|
1 | | -CB LiveQuery API Examples |
2 | | -========================= |
| 1 | +CB LiveQuery API Examples - DEPRECATED |
| 2 | +====================================== |
3 | 3 |
|
4 | | -Let's cover a few example functions that our LiveQuery Python bindings enable. To begin, we need to import the |
5 | | -relevant libraries:: |
| 4 | +Users of Carbon Black Cloud must transition to the Carbon Black Cloud Python SDK. |
6 | 5 |
|
7 | | - >>> import sys |
8 | | - >>> from cbapi.psc.livequery import CbLiveQueryAPI |
9 | | - >>> from cbapi.psc.livequery.models import Run, Result |
| 6 | +Please see |
| 7 | +`Carbon Black Cloud Python SDK on the Developer Network <https://developer.carbonblack.com/reference/carbon-black-cloud/integrations/python-sdk>`_ |
| 8 | +for details. |
10 | 9 |
|
11 | | - |
12 | | -Now that we've imported the necessary libraries, we can perform some queries on our endpoints. |
13 | | - |
14 | | -Create a Query Run |
15 | | ----------------------------------- |
16 | | - |
17 | | -Let's create a Query Run. First, we specify which profile to use for authentication from our credentials.psc file and |
18 | | -create the LiveQuery object. |
19 | | - |
20 | | - >>> profile = "default' |
21 | | - >>> cb = CbLiveQueryAPI(profile=profile) |
22 | | - |
23 | | -Now, we specify the SQL query that we want to run, name of the run, device IDs, and device types. |
24 | | - |
25 | | - >>> sql = 'select * from logged_in_users;' |
26 | | - >>> name_of_run = 'Selecting all logged in users' |
27 | | - >>> device_ids = '1234567' |
28 | | - >>> device_types = 'WINDOWS' |
29 | | - |
30 | | -Now, we create a query and add these values to it. |
31 | | - |
32 | | - >>> query = cb.query(sql) |
33 | | - >>> query.name(name_of_run) |
34 | | - >>> query.device_ids(device_ids) |
35 | | - >>> query.device_types(device_types) |
36 | | - |
37 | | -Finally, we submit the query and print the results. |
38 | | - |
39 | | - >>> run = query.submit() |
40 | | - >>> print(run) |
41 | | - |
42 | | -This query should return all logged in Windows endpoints with a ``device_id`` of ``1234567``. |
43 | | - |
44 | | -The same query can be executed with the example script |
45 | | -`manage_run.py <https://github.com/carbonblack/cbapi-python/blob/master/examples/livequery/manage_run.py>`_. :: |
46 | | - |
47 | | - python manage_run.py --profile default create --sql 'select * from logged_in_users;' --name 'Selecting all logged in users' --device_ids '1234567' --device_types 'WINDOWS' |
48 | | - |
49 | | -Other possible arguments to ``manage_run.py`` include ``--notify`` and ``--policy_ids``. |
50 | | - |
51 | | -Get Query Run Status |
52 | | ---------------------- |
53 | | - |
54 | | -Now that we've created a Query Run, let's check the status. If we haven't already authenticated with a credentials |
55 | | -profile, we begin by specifying which profile to authenticate with. |
56 | | - |
57 | | - >>> profile = 'default' |
58 | | - >>> cb = CbLiveQueryAPI(profile=profile) |
59 | | - |
60 | | -Next, we select the run with the unique run ID. |
61 | | - |
62 | | - >>> run_id = 'a4oh4fqtmrr8uxrdj6mm0mbjsyhdhhvz' |
63 | | - >>> run = cb.select(Run, run_id) |
64 | | - >>> print(run) |
65 | | - |
66 | | -This can also be accomplished with the example script |
67 | | -`manage_run.py <https://github.com/carbonblack/cbapi-python/blob/master/examples/livequery/manage_run.py>`_:: |
68 | | - |
69 | | - python manage_run.py --profile default --id a4oh4fqtmrr8uxrdj6mm0mbjsyhdhhvz |
70 | | - |
71 | | -In addition, you can specify which order you want results returned. To change from the default ascending order, use |
72 | | -the flag ``-d`` or ``--descending_results``:: |
73 | | - |
74 | | - python manage_run.py --profile default --id a4oh4fqtmrr8uxrdj6mm0mbjsyhdhhvz --descending_results |
75 | | - |
76 | | -Get Query Run Results |
77 | | ---------------------- |
78 | | - |
79 | | -Let's view the results of a run. If we haven't already authenticated, we must start with that. |
80 | | - |
81 | | - >>> profile = 'default' |
82 | | - >>> cb = CbLiveQueryAPI(profile=profile) |
83 | | - |
84 | | -To view the results of a run, we must specify the run ID. |
85 | | - |
86 | | - >>> run_id = 'a4oh4fqtmrr8uxrdj6mm0mbjsyhdhhvz' |
87 | | - >>> results = cb.select(Result).run_id(run_id) |
88 | | - |
89 | | -Finally, we print the results. |
90 | | - |
91 | | - >>> for result in results: |
92 | | - ... print(result) |
93 | | - |
94 | | -Results can be narrowed down with the following criteria:: |
95 | | - |
96 | | - device_ids |
97 | | - status |
98 | | - |
99 | | -Examples of using these criteria are below:: |
100 | | - |
101 | | - >>> device_id = '1234567' |
102 | | - >>> results.criteria(device_id=device_id) |
103 | | - >>> status = 'matched' |
104 | | - >>> results.criteria(status=status) |
105 | | - |
106 | | -Finally, we print the results. |
107 | | - |
108 | | - >>> for result in results: |
109 | | - ... print(result) |
110 | | - |
111 | | - |
112 | | -You can also retrieve run results with the example script |
113 | | -`run_search.py <https://github.com/carbonblack/cbapi-python/blob/master/examples/livequery/run_search.py>`_:: |
114 | | - |
115 | | - python run_search.py --profile default --id a4oh4fqtmrr8uxrdj6mm0mbjsyhdhhvz --device_ids '1234567' --status 'matched' |
| 10 | +CBAPI is not maintained for Carbon Black Cloud. |
0 commit comments