From 177ebe637f87ef2a3f9fb38780ad3a8cdd9945ca Mon Sep 17 00:00:00 2001
From: wh1te909 <dcparsi@gmail.com>
Date: Wed, 20 May 2020 08:19:55 +0000
Subject: [PATCH] added event log checks
 wh1te909/winagent@de54b262eab48f43d3eeb69a8940390507e71e03

---
 src/components/ChecksTab.vue                  |  54 +++++-
 .../automation/OverviewChecksTab.vue          |   6 +-
 src/components/automation/PolicyChecksTab.vue |  46 +++--
 .../modals/checks/AddEventLogCheck.vue        | 149 ++++++++++++++++
 .../modals/checks/EditEventLogCheck.vue       | 161 ++++++++++++++++++
 .../modals/checks/EventLogCheckOutput.vue     |  50 ++++++
 .../modals/tasks/AddAutomatedTask.vue         |   3 +-
 7 files changed, 454 insertions(+), 15 deletions(-)
 create mode 100644 src/components/modals/checks/AddEventLogCheck.vue
 create mode 100644 src/components/modals/checks/EditEventLogCheck.vue
 create mode 100644 src/components/modals/checks/EventLogCheckOutput.vue

diff --git a/src/components/ChecksTab.vue b/src/components/ChecksTab.vue
index 3edc208..3bc7d1f 100644
--- a/src/components/ChecksTab.vue
+++ b/src/components/ChecksTab.vue
@@ -41,6 +41,12 @@
               </q-item-section>
               <q-item-section>Script Check</q-item-section>
             </q-item>
+            <q-item clickable v-close-popup @click="showAddEventLogCheck = true">
+              <q-item-section side>
+                <q-icon size="xs" name="fas fa-clipboard-list" />
+              </q-item-section>
+              <q-item-section>Event Log Check</q-item-section>
+            </q-item>
           </q-list>
         </q-menu>
       </q-btn>
@@ -145,6 +151,9 @@
               <q-td
                 v-else-if="props.row.check_type === 'winsvc'"
               >Service Check - {{ props.row.svc_display_name }}</q-td>
+              <q-td
+                v-else-if="props.row.check_type === 'eventlog'"
+              >Event Log Check - {{ props.row.desc }}</q-td>
               <q-td v-if="props.row.status === 'pending'">Awaiting First Synchronization</q-td>
               <q-td v-else-if="props.row.status === 'passing'">
                 <q-badge color="positive">Passing</q-badge>
@@ -164,6 +173,12 @@
                   @click="scriptMoreInfo(props.row)"
                 >output</span>
               </q-td>
+              <q-td v-else-if="props.row.check_type === 'eventlog'">
+                <span
+                  style="cursor:pointer;color:blue;text-decoration:underline"
+                  @click="eventLogMoreInfo(props.row)"
+                >output</span>
+              </q-td>
               <q-td v-else>{{ props.row.more_info }}</q-td>
               <q-td>{{ props.row.last_run }}</q-td>
               <q-td>{{ props.row.assigned_task }}</q-td>
@@ -239,6 +254,23 @@
     <q-dialog v-model="showScriptOutput">
       <ScriptOutput @close="showScriptOutput = false; scriptInfo = {}" :scriptInfo="scriptInfo" />
     </q-dialog>
+    <!-- event log check -->
+    <q-dialog v-model="showAddEventLogCheck">
+      <AddEventLogCheck @close="showAddEventLogCheck = false" :agentpk="checks.pk" />
+    </q-dialog>
+    <q-dialog v-model="showEditEventLogCheck">
+      <EditEventLogCheck
+        @close="showEditEventLogCheck = false"
+        :editCheckPK="editCheckPK"
+        :agentpk="checks.pk"
+      />
+    </q-dialog>
+    <q-dialog v-model="showEventLogOutput">
+      <EventLogCheckOutput
+        @close="showEventLogOutput = false; evtlogdata = {}"
+        :evtlogdata="evtlogdata"
+      />
+    </q-dialog>
   </div>
 </template>
 
@@ -259,6 +291,9 @@ import EditWinSvcCheck from "@/components/modals/checks/EditWinSvcCheck";
 import AddScriptCheck from "@/components/modals/checks/AddScriptCheck";
 import EditScriptCheck from "@/components/modals/checks/EditScriptCheck";
 import ScriptOutput from "@/components/modals/checks/ScriptOutput";
+import AddEventLogCheck from "@/components/modals/checks/AddEventLogCheck";
+import EditEventLogCheck from "@/components/modals/checks/EditEventLogCheck";
+import EventLogCheckOutput from "@/components/modals/checks/EventLogCheckOutput";
 
 export default {
   name: "ChecksTab",
@@ -275,7 +310,10 @@ export default {
     EditWinSvcCheck,
     AddScriptCheck,
     EditScriptCheck,
-    ScriptOutput
+    ScriptOutput,
+    AddEventLogCheck,
+    EditEventLogCheck,
+    EventLogCheckOutput
   },
   mixins: [mixins],
   data() {
@@ -293,8 +331,12 @@ export default {
       showAddScriptCheck: false,
       showEditScriptCheck: false,
       showScriptOutput: false,
+      showAddEventLogCheck: false,
+      showEditEventLogCheck: false,
+      showEventLogOutput: false,
       editCheckPK: null,
       scriptInfo: {},
+      evtlogdata: {},
       columns: [
         { name: "smsalert", field: "text_alert", align: "left" },
         { name: "emailalert", field: "email_alert", align: "left" },
@@ -355,6 +397,10 @@ export default {
       this.scriptInfo = props;
       this.showScriptOutput = true;
     },
+    eventLogMoreInfo(props) {
+      this.evtlogdata = props;
+      this.showEventLogOutput = true;
+    },
     editCheck(category) {
       switch (category) {
         case "diskspace":
@@ -375,6 +421,9 @@ export default {
         case "script":
           this.showEditScriptCheck = true;
           break;
+        case "eventlog":
+          this.showEditEventLogCheck = true;
+          break;
         default:
           return false;
       }
@@ -411,7 +460,8 @@ export default {
         ...this.checks.memchecks,
         ...this.checks.scriptchecks,
         ...this.checks.winservicechecks,
-        ...this.checks.pingchecks
+        ...this.checks.pingchecks,
+        ...this.checks.eventlogchecks
       ];
     }
   }
diff --git a/src/components/automation/OverviewChecksTab.vue b/src/components/automation/OverviewChecksTab.vue
index dc92fa0..62d90d3 100644
--- a/src/components/automation/OverviewChecksTab.vue
+++ b/src/components/automation/OverviewChecksTab.vue
@@ -68,6 +68,9 @@
               <q-td
                 v-else-if="props.row.check_type === 'winsvc'"
               >Service Check - {{ props.row.svc_display_name }}</q-td>
+              <q-td
+                v-else-if="props.row.check_type === 'eventlog'"
+              >Event Log Check - {{ props.row.desc }}</q-td>
               <q-td v-if="props.row.status === 'pending'">Awaiting First Synchronization</q-td>
               <q-td v-else-if="props.row.status === 'passing'">
                 <q-badge color="positive">Passing</q-badge>
@@ -155,7 +158,8 @@ export default {
         ...this.checks.memchecks,
         ...this.checks.scriptchecks,
         ...this.checks.winservicechecks,
-        ...this.checks.pingchecks
+        ...this.checks.pingchecks,
+        ...this.checks.eventlogchecks
       ];
     }
   }
diff --git a/src/components/automation/PolicyChecksTab.vue b/src/components/automation/PolicyChecksTab.vue
index 03e627d..968242e 100644
--- a/src/components/automation/PolicyChecksTab.vue
+++ b/src/components/automation/PolicyChecksTab.vue
@@ -41,6 +41,12 @@
               </q-item-section>
               <q-item-section>Script Check</q-item-section>
             </q-item>
+            <q-item clickable v-close-popup @click="showAddEventLogCheck = true">
+              <q-item-section side>
+                <q-icon size="xs" name="fas fa-clipboard-list" />
+              </q-item-section>
+              <q-item-section>Event Log Check</q-item-section>
+            </q-item>
           </q-list>
         </q-menu>
       </q-btn>
@@ -102,11 +108,7 @@
 
                   <q-separator></q-separator>
 
-                  <q-item
-                    clickable
-                    v-close-popup
-                    @click="showPolicyCheckStatusModal(props.row)"
-                  >
+                  <q-item clickable v-close-popup @click="showPolicyCheckStatusModal(props.row)">
                     <q-item-section side>
                       <q-icon name="remove_red_eye" />
                     </q-item-section>
@@ -153,6 +155,9 @@
               <q-td
                 v-else-if="props.row.check_type === 'winsvc'"
               >Service Check - {{ props.row.svc_display_name }}</q-td>
+              <q-td
+                v-else-if="props.row.check_type === 'eventlog'"
+              >Event Log Check - {{ props.row.desc }}</q-td>
               <q-td>
                 <q-btn
                   label="See Status"
@@ -232,12 +237,21 @@
         :policypk="checks.id"
       />
     </q-dialog>
-    <q-dialog v-model="showPolicyCheckStatus">
-      <PolicyCheckStatus 
-        :check="statusCheck" 
-        @close="closePolicyCheckStatusModal" 
+    <!-- event log check -->
+    <q-dialog v-model="showAddEventLogCheck">
+      <AddEventLogCheck @close="showAddEventLogCheck = false" :policypk="checks.id" />
+    </q-dialog>
+    <q-dialog v-model="showEditEventLogCheck">
+      <EditEventLogCheck
+        @close="showEditEventLogCheck = false"
+        :editCheckPK="editCheckPK"
+        :policypk="checks.id"
       />
     </q-dialog>
+
+    <q-dialog v-model="showPolicyCheckStatus">
+      <PolicyCheckStatus :check="statusCheck" @close="closePolicyCheckStatusModal" />
+    </q-dialog>
   </div>
 </template>
 
@@ -258,6 +272,8 @@ import EditWinSvcCheck from "@/components/modals/checks/EditWinSvcCheck";
 import AddScriptCheck from "@/components/modals/checks/AddScriptCheck";
 import EditScriptCheck from "@/components/modals/checks/EditScriptCheck";
 import PolicyCheckStatus from "@/components/automation/modals/PolicyCheckStatus";
+import AddEventLogCheck from "@/components/modals/checks/AddEventLogCheck";
+import EditEventLogCheck from "@/components/modals/checks/EditEventLogCheck";
 
 export default {
   name: "PolicyChecksTab",
@@ -275,7 +291,9 @@ export default {
     EditWinSvcCheck,
     AddScriptCheck,
     EditScriptCheck,
-    PolicyCheckStatus
+    PolicyCheckStatus,
+    AddEventLogCheck,
+    EditEventLogCheck
   },
   mixins: [mixins],
   data() {
@@ -293,6 +311,8 @@ export default {
       showAddScriptCheck: false,
       showEditScriptCheck: false,
       showPolicyCheckStatus: false,
+      showAddEventLogCheck: false,
+      showEditEventLogCheck: false,
       editCheckPK: null,
       statusCheck: {},
       columns: [
@@ -347,6 +367,9 @@ export default {
         case "script":
           this.showEditScriptCheck = true;
           break;
+        case "eventlog":
+          this.showEditEventLogCheck = true;
+          break;
         default:
           return false;
       }
@@ -390,7 +413,8 @@ export default {
         ...this.checks.memchecks,
         ...this.checks.scriptchecks,
         ...this.checks.winservicechecks,
-        ...this.checks.pingchecks
+        ...this.checks.pingchecks,
+        ...this.checks.eventlogchecks
       ];
     }
   }
diff --git a/src/components/modals/checks/AddEventLogCheck.vue b/src/components/modals/checks/AddEventLogCheck.vue
new file mode 100644
index 0000000..c9722c7
--- /dev/null
+++ b/src/components/modals/checks/AddEventLogCheck.vue
@@ -0,0 +1,149 @@
+<template>
+  <q-card style="min-width: 40vw">
+    <q-card-section class="row items-center">
+      <div class="text-h6">Add Event Log Check</div>
+      <q-space />
+      <q-btn icon="close" flat round dense v-close-popup />
+    </q-card-section>
+
+    <q-form @submit.prevent="addCheck">
+      <q-card-section>
+        <q-input
+          dense
+          outlined
+          v-model="desc"
+          label="Descriptive Name"
+          :rules="[ val => !!val || '*Required' ]"
+        />
+      </q-card-section>
+      <q-card-section>
+        <q-select
+          dense
+          outlined
+          v-model="logname"
+          :options="logNameOptions"
+          label="Event log to query"
+        />
+      </q-card-section>
+      <q-card-section>
+        <q-select
+          dense
+          outlined
+          v-model="failWhen"
+          :options="failWhenOptions"
+          label="Fail When"
+          emit-value
+          map-options
+        />
+      </q-card-section>
+      <q-card-section>
+        <q-input
+          dense
+          outlined
+          v-model.number="eventID"
+          label="Event ID"
+          :rules="[ 
+                    val => !!val.toString() || '*Required',
+                    val => val >= 0 || 'Min 0',
+                    val => val <= 999999 || 'Max 999999'
+                ]"
+        />
+      </q-card-section>
+      <q-card-section>
+        <q-input
+          dense
+          outlined
+          v-model.number="searchLastDays"
+          label="How many previous days to search (Enter 0 for the entire log)"
+          :rules="[ 
+                    val => !!val.toString() || '*Required',
+                    val => val >= 0 || 'Min 0',
+                    val => val <= 9999 || 'Max 9999'
+                ]"
+        />
+      </q-card-section>
+      <q-card-section>
+        <span>Event Type:</span>
+        <div class="q-gutter-sm">
+          <q-radio dense v-model="eventType" val="INFO" label="Information" />
+          <q-radio dense v-model="eventType" val="WARNING" label="Warning" />
+          <q-radio dense v-model="eventType" val="ERROR" label="Error" />
+          <q-radio dense v-model="eventType" val="AUDIT_SUCCESS" label="Success Audit" />
+          <q-radio dense v-model="eventType" val="AUDIT_FAILURE" label="Failure Audit" />
+        </div>
+      </q-card-section>
+      <q-card-section>
+        <q-select
+          outlined
+          dense
+          v-model="failure"
+          :options="failures"
+          label="Number of consecutive failures before alert"
+        />
+      </q-card-section>
+      <q-card-actions align="right">
+        <q-btn label="Add" color="primary" type="submit" />
+        <q-btn label="Cancel" v-close-popup />
+      </q-card-actions>
+    </q-form>
+  </q-card>
+</template>
+
+<script>
+import axios from "axios";
+import { mapState } from "vuex";
+import mixins from "@/mixins/mixins";
+export default {
+  name: "AddEventLogCheck",
+  props: ["agentpk", "policypk"],
+  mixins: [mixins],
+  data() {
+    return {
+      desc: null,
+      eventID: 0,
+      eventType: "INFO",
+      logname: "Application",
+      logNameOptions: ["Application", "System", "Security"],
+      failWhen: "contains",
+      searchLastDays: 1,
+      failWhenOptions: [
+        { label: "Log contains", value: "contains" },
+        { label: "Log does not contain", value: "not_contains" }
+      ],
+      failure: 1,
+      failures: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+    };
+  },
+  methods: {
+    addCheck() {
+      const pk = this.policypk ? { policy: this.policypk } : { pk: this.agentpk };
+
+      const data = {
+        ...pk,
+        check_type: "eventlog",
+        desc: this.desc,
+        log_name: this.logname,
+        event_id: this.eventID,
+        event_type: this.eventType,
+        fail_when: this.failWhen,
+        search_last_days: this.searchLastDays,
+        failure: this.failure
+      };
+      axios
+        .post("/checks/addstandardcheck/", data)
+        .then(r => {
+          this.$emit("close");
+
+          if (this.policypk) {
+            this.$store.dispatch("automation/loadPolicyChecks", this.policypk);
+          } else {
+            this.$store.dispatch("loadChecks", this.agentpk);
+          }
+
+          this.notifySuccess("Event log check was added!");
+        })
+        .catch(e => this.notifyError(e.response.data.desc));
+    }
+  }
+};
+</script>
\ No newline at end of file
diff --git a/src/components/modals/checks/EditEventLogCheck.vue b/src/components/modals/checks/EditEventLogCheck.vue
new file mode 100644
index 0000000..a031ce1
--- /dev/null
+++ b/src/components/modals/checks/EditEventLogCheck.vue
@@ -0,0 +1,161 @@
+<template>
+  <q-card style="min-width: 40vw">
+    <q-card-section class="row items-center">
+      <div class="text-h6">Edit Event Log Check</div>
+      <q-space />
+      <q-btn icon="close" flat round dense v-close-popup />
+    </q-card-section>
+
+    <q-form @submit.prevent="editCheck">
+      <q-card-section>
+        <q-input
+          dense
+          outlined
+          v-model="desc"
+          label="Descriptive Name"
+          :rules="[ val => !!val || '*Required' ]"
+        />
+      </q-card-section>
+      <q-card-section>
+        <q-select
+          dense
+          outlined
+          v-model="logname"
+          :options="logNameOptions"
+          label="Event log to query"
+        />
+      </q-card-section>
+      <q-card-section>
+        <q-select
+          dense
+          outlined
+          v-model="failWhen"
+          :options="failWhenOptions"
+          label="Fail When"
+          emit-value
+          map-options
+        />
+      </q-card-section>
+      <q-card-section>
+        <q-input
+          dense
+          outlined
+          v-model.number="eventID"
+          label="Event ID"
+          :rules="[ 
+                    val => !!val.toString() || '*Required',
+                    val => val >= 0 || 'Min 0',
+                    val => val <= 999999 || 'Max 999999'
+                ]"
+        />
+      </q-card-section>
+      <q-card-section>
+        <q-input
+          dense
+          outlined
+          v-model.number="searchLastDays"
+          label="How many previous days to search (Enter 0 for the entire log)"
+          :rules="[ 
+                    val => !!val.toString() || '*Required',
+                    val => val >= 0 || 'Min 0',
+                    val => val <= 9999 || 'Max 9999'
+                ]"
+        />
+      </q-card-section>
+      <q-card-section>
+        <span>Event Type:</span>
+        <div class="q-gutter-sm">
+          <q-radio dense v-model="eventType" val="INFO" label="Information" />
+          <q-radio dense v-model="eventType" val="WARNING" label="Warning" />
+          <q-radio dense v-model="eventType" val="ERROR" label="Error" />
+          <q-radio dense v-model="eventType" val="AUDIT_SUCCESS" label="Success Audit" />
+          <q-radio dense v-model="eventType" val="AUDIT_FAILURE" label="Failure Audit" />
+        </div>
+      </q-card-section>
+      <q-card-section>
+        <q-select
+          outlined
+          dense
+          v-model="failure"
+          :options="failures"
+          label="Number of consecutive failures before alert"
+        />
+      </q-card-section>
+      <q-card-actions align="right">
+        <q-btn label="Edit" color="primary" type="submit" />
+        <q-btn label="Cancel" v-close-popup />
+      </q-card-actions>
+    </q-form>
+  </q-card>
+</template>
+
+<script>
+import axios from "axios";
+import { mapState } from "vuex";
+import mixins from "@/mixins/mixins";
+export default {
+  name: "EditEventLogCheck",
+  props: ["agentpk", "policypk", "editCheckPK"],
+  mixins: [mixins],
+  data() {
+    return {
+      desc: null,
+      eventID: null,
+      eventType: null,
+      logname: null,
+      logNameOptions: ["Application", "System", "Security"],
+      failWhen: null,
+      searchLastDays: null,
+      failWhenOptions: [
+        { label: "Log contains", value: "contains" },
+        { label: "Log does not contain", value: "not_contains" }
+      ],
+      failure: null,
+      failures: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+    };
+  },
+  methods: {
+    getCheck() {
+      axios.get(`/checks/getstandardcheck/eventlog/${this.editCheckPK}/`).then(r => {
+        this.desc = r.data.desc;
+        this.eventID = r.data.event_id;
+        this.eventType = r.data.event_type;
+        this.logname = r.data.log_name;
+        this.failWhen = r.data.fail_when;
+        this.searchLastDays = r.data.search_last_days;
+        this.failure = r.data.failures;
+      });
+    },
+    editCheck() {
+      const data = {
+        pk: this.editCheckPK,
+        check_type: "eventlog",
+        desc: this.desc,
+        log_name: this.logname,
+        event_id: this.eventID,
+        event_type: this.eventType,
+        fail_when: this.failWhen,
+        search_last_days: this.searchLastDays,
+        failures: this.failure
+      };
+      axios
+        .patch("/checks/editstandardcheck/", data)
+        .then(r => {
+          this.$emit("close");
+
+          if (this.policypk) {
+            this.$store.dispatch("automation/loadPolicyChecks", this.policypk);
+          } else {
+            this.$store.dispatch("loadChecks", this.agentpk);
+          }
+
+          this.notifySuccess("Event log check was edited!");
+        })
+        .catch(e => this.notifyError(e.response.data.desc));
+    }
+  },
+  created() {
+    this.getCheck();
+  }
+};
+</script>
\ No newline at end of file
diff --git a/src/components/modals/checks/EventLogCheckOutput.vue b/src/components/modals/checks/EventLogCheckOutput.vue
new file mode 100644
index 0000000..21a1456
--- /dev/null
+++ b/src/components/modals/checks/EventLogCheckOutput.vue
@@ -0,0 +1,50 @@
+<template>
+  <q-card style="min-width: 90vw" class="q-pa-xs">
+    <q-card-section>
+      <div class="row items-center">
+        <div class="text-h6">{{ evtlogdata.desc }}</div>
+        <q-space />
+        <q-btn icon="close" flat round dense v-close-popup />
+      </div>
+      <div>
+        <q-table
+          dense
+          class="remote-bg-tbl-sticky"
+          :data="evtlogdata.more_info.log"
+          :columns="columns"
+          :pagination.sync="pagination"
+          row-key="uid"
+          binary-state-sort
+          virtual-scroll
+          no-data-label="No event logs"
+        />
+      </div>
+    </q-card-section>
+  </q-card>
+</template>
+
+<script>
+export default {
+  name: "EventLogCheckOutput",
+  props: ["evtlogdata"],
+  data() {
+    return {
+      pagination: {
+        rowsPerPage: 0,
+        sortBy: "time",
+        descending: true
+      },
+      columns: [
+        { name: "eventType", label: "Type", field: "eventType", align: "left", sortable: true },
+        { name: "source", label: "Source", field: "source", align: "left", sortable: true },
+        { name: "eventID", label: "Event ID", field: "eventID", align: "left", sortable: true },
+        { name: "time", label: "Time", field: "time", align: "left", sortable: true },
+        { name: "message", label: "Message", field: "message", align: "left", sortable: true }
+      ]
+    };
+  },
+  beforeDestroy() {
+    this.$emit("close");
+  }
+};
+</script>
\ No newline at end of file
diff --git a/src/components/modals/tasks/AddAutomatedTask.vue b/src/components/modals/tasks/AddAutomatedTask.vue
index 833f851..ffb6810 100644
--- a/src/components/modals/tasks/AddAutomatedTask.vue
+++ b/src/components/modals/tasks/AddAutomatedTask.vue
@@ -178,7 +178,8 @@ export default {
         ...this.checks.memchecks,
         ...this.checks.scriptchecks,
         ...this.checks.winservicechecks,
-        ...this.checks.pingchecks
+        ...this.checks.pingchecks,
+        ...this.checks.eventlogchecks
       ];
     },
     checksOptions() {