Installation

Installing DynamiteSDK is easy, but requires that you have a running version of DynamiteNSM in your environment.

Prerequisites

  • Python3.5 or higher.

  • Access to DynamiteNSM monitor instance.

Installation

Install from pip:

pip install dynamite-sdk

Or install via setup.py:

python setup.py install

Configuration

Once installed create a config.cfg in /etc/dynamite/dynamite_sdk/config.cfg or in the runtime directory. The config file will look something like this, but you’ll need to change the elasticsearch_url and elasticsearch_password.:

[AUTHENTICATION]
elasticsearch_url = http://localhost:9200
elasticsearch_user = elastic
elasticsearch_password = changeme

[SEARCH]
timeout = 60
max_results = 20000

Getting Started

Once everything is pointed to your host you can test the connection with the snipit below:

from datetime import datetime, timedelta
from dynamite_sdk.search import Search

# Set our search time period
start = datetime.now() - timedelta(minutes=5)
end = datetime.now()

# Instantiate our Search object
search = Search('events', as_dataframe=True)

# Execute our search
search.execute_query(start, end)

# Get our results as a dataframe
print(search.results)

Extra Examples

  • Working with Netflow and Zeek (conn.log) events [notebook_1]

  • Working with Zeek network protocol events [notebook_2]

  • Pivoting between Zeek events [notebook_3]