One common use case that I have seen at several customers is that they want their SecOps or Operations folks have the ability to monitor that MSV Actors are up and available.
To prevent false alarms, a script was created to "ping" the actors. The script can be put on a scheduled CRON or be ran manually as a part of the playbook. Feel free to take a look at the Python below and use as needed. For simplicity, I did not include the code to create the HTTPs session to the Director.
# Get the list of non-protected actors
def setup_data_fields():
global nodeData, evalData
response = session.get(f'https://{director_ip}/topology/nodes.json')
if response.status_code != 200:
print('Unable to get node information from director.')
sys.exit(-1)
nodeData = json.loads(response.text)
# get the list of protected actors
def setup_data_fields2():
global nodeData, evalData
response = session.get(f'https://{director_ip}/topology/protected.json')
if response.status_code != 200:
print('Unable to get node information from director.')
sys.exit(-1)
nodeData = json.loads(response.text)
#Just what it says - "Ping the actor"
def refreshTheActor(myID = 0):
response = session.get(f'https://{director_ip}/topology/nodes/{myID}/pull_info')
print (response)
if response.status_code != 422:
print('Unable to refresh the actor.')
sys.exit(-1)
# ping actors that have not checked in in the last 5 minutes
currentRefreshTime = datetime.now() - timedelta(minutes=5)
date_format = "%Y-%m-%dT%H:%M:%S.%fZ"
setup_data_fields()
for myNode in nodeData['registered']:
idNumber = myNode['id']
print(idNumber)
if ((datetime.strptime(myNode['last_comms'],date_format)) > currentRefreshTime):
#add your ALERT HERE
refreshTheActor(idNumber)
setup_data_fields2()
for myNode in nodeData['protected_nodes']:
idNumber = myNode['id']
print(idNumber)
if ((datetime.strptime(myNode['last_comms'],date_format)) > currentRefreshTime):
#add your ALERT HERE
refreshTheActor(idNumber)
LinkedIn
Twitter
