Edge Defense Manager Client

This simple client allows you to use Edge Defense Manager's public API.

Requirements

• Python (tested on Python 2.7 and Python 3.6.5)
• Requests

Installation:

sudo pip install edm-client

Source code is available on GitHub.

Generating an API Token From Edge Defense Manager

Access to the Edge Defense Manager API requires an API token for authentication. You generate the token in the EDM command line interface (CLI).

The API token is associated with the user account under which it is generated. Any user can generate an EDM API token, except for the root user.

To generate an EDM API token:

1. Establish an SSH connection to EDM.

2. Log in to the operating system CLI with your EDM credentials.

3. To create the token, enter 'services aaa local apitoken generate <username> <one-word-description>'.

   The system responds with the new API token, for example:

   Added token: LMttPZ45FXnJT6IokVh6Px-otiKGDMkUdyQmJMWmWGz

4. For later use, copy the token and then paste it to a text file.

5. To log out of the CLI, enter exit

To View or delete a token, use one of the following commands.

• services aaa local apitoken show
• services aaa local apitoken remove

Using the Client

Import the package:

from edmclient.edm import EdgeDefenseManager
dev = EdgeDefenseManager(<host>, <apitoken>, api_version=<api_version, eg. 'v1'>, raise_on_error=<True|False>)

Managing Devices

Add a device:

dev.devices.add(host='aed_1.example.com',
                apiToken='WWPi7_',
                name='AED_1')

View devices:

dev.devices.show()
dev.devices.show(id=1)

Remove devices:

dev.devices.remove(id=1)

Update a device:

dev.devices.update(id=1,
                   host='aed_1.example.com',
                   apiToken='WWPi7_',
                   name='AED_1')

Partially update a device:

dev.devices.update(id=1, name='NEW_AED_1')
dev.devices.update(id=1, apiToken='sdf79_kjI')

Viewing Alerts

View threats:

dev.alerts.threats.show(start='2018-09-08T00:00:00Z')

View DDoS alerts:

dev.alerts.ddos.show(start='2018-09-08T00:00:00Z')

View DDoS counts:

dev.alerts.ddos.count.show(start='2018-09-08T00:00:00Z')

Viewing Traffic

View traffic:

dev.traffic.edge.show(start='2018-09-08T00:00:00Z')

Viewing Contextual Threat Intelligence (CTI)

View CTI data:

dev.cti.insights.show(indicatorValue='1.2.3.4')

Configuring CTI

View the CTI configuration:

dev.configuration.cti.show()

Add or Update the CTI configuration:

dev.configuration.cti.update(cti_token='ajfdgFJGFGmh27hnbv')

Executive Reporting

Create a new report:

dev.reports.create(name='Example Report')

Update a report:

dev.reports.update(id=1, name='Updated Example Report')

Partial update a report:

dev.reports.partial_update(id=1, name='Updated Example Report')

View a condensed list of all reports:

dev.reports.show(page=1, pageSize=100, order='asc', orderBy='createdAt')

View single report:

dev.reports.show(id=3)

View report status:

dev.reports.show(id=3, show_status=True)

Delete a report:

dev.reports.delete(id=1)

Running Unit Tests

If nose is not installed, then run:

pip3 install nose

Run the following command from the package directory:

nosetests