File Coverage

blib/lib/Net/SecurityCenter/API/Analysis.pm

Criterion	Covered	Total	%
statement	15	144	10.4
branch	0	40	0.0
condition			n/a
subroutine	5	16	31.2
pod	6	6	100.0
total	26	206	12.6

package Net::SecurityCenter::API::Analysis;

use warnings;
use strict;

use Carp;

use parent 'Net::SecurityCenter::Base';

use Net::SecurityCenter::Utils qw(:all);

our $VERSION = '0.300';

my $common_template = {
    tool => {
        allow => [
            'cceipdetail',           'cveipdetail',  'iavmipdetail',   'iplist',
            'listmailclients',       'listservices', 'listos',         'listsoftware',
            'listsshservers',        'listvuln',     'listwebclients', 'listwebservers',
            'sumasset',              'sumcce',       'sumclassa',      'sumclassb',
            'sumclassc',             'sumcve',       'sumdnsname',     'sumfamily',
            'sumiavm',               'sumid',        'sumip',          'summsbulletin',
            'sumport',               'sumprotocol',  'sumremediation', 'sumseverity',
            'sumuserresponsibility', 'trend',        'vulndetails',    'vulnipdetail',
            'vulnipsummary'
        ],
    },
    view => {
        allow => [ 'all', 'new', 'patched' ]
    },
    limit => {
        allow   => qr/^\d+$/,
        default => 1000,
    },
    page => {
        allow   => qr/^(\d+|all)$/,
        default => 'all',
    },
    sort_dir => {
        allow  => [ 'ASC', 'DESC' ],
        filter => sub { uc $_[0] },
    },
    scan_id => {
        allow => qr/^\d+$/,
    },
    lce_id => {
        allow => qr/^\d+$/,
    },
    query_id => {
        allow => qr/^\d+$/,
    },
    date => {
        allow => qr/^(\d+|all)$/,
    }
};

#-------------------------------------------------------------------------------
# METHODS
#-------------------------------------------------------------------------------

sub get {

    my ( $self, %args ) = @_;

    my $tmpl = {
        type => {
            allow    => [ 'scLog', 'vuln', 'event', 'mobile', 'user' ],
            required => 1,
        },
        tool   => $common_template->{'tool'},
        source => {
            allow => [ 'cumulative', 'individual', 'archive', 'patched', 'lce' ],
        },
        sort_dir   => $common_template->{'sort_dir'},
        sort_field => {},
        view       => $common_template->{'view'},
        scan_id    => $common_template->{'scan_id'},
        lce_id     => $common_template->{'lce_id'},
        query_id   => $common_template->{'query_id'},
        query      => {},
        filters    => {},
        date       => $common_template->{'date'},
        limit      => $common_template->{'limit'},
        page       => $common_template->{'page'},
        download   => {},
        columns    => {},
    };

    my $params = sc_check_params( $tmpl, \%args );

    my $scan_id    = delete( $params->{'scan_id'} );
    my $query_id   = delete( $params->{'query_id'} );
    my $lce_id     = delete( $params->{'lce_id'} );
    my $tool       = delete( $params->{'tool'} );
    my $type       = delete( $params->{'type'} );
    my $filters    = delete( $params->{'filters'} );
    my $date       = delete( $params->{'date'} );
    my $source     = delete( $params->{'source'} );
    my $sort_dir   = delete( $params->{'sort_dir'} );
    my $sort_field = delete( $params->{'sort_field'} );
    my $view       = delete( $params->{'view'} );

    # Fallback sourceType param
    if ( defined( $params->{'source_type'} ) ) {
        $type = $params->{'source_type'};
    }

    # Pagination
    my $count = 0;
    my $page  = delete( $params->{'page'} );
    my $limit = delete( $params->{'limit'} );
    my $total = $limit;

    # For download API
    my $download = delete( $params->{'download'} );
    my $columns  = delete( $params->{'columns'} );

    my $analysis_params = {
        type  => $type,
        query => {
            filters => [],
            type    => $type,
        }
    };

    my @results = ();

    # If not defined the query build the query using "filters" argument
    if ($filters) {

        if ( ref $filters->[0] eq 'ARRAY' ) {

            foreach my $filter ( @{$filters} ) {

                push(
                    @{ $analysis_params->{'query'}->{'filters'} },
                    {
                        'filterName' => $filter->[0],
                        'operator'   => $filter->[1],
                        'value'      => $filter->[2],
                        'type'       => $type,
                    }
                );
            }

        } else {
            $analysis_params->{'query'}->{'filters'} = $filters;
        }

    }

    if ($query_id) {
        $analysis_params->{'query'}->{'id'} = $query_id;
    }

    if ($source) {
        $analysis_params->{'sourceType'} = $source;
    }

    if ($tool) {
        $analysis_params->{'query'}->{'tool'} = $tool;
    }

    if ($sort_dir) {
        $analysis_params->{'sortDir'} = $sort_dir;
    }

    if ($sort_field) {
        $analysis_params->{'sortField'} = $sort_field;
    }

    if ($view) {
        $analysis_params->{'view'} = $view;
    }

    if ($scan_id) {
        $analysis_params->{'scanID'} = $scan_id;
    }

    # Add pagination
    if ( $page eq 'all' ) {
        $analysis_params->{'query'}->{'startOffset'} = 0;
        $analysis_params->{'query'}->{'endOffset'}   = $limit;
    } else {
        $analysis_params->{'query'}->{'startOffset'} = $page * $limit;
        $analysis_params->{'query'}->{'endOffset'}   = ( $page + 1 ) * $limit;
    }

    # Add date params for "scLog" analysis type
    if ( $type eq 'scLog' ) {
        $analysis_params->{'date'} = $date;
    }

    # Download API
    if ($download) {

        my @columns_params = ();

        foreach my $column ( split( /,/, $columns ) ) {
            push( @columns_params, { 'name' => $column } );
        }

        $analysis_params->{'columns'} = \@columns_params;

        # TODO check offset
        my $result = $self->client->post( '/analysis/download', $analysis_params );
        return $result;
    }

    while ( $total > $count ) {
        my $result = $self->client->post( '/analysis', $analysis_params );

        return if ( !$result );

        push( @results, @{ $result->{'results'} } );

        $total = $result->{'totalRecords'};

        if ( $page eq 'all' ) {
            $count                                       = $result->{'endOffset'};
            $analysis_params->{'query'}->{'startOffset'} = $count;
            $analysis_params->{'query'}->{'endOffset'}   = $count + $limit;
        } else {
            $count = $total;
        }

    }

    return \@results;

}

#-------------------------------------------------------------------------------

sub download {

    my ( $self, %args ) = @_;

    $args{'download'} = 1;

    return $self->get(%args);

}

#-------------------------------------------------------------------------------

sub get_vulnerabilities {

    my ( $self, %args ) = @_;

    my $tmpl = {
        query_id   => $common_template->{'query_id'},
        sort_dir   => $common_template->{'sort_dir'},
        sort_field => {},
        source     => {
            allow => [ 'individual', 'cumulative', 'patched' ],
        },
        view    => $common_template->{'view'},
        scan_id => $common_template->{'scan_id'},
        tool    => {
            allow   => $common_template->{'tool'}->{'allow'},
            default => 'vulndetails',
        },
        page    => $common_template->{'page'},
        limit   => $common_template->{'limit'},
        filters => {}
    };

    my $params = sc_check_params( $tmpl, \%args );

    $params->{'type'} = 'vuln';

    return $self->get( %{$params} );

}

#-------------------------------------------------------------------------------

sub get_events {

    my ( $self, %args ) = @_;

    my $tmpl = {
        query_id   => $common_template->{'query_id'},
        sort_dir   => $common_template->{'sort_dir'},
        sort_field => {},
        source     => {
            allow => [ 'lce', 'archive' ],
        },
        lce_id => $common_template->{'lce_id'},
        view   => {},
        limit  => $common_template->{'limit'},
        page   => $common_template->{'page'},
        tool   => {
            allow => [
                'listdata',    'sumasset', 'sumclassa', 'sumclassb', 'sumclassc', 'sumconns',
                'sumdate',     'sumdstip', 'sumevent',  'sumevent2', 'sumip',     'sumport',
                'sumprotocol', 'sumsrcip', 'sumtime',   'sumtype',   'sumuser',   'syslog',
                'timedist'
            ],
            default => 'syslog'
        }
    };

    my $params = sc_check_params( $tmpl, \%args );

    $params->{'type'} = 'event';

    return $self->get( %{$params} );

}

#-------------------------------------------------------------------------------

sub get_mobile {

    my ( $self, %args ) = @_;

    my $tmpl = {
        query_id   => $common_template->{'query_id'},
        sort_dir   => $common_template->{'sort_dir'},
        sort_field => {},
        tool       => {
            allow => [
                'listvuln', 'sumdeviceid', 'summdmuser',  'summodel',
                'sumoscpe', 'sumpluginid', 'sumseverity', 'vulndetails'
            ],
            default => 'vulndetails'
        },
        limit => $common_template->{'limit'},
        page  => $common_template->{'page'},
    };

    my $params = sc_check_params( $tmpl, \%args );

    $params->{'type'} = 'mobile';

    return $self->get( %{$params} );

}

#-------------------------------------------------------------------------------

sub get_log {

    my ( $self, %args ) = @_;

    my $severity_filter = sub {

        my $severity = { 'INFO' => 0, 'WARNING' => 1, 'CRITICAL' => 2 };

        return {
            filterName => 'severity',
            value      => {
                id       => $severity->{ uc( $_[0] ) },
                operator => '=',
                name     => uc( $_[0] ),
            }
        };

    };

    my $keyword_filter = sub {
        return { filterName => 'keyword', operator => '=', value => $_[0] };
    };

    my $module_filter = sub {
        return { filterName => 'module', operator => '=', value => $_[0] };
    };

    my $organization_filter = sub {
        return { filterName => 'module', operator => '=', value => { id => $_[0] } };
    };

    my $initiator_filter = sub {
        return { filterName => 'initiator', operator => '=', value => { id => $_[0] } };
    };

    my $tmpl = {
        severity => {
            allow       => [ 'info', 'warning', 'critical' ],
            post_filter => \&$severity_filter,
        },
        keywords => {
            filter => \&$keyword_filter,
        },
        module => {
            filter => \&$module_filter,
        },
        organization => {
            filter => \&$organization_filter,
        },
        initiator => {
            filter => \&$initiator_filter,
        },
        date  => $common_template->{'date'},
        limit => $common_template->{'limit'},
        page  => $common_template->{'page'},
    };

    my $params = sc_check_params( $tmpl, \%args );

    my $analysis_params = {
        type    => 'scLog',
        date    => $params->{'date'},
        filters => [],
    };

    my $severity     = delete( $params->{'severity'} );
    my $keyword      = delete( $params->{'keyword'} );
    my $module       = delete( $params->{'module'} );
    my $organization = delete( $params->{'orgwnization'} );
    my $initiator    = delete( $params->{'initiator'} );

    if ($severity) {
        push( @{ $analysis_params->{'filters'} }, $severity );
    }

    if ($keyword) {
        push( @{ $analysis_params->{'filters'} }, $keyword );
    }

    if ($module) {
        push( @{ $analysis_params->{'filters'} }, $module );
    }

    if ($organization) {
        push( @{ $analysis_params->{'filters'} }, $organization );
    }

    if ($initiator) {
        push( @{ $analysis_params->{'filters'} }, $initiator );
    }

    return $self->get( %{$analysis_params} );

}

#-------------------------------------------------------------------------------

1;

__END__