Module: NexposeSCCM

Defined in:

lib/nexpose_sccm.rb,
lib/nexpose_sccm/wql.rb,
lib/nexpose_sccm/version.rb,
lib/nexpose_sccm/collection.rb,
lib/nexpose_sccm/connection.rb,
lib/nexpose_sccm/powershell.rb,
lib/nexpose_sccm/data_source.rb,
lib/nexpose_sccm/helpers/pg_helper.rb,
lib/nexpose_sccm/deployment_package.rb,
lib/nexpose_sccm/utilities/nx_logger.rb,
lib/nexpose_sccm/software_update_group.rb,
lib/nexpose_sccm/helpers/nexpose_helper.rb

Defined Under Namespace

Modules: DataSource, Powershell, Wql Classes: Collection, Connection, DeploymentPackage, NxLogger, SoftwareUpdateGroup

Constant Summary

VERSION =

'0.4.0'

VENDOR =

'Microsoft'

PRODUCT =

'SCCM'

Class Attribute Summary

• .logger ⇒ Object

  Returns the value of attribute logger.

Class Method Summary

• .generate_updates(settings, input_file = nil) ⇒ Object
• .prompt(*args) ⇒ Object
• .setup(settings) ⇒ Object

Class Attribute Details

.logger ⇒ Object

Returns the value of attribute logger.

# File 'lib/nexpose_sccm.rb', line 285

def logger
  @logger
end

Class Method Details

.generate_updates(settings, input_file = nil) ⇒ Object

# File 'lib/nexpose_sccm.rb', line 44

def generate_updates(settings, input_file=nil)
  scope = settings[:sccm][:software_update_group][:scope]
  data_source = settings[:sccm][:data_source]

  if settings[:sccm][:generate_unknown_device_report]
    date = Time.now.strftime('%Y%m%d_%H%M%S')
    report = "devices-not-found-sccm-#{date}.csv"
    report_location = settings[:sccm][:report_location]
    unless File.exist?(File.expand_path(report_location))
      Dir.mkdir(report_location)
    end

    csv_report_contents = Set.new()
  end

  # Get known SCCM devices with details
  sccm_devices = @sccm.get_devices
  ## Get current list of collections
  collections = @sccm.get_collections(sccm_devices)

  ## Initiate the data source connection
  @logger.debug("Logging into Nexpose / DWH")
  @nsc = NexposeSCCM::DataSource::Connection.new(data_source,
                                                 settings[:postgres],
                                                 settings[:nexpose])

  @logger.info("Successfully connected to Data Source #{data_source}")

  sup_data = []
  begin
    query = settings[:queries][scope.to_sym][data_source.to_sym]
    match_for_prompt = query.scan(/'<.*?>'/)

    unless match_for_prompt.nil? || match_for_prompt.empty?
      if !input_file.nil? && File.exist?(input_file)
        inputs = CSV.read(input_file, :headers=>true)
      end

      match_for_prompt.each do |match|
        if !inputs.nil? && inputs.headers.include?(match.gsub("'<",'').gsub(">'",''))
          input = inputs[match.gsub("'<",'').gsub(">'",'')]
        else
          input = prompt("Please provide #{match} to be processed " \
                    "(comma separated for any lists): ").strip.split(',')
        end
        input = input.map{|e| "'#{e}'"}

        query.gsub!(/#{match}/, "#{input.join(',')}")
      end
    end

    @logger.debug("Retrieving Data")
    sup_data = @nsc.fetch_data(query)
  rescue => e
    @logger.error("There was an error running the query. " \
      "Check the scope and data source settings for validity: #{e}")
    exit
  end

  unless sup_data.length > 0
    @logger.debug("No updates returned using query: #{query}")
    @logger.info('No updates to work on. Exiting...')
    exit 0
  end

  ## SUP scopes are defined by the query used to run them.
  @logger.info("Software Update Group scope: #{scope}")

  sugs = {}

  @logger.debug("Getting CI_IDS using scope: #{scope}")

  @logger.info("Looping through output of length #{sup_data.length}")
  sup_data.each do |o|
    unless o.key?(:key)
      @logger.error("Query to pull data from #{data_source} " \
                "does not have the 'key' field, exiting...")
      exit 1
    end

    key = o[settings[:sccm][:software_update_group_key].to_sym]
    collection_key = o[settings[:sccm][:collection_key].to_sym]
    key_ip = o[:ip_address].split(':')[0].strip
    key_hostname = o[:host_name]

    device = sccm_devices.select do |dev|
      (dev.host_name.to_s.casecmp(key_hostname) == 0 unless key_hostname.nil?) ||
        (dev.ip_address.to_a.include?(key_ip) unless key_ip.nil?)
    end.first

    if device.nil?
      if settings[:sccm][:generate_unknown_device_report]
        csv_report_contents << [key_ip, key_hostname]
      end
    else
      collection_name = "Rapid7_#{collection_key}"
      collection_match = collections.select do |collection|
        collection.name.eql?(collection_name)
      end.first

      if collection_match.nil?
        collection_match = NexposeSCCM::Collection.new(collection_name)
        collection_match.members.add(device)
        collections << collection_match
      else
        collection_match.members.add(device)
      end
    end

    unless sugs.key?(key)
      sugs[key] = {
        :ci_ids => [],
        :description => "Scope: #{scope}",
        :name => "Rapid7_#{key}"
      }
    end

    ## Pesky way of grabbing an UUID for the specific microsoft patch until
    ## Nexpose has a better way of making this data available
    nexpose_id = o[:nexpose_id]
    uuid = nil
    begin
      match = nexpose_id.match(/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/).captures
      uuid = match[0]
    rescue
      @logger.debug('Must be no UUID available, going to next...')
    end
    next if uuid.nil?
    ci_ids = @sccm.get_ci_id(uuid)
    next unless ci_ids.length > 0

    sugs[key][:ci_ids] += ci_ids
  end

  ## Get current list of SUGs for update actions
  @logger.debug("Retrieving current Software Update Groups from SCCM")
  groups = @sccm.get_software_update_groups

  sug_objects=[]
  sug_action_type = settings[:sccm][:software_update_group][:action]
  ## At a minimum, we create Software Update Groups
  sugs.each do |k,v|
    @logger.info("Working on SUP: #{k}")
    match = groups.select { |g| g.name.casecmp(v[:name]) == 0 }
    ## Update if we find matching names
    if sug_action_type.casecmp('update') == 0
      if match.length > 0
        sug = match[0]
        sug.ci_ids = v[:ci_ids]
        sug.description = v[:description]
        res = sug.save(@sccm)
        sug_objects << sug
        if res
          msg = "Successfully updated Software Update Group: #{v[:name]}"
          @logger.debug(msg)
        else
          @logger.error("Error updating Software Update Group: #{v[:name]}")
        end
      end
    end

    if sug_action_type.casecmp('create') == 0 || match.empty?
      ## Create sug if action is create or update didn't work.
      sug = NexposeSCCM::SoftwareUpdateGroup.new(v[:name],
                                                 v[:description],
                                                 v[:ci_ids])
      sug_objects << sug
      res = sug.save(@sccm)
      if res
        msg = "Successfully created Software Update Group: #{v[:name]}"
        @logger.debug(msg)
      else
        @logger.error("Error creating Software Update Group: #{v[:name]}")
      end
    end
  end

  # Save collections with devices
  @logger.debug("Saving Collections")
  collections.each do |collection|
    collection.save(@sccm)
  end

  ## Download/deployment package creation if set to true
  if settings[:sccm].key?(:create_deployment_package) &&
    settings[:sccm][:create_deployment_package]
    @logger.debug("Creating the Deployment Packages")
    sug_objects.each do |sug_object|
      name = sug_object.name
      package_name = "Rapid7-Deployment-Package-#{name}"
      package_path = "#{@sccm.staging}\\#{name}"

      deployment_package = @sccm.get_deployment_package(package_name)
      package_id =
        if deployment_package.empty?
          nil
        else
          deployment_package.first[:package_id]
        end
        #deployment_package.empty? ? nil : deployment_package.first[:package_id]
      package = NexposeSCCM::DeploymentPackage.new(package_name,
                                                   name,
                                                   package_path,
                                                   package_id)

      # Don't process if no ci ids for SUG
      unless sug_object.ci_ids.empty?
        @logger.debug("Saving the Deployment Package: #{package_name}")
        # Save deployment package if enabled and doesn't exist already
        package.save(@sccm) if package.id.nil?

        # Download updates if enabled
        @logger.debug("Downloading the Deployment Package")
        package.download_updates(@sccm) if settings[:sccm][:download_updates]
      end
    end
  end

  # Generate report if configured and content exists
  if settings[:sccm][:generate_unknown_device_report]
    report_length = csv_report_contents.length
    if report_length > 0
      @logger.debug("Creating Unknown Device report")
      CSV.open(report_location + report, 'ab') do |csv|
        csv << ['IP Address','Hostname']
        csv_report_contents.each do |entry|
          csv << entry
        end
      end
    end
    @logger.debug("Unknown Device report length: #{report_length}")
  end

  @logger.info("Nexpose SCCM integration has finished.")
end

.prompt(*args) ⇒ Object

# File 'lib/nexpose_sccm.rb', line 280

def prompt(*args)
  print(*args)
  gets
end

.setup(settings) ⇒ Object

# File 'lib/nexpose_sccm.rb', line 14

def setup(settings)
  @logger = NexposeSCCM::NxLogger.instance
  @logger.setup_statistics_collection(NexposeSCCM::VENDOR,
                                      NexposeSCCM::PRODUCT,
                                      NexposeSCCM::VERSION)
  @logger.setup_logging(true,
                        settings[:logging][:log_level],
                        settings[:logging][:log_stdout],
                        settings[:logging][:log_file_rotation],
                        settings[:logging][:log_file_size])
  NexposeSCCM.logger = @logger

  ## Setting up SCCM connection
  @logger.debug("Logging into SCCM")
  sccm = settings[:sccm]
  @sccm = NexposeSCCM::Connection.new(sccm[:protocol],
                                      sccm[:host],
                                      sccm[:port],
                                      sccm[:path],
                                      sccm[:location],
                                      sccm[:user],
                                      sccm[:pass],
                                      sccm[:namespace],
                                      sccm[:staging],
                                      sccm[:no_ssl_peer_verification],
                                      sccm[:ssl_peer_fingerprint])
  ## Logging into SCCM
  @sccm.login
end