Package: code42cli
The Code42 CLIUse thecode42command to interact with your Code42 environment.code42 security-datais a CLI tool for extracting AED events.
Additionally, you can choose to only get events that Code42 previously did not observe since you last recorded a
checkpoint (provided you do not change your query).code42 watchlistsis a collection of tools for managing your employee watchlists.RequirementsPython 3.6.2+InstallationInstall thecode42CLI using:$python3-mpipinstallcode42cliUsageFirst, create your profile:code42profilecreate--nameMY_FIRST_PROFILE--serverexample.authority.com--usernamesecurity.admin@example.comYour profile contains the necessary properties for logging into Code42 servers. After runningcode42 profile create,
the program prompts you about storing a password. If you agree, you are then prompted to input your password.Your password is not shown when you docode42 profile show. However,code42 profile showwill confirm that a
password exists for your profile. If you do not set a password, you will be securely prompted to enter a password each
time you run a command.For development purposes, you may need to ignore ssl errors. If you need to do this, use the--disable-ssl-errorsoption when creating your profile:code42profilecreate-nMY_FIRST_PROFILE-shttps://example.authority.com-usecurity.admin@example.com--disable-ssl-errorsYou can add multiple profiles with different names and the change the default profile with theusecommand:code42profileuseMY_SECOND_PROFILEWhen the--profileflag is available on other commands, such as those insecurity-data, it will use that profile
instead of the default one. For example,code42security-datasearch-b2020-02-02--profileMY_SECOND_PROFILETo see all your profiles, do:code42profilelistSecurity Data and AlertsUsing the CLI, you can query for security events and alerts just like in the admin console, but the results are output
to stdout so they can be written to a file or piped out to another process (for sending to an external syslog server, for
example).The following examples pertain to security events, but can also be used for alerts by replacingsecurity-datawithalerts:To print events to stdout, do:code42security-datasearch-b<begin_date>Note that-bor--beginis usually required.And end date can also be given with-eor--endto query for a specific date range (if end is not passed, it will get all events up to the present time).To specify a begin/end time, you can pass a date or a date w/ time as a string:code42security-datasearch-b'2020-02-02 12:51:00'code42security-datasearch-b'2020-02-02 12:30'code42security-datasearch-b'2020-02-02 12'code42security-datasearch-b2020-02-02or a shorthand string specifying either days, hours, or minutes back from the current time:code42security-datasearch-b30dcode42security-datasearch-b10d-e12hBegin date will be ignored if provided on subsequent queries using-c/--use-checkpoint.Use other formats with-f:code42security-datasearch-b2020-02-02-fCEFThe available formats are CEF, JSON, and RAW-JSON.
Currently, CEF format is only supported for security events.To write events to a file, just redirect your output:code42security-datasearch-b2020-02-02>filename.txtTo send events to an external server, use thesend-tocommand, which behaves the same assearchexcept for defaulting
toRAW-JSONoutput and sending results to an external server instead of to stdout:The default port (if none is specified on the address) is the standard syslog port 514, and default protocol is UDP:code42security-datasend-to10.10.10.42-b1dResults can also be sent over TCP to any port by using the-p/--protocolflag and adding a port to the address argument:code42security-datasend-to10.10.10.42:8080-pTCP-b1dNote: For more complex requirements when sending to an external server (SSL, special formatting, etc.), use a dedicated
syslog forwarding tool likersyslogor connection tunneling tool likestunnel.If you want to periodically run the same query, but only retrieve the new events each time, use the-c/--use-checkpointoption with a name for your checkpoint. This stores the timestamp of the query's last event to a
file on disk and uses that as the "begin date" timestamp filter on the next query that uses the same checkpoint name.
Checkpoints are stored per profile.Initial run requires a begin date:code42security-datasearch-b30d--use-checkpointmy_checkpointSubsequent runs do not:code42security-datasearch--use-checkpointmy_checkpointYou can also use wildcard for queries, but note, if they are not in quotes, you may get unexpected behavior.code42security-datasearch--actor"*"The search query parameters are as follows:-t/--type(exposure types)-b/--begin(begin date)-e/--end(end date)--c42-username--actor--md5--sha256--source--file-name--file-path--process-owner--tab-url--include-non-exposure(does not work with-t)--advanced-query(raw JSON query)You cannot use other query parameters if you use--advanced-query.
To learn more about acceptable arguments, add the-hflag tocode42 security-dataSaved Searches:The CLI can also access "saved searches" that are stored in the admin console, and run them via their saved search ID.Use thesaved-search listsubcommand to list existing searches with their IDs:code42security-datasaved-searchlistTheshowsubcommand will give details about the search with the provided ID:code42security-datasaved-searchshow<ID>To get the results of a saved search, use the--saved-searchoption with your search ID on thesearchsubcommand:code42security-datasearch--saved-search<ID>TroubleshootingIf you keep getting prompted for your password, try resetting withcode42 profile reset-pw.
If that doesn't work, delete your credentials file located at ~/.code42cli or the entry in keychain.Shell tab completionTo enable shell autocomplete when you hittabafter the first few characters of a command name, do the following:For Bash, add this to ~/.bashrc:eval "$(_CODE42_COMPLETE=source_bash code42)"For Zsh, add this to ~/.zshrc:eval "$(_CODE42_COMPLETE=source_zsh code42)"For Fish, add this to ~/.config/fish/completions/code42.fish:eval (env _CODE42_COMPLETE=source_fish code42)Open a new shell to enable completion. Or run the eval command directly in your current shell to enable it temporarily.Writing ExtensionsThe CLI exposes a few helpers for writing custom extension scripts powered by the CLI. Read the user-guidehere.