@@ -991,31 +991,31 @@ def facets(self, fieldlist, max_rows=0):
991
991
resp = self ._cb .post_object (url , body = request )
992
992
result = resp .json ()
993
993
return result .get ("results" , [])
994
-
994
+
995
995
def _update_status (self , status , remediation , comment ):
996
- request = { "state" : status , "criteria" : self ._build_criteria (), "query" : self ._query_builder ._collapse ()}
996
+ request = {"state" : status , "criteria" : self ._build_criteria (), "query" : self ._query_builder ._collapse ()}
997
997
if remediation is not None :
998
998
request ["remediation_state" ] = remediation
999
999
if comment is not None :
1000
1000
request ["comment" ] = comment
1001
1001
resp = self ._cb .post_object (self ._bulkupdate_url .format (self ._cb .credentials .org_key ), body = request )
1002
1002
output = resp .json ()
1003
1003
return output ["request_id" ]
1004
-
1004
+
1005
1005
def update (self , remediation = None , comment = None ):
1006
1006
"""
1007
1007
Update all alerts matching the given query. The alerts will be left in an OPEN state after this request.
1008
-
1008
+
1009
1009
:param remediation str: The remediation state to set for all alerts.
1010
1010
:param comment str: The comment to set for all alerts.
1011
1011
:return: The request ID, which may be used to select a WorkflowStatus object.
1012
1012
"""
1013
1013
return self ._update_status ("OPEN" , remediation , comment )
1014
-
1014
+
1015
1015
def dismiss (self , remediation = None , comment = None ):
1016
1016
"""
1017
1017
Dismiss all alerts matching the given query. The alerts will be left in a DISMISSED state after this request.
1018
-
1018
+
1019
1019
:param remediation str: The remediation state to set for all alerts.
1020
1020
:param comment str: The comment to set for all alerts.
1021
1021
:return: The request ID, which may be used to select a WorkflowStatus object.
@@ -1071,7 +1071,7 @@ class CBAnalyticsAlertSearchQuery(BaseAlertSearchQuery):
1071
1071
valid_sensor_actions = ["POLICY_NOT_APPLIED" , "ALLOW" , "ALLOW_AND_LOG" , "TERMINATE" , "DENY" ]
1072
1072
valid_threat_cause_vectors = ["EMAIL" , "WEB" , "GENERIC_SERVER" , "GENERIC_CLIENT" , "REMOTE_DRIVE" ,
1073
1073
"REMOVABLE_MEDIA" , "UNKNOWN" , "APP_STORE" , "THIRD_PARTY" ]
1074
-
1074
+
1075
1075
def __init__ (self , doc_class , cb ):
1076
1076
super ().__init__ (doc_class , cb )
1077
1077
self ._bulkupdate_url = "/appservices/v6/orgs/{0}/alerts/cbanalytics/workflow/_criteria"
0 commit comments