Installation¶
Installing DynamiteSDK is easy, but requires that you have a running version of DynamiteNSM in your environment.
Prerequisites¶
Python3.5 or higher.
Access to DynamiteNSM monitor instance.
Installation¶
Install from pip:
pip install dynamite-sdk
Or install via setup.py:
python setup.py install
Configuration¶
Once installed create a config.cfg in /etc/dynamite/dynamite_sdk/config.cfg or in the runtime directory. The config file will look something like this, but you’ll need to change the elasticsearch_url and elasticsearch_password.:
[AUTHENTICATION]
elasticsearch_url = http://localhost:9200
elasticsearch_user = elastic
elasticsearch_password = changeme
[SEARCH]
timeout = 60
max_results = 20000
Getting Started¶
Once everything is pointed to your host you can test the connection with the snipit below:
from datetime import datetime, timedelta
from dynamite_sdk.search import Search
# Set our search time period
start = datetime.now() - timedelta(minutes=5)
end = datetime.now()
# Instantiate our Search object
search = Search('events', as_dataframe=True)
# Execute our search
search.execute_query(start, end)
# Get our results as a dataframe
print(search.results)
Extra Examples¶
Working with Netflow and Zeek (conn.log) events [notebook_1]
Working with Zeek network protocol events [notebook_2]
Pivoting between Zeek events [notebook_3]