Skip to content

Commit 5cc61e2

Browse files
Adds Falcon Script Enumeration (#234)
* Adds Falcon Script enumeration * Changes for linting and bump in dependencies * Fix for black * pylint fixes for legacy Python
1 parent 7984f22 commit 5cc61e2

4 files changed

Lines changed: 793 additions & 212 deletions

File tree

caracara/modules/rtr/constants.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
"encrypt": "active_responder",
1111
"env": "read_only",
1212
"eventlog": "read_only",
13+
"falconscript": "admin",
1314
"filehash": "read_only",
1415
"get": "active_responder",
1516
"getsid": "read_only",

caracara/modules/rtr/rtr.py

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@ def describe_scripts(self, filters: Union[str, FalconFilter] = None) -> Dict:
249249
Returns
250250
-------
251251
Dict: a dictionary containing a list of every script uploaded to the Falcon Cloud,
252-
including its contents
252+
including the contents
253253
"""
254254
self.logger.info("Querying RTR scripts using the filter string %s", filters)
255255
func_ids = partial(self.rtr_admin_api.list_scripts, filter=filters)
@@ -262,3 +262,35 @@ def describe_scripts(self, filters: Union[str, FalconFilter] = None) -> Dict:
262262

263263
script_data = batch_get_data(script_ids, self.rtr_admin_api.get_scripts)
264264
return script_data
265+
266+
@filter_string
267+
def describe_falcon_scripts(self, filters: Union[str, FalconFilter] = None) -> Dict:
268+
"""
269+
Query RTR scripts provided by the Falcon platform, known as "Falcon Scripts".
270+
271+
These scripts can be executed via the RTR falconscript command.
272+
273+
Arguments
274+
---------
275+
filters: Union[FalconFilter, str], optional
276+
Filters to apply to the script search
277+
278+
Returns
279+
-------
280+
Dict: a dictionary containing a list of every available Falcon script,
281+
including its contents
282+
"""
283+
self.logger.info("Querying RTR Falcon scripts using the filter string %s", filters)
284+
func_ids = partial(self.rtr_admin_api.list_falcon_scripts, filter=filters)
285+
falcon_script_ids = all_pages_numbered_offset_parallel(
286+
func=func_ids,
287+
logger=self.logger,
288+
)
289+
self.logger.info("Retrieved %d falcon script IDs", len(falcon_script_ids))
290+
self.logger.debug(falcon_script_ids)
291+
292+
falcon_script_data = batch_get_data(
293+
falcon_script_ids,
294+
self.rtr_admin_api.get_falcon_scripts,
295+
)
296+
return falcon_script_data

0 commit comments

Comments
 (0)