PRTG에 알람 발생시 mattermost 로 incomming webhook에 전송하는걸.. 하려고 했으나.. 그게 지원이 좀 힘들어서
arcsight 로 syslog 전송하고 syslog받으면 arcsight에서 내부 sh을 실행하고.. sh 에는 python 파일을 실행하도록 해놓고..
mattermost는 push로 담당자에게 전달..
메세지 분석해서 띄워놓은 python bot에서 추가 rest api를 호출해서 시스템 자원 확인해서 다시 mattermost 에게 전달.. 그 후 다시 담당자에게 push..
paloalto -> PRTG -> Arcsight -> sh실행 -> python 실행 -> mattermost -> push and incomming webhook -> python bot -> push
paloalto rest api 를 python bot에서 호출해야되니 key 받아서 호출하고.. 필요한 리소스들 가져오는 것까지 짰는데..
맙소사..
이런게 있었네요...
이미 모듈화가 있었어요 ㅠㅠㅠ 된장....
괜히 고생했어.... ㅠㅠ
[yad2nus@VM mattermost]$ panxapi.py --help
panxapi.py [options] [xpath]
-d delete object at xpath
-e element edit XML element at xpath
-g get candidate config at xpath
-k generate API key
-s show active config at xpath
-S element set XML element at xpath
-U cmd execute dynamic update command
-C cmd commit candidate configuration
--validate validate candidate configuration
--force force commit when conflict
--partial part commit specified part
--sync synchronous commit
-A cmd commit-all (Panorama)
--ad-hoc query perform ad hoc request
--modify insert known fields in ad hoc query
-o cmd execute operational command
--export category export files
--log log-type retrieve log files
--report report-type retrieve reports (dynamic|predefined|custom)
--name report-name report name
--src src clone source node xpath
export source file/path/directory
--dst dst move/clone destination node name
rename new name
export destination file/path/directory
--move where move after, before, bottom or top
--rename rename object at xpath to dst
--clone clone object at xpath, src xpath
--override element override template object at xpath
--vsys vsys VSYS for dynamic update/partial commit/
operational command/report
-l api_username[:api_password]
-h hostname
-P port URL port number
--serial number serial number for Panorama redirection/
commit-all/threat-pcap
--group name device group for commit-all
--merge merge with candidate for commit-all
--nlogs num retrieve num logs
--skip num skip num logs
--filter filter log selection filter
--interval seconds log/commit/report job query interval
--timeout seconds log/commit/report job query timeout
--stime time search time for threat-pcap
--pcapid id threat-pcap ID
-K api_key
-x print XML response to stdout
-p print XML response in Python to stdout
-j print XML response in JSON to stdout
-r print result content when printing response
--text print text response to stdout
-X convert text command to XML
--ls print formatted PCAP listing to stdout
--recursive recursive export
-H use http URL scheme (default https)
-G use HTTP GET method (default POST)
-D enable debug (multiple up to -DDD)
-t tag .panrc tagname
-T seconds urlopen() timeout
--cafile path file containing CA certificates
--capath path directory of hashed certificate files
--version display version
--help display usage
