4.4.7.1. From python objects

Parser for AQL queries and GUI expressions from python objects.

class axonius_api_client.api.wizards.wizard.Wizard(apiobj, log_level='debug')[source]

Bases: object

Parser for AQL queries and GUI expressions from python objects.

Examples

Create a client using axonius_api_client.connect.Connect and assume apiobj is either client.devices or client.users

>>> apiobj = client.devices  # or client.users

Define some entries to parse

>>> entries = [
...   {
...     'value': 'hostname contains test',
...     'type': 'simple',
...   },
...   {
...     'value': 'installed_software // name contains chrome // version earlier_than 82',
...     'type': 'complex'
...   },
... ]

Parse the entries into a query and GUI expressions

>>> parsed = apiobj.wizard.parse(entries=entries)
>>> list(parsed)
['expressions', 'query']

Get the query produced by the wizard

>>> query = parsed["query"]
>>> query[:80]
'(specific_data.data.hostname == regex("test", "i")) and (specific_data.data.inst'

Get the GUI expressions produced by the wizard

>>> expressions = parsed["expressions"]
>>> expressions[0]['filter']
'(specific_data.data.hostname == regex("test", "i"))'
>>> expressions[1]['filter'][:80]
'and (specific_data.data.installed_software == match([(name == regex("chrome", "i'

Use the query to get assets

>>> assets = apiobj.get(query=query)
>>> len(assets)
2

Use the query to get a count of assets >>> count = apiobj.count(query=query) >>> count 2

Use the query and expressions to create a saved query that the GUI understands

>>> sq = apiobj.saved_query.add(name="test", query=query, expressions=expressions)
Parameters:

log_level (typing.Union[str, int]) –

DOCS: str = '\n# Example:\n[\n  {\n    "type": "simple",\n    "value": "( hostname contains test"\n  },\n  {\n    "type": "simple",\n    "value": "! hostname contains internal )"\n  },\n  {\n    "type": "simple",\n    "value": "( os.type equals windows"\n  },\n  {\n    "type": "simple",\n    "value": "| os.type equals os x )"\n  },\n  {\n    "type": "complex",\n    "value": "installed_software // name contains chrome // version earlier_than 82"\n  }\n]\n\n\n# Format -- [] represents optional items:\n# "type": "simple, "value": "[& | ! ( )] FIELD OPERATOR VALUE [)]"\n# Description: "Filter entry for simple fields"\n# "type": "complex", "value": "[& | ! ( )] COMPLEX-FIELD // SUB-FIELD OPERATOR VALUE[ //  ...] [)]"\n# Description: "Filter entry for complex fields and their sub-fields"\n\n# Flags:\n# &  Use and instead of or (default)\n# |  Use or instead of and (overrides &)\n# !  Use not\n# (  Open a parentheses\n# )  Close a parentheses (can also be at end of entry)\n'
__init__(apiobj, log_level='debug')[source]

Query wizard builder.

Parameters:
LOG: logging.Logger

Logger for this object.

APIOBJ

Asset object.

Type:

axonius_api_client.api.assets.asset_mixin.AssetMixin

PARSER

Value parser.

Type:

axonius_api_client.parsers.wizards.WizardParser

parse(entries, source='list of dictionaries')[source]

Parse a list of entries into a query and the associated GUI query wizard expressions.

Parameters:

  • entries (typing.List[dict]) – list of entries to parse

  • source (str) – where entries came from

Return type:

dict

_parse_entries(entries, source)[source]

Parse a list of entries into a query and the associated GUI query wizard expressions.

Parameters:

  • entries (typing.List[dict]) – list of entries to parse

  • source (str) – where entries came from

Raises:

axonius_api_client.exceptions.WizardError – if an entry fails to be parsed

Return type:

typing.List[dict]

_parse_flags(entry, idx, entries, tracker, is_open)[source]

Parse flags from an entry.

Parameters:

  • entry (dict) – entry to parse with Entry.VALUE key

  • idx (int) – index of this entry

  • entries (typing.List[dict]) – all entries

  • tracker (int) – tracker for Entry.WEIGHT key

  • is_open (bool) – parenthesis are currently open

Return type:

dict

_parse_exprs(entries)[source]

Parse a list of entries into GUI expressions.

Parameters:

entries (typing.List[dict]) – list of entries to parse

Raises:

axonius_api_client.exceptions.WizardError – if an entry fails to be parsed

Return type:

typing.List[dict]

_parse_simple(entry, idx)[source]

Parse an entry of type simple into GUI expressions.

Parameters:

  • entry (dict) – entry to parse

  • idx (int) – index of this entry

Return type:

dict

_parse_complex(entry, idx)[source]

Parse an entry of type complex into GUI expressions.

Parameters:

  • entry (dict) – entry to parse

  • idx (int) – index of this entry

Raises:

axonius_api_client.exceptions.WizardError – if sub expr fails to parse

Return type:

dict

_parse_sub(field, value_raw, idx)[source]

Parse sub expression of an entry of type complex.

Parameters:

  • field (dict) – complex field schema

  • value_raw (str) – the value split from the complex filter line

  • idx (int) – index of this entry

Raises:

axonius_api_client.exceptions.WizardError – if sub-field supplied is not a valid sub-field of the complex field

Return type:

dict

_split_flags(value_raw, flags=None)[source]

Parse an expression and get the flags from the beginning and end.

Parameters:
Raises:

axonius_api_client.exceptions.WizardError – if value is empty after removing flags

Return type:

typing.Tuple[typing.List[str], str]

_split_simple(value_raw)[source]

Split a simple query wizard expression into field, operator, and value.

Parameters:

value_raw (str) – the raw unparsed value to parse

Return type:

typing.Tuple[str, str, str]

_split_complex(value_raw)[source]

Split a complex query wizard expression into field and sub-field expressions.

Parameters:

value_raw (str) – the raw unparsed value to parse

Return type:

typing.Tuple[str, typing.List[str]]

_get_operator(operator, field, value_raw)[source]

Validate the supplied operator for an expression for the type of field.

Parameters:

  • operator (str) – operator supplied by user

  • field (dict) – field schema to check that operator is valid for

  • value_raw (str) – raw unparsed value where operator and field came from

Return type:

axonius_api_client.constants.fields.Operator

_get_field(value, value_raw)[source]

Find a field schema for the supplied field name.

Parameters:

  • value (str) – name of field to find schema for

  • value_raw (str) – raw unparsed value where field name came from

Raises:

axonius_api_client.exceptions.WizardError – if field can not be found or is “all” field

Return type:

dict

_get_field_complex(value, value_raw)[source]

Find a field schema for the supplied complex field name.

Parameters:

  • value (str) – name of complex field to find schema for

  • value_raw (str) – raw unparsed value where complex field name came from

Raises:

axonius_api_client.exceptions.WizardError – if field can not be found, is not a complex field, or is “all” field

Return type:

dict

_check_entry_type(etype, types)[source]

Check that a supplied entry type is valid.

Parameters:

  • etype (str) – entry type to check

  • types (typing.List[str]) – valid entry types to check etype against

Raises:

axonius_api_client.exceptions.WizardError – if etype is not on of types

Return type:

str

_check_entry_keys(entry, keys)[source]

Check that an entry has the required keys.

Parameters:

  • entry (dict) – entry to check keys against

  • keys (typing.List[str]) – list of keys that entry must have

Raises:

axonius_api_client.exceptions.WizardError – if key is not in entry, value is empty, or value is not a string

Return type:

dict

_check_patterns(value_raw, value, src, patterns)[source]

Check that a value matches a list of regex patterns.

Parameters:

  • value_raw (str) – raw unparsed value where value came from

  • value (str) – value to check patterns against

  • src (str) – identifier of what value represents

  • patterns (typing.List[str]) – list of regex patterns to check value against

Raises:

axonius_api_client.exceptions.WizardError – if value is empty or does not match one of the patterns

_init()[source]

Post init setup.