mfesiem / msiem

McAfee SIEM Command Line Interface. Most of the msiempy features accessible with CLI.

McAfee SIEM Command Line Interface

                _                
  _ __ ___  ___(_) ___ _ __ ___  
 | '_ ` _ \/ __| |/ _ | '_ ` _ \ 
 | | | | | \__ | |  __| | | | | |
 |_| |_| |_|___|_|\___|_| |_| |_| CLI
     
 McAfee SIEM Command Line Interface

Most of the msiempy features accessible with CLI.

Based on the work of Andy Walden.

Features

msiem config              Set and print your msiempy config.
msiem alarms              Query alarms with alarms and events based regex filters. 
                          Print, acknowledge, unacknowledge and delete alarms.
msiem esm                 Show ESM version and misc informations regarding your ESM.
msiem ds                  Add datasources from CSV or INI files, list, search, remove.
msiem events              Query events with any simple filter.
msiem api                 Quickly make API requests to any enpoints with any data.

Installation

$ pip install msiem --upgrade

Command Line Interface documentation

Read the documentation or use msiem -h.

More to come !

msiem's Issues

Use better manpage HTML

https://daniel.haxx.se/projects/roffit/

Add default keys for triggering events with `--no_events`

msiem alarms -t LAST_3_DAYS --no_events will show events with keys: ruleName | srcIp | destIp instead of ruleMessage | sourceIp | destIp . This leads into displaying None a lot...

Workaround:
Use msiem alarms -t LAST_3_DAYS --no_events --events_fields ruleMessage sourceIp destIp

Todo: configure a new static var and assign it to events fields if --no_events and SIEM version >=11.x

Implements watchlist operations

Bulk watchlist values import from files.
API limit is 2k per request.

Datasource command

TODO: integrate dstools as msiem ds command

Impossible to copy/paste code from manpage

in version 0.3.1

This issue si because of groff -mandoc -Thtml

Implement event queries

Implement grouped and detail events queries.

msiem events

Switch to Click to handle CLI args

Complex CLI are a pain, this will probably make things clearer

Click docs: https://click.palletsprojects.com/en/7.x/commands/#callback-invocation

Pull alarm condition tree and metadata

msiem alarms --info/-i <id>
--> show the conditionnal xml tree and alarm meta data