brokensound77 / toruk Goto Github PK

I started to write my own persistent connector for CS/Splunk and found this script. I am new to Python but I managed to get logged-in and set cookies and maintain a session for 2 days with bash ;) the next part is setting up the script to perform Splunk searches ...

CS_BADGER_WIP.txt

getting 401 with single sign on when running spluruk.py -q "earliest=10d latest=now form.analyst=*" for the line:
r5 = self.sesh.post('https://falcon.crowdstrike.com/api2/auth/verify', headers=self.head)

Using browser, I login using my email address and click on continue without having to type in password. I also tried with the username (20 alphanumeric length) and password but still got 401

based on alias, customer name, or cid

Allow for a sleep time to be entered for the loop mode. May need to send the pulse and heartbeat to prevent timeout.

I just wanted to say thank you for posting this. Specifically, https://github.com/brokensound77/toruk/blob/master/tools/spluruk.py

It's the only example I could find of how to use pyotp in a session! I appreciate the example, it really helped me get unstuck.