Using data from ResultSet in tanium_ng

Example Source Dataset

Note

This is only valid for PyTan 4.0.0 (not yet released!!)

This dataset is the return from asking the question Get Computer Name and IP Route Details and IP Address and Installed Applications from all machines, waiting for all answers to come in from 3 clients, and then performing a GetResultData using pytan.handler.get_result_data(). See XML Request and XML Response at the bottom to see the raw XML request and respones to/from Tanium.

ResultSetList objects

ResultSetLists hold a list of ResultSet's, but the API only ever returns one (AFAIK):

>>> type(rd)
<class 'pytan.tanium_ng.ResultSetList'>
>>> print(rd)
ResultSetList: ResultSetList.now=2015/12/30 17:05:01 GMT-0000, ResultSetList.result_set=ResultSet: ResultSet.age=0, ResultSet.archived_question_id=0, ResultSet.columns=ColumnList: ColumnList.length=13, ResultSet.estimated_total=3, ResultSet.expire_seconds=0, ResultSet.filtered_row_count=3, ResultSet.filtered_row_count_machines=3, ResultSet.issue_seconds=0, ResultSet.item_count=3, ResultSet.mr_passed=3, ResultSet.mr_tested=3, ResultSet.passed=3, ResultSet.question_id=40328, ResultSet.report_count=2, ResultSet.row_count=3, ResultSet.row_count_machines=3, ResultSet.rows=RowList: RowList.length=3, ResultSet.saved_question_id=0, ResultSet.seconds_since_issued=0, ResultSet.select_count=4, ResultSet.tested=3

Print when this data was gathered:

>>> print(rd.now)
2015/12/30 17:05:01 GMT-0000

ResultSet object in ResultSetList objects

ResultSets hold the row and column data for a given question:

>>> type(rd.result_set)
<class 'pytan.tanium_ng.ResultSet'>
>>> print(rd.result_set)
ResultSet: ResultSet.age=0, ResultSet.archived_question_id=0, ResultSet.columns=ColumnList: ColumnList.length=13, ResultSet.estimated_total=3, ResultSet.expire_seconds=0, ResultSet.filtered_row_count=3, ResultSet.filtered_row_count_machines=3, ResultSet.issue_seconds=0, ResultSet.item_count=3, ResultSet.mr_passed=3, ResultSet.mr_tested=3, ResultSet.passed=3, ResultSet.question_id=40328, ResultSet.report_count=2, ResultSet.row_count=3, ResultSet.row_count_machines=3, ResultSet.rows=RowList: RowList.length=3, ResultSet.saved_question_id=0, ResultSet.seconds_since_issued=0, ResultSet.select_count=4, ResultSet.tested=3

Print the estimated number of clients currently available:

>>> print(rd.result_set.estimated_total)
3

.. todo:: document the other attributes available in a result_set

Working with rows in ResultSet objects

Get rows from result_set

Rows are stored in rd.result_set.rows:

>>> rows = rd.result_set.rows
>>> type(rows)
<class 'pytan.tanium_ng.RowList'>

Individual rows are available via rows[n] or rows.rows[n]:

>>> type(rows.rows)
<class 'list'>

See how many rows contained in this result_set:

>>> len(rows)
3

Get row 1 for this result set:

>>> row = rows[0]
>>> type(row)
<class 'pytan.tanium_ng.Row'>
>>> print(row)
Row: Row.length=13, Row.id=1301093592, Row.cid=2275854501

Get columns from rows

Columns are available via row[n] or row.columns[n] or row['Display Name']:

>>> type(row.columns)
<class 'list'>

See how many columns are in this row:

>>> len(row)
13

Get col 1 for this row:

>>> col = row[0]
>>> type(col)
<class 'pytan.tanium_ng.Column'>
>>> print(col)
Column: Column.length=1, Column.display_name=Computer Name, Column.result_type_int=1, Column.what_hash=3409330187, Column.result_type=String

Get the hash of the sensor correlated with this column in this row:

>>> print(col.what_hash)
3409330187

Get the name of this sensors subcolumn for this column in this row:

>>> print(col.display_name)
Computer Name

Get the result type of this sensors subcolumn for this column in this row:

>>> print(col.result_type)
String

Get values from columns in rows

Values are available for this column of this row via col[0] or col.values[0]:

>>> type(col.values)
<class 'list'>

See how many values are in this column for this row:

>>> len(col)
1

Get val 1 for this column of this row:

>>> val = col[0]
>>> print(val)
TPT1.pytanlab.com
>>> type(val)
<class 'str'>

Working with Columns in ResultSet objects

Get columns from result_set

Columns are stored in rd.result_set.columns:

>>> columns = rd.result_set.columns
>>> type(columns)
<class 'pytan.tanium_ng.ColumnList'>

Individual columns are available via columns[n] or columns.columns[n]:

>>> type(columns.columns)
<class 'list'>

See how many columns are in this result_set:

>>> len(columns)
13

Get column 1 for this result_set:

>>> col = columns[0]
>>> type(col)
<class 'pytan.tanium_ng.Column'>
>>> print(col)
Column: Column.length=1, Column.display_name=Computer Name, Column.result_type_int=1, Column.what_hash=3409330187, Column.result_type=String

Get the hash of the sensor correlated with this column:

>>> print(col.what_hash)
3409330187

Get the name of this sensors subcolumn for this column:

>>> print(col.display_name)
Computer Name

Get the result type of this sensors subcolumn for this column:

>>> print(col.result_type)
String

Get rows from columns

Rows are available for this column via col[n] or col.values[n]:

>>> type(col.values)
<class 'list'>

See how many rows are in this column:

>>> len(col)
3

Get values from rows in columns

Get the values for the first row of this column:

>>> rowvals = col[0]
>>> print(rowvals)
['TPT1.pytanlab.com']

Get val 1 for this row of this column:

>>> rowval = rowvals[0]
>>> print(rowval)
TPT1.pytanlab.com
>>> type(rowval)
<class 'str'>

Pulling it all together

Get all Rows in list form as an X axis view

This uses the columns as headers for output.

First, get all the column headers:

>>> headers = [c.display_name for c in rd.result_set.columns]

Now get all row values from rows:

>>> all_row_vals = []
>>> for row in rd.result_set.rows:
...   this_row_vals = ['; '.join(row[h].values) for h in headers]
...   all_row_vals.append(this_row_vals)

Print the first 2 columns of the headers:

>>> for i in headers[0:2]:
...     print(i)
Computer Name
Destination

Print the first 2 columns of the each row:

>>> for i in all_row_vals:
...     print(i[0:2])
['TPT1.pytanlab.com', '0.0.0.0; 10.0.1.240; 127.0.0.1; 127.0.0.0; 10.0.1.0']
['WIN-6U71ED4M23D', '10.0.1.11; 127.0.0.1; 0.0.0.0; 127.0.0.0; 10.0.1.0']
['auth-services.pytanlab.com', '0.0.0.0; 127.0.0.1; 127.0.0.0; 10.0.1.230; 10.0.1.0']

Get all Rows in dict form as an X axis view

This uses the columns as headers for output.

Create a dict for each row with the key being the columns display name and the value being the values for that column:

>>> all_row_vals = []
>>> for row in rd.result_set.rows:
...     this_row_vals = {c.display_name: '; '.join(c) for c in row}
...     all_row_vals.append(this_row_vals)
...

Print the first 79 characters of the string form for each row's dict:

>>> for i in all_row_vals:
...    print(str(i)[0:79])
...
{'Interface': '-; -; -; -; -', 'IP Address': '10.0.1.240', 'Computer Name': 'TP
{'Interface': '-; -; -; -; -', 'IP Address': '2604:2000:1200:4000:11a5:a1d7:87d
{'Interface': '-; -; -; -; -', 'IP Address': '10.0.1.230; fe80::c968:9004:3983:

Get all Rows in list form as a Y axis view

This uses the rows as headers for output.

First, create a header to store the column name:

>>> headers = ['Column Name']

Then get all the rows and add a header for each row index:

>>> headers += ['Row {} Values'.format(i + 1) for i, _ in enumerate(rd.result_set.rows)]

Now get all row values from columns:

>>> all_col_vals = []
>>> for col in rd.result_set.columns:
...     this_col_vals = [col.display_name]
...     this_col_vals += ['; '.join(row) for row in col]
...     all_col_vals.append(this_col_vals)

Print the headers:

>>> for i in headers:
...    print(i)
...
Column Name
Row 1 Values
Row 2 Values
Row 3 Values

Print the first 2 rows:

>>> for i in all_col_vals[0:2]:
...     print(i)
...
['Computer Name', 'TPT1.pytanlab.com', 'WIN-6U71ED4M23D', 'auth-services.pytanlab.com']
['Destination', '0.0.0.0; 10.0.1.240; 127.0.0.1; 127.0.0.0; 10.0.1.0', '10.0.1.11; 127.0.0.1; 0.0.0.0; 127.0.0.0; 10.0.1.0', '0.0.0.0; 127.0.0.1; 127.0.0.0; 10.0.1.230; 10.0.1.0']

Get all Rows in dict form as a Y axis view