bmeyer99/api_json_to_file

Pulls from a enSilo API with basic authentication saves JSON output as a file

api_json_to_file's Issues

Track events that have been pulled

Not only do the events needs to be tracked, thinking sqlite, we need to figure out if an event has been updated with a new item, thinking may need to hash the events when they come in and if we pull again we can check against the hash to see if it changed.

This will be helpful if using the "LastSeen" field to understand if it is later than the previous "LastSeen"

pull events based on last pull
if eventId is already known
if lastSeen is later than previous lastSeen
Pull new events with all data
If RawId matches existing
Move onto next
else save rawId file
replace old events file with new data
else pull as normal

Newly created organizations are not populated after program start

Need to refresh organizations list to pull from all organizations if user has chosen "all" organizations, needs to be during event pull, if all is chosen then update organization list to loop through

Bug - When finds historical data it doesn't pull all new events

Save incoming JSON data to XML file

Convert JSON to XML and save into file

Need to keep track of which organization was previously ran

When you run another pull from a different organization it uses the timestamp of the previous scan

Add organization name to event file names

Password is stored in clear text - need to encrypt in variable

Password is retrieved from user at start, need to store safely in memory for subsequent runs

No error checking for bad password on API call

Cannot pull more than one organization at a time

Need option to pull events for all organizations

Understand how to pull raw events

We can pull the general events at this point. There are raw events, with raw event IDs, that make up the general events.
How are they related, one to many? Many to many?
How does this need to be stored?

Create mapping for JSON event data to FortiSIEM XML format