Critical System Protection

 View Only

CSP Query Batch files for quick reference of IDS events 

May 18, 2012 11:16 AM

Below is a working example of a quick reference batch that I put together in order to grab data from the CSP console quickly and in a "readable" format so that one doesn't have to launch the console every time.

Pre-reqs
1. There are already queries defined that you would want to pull data against
     for this example, I created a folder under queries called test and then a query that gets the data that i want called checksum in the csp console.
2. There is already a query tools user created
     for this example, I created a query user called queryusername with a password of password
3. The management console is installed on your workstation
4. A folder called csp_events exists under root on your work pc (c:\csp_eventws)

Steps to create and run the batch:
**you will need to modify the set properties in the report_generator.bat file to match your environment

1. place the example.ini for the query in the %programfiles%\Symantec\Critical System Protection\Console directory (assuming you're installed the console in the default location)

2. place the example.bat for the query in the %programfiles%\Symantec\Critical System Protection\Console directory (assuming you're installed the console in the default location)

3. place the report_generator.bat file on your desktop (or other easily accessed location)

I've tried to comment the batch files so that all aspects are easily understood.
enjoy.

----------------------example.ini----------------------------------------------------------------------------------------------------------------------------
[Source]
path=Queries/TEST/checksum
[Action]
action=export
file type=csv
file=c:\csp_reports\eventsall.csv
[Parameters]

----------------------example.bat----------------------------------------------------------------------------------------------------------------------------
@ECHO OFF
REM---- changed path to jre folder root
set JAVA_HOME=C:\Program Files\Symantec\Critical System Protection\Console\jre

REM---- Prepare Appropriate Java Execution Commands -------------------------

if not "%OS%" == "Windows_NT" goto noTitle
set _STARTJAVA=start "Manager" "%JAVA_HOME%\bin\javaw"
set _RUNJAVA="%JAVA_HOME%\bin\javaw"
goto gotTitle
:noTitle
set _STARTJAVA=start "%JAVA_HOME%\bin\javaw"
set _RUNJAVA="%JAVA_HOME%\bin\javaw"

:gotTitle

REM---- Set Up The Runtime Classpath -----------------------------------------

set _CONSOLE_CP=.;conf;lib/seui.jar;lib/sis-ajaxswing.jar;lib/sis-authoring.jar;lib/sis-common.jar;lib/sis-console.jar;lib/sis-dxmt.jar;lib/sis-gilt.jar;lib/sis-graphics.jar;lib/sis-help.jar;lib/sis-liveupdate.jar;lib/sis-mgrapi.jar;lib/sis-ofwt.jar;lib/sis-pengine.jar;lib/sis-profiler.jar;lib/sis-sesa.jar
set _OTHER_CP=lib/activation.jar;lib/ajaxswing.jar;lib/alloy.jar;lib/asboot.jar;lib/certj.jar;lib/dbunit-2.1.jar;lib/gfs.jar;lib/itext-1.2.jar;lib/jasperreports-1.1.1.jar;lib/jcchartK.jar;lib/jhall.jar;lib/jlfgr-1_0.jar;lib/jlu.jar;lib/joesnmp.jar;lib/jsafe.jar;lib/jtds-1.2.jar;lib/junit-4.1.jar;lib/mail.jar;lib/xerces.jar

REM---- echo Using CLASSPATH: "%_CONSOLE_CP%;%_OTHER_CP%"
REM---- Execute The Requested Command ---------------------------------------
:doRun
@start "SCSP" %_RUNJAVA% -Dappfire.home=. -cp "%_CONSOLE_CP%;%_OTHER_CP%" com.symantec.sis.console.ConsoleApp %*
REM--- Added in a delay for roughly 45 seconds in order to allow file rename
ping localhost -n 40 -w 24000 >NUL
goto cleanup

REM---- Restore Environment Variables ---------------------------------------
:cleanup
@echo off
set _CONSOLE_CP=
set _OTHER_CP=
set _RUNJAVA=
set _STARTJAVA=
:finish
REM---- Added in a rename function to todays date with a random integer at the end so multiple files can be created with todays date
REM---- make sure that the folder exists on your work pc at c:\csp_reports, change as needed both here and in the ini file
cd\
cd csp_reports
for /f "tokens=1-5 delims=/ " %%d in ("%date%") do rename eventsall.csv %%e-%%f-%%g-eventsall-%random%.csv
REM---- if operations have failed, remove the previous baseline file
del eventsall.csv
REM---- launch your csp_reports folder
explorer C:\csp_reports

----------------------report_generator.bat----------------------------------------------------------------------------------------------------------------------------

@ECHO OFF
REM-- change the color of the dos window so that you know where you are quickly
COLOR 4f
REM-- CSP Query Report Generator
REM-- variables

REM-- ip address of the csp management server
set querysvr=x.x.x.x

REM-- csp query user id
set queryusr=queryusername

REM-- batch file to launch csp
set querybat=example.bat

REM-- pwd of the query user id
set querypwd=password

REM-- ini file that tells the item what to do
set queryini=example.ini

CLS

:MAINMENU
REM -- Menu choices for server realm
title CSP Report Generator...DO NOT CLOSE THIS WINDOW
ECHO        CSP Report Generator
ECHO ----------------------------------------
ECHO Enter the NUMBER for your report
ECHO ----------------------------------------
REM-- These items can be configured to produce a menu of items to pick from
ECHO      1. events      (type 1)
ECHO      2. events all  (type 2)
ECHO      -----------------------
ECHO      X. EXIT/QUIT   (type x)
SET Choice=
ECHO .
SET /P Choice=Type the NUMBER and press Enter
IF NOT '%Choice%'=='' SET Choice=%Choice:~0,1%
ECHO.
REM-- Corrolate the choices above to the place in the batch file that they jump to
IF /I '%Choice%'=='1' GOTO EVENTS
IF /I '%Choice%'=='2' GOTO EVENTSALL
IF /I '%Choice%'=='X' GOTO End
CLS
ECHO "%Choice%" is not a valid choice. Please choose a number or letter from the menu.
ECHO.
GOTO MAINMENU

REM ------------------------------------------------------------------------------
REM-- Not being used atm
:EVENTS
@echo off
REM-- Not being used....just a placehold for this example
REM-- This will autojump back to the main menu
goto MAINMENU

REM ------------------------------------------------------------------------------
:EVENTSALL
@echo off
REM-- change the color of the dos window so that you know where you are quickly
color 3f
title CSP Generating EventALL File Report
echo generating report
echo please wait
echo script will exit when completed
REM-- Console is installed on a the work pc where the script resides
REM-- Run this script on the work pc
cd\
cd "Program Files\Symantec\Critical System Protection\Console"
%querybat% -u %queryusr% -p %querypwd% -q %queryini% -s %querysvr%
goto MAINMENU

REM ------------------------------------------------------------------------------
:End

 

Statistics
0 Favorited
0 Views
0 Files
0 Shares
0 Downloads

Tags and Keywords

Related Entries and Links

No Related Resource entered.