Package: iqcli
READMEInQuest platform v3 Python client with CLI interface.Install with pippipinstalliqcliInstall withpipenvThis client includes a CLI interface. To set it up withpipenv:Create a virtual environment and installpipenv:python3-mvenvvenv
.venv/bin/activate
pipinstall-UpippipenvInstall dependencies withpipenv:pipenvinstallFollow the remaining steps only for CLI setup.Create a configuration file from the default template:cpconfig.yml.distconfig.ymlEditconfig.ymland set up server details.InQuest Command Line DriverUsage:
    ./iq-cli.py [options] session export <id>
    ./iq-cli.py [options] file search [--limit=<limit>] [--eventid=<eventid>] [--signature-name=<signature-name>] [--signature-category=<signature-category>]
    ./iq-cli.py [options] file download id <id> [--output=<output>] [--dfi-output=<dfi-output>]
    ./iq-cli.py [options] file download hash <(md5|sha1|sha256|sha512)> [--output=<output>] [--dfi-output=<dfi-output>]
    ./iq-cli.py [options] file scan <input>
    ./iq-cli.py [options] saved-search <id> [--limit=<limit>]

Options:
    --api=<apikey>              Specify an API key.
    --host=<hostname>           API server hostname.
    --secure=<true|false>       Use HTTPS if true, HTTP if false [default: true].
    --verify-tls=<true|false>   Verify validity of TLS certificate when using HTTPS [default: true].

    --limit                     Maximum number of entries [default: 25].
    --eventid                   Event ID of the Signature hit.
    --signature-name            Name of the Signature hit.
    --signature-category        Category of the Signature hit.
    --output=<output>           Target file. If not set, the file will be streamed to stdout.
    --dfi-output=<dfi-output>   Target location for DFI content. If not set, DFI content will not be downloaded.CLI examplespipenv./iq-cli.py--apiAPIKEY--hostSERVER--securetrue--verify-tlstruesessionexportID
./iq-cli.py--apiAPIKEY--hostSERVER--securetrue--verify-tlstruefilesearch--limitLIMIT--eventidEVENTID--signature-nameSIGNATURE_NAME--signature-categorySIGNATURE_CATEGORY
./iq-cli.py--apiAPIKEY--hostSERVER--securetrue--verify-tlstruefiledownloadidID--output/path/to/target/file--dfi-output/path/to/target/folder
./iq-cli.py--apiAPIKEY--hostSERVER--securetrue--verify-tlstruefiledownloadhashHASH--output/path/to/target/file--dfi-output/path/to/target/folder
./iq-cli.py--apiAPIKEY--hostSERVER--securetrue--verify-tlstruefilescan/path/to/target/file
./iq-cli.py--apiAPIKEY--hostSERVER--securetrue--verify-tlstruesaved-searchID--limitLIMITpipiqcli--apiAPIKEY--hostSERVER--securetrue--verify-tlstruesessionexportID
iqcli--apiAPIKEY--hostSERVER--securetrue--verify-tlstruefilesearch--limitLIMIT--eventidEVENTID--signature-nameSIGNATURE_NAME--signature-categorySIGNATURE_CATEGORY
iqcli--apiAPIKEY--hostSERVER--securetrue--verify-tlstruefiledownloadidID--output/path/to/target/file--dfi-output/path/to/target/folder
iqcli--apiAPIKEY--hostSERVER--securetrue--verify-tlstruefiledownloadhashHASH--output/path/to/target/file--dfi-output/path/to/target/folder
iqcli--apiAPIKEY--hostSERVER--securetrue--verify-tlstruefilescan/path/to/target/file
iqcli--apiAPIKEY--hostSERVER--securetrue--verify-tlstruesaved-searchID--limitLIMITAPI InterfaceConfiguration and examples:#!/usr/bin/env pythonimportsimplejsonasjson# pipenvimportapifromlibimportclient# pipimportiqcli.apifromiqcli.libimportclientclient.config={'apikey':'0000000000000000000000000000000000000000','server':{'host':'xxxxxx','secure':True,'verify':False,}}# Get full session info by IDentity=api.session.export(session_id=1)# Search by Signature Category:result=api.search.files(limit=2,signature_category='FileID',)# Search by Signature Nameresult=api.search.files(limit=2,signature_name='Adobe PDF',)# Search by Signature EventIDresult=api.search.files(limit=2,eventid=1000000,)# Iterate over search resultsforfileinresult:print(json.dumps(file,indent=4))# Download File by IDapi.file.download_by_id(1,output='/tmp/file.out',dfi_output='/tmp/dfi')# Download File by Hashapi.file.download_by_hash('00000000000000000000000000000000',output='/tmp/file.out',dfi_output='/tmp/dfi')# Scan Fileapi.file.scan('/tmp/file.in')# Run a saved searchapi.search.saved(1,limit=2)