msiempy
msiempy copied to clipboard
Periodic ESM Maintenance Tasks with API
Describe The library should cover simple maintenance tasks like
- Removing the old triggered alarms:
OK: This can be done with
AlarmManager
- Removing older reports I don't think so.
- Creating a ESM Settings backup I don't think so.
- Creating a Full Data backup.
Andy's code should be imported to the
ESM
object to create astart_full_backup()
method maybe. - Removing the older Settings back up files: I don't think so.
- Removing the older full back up files locally stored in the ESM I don't think so.
- Performing a dummy write and policy rollout Not yet, See #96
- Running Cron jobs to capture hardware faults, device health status, available disk space in the partitions like checking the index_hd and data_hd available space, swap memory, load average CPU utilization, RAM utilization etc.
Ok: This can be done with
ESM
object - Performing manual rules update if automatic rules update is not enabled. I don't think so.
SIEM and msiempy versions:
- msiempy: 0.3.5
Additional context Ticket open after review of this thread: https://community.mcafee.com/t5/Security-Information-and-Event/Periodic-ESM-Maintenance-Tasks/m-p/672378/highlight/false#