Lacework Reports CLI/SDK

Coverage Report

laceworkreports is a Python cli/package for creating reports from Lacework data.

🚀 Features

Retrieve Lacework API data from activities, entities, queries, configs
Save results as csv, json, or to postgres
Transform results using jinja template
Override returned field names using field_map (supports nested json notation: parent.child.value)
Stores complex json objects as JSONB in postgres
Flatten json structures before writing

CLI Usage

laceworkreports export vulnerabilities hosts csv --file-path="export.csv"

laceworkreports

See CLI README for details.

SDK Usage

from laceworkreports import common
from laceworkreports.sdk.DataHandlers import (
    DataHandlerTypes,
    ExportHandler,
    QueryHandler,
)

eh = ExportHandler(
    format=DataHandlerTypes.CSV,
    results=QueryHandler(
        client=LaceworkClient(),
        type=common.ObjectTypes.Activities.value,
        object=common.ActivitiesTypes.DNSSummaries.value,
        filters=[{"field": "mid", "expression": "eq", "value": 851}],
        returns=["fqdn"],
    ).execute(),
    file_path="export.csv",
).export()

See example.py for details.

Installation

pip install -U laceworkreports

or install with Poetry

poetry add laceworkreports

Then you can run

laceworkreports --help

or with Poetry:

poetry run laceworkreports --help

or run with docker:

docker run --rm -it --name laceworkreports \
    -v ~/.lacework.toml:/home/user/.lacework.toml -v $(pwd)/reports:/app/reports \
    laceworkps/laceworkreports:latest --help

or run with docker and start a shell:

docker run --rm --entrypoint="/bin/bash" -it --name laceworkreports \
    -v ~/.lacework.toml:/home/user/.lacework.toml -v $(pwd)/reports:/app/reports \
    laceworkps/laceworkreports:latest --help

or run with docker and force uid:gid on the volume mount (may be required for write permissions):

docker run --rm -it \
    --name laceworkreports \
    -v ~/.lacework.toml:/home/user/.lacework.toml \
    -v $(pwd)/reports:/app/reports \
    --env=HOME=/home/user \
    --user $UID:$GID \
    laceworkps/laceworkreports:latest

📈 Releases

You can see the list of available releases on the GitHub Releases page.

We follow Semantic Versions specification.

We use Release Drafter. As pull requests are merged, a draft release is kept up-to-date listing the changes, ready to publish when you’re ready. With the categories option, you can categorize pull requests in release notes using labels.

List of labels and corresponding titles

Label	Title in Releases
`enhancement`, `feature`	🚀 Features
`bug`, `refactoring`, `bugfix`, `fix`	🔧 Fixes & Refactoring
`build`, `ci`, `testing`	📦 Build System & CI/CD
`breaking`	💥 Breaking Changes
`documentation`	📝 Documentation
`dependencies`	⬆️ Dependencies updates

🛡 License

This project is licensed under the terms of the BSD-3 license. See LICENSE for more details.

📃 Citation

@misc{laceworkreports,
  author = {Lacework Inc.},
  title = {laceworkreports is a Python cli/package for creating reports from Lacework data.},
  year = {2022},
  publisher = {GitHub},
  journal = {GitHub repository},
  howpublished = {\url{https://github.com/laceworkps/laceworkreports}}
}

Release files for laceworkreports 1.3.48

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for laceworkreports 1.3.48
File	Size	Uploaded
laceworkreports-1.3.48.tar.gz	414.4 kB	Nov 9, 2022	Details

Built distribution (wheel)

Table of built distributions (wheels) for laceworkreports 1.3.48
File	Interpreter	ABI	Platform	Reset
laceworkreports-1.3.48-py3-none-any.whl 422.6 kB Nov 9, 2022	Python 3	none	any	Details

Total release size: 837.1 kB

Release files / laceworkreports-1.3.48.tar.gz

Download URL	laceworkreports-1.3.48.tar.gz
Size	414.4 kB
Tags	Source
SHA-256 checksum How to use checksums	`a6a36c13296afd2bac9b92ba17d6221028f75817e1e19f08cc171c35e4ad14a8`
BLAKE2b-256 checksum How to use checksums	`e2d43c8b050da2f2d8f1145f04c7296046108517c612ddf406ac8d7110e66806`
Upload date	Nov 9, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`poetry/1.2.2 CPython/3.8.10 Linux/5.15.0-1022-azure`

Release files / laceworkreports-1.3.48-py3-none-any.whl

Download URL	laceworkreports-1.3.48-py3-none-any.whl
Size	422.6 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`1ff7c896299da167563473b08326e06bb8e20527acea8730161eb848736d38f2`
BLAKE2b-256 checksum How to use checksums	`56f818a39073db2330b4bff14a37fd162b4cfae6b0c6bbee6930ac4c7a738984`
Upload date	Nov 9, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`poetry/1.2.2 CPython/3.8.10 Linux/5.15.0-1022-azure`