davidmoremad / dome9

Python wrapper for the Dome9 API

Dome9 (Python SDK)

🚨 This package is not maintained anymore. I recommend you to use the official Dome9 Python SDK

Dome9, also known as Checkpoint CloudGuard, is a cloud native security solutions for securing assets and workloads. At the core of this solution, CloudGuard Posture Management visualizes and assesses security posture, detects misconfigurations, automates and actively enforces standard policies (GDPR, HIPAA, ISO27001...), and protects against attacks and insider threats.

This repository contains a Python SDK of this tool. Initially its SDK did not have much functionality and that is why I developed this one to be able to work and include it within my Continuous Integration processes.

If you want to integrate Dome9 as part of your CI, check my other modules: Dome9 CLI and Agile.

Installation

pip install dome9

📚 Documentation: https://dome9.readthedocs.io/

Usage

There are two ways to authenticate:

• As Arguments: Passing variables on init -> Dome9(key='xxxxxx', secret='yyyyyyy')
• As Environment variables: Setting your credentials as environment variables -> DOME9_ACCESS_KEY and DOME9_SECRET_KEY

from dome9 import Dome9

dome9 = Dome9(key='xxxxxx', secret='yyyyyyy')

rulesets = dome9.list_rulesets()

export DOME9_ACCESS_KEY='xxxxxxxxxxxxxxxxxxxx'
export DOME9_SECRET_KEY='yyyyyyyyyyyyyyyyyyyy'
python -c "from dome9 import Dome9; print(Dome9().list_rulesets())"

What can I do?

• 🌵 List all cloud accounts -> dome9.list_cloud_accounts()
• 🌻 List AWS accounts -> dome9.list_aws_accounts()
• 🌷 List KUBERNETES accounts -> dome9.list_kubernetes_accounts()
• 🌼 Create ruleset -> dome9.create_ruleset()
• 🌴 Create remediation -> dome9.create_remediation()
• 🌲 Connect new AWS account -> dome9.create_aws_account()
• 🌹 Run assessment -> dome9.run_assessment()
• 🍀 List all your cloud assets -> dome9.list_protected_assets()

dome9's Issues

🍺 Refactor - Remediation New API calls

Dome9 has changed Remediation caller:

• Old: ComplianceRemediation. Reference.
• New: Compliance/Remediation. Reference.

Change it in order to update CLI

🍺 Audit logs - Control access & events

Add audit logs in order to control access and events

• Doc: https://api-v2-docs.dome9.com/#audit_get

🐞 Setup.py -> io.open() instead open() for Python2 compatibility

Error installing dome9 (0.5) due to use of open() on setup.py:

Error build: https://github.com/Telefonica/dome9-cli/runs/6594916448?check_suite_focus=true

Collecting dome9
  Downloading dome9-0.4.1.tar.gz (9.0 kB)
    ERROR: Command errored out with exit status 1:
     command: /opt/hostedtoolcache/Python/2.7.18/x64/bin/python -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-install-zDaJct/dome9/setup.py'"'"'; __file__='"'"'/tmp/pip-install-zDaJct/dome9/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' egg_info --egg-base /tmp/pip-pip-egg-info-NBhNnu
         cwd: /tmp/pip-install-zDaJct/dome9/
    Complete output (7 lines):
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/tmp/pip-install-zDaJct/dome9/setup.py", line 26, in <module>
        version=read_file('VERSION').strip(),
      File "/tmp/pip-install-zDaJct/dome9/setup.py", line [21](https://github.com/Telefonica/dome9-cli/runs/6594916448?check_suite_focus=true#step:4:22), in read_file
        with open(filename, encoding="utf-8") as f:
    TypeError: 'encoding' is an invalid keyword argument for this function
    ----------------------------------------
ERROR: Command errored out with exit status 1: python setup.py egg_info Check the logs for full command output.
Error: Process completed with exit code 1.

Solution: https://bugs.launchpad.net/pbr/+bug/1470551

🛠️ Handle 404 errors to avoid crashes on CLI

Traceback (most recent call last):
  File "C:\Users\david\Repositories\dome9-cli\cli\dome9cli.py", line 304, in <module>
    fire.Fire(Dome9CLI())
  File "C:\Users\david\.virtualenvs\dome9-cli-b-5h-f_6\lib\site-packages\fire\core.py", line 141, in Fire
    component_trace = _Fire(component, args, parsed_flag_args, context, name)
  File "C:\Users\david\.virtualenvs\dome9-cli-b-5h-f_6\lib\site-packages\fire\core.py", line 466, in _Fire
    component, remaining_args = _CallAndUpdateTrace(
  File "C:\Users\david\.virtualenvs\dome9-cli-b-5h-f_6\lib\site-packages\fire\core.py", line 681, in _CallAndUpdateTrace
    component = fn(*varargs, **kwargs)
  File "C:\Users\david\Repositories\dome9-cli\cli\dome9cli.py", line 294, in get_assessment
    data = self._dome9.get_assessment(assessmentId)
  File "C:\Users\david\.virtualenvs\dome9-cli-b-5h-f_6\lib\site-packages\dome9\dome9.py", line 426, in get_assessment
    return self._get(route='AssessmentHistoryV2/%s' % str(assessmentId))
  File "C:\Users\david\.virtualenvs\dome9-cli-b-5h-f_6\lib\site-packages\dome9\dome9.py", line 65, in _get
    return self._request('get', route, payload)
  File "C:\Users\david\.virtualenvs\dome9-cli-b-5h-f_6\lib\site-packages\dome9\dome9.py", line 61, in _request
    raise Exception(err)
Exception: {'code': 404, 'message': 'Not Found', 'content': b'Resource with id 2222222222222 of type AssessmentHistoryEntity was not found'}

Question about run_assessment

Hi, David.
Thanks for writing a great code.
I have a question about your code.

When I run "dome9.run_assessment", I get a 500 error, but I cannot determine if the problem is on the Dome9 side or in my code.
Here is the code I ran. All arguments are set separately with type str.

from dome9 import Dome9
dome9 = Dome9(key=api_key_id, secret=api_secret_key)
dome9.run_assessment(rulesetId, cloudAccountId, region=None)

And here is the error statement.

Exception: {'code': 500, 'message': 'Internal Server Error', 'content': b'An error has occured.'}

Please let me know your thoughts on where the problem lies.

list_protected_assets does not return

While trying to use list_protected_assets() it does not ever return for me. I believe the issue is here as when I comment out this line I get the return I expect.

Am I using the package incorrectly or should this line be removed?

🍺 Authorization: File ~/.dome9

Add new way to authorizate dome9 SDK using a configuration file (something like ~/.dome9)