Function siem_export

cli/main.py:1255–1282

Run scan and export results to SIEM.

(
    target: str = typer.Argument(..., help="Target to scan and export"),
    provider: str = typer.Option("webhook", "--provider", "-p"),
    url: str = typer.Option(..., "--url", "-u", help="SIEM endpoint URL"),
    token: Optional[str] = typer.Option(None, "--token", "-t"),
)

@siem_app.command("test")
def siem_test(
    provider: str = typer.Argument(..., help="SIEM provider (splunk/elasticsearch/syslog/webhook)"),
    url: str = typer.Option(..., "--url", "-u", help="SIEM endpoint URL"),
    token: str | None = typer.Option(None, "--token", "-t", help="Auth token"),
):
    """Test SIEM connection."""
    setup_logging()

    console.print(f"[bold]Testing SIEM Connection:[/bold] {provider}")

    async def run():
        from modules.siem import ElasticsearchExporter, SplunkExporter, WebhookExporter

        if provider == "splunk":
            exporter = SplunkExporter(hec_url=url, hec_token=token or "")
        elif provider == "elasticsearch":
            exporter = ElasticsearchExporter(hosts=[url])
        elif provider == "webhook":
            exporter = WebhookExporter(url=url)
        else:
            console.print(f"[red]Unknown provider: {provider}[/red]")
            return

        if await exporter.test_connection():
            console.print("[green]✓ Connection successful[/green]")
        else:
            console.print("[red]✗ Connection failed[/red]")

    run_async(run())