Python program using SEPM API to fetch information related to all endpoints. File can be used as
template to fetch other information using SEPM API.
Suggestions and usecases are most welcome to further extend.
Note: I failed to find AV definition version related to endpoint from API
import requests, json, pprint
pagesize = 1000
api_url_base = "https://<IPAddress>:8446/sepm/api/v1/"
authentication_url = "https://<IPAddress>:8446/sepm/api/v1/identity/authenticate"
# if output is required in JSON format
json_format = True
# Provide Username and Password details of SEPM console
payload = {
"username" : "*******","password" : "*******","domain" : ""}
headers = {"Content-Type":"application/json"}
#requests.packages.urllib3.util.ssl_.DEFAULT_CIPHERS += 'HIGH:!DH:!aNULL' # necessary
#r = requests.Session() # Start session in order to store the SessionID Cookie
r = requests.post(authentication_url, verify=False, headers=headers, data=json.dumps(payload))
api_token = (r.json()["token"])
headers = {'Content-Type': 'application/json', 'Authorization': 'Bearer {0}'.format(api_token)}
#Function to fetch information based on URL passed and response
def get_info(url,params):
api_url = url
params = params
response = requests.get(api_url, headers=headers,verify=False, params=params)
if response.status_code == 200:
return json.loads(response.content.decode('utf-8'))
else:
return response.status_code
def aggregate(endpoint_info,numberOfElements):
#pprint.pprint(endpoints_info)
itr =0
while itr <= (numberOfElements-1):
computerName=endpoints_info['content'][itr]['computerName']
ipAddresses=endpoints_info['content'][itr]['ipAddresses'][0]
logonUserName=endpoints_info['content'][itr]['logonUserName']
lastUpdateTime=endpoints_info['content'][itr]['creationTime']
agentVersion = endpoints_info['content'][itr]['agentVersion']
print(computerName, ipAddresses, logonUserName, agentVersion)
itr = itr+1
# REST API URL to fetch information
groups_url = '{0}groups'.format(api_url_base)
fingerprint_url = '{0}policy-objects/fingerprints'.format(api_url_base)
endpoints_url = '{0}computers?'.format(api_url_base)
total_pages = get_info(endpoints_url,{'pageSize':pagesize})['totalPages']
#for itr in range(total_pages):
itr = 1
while itr <= total_pages:
params = {'pageSize':pagesize, 'pageIndex':itr}
endpoints_info = get_info(endpoints_url,params)
numberOfElements = endpoints_info['numberOfElements']
itr = itr +1
if endpoints_info is not 200:
#pprint.pprint(endpoints_info)
aggregate(endpoints_info,numberOfElements)
else:
print('[!] Request Failed, {0}')
#req= requests.post(groups_url, None, {"Authorization": "Bearer %s" %r.json()["token"]})