`laceworksdk.api.v2.activities`

Lacework Activities API wrapper.

Module Contents

Classes

ActivitiesAPI

A class used to represent the Activities API endpoint

class laceworksdk.api.v2.activities.ActivitiesAPI(session)[source]

A class used to represent the Activities API endpoint

Get information about network activities detected through the Lacework agent.

The Activities API endpoint is a parent for different types of activities that can be queried.

Attributes:

changed_files:: A ChangedFilesAPI instance.
connections:: A ConnectionsAPI instance.
dns:: A DnsAPI instance.
user_logins:: A UserLoginsAPI instance.

class ChangedFilesAPI(session, object_type, endpoint_root='/api/v2')[source]

Bases: laceworksdk.api.search_endpoint.SearchEndpoint

A class used to represent the Changed Files API endpoint

Search for changed files in your environment

property session: Get the HttpSession instance the object is using.

search(json=None, resource=None)

A method to search objects.

See the API documentation for this API endpoint for valid fields to search against.

NOTE: While the “value” and “values” fields are marked as “optional” you must use one of them, depending on the operation you are using.

Parameters:

json (dict) –
The desired search parameters:
- timeFilter (dict, optional): A dict containing the time frame for the search:
  - startTime (str): The start time for the search
  - endTime (str): The end time for the search
- filters (list of dict, optional): Filters based on field contents:
  - field (str): The name of the data field to which the condition applies
  - expression (str): The comparison operator for the filter condition. Valid values are:
  ”eq”, “ne”, “in”, “not_in”, “like”, “ilike”, “not_like”, “not_ilike”, “not_rlike”, “rlike”, “gt”, “ge”, “lt”, “le”, “between”
  - value (str, optional): The value that the condition checks for in the specified field. Use this attribute when using an operator that requires a single value.
  - values (list of str, optional): The values that the condition checks for in the specified field. Use this attribute when using an operator that requires multiple values.
- returns (list of str, optional): The fields to return
resource (str) – The Lacework API resource to search (Example: “AlertChannels”)

Yields:

dict – returns a generator which yields a page of objects at a time as returned by the Lacework API.

class ConnectionsAPI(session, object_type, endpoint_root='/api/v2')[source]

Bases: laceworksdk.api.search_endpoint.SearchEndpoint

A class used to represent the Connections API endpoint

Search for connections in your environment.

property session: Get the HttpSession instance the object is using.

search(json=None, resource=None)

A method to search objects.

See the API documentation for this API endpoint for valid fields to search against.

NOTE: While the “value” and “values” fields are marked as “optional” you must use one of them, depending on the operation you are using.

Parameters:

json (dict) –
The desired search parameters:
- timeFilter (dict, optional): A dict containing the time frame for the search:
  - startTime (str): The start time for the search
  - endTime (str): The end time for the search
- filters (list of dict, optional): Filters based on field contents:
  - field (str): The name of the data field to which the condition applies
  - expression (str): The comparison operator for the filter condition. Valid values are:
  ”eq”, “ne”, “in”, “not_in”, “like”, “ilike”, “not_like”, “not_ilike”, “not_rlike”, “rlike”, “gt”, “ge”, “lt”, “le”, “between”
  - value (str, optional): The value that the condition checks for in the specified field. Use this attribute when using an operator that requires a single value.
  - values (list of str, optional): The values that the condition checks for in the specified field. Use this attribute when using an operator that requires multiple values.
- returns (list of str, optional): The fields to return
resource (str) – The Lacework API resource to search (Example: “AlertChannels”)

Yields:

dict – returns a generator which yields a page of objects at a time as returned by the Lacework API.

class DnsAPI(session, object_type, endpoint_root='/api/v2')[source]

Bases: laceworksdk.api.search_endpoint.SearchEndpoint

A class used to represent the DNS Lookup API endpoint

Search for DNS summaries in your environment.

property session: Get the HttpSession instance the object is using.

search(json=None, resource=None)

A method to search objects.

See the API documentation for this API endpoint for valid fields to search against.

NOTE: While the “value” and “values” fields are marked as “optional” you must use one of them, depending on the operation you are using.

Parameters:

json (dict) –
The desired search parameters:
- timeFilter (dict, optional): A dict containing the time frame for the search:
  - startTime (str): The start time for the search
  - endTime (str): The end time for the search
- filters (list of dict, optional): Filters based on field contents:
  - field (str): The name of the data field to which the condition applies
  - expression (str): The comparison operator for the filter condition. Valid values are:
  ”eq”, “ne”, “in”, “not_in”, “like”, “ilike”, “not_like”, “not_ilike”, “not_rlike”, “rlike”, “gt”, “ge”, “lt”, “le”, “between”
  - value (str, optional): The value that the condition checks for in the specified field. Use this attribute when using an operator that requires a single value.
  - values (list of str, optional): The values that the condition checks for in the specified field. Use this attribute when using an operator that requires multiple values.
- returns (list of str, optional): The fields to return
resource (str) – The Lacework API resource to search (Example: “AlertChannels”)

Yields:

dict – returns a generator which yields a page of objects at a time as returned by the Lacework API.

class UserLoginsAPI(session, object_type, endpoint_root='/api/v2')[source]

Bases: laceworksdk.api.search_endpoint.SearchEndpoint

A class used to represent the UserLogins API endpoint

Search for user logins in your environment.

property session: Get the HttpSession instance the object is using.

search(json=None, resource=None)

A method to search objects.

See the API documentation for this API endpoint for valid fields to search against.

NOTE: While the “value” and “values” fields are marked as “optional” you must use one of them, depending on the operation you are using.

Parameters:

json (dict) –
The desired search parameters:
- timeFilter (dict, optional): A dict containing the time frame for the search:
  - startTime (str): The start time for the search
  - endTime (str): The end time for the search
- filters (list of dict, optional): Filters based on field contents:
  - field (str): The name of the data field to which the condition applies
  - expression (str): The comparison operator for the filter condition. Valid values are:
  ”eq”, “ne”, “in”, “not_in”, “like”, “ilike”, “not_like”, “not_ilike”, “not_rlike”, “rlike”, “gt”, “ge”, “lt”, “le”, “between”
  - value (str, optional): The value that the condition checks for in the specified field. Use this attribute when using an operator that requires a single value.
  - values (list of str, optional): The values that the condition checks for in the specified field. Use this attribute when using an operator that requires multiple values.
- returns (list of str, optional): The fields to return
resource (str) – The Lacework API resource to search (Example: “AlertChannels”)

Yields:

dict – returns a generator which yields a page of objects at a time as returned by the Lacework API.

laceworksdk.api.v2.activities

Module Contents

Classes

Attributes:

`laceworksdk.api.v2.activities`