Technical Library | Support

Go to the table of contents Go to the previous page You are at the end of the document View or print as PDF
Creating Remediation Scripts for TRITON AP-DATA > Code samples
Code samples
Creating Remediation Scripts | Data Protection | Version 8.3.x
This section provides some code samples; some samples use DiscoveryIncidentProcessing, while some don't.
1.
#Set the destination folder for sensitive files
2.
Location = r'\\127.0.0.1\quarantine'
3.
DaysKeepActiveFiles = 0
4.
#--------------------------------------------------------------
5.
#DO NOT MODIFYSCRIPT PAST THIS LINE
6.
import sys
7.
from DiscoveryIncidentProcessing import MoveDiscoveryIncident
8.
 
9.
MoveDiscoveryIncident(sys.argv[1],Location,False,DaysKeepActiveFiles,'')
This example is one of the 3 scripts that come with TRITON AP-DATA and reside in the %dss_home%/RunCommands folder. It is an example of using the DiscoveryIncidentProcessing module and is self-explanatory.
The following example is a little more involved and does the XML parsing without using the helper module - the module is useful only for discovery incidents:
1.
"Send an email to the recipients of a Data in Motion incident"
2.
 
3.
# some XML search path constants for easier XML handling
4.
NS1=u".//{http://www.portauthoritytech.com/schmea/xml-rpc/1.0}"
5.
EVT=u".//{http://www.portauthoritytech.com/schmea/incident/1.0}"
6.
EVTSOURCE=EVT+u"source"
7.
EVTDETAIL=EVT+u"detail"
8.
EVTDESTINATIONS=EVT+u"destinations"
9.
EVTDESTINATION=EVT+u"destination"
10.
EVTSUBJECT=EVT+u"subject"
11.
 
12.
## the email message that would be sent to the user(s)
13.
EMAILMESSAGE="""From: Your friendly TRITON AP-DATA <dss@example.com>\r
14.
To: %(deststring)s\r
15.
Subject: Re: %(subject)s\r
16.
\r
17.
Dear Sir or Madam,\r
18.
\r
19.
A message sent to you from %(source)s with the subject "%(subject)s" has violated the PCI regulation - and therefore has been blocked by TRITON AP-DATA. Please contact the sender and request that they redact all cardholder information (such as name, credit card number, expiration date, CVV) from their message and resend it.\r
20.
\r
21.
Regards,\r
22.
\r
23.
Your friendly TRITON AP-DATA\r
24.
"""
25.
 
26.
# email gateway
27.
SMTPGATEWAY='10.4.228.240:25'
28.
 
29.
import sys
30.
import xml.etree.ElementTree as ET
31.
import smtplib
32.
 
33.
# parse the XML file
34.
oXMLTree=ET.parse(sys.argv[1])
35.
 
36.
## search for a few key pieces of data
37.
dIncidentDetails={}
38.
 
39.
# source
40.
dIncidentDetails['source']=oXMLTree.find(EVTSOURCE).find(EVTDETAIL).get('value')
41.
 
42.
# destinations
43.
lDests=[
44.
elem.find(EVTDETAIL).get('value')
45.
for elem
46.
in oXMLTree.find(EVTDESTINATIONS)
47.
]
48.
dIncidentDetails['deststring']=', '.join(lDests)
49.
 
50.
# extract the subject
51.
dIncidentDetails['subject']=oXMLTree.find(EVTSUBJECT).text
52.
 
53.
## send an email message
54.
 
55.
oSMTP=smtplib.SMTP(SMTPGATEWAY)
56.
oSMTP.sendmail(dIncidentDetails['source'],lDests,EMAILMESSAGE % dIncidentDetails)
57.
oSMTP=None
Please note several important aspects of this example:
*
The search paths constructed on lines 4-10 do not contain the xmlns shortcuts for the namespaces but rather the full URL. This is a requirement of the particular XML library used (xml.etree) and is also more resilient to future changes in the XML format.
*
Lines 13 to 24 contain an IMF message (RFC5322) ready to be sent by SMTP. Note the Pythonic variable substitutions inside the script makes for an easy ad-hock template language.
*
Lines 30 and 34 are all that is required to parse the XML file. Then, extracting information from the XML file is done in a series of searches on lines 40, 44, 46 and 51. It doesn't get easier than this.
*
Lines 43-47 are a Python construct called "list comprehension" - a powerful and useful Python constructs for transforming lists. Read up on it in http://www.python.org/dev/peps/pep-0202/ if you're not familiar with it.
*
Lines 55-57 sends an SMTP message. Please note that the gateway must accept SMTP connections for this to work.
*
There is a bug in this code - if an incoming mail has destinations outside of the organization as well as inside, then all of the destinations will receive the notification message. This is usually not the desired action. Fixing it is easy and left as an exercise to the reader.
The following example is short but very useful:
1.
"copy the context xml file into a backup folder"
2.
import sys,os
3.
 
4.
fileName=sys.argv[1]
5.
 
6.
# check which platform we're on
7.
if sys.platform[:5]=='linux':
8.
tempFolder='/tmp'
9.
elif sys.platform[:3]=='win':
10.
tempFolder=r'c:\temp' # assumes the folder is there!!!
11.
else:
12.
# different platform?
13.
sys.exit(1)
14.
 
15.
newName=os.path.join(tempFolder,os.path.split(fileName)[1])
16.
 
17.
# copy!
18.
newFile=open(newName,'wb')
19.
oldFile=open(fileName,'rb')
20.
newFile.write(oldFile.read())
21.
newFile.close()
This short piece of code simply copies the provided XML file to a temporary location - usually for debugging or further examination.
 
* 
Note 
Lines 7-13 demonstrate how to write a remediation script that is valid on both Windows and Linux. It uses the sys.platform facility to determine the file system structure. Note that the complete string in sys.platform may be linux2, win32, etc - but the script only looks at the first few characters to make a determination.
Additional note: If you want to write multi-platform code in Python, it's best to avoid making assumptions about the environment if possible. Python helps you quite a bit in that regard by providing facilities that performs certain actions regardless of the platform you are on. A very common example is concatenating filenames and folders.
The following code is not cross-platform because it will fail on a Linux machine.
if not folderName[-1:]=='\\':
folderName+=r'\\'
pathName=folderName+fileName
Python provides a comprehensive library of path handling routines - os.path - that works regardless of the operating system the script runs on:
pathName = os.path.join(folderName,fileName)
The same applies to other operations such as splitting a path. For example, the following script:
pathParts = pathName.rsplit('/',1)
if len(pathParts)==2:
folderName,fileName=pathParts
would work just as well using:
folderName,fileName = os.path.split(pathName)
These scripts would work on both operating systems, and also cover corner cases you may not have considered (for example the input is just a folder and not a filename).

Go to the table of contents Go to the previous page You are at the end of the document View or print as PDF
Creating Remediation Scripts for TRITON AP-DATA > Code samples
Copyright 2016 Forcepoint LLC. All rights reserved.