#!/bin/bash
#
# Define your syslog receiver IP/hostname and port here
LOG_IP=1.2.3.4
LOG_CAPTURE_PORT=514

# Define CEF log base format
cefDate=$(date "+%b %d %T")
cefHost=$(hostname)
cefBase="$cefDate $cefHost CEF:0|RSA|NetWitness Platform|11.3|ThreatAwareAuthentication|High Risk Users Report|6|"

# Get deploy_admin password
DEPLOY_PW=$(security-cli-client --get-config-prop --prop-hierarchy nw.security-client --prop-name platform.deployment.password --quiet)

# Determine ESAPrimary IP/hostname
esaPrimary=$(echo -e 'use orchestration-server\ndb.host.find({installedServices:"ESAPrimary"})' | mongo admin -u deploy_admin -p $DEPLOY_PW | grep -Po "\"hostname\" : \".+?\"" | sed -e "s/\"hostname\" : //g; s/\"//g")

for incidentId in $(echo -e 'use respond-server\ndb.suspicious_users.find({})' | mongo admin -u deploy_admin -p $DEPLOY_PW --host $esaPrimary | grep -Po "\"incidentId\" : \".+?\"" | sed -e "s/\"incidentId\" : //g; s/\"//g" | uniq)
do
	cefLog="$cefBase"
	cefLog+="incidentId=$incidentId "
	for email in $(echo -e "use respond-server\ndb.suspicious_users.find({incidentId:\"$incidentId\"})" | mongo admin -u deploy_admin -p $DEPLOY_PW --host $esaPrimary | grep -Po "\"emailAddress\" : \".+?\"" | sed -e "s/\"emailAddress\" : //g; s/\"//g")
	do
		cefLog+="suspiciousUser=$email "
	done
	incidentCreated=$(echo -e "use respond-server\ndb.incident.find({\"_id\":\"$incidentId\"})" | mongo admin -u deploy_admin -p $DEPLOY_PW --host $esaPrimary | grep -Po "\"created\" : .*?\)" | sed -e "s/\"created\" : ISODate(//g; s/\"\|)//g")
	cefLog+="incidentCreated=$incidentCreated "
	incidentName=$(echo -e "use respond-server\ndb.incident.find({\"_id\":\"$incidentId\"})" | mongo admin -u deploy_admin -p $DEPLOY_PW --host $esaPrimary | grep -Po "\"name\" : \".*?\"" | sed -e "s/\"name\" : //g; s/\"\|)//g")
	cefLog+="incidentName=$incidentName "
	echo "$cefLog" > /tmp/$incidentId.log
	NwLogPlayer -r 3 -f /tmp/$incidentId.log -s $LOG_IP -p $LOG_CAPTURE_PORT
done
