updated threat filtering by computerName, groupName, groupID and k8scluster

[log1-c]

As the SentinelOne API parameter computerName__contains is not an exact match when filtering threats for specific ComputerNames, I updated the GetThreats function to ignore any threats that don't match the given ComputerName via the --computer-name parameter.

Current behavior for reference:
--computer-name "abc-job01"
Get's threats for hosts like abc-job01 but also for abc-job01_whatever (and so on).

If parameter --computer-name is not supplied, the function will gather all threats for the site

[martialblog]

Hi, thanks for the PR. I will have a look at it.

[martialblog]

I think the change makes sense. The flag --computer-name also states this in the help "Only list threats belonging to the specified computer name", so it should be expected to only match full names not substrings.

Note: Might be nice to add the possibility to set the flag multiple times or have a flag to toggle the precise matching. But we can do that in another PR.

We can optimize the implementation a bit.

Since we already pass the url.Values map into the GetThreats method and it already contains the computer name, we can just use this value. Example:

func (c *Client) GetThreats(values url.Values) (threats []*Threat, err error) {
...
if computerName, ok := values["computerName__contains"]; ok {
    // continue if the name matches
}
...

I also checked the API docs, there is only the "computerName__contains" parameter and nothing to match exactely from what I can see. Don't now if the "contains" filter can include patterns.

[martialblog]

From the API docs:

computerName__contains
Free-text filter by computer name (supports multiple values). Example: "john-office,WIN".

If we do a precise matching by name then we would lose the ability to use multiple values. So a toggle option might be valuable.

[martialblog]

I think this change is something we could add. However, the PR needs some feedback and fixing (see GitHub Actions) before we can move forward.

[log1-c]

a colleague added the options to filter threats by groupID, groupName and k8s cluster.