 22 | ```bash |
24 | | -c42sec profile set -s https://example.authority.com -u security.admin@example.com -p |
| 23 | +code42 profile set -s https://example.authority.com -u security.admin@example.com |
25 | 24 | ``` |
| 25 | +Your profile contains the necessary properties for logging into Code42 servers. |
| 26 | +You will prompted for a password if there is not one saved for your current username/authority URL combination. |
26 | 27 |
|
27 | | -`-p` will prompt for your password securely. If your username does not have a password stored, you will be prompted anyway. |
| 28 | +To explicitly set your password, use `-p`: |
| 29 | +```bash |
| 30 | +code42 profile set -p |
| 31 | +``` |
| 32 | +You will be securely prompted to input your password. |
| 33 | +Your password is not stored in plain-text, and is not shown when you do `code42 profile show`. |
| 34 | +However, `code42 profile show` will confirm that there is a password set for your profile. |
28 | 35 |
|
29 | 36 | To ignore SSL errors, do: |
| 37 | +```bash |
| 38 | +code42 profile set --disable-ssl-errors |
| 39 | +``` |
30 | 40 |
|
| 41 | +To re-enable SSL errors, do: |
31 | 42 | ```bash |
32 | | -c42sec profile set --ignore-ssl-errors true |
| 43 | +code42 profile set --enable-ssl-errors |
33 | 44 | ``` |
34 | 45 |
|
| 46 | +Next, you can query for events and send them to three possible destination types |
| 47 | +* stdout |
| 48 | +* A file |
| 49 | +* A server, such as SysLog |
| 50 | + |
| 51 | +To print events to stdout, do: |
| 52 | +```bash |
| 53 | +code42 securitydata print |
| 54 | +``` |
| 55 | + |
| 56 | +To write events to a file, do: |
| 57 | +```bash |
| 58 | +code42 securitydata write-to filename.txt |
| 59 | +``` |
| 60 | + |
| 61 | +To send events to a server, do: |
| 62 | +```bash |
| 63 | +code42 securitydata send-to https://syslog.company.com -p TCP |
| 64 | +``` |
| 65 | + |
| 66 | +Each destination-type subcommand shares query parameters |
| 67 | +* `-t` (exposure types) |
| 68 | +* `-b` (begin date) |
| 69 | +* `-e` (end date) |
| 70 | +* `--advanced-query` (raw JSON query) |
| 71 | + |
| 72 | +Note that you cannot use other query parameters if you use `--advanced-query`. |
| 73 | + |
| 74 | +To learn more about acceptable arguments, add the `-h` flag to `code42` or and of the destination-type subcommands. |
| 75 | + |
| 76 | + |
35 | 77 | # Known Issues |
36 | 78 |
|
37 | 79 | Only the first 10,000 of each set of events containing the exact same insertion timestamp is reported. |
0 commit comments