checks/fireeye_content

   1 #!/usr/bin/python
   2 # -*- encoding: utf-8; py-indent-offset: 4 -*-
   3 # +------------------------------------------------------------------+
   4 # |             ____ _               _        __  __ _  __           |
   5 # |            / ___| |__   ___  ___| | __   |  \/  | |/ /           |
   6 # |           | |   | '_ \ / _ \/ __| |/ /   | |\/| | ' /            |
   7 # |           | |___| | | |  __/ (__|   <    | |  | | . \            |
   8 # |            \____|_| |_|\___|\___|_|\_\___|_|  |_|_|\_\           |
   9 # |                                                                  |
  10 # | Copyright Mathias Kettner 2016             mk@mathias-kettner.de |
  11 # +------------------------------------------------------------------+
  12 #
  13 # This file is part of Check_MK.
  14 # The official homepage is at http://mathias-kettner.de/check_mk.
  15 #
  16 # check_mk is free software;  you can redistribute it and/or modify it
  17 # under the  terms of the  GNU General Public License  as published by
  18 # the Free Software Foundation in version 2.  check_mk is  distributed
  19 # in the hope that it will be useful, but WITHOUT ANY WARRANTY;  with-
  20 # out even the implied warranty of  MERCHANTABILITY  or  FITNESS FOR A
  21 # PARTICULAR PURPOSE. See the  GNU General Public License for more de-
  22 # ails.  You should have  received  a copy of the  GNU  General Public
  23 # License along with GNU Make; see the file  COPYING.  If  not,  write
  24 # to the Free Software Foundation, Inc., 51 Franklin St,  Fifth Floor,
  25 # Boston, MA 02110-1301 USA.
  26
  27 # .1.3.6.1.4.1.25597.11.5.1.5.0 456.180 --> FE-FIREEYE-MIB::feSecurityContentVersion.0
  28 # .1.3.6.1.4.1.25597.11.5.1.6.0 1 --> FE-FIREEYE-MIB::feLastContentUpdatePassed.0
  29 # .1.3.6.1.4.1.25597.11.5.1.7.0 2016/02/26 15:42:06 --> FE-FIREEYE-MIB::feLastContentUpdateTime.0
  30
  31 from collections import namedtuple
  32
  33
  34 def parse_fireeye_content(info):
  35     security_content_status_map = {
  36         '1': 'OK',
  37         '0': 'failed',
  38     }
  39
  40     version, update_status_raw, update_time_str = info[0]
  41     update_status = security_content_status_map.get(update_status_raw)
  42
  43     # If content update has never completed, last_update_time contains no valid timestamp
  44     # In that case, we just skip the output
  45     try:
  46         update_time_seconds = \
  47             time.mktime(time.strptime(update_time_str, '%Y/%m/%d %H:%M:%S'))
  48     except ValueError:
  49         update_time_seconds = None
  50
  51     SecurityContent = namedtuple('SecurityContent',
  52                                  'version update_status update_time_str update_time_seconds')
  53     return SecurityContent(version, update_status, update_time_str, update_time_seconds)
  54
  55
  56 def check_fireeye_content(_no_item, params, parsed):
  57     if parsed.update_status != 'OK':
  58         yield 1, 'Update: failed'
  59
  60     yield 0, 'Last update: %s' % parsed.update_time_str
  61
  62     if parsed.update_time_seconds is None:
  63         yield 0, 'update has never completed'
  64     else:
  65         yield check_levels(
  66             time.time() - parsed.update_time_seconds,
  67             None,
  68             params.get('update_time_levels'),
  69             human_readable_func=get_age_human_readable,
  70             infoname="Age",
  71         )
  72
  73     yield 0, "Security version: %s" % parsed.version
  74
  75
  76 check_info["fireeye_content"] = {
  77     "parse_function": parse_fireeye_content,
  78     "inventory_function": discover_single,
  79     "check_function": check_fireeye_content,
  80     "service_description": "Security content",
  81     "snmp_info": (
  82         ".1.3.6.1.4.1.25597.11.5.1",
  83         [
  84             "5",  # FE-FIREEYE-MIB::feSecurityContentVersion
  85             "6",  # FE-FIREEYE-MIB::feLastContentUpdatePassed
  86             "7",  # FE-FIREEYE-MIB::feLastContentUpdateTime
  87         ]),
  88     "snmp_scan_function": scan_fireeye,
  89     "includes": ["fireeye.include"],
  90     "group": "fireeye_content",
  91 }