From fffca9b06ec9c6ca30d59a8f9f6609c63cbfaddd Mon Sep 17 00:00:00 2001 From: Paul Nguyen Date: Tue, 7 Dec 2021 10:07:41 -0800 Subject: [PATCH 1/2] fix(app): Fix panContentPack error. Fixes #222 --- .../bin/panContentPack.py | 20 +++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/SplunkforPaloAltoNetworks/bin/panContentPack.py b/SplunkforPaloAltoNetworks/bin/panContentPack.py index b51490f2..d6a49ae0 100644 --- a/SplunkforPaloAltoNetworks/bin/panContentPack.py +++ b/SplunkforPaloAltoNetworks/bin/panContentPack.py @@ -81,6 +81,7 @@ def usage(): common.exit_with_error("Usage: | pancontentpack ") def parse_apps(apps_xml): + logger.debug("Begin Parsing Apps") obj = xmltodict.parse(apps_xml) try: apps = obj['response']['result']['application']['entry'] @@ -129,7 +130,8 @@ def parse_apps(apps_xml): common.exit_with_error(string_types(e)) # convert all out of unicode for key in a: - a[key] = string_types(a[key]) + logger.debug(key + ': ' + a[key]) + a[key] = str(a[key]) csv_apps.append(a) logger.info("Found %s apps" % len(csv_apps)) return csv_apps @@ -196,19 +198,27 @@ def main(): # Get the sessionKey sessionKey = settings['sessionKey'] - log(debug, "Begin get API key") + logger.debug("Begin get API key") + # Get the API key from the Splunk store or from the device at hostname if no apikey is stored apikey = common.apikey(sessionKey, args[0], debug) - device = pandevice.base.PanDevice(args[0], api_key=apikey) - device.refresh_system_info() + try: + systeminfo = device.refresh_system_info() + logger.debug(systeminfo) + except Exception as e: + logger.error("Error refreshing device: %s" % e) try: if args[1] == "apps": + logger.debug("Getting Apps") device.xapi.get("/config/predefined/application") app_xml = device.xapi.xml_document + logger.debug(app_xml) csv = parse_apps(app_xml) + logger.debug(csv) else: + logger.info("Getting Threats") if device._version_info >= (8, 0, 0): threat_xml = device.op( 'show predefined xpath "/predefined/threats"', @@ -220,10 +230,12 @@ def main(): csv = parse_threats(threat_xml) except pan.xapi.PanXapiError as e: + logger.error(e) common.exit_with_error(string_types(e)) # output results + logger.debug("Send CSV to Splunk") splunk.Intersplunk.outputResults(csv) From b2d5733c369939e1f3c3d19da30966b86ab794e7 Mon Sep 17 00:00:00 2001 From: Paul Nguyen Date: Wed, 8 Dec 2021 16:18:36 -0800 Subject: [PATCH 2/2] fix(app): Fix bug #222 --- SplunkforPaloAltoNetworks/bin/panContentPack.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/SplunkforPaloAltoNetworks/bin/panContentPack.py b/SplunkforPaloAltoNetworks/bin/panContentPack.py index d6a49ae0..a3a20772 100644 --- a/SplunkforPaloAltoNetworks/bin/panContentPack.py +++ b/SplunkforPaloAltoNetworks/bin/panContentPack.py @@ -51,7 +51,7 @@ import environment import xmltodict from collections import OrderedDict -from six import string_types +from six import string_types logger = common.logging.getLogger().getChild('updateAppsThreats') @@ -208,6 +208,7 @@ def main(): logger.debug(systeminfo) except Exception as e: logger.error("Error refreshing device: %s" % e) + common.exit_with_error(string_types(e)) try: if args[1] == "apps":