grove.connectors.fleetdm package

FleetDM connectors for Grove.

Submodules

grove.connectors.fleetdm.api module

FleetDM Vulnerability API client.

class grove.connectors.fleetdm.api.Client(token: str | None = None, retry: bool | None = True, params: Dict[str, Any] | None = None, jmespath_queries: str | None = None, api_uri: str | None = None)

Bases: object

get_hosts(params: Dict[str, Any], jmespath_queries: str, api_uri: str, cursor: str | None) → AuditLogEntries

Fetches a list of hosts which match the provided filters.

Parameters:

• params – get parameters json dict from https://fleetdm.com/docs/rest-api/rest-api#list-hosts

• jmespath_queries – jmespath query to filter JSON response as specified at https://jmespath.org/

• cursor – The cursor passed from host_logs.py that includes the last update date of systems in Grove

Returns:

AuditLogEntries object containing a pagination cursor, and log entries.

grove.connectors.fleetdm.host_logs module

FleetDM Vulnerability connector for Grove.

class grove.connectors.fleetdm.host_logs.Connector(config: ConnectorConfig, context: Dict[str, str])

Bases: BaseConnector

LOG_ORDER = 'CHRONOLOGICAL'

NAME = 'fleetdm_host_logs'

POINTER_PATH = 'software_updated_at'

property api_uri

The URI for the API call

For example: https://panel.fleetdm.example.com

Returns:

The configured FleetDM API URI.

collect()

Collects all hosts from the FleetDM API.

property jmespath_queries

Fetches the parameters for the jmespath filters of the data response.

Jmespath query language is defined and can be tested at https://jmespath.org/ This allows you to configure what data to include or filter from the FleetDM response.

An example is:

“jmespath_queries”: “{hostname:hostname,updated_at:updated_at}”

This returns the following structure of data about each host:

{

updated_at: hostname:

}

Returns:

A string of the Jmespath response that should define the JSON object to return. Default is *, the full set of JSON response

property params

Fetches the parameters for the API call.

This is used to set what parameters to use in the API call.

Returns:

The dict of params defined in the connector configuration.