def getCapabilities4User(user=None, session_key=None):
     """
     Get the capabilities for the given user.
     """
     
     roles = []
     capabilities = []
     
     # Get user info              
     if user is not None:
         logger.info('Retrieving role(s) for current user: %s' % (user))
         userDict = entity.getEntities('authentication/users/%s' % (user), count=-1, sessionKey=session_key)
     
         for stanza, settings in userDict.items():
             if stanza == user:
                 for key, val in settings.items():
                     if key == 'roles':
                         logger.info('Successfully retrieved role(s) for user: %s' % (user))
                         roles = val
          
     # Get capabilities
     for role in roles:
         logger.info('Retrieving capabilities for current user: %s' % (user))
         roleDict = entity.getEntities('authorization/roles/%s' % (role), count=-1, sessionKey=session_key)
         
         for stanza, settings in roleDict.items():
             if stanza == role:
                 for key, val in settings.items():
                     if key == 'capabilities' or key =='imported_capabilities':
                         logger.info('Successfully retrieved %s for user: %s' % (key, user))
                         capabilities.extend(val)
         
     return capabilities     

def get_firewall_credentials(session_key):
    """Given a splunk session_key returns a clear text user name
    and password from a splunk password container"""
    try:
        # Get all credentials
        logger.debug("Getting firewall credentials from Splunk")
        entities = entity.getEntities(['admin', 'passwords'],
                                      namespace=APPNAME, owner='nobody',
                                      sessionKey=session_key)

        accounts = entity.getEntities(['admin', 'Splunk_TA_paloalto_account'],
                                      namespace=APPNAME, owner='nobody',
                                      sessionKey=session_key)
    except Exception as e:
        exit_with_error("Could not get %s credentials from splunk. \
                         Error: %s" % (APPNAME, str(e)))
    # Check for username and passwords
    for i, c in accounts.items():
        if i.lower() == 'firewall' or i.lower() == 'panorama':
            username = accounts[i]['username']

    for i, c in entities.items():
        if c['username'] == 'Firewall``splunk_cred_sep``1':
            logger.debug('Match found for firewall credentials')
            clear_password = json.loads(c['clear_password'])
            password = clear_password['password']

    if username and password:
        logger.debug('Credentials have been found')
        return username, password
    else:
        raise NoCredentialsFound("No credentials have been found")

def reloadConf(self, procInputs=[], scriptInputs=[]):
	for procInput in procInputs:
		en.getEntities( procInput,
		  	sessionKey = self.getSessionKey() )

	#TODO: Handle restart of individual cripted
	for scriptInput in scriptInputs:
		en.getEntities( scriptInput,
		  	sessionKey = self.getSessionKey() )

def search(token, srch=None, sort='seed'):

    if srch:
        return entity.getEntities(ENTITY_PATH, namespace=APP_NAME,
                                  owner='nobody', sessionKey=token, 
                                  sort_key=sort, search=srch)
    else:
        return entity.getEntities(ENTITY_PATH, namespace=APP_NAME,
                                  owner='nobody', sessionKey=token,
                                  sort_key=sort) 

    def getParsedView(self, namespace, refresh, rawxml, viewid, viewdigest):
        with self.views_lock:
            entry = self.digest_to_view_map.get(viewdigest)
            if entry:
                self.touchCacheEntry(viewdigest)
                # Cache hit!
                return entry

        if len(rawxml) == 0:
            # Only do a single viewstate GET for each batch of cache misses.
            rawxml.update(en.getEntities(VIEW_ENTITY_CLASS,
                                         namespace=namespace,
                                         refresh=refresh,
                                         count=-1))

        parsed_view = None
        try:
            viewobj = rawxml.get(viewid)
            if not viewobj:
                # This view's digest appeared in an earlier GET, but it no
                # longer exists now that we are trying to fetch its contents.
                # It has probably been deleted or re-permissioned. Ignore it.
                return None
            native_view = viewconf.loads(viewobj.get('eai:data'), viewid, isStorm=splunk.util.normalizeBoolean(cherrypy.config.get('storm_enabled')))
            parsed_view = self._generateViewRoster(viewid, native_view, viewobj.getFullPath())
            with self.views_lock:
                self.digest_to_view_map[viewdigest] = parsed_view
                self.touchCacheEntry(viewdigest)
                self.evictLeastRecentlyUsed()
            logger.info('Populate cache for view "%s" (%s) with digest %s, making cache_size=%s' % (viewid, namespace, viewdigest, len(self.digest_to_view_map)))
        except Exception, e:
            logger.error('Error loading view "%s"' % viewid)
            logger.exception(e)

def get_wildfire_apikey(session_key):
    """Given a splunk session_key returns a clear
    text API Key from a splunk password container"""
    try:
        logger.debug("Getting wildfire apikey from Splunk")
        entities = entity.getEntities(['admin', 'passwords'],
                                      namespace=APPNAME, owner='nobody',
                                      sessionKey=session_key)
    except Exception as e:
        entities = {}
        exit_with_error("Could not get %s credentials from splunk."
                        "Error: %s" % (APPNAME, str(e)))
    try:
        clear_password = json.loads(entities['__REST_CREDENTIAL__#Splunk_TA_paloalto#configs/conf-splunk_ta_paloalto_settings:additional_parameters``splunk_cred_sep``1:']['clear_password'])
        api_key = clear_password['wildfire_api_key']
        logger.debug('WildFire API key exists')
        return api_key
    except KeyError:
        logger.info(
            "There are Palo Alto Networks WildFire malware events, "
            "but no WildFire API Key found, please set the API key "
            "in the Splunk_TA_paloalto Add-on Configuration dashboard.")
        exit_with_error("No WildFire API key is set, "
                        "set apikey in Add-on configuration.",
                        log_error=False,
                        log_traceback=False)
    except (ValueError, TypeError):
        exit_with_error("Problem getting WildFire API Key from JSON returned by Splunk password API")

 def get_data(self, eai_path, root, msg=None, **kwargs):
     entity_path = eai_path
     if len(root) > 0:
         entity_path = '/'.join([eai_path, root])
         
     try:
         entities = en.getEntities(entity_path, sessionKey=cherrypy.session['sessionKey'], **kwargs)
         
     except splunk.RESTException, e:
         if e.statusCode == 401:
             err = _('Client is not authenticated.')
             return (None, (err,400))
             
         elif e.statusCode == 403:
             err = _('You are not authorized to perform this action.')
             return (None, (err,400))
             
         else: 
             err = _('Unable to open the selected path. Path doesn\'t exist or access is denied.')
             if not msg and len(root)>0:
                 # return error and the root nodes
                 logger.warn('%s %s' % (err, e.get_extended_message_text()))
                 return self.get_data(eai_path, '', msg=err, **kwargs)
             else:                     
                 # if root node can't be accessed, just display the message
                 return (None, err)

def run():
    logger.debug("start running.")
    config = get_config()
    logger.debug("config = %s" % config)
    try:
        servers = en.getEntities(["admin","opcservers"], sessionKey=config["session_key"], hostPath=config["server_uri"])
        logger.debug("servers = %s" % servers)
    except Exception as ex:
        logger.critical("%ss" % ex)
    
    server = servers[config["server"]]    
    logger.debug("server = %s" % server)
    
    opcserver = dict( dcomhost = server["dcomhost"], domain = server["domain"], user = server["user"], password = server["password"], 
                      progid = server["progid"], clsid = server["clsid"])
    
    measures = dict( items = config["measures"], duration = config["duration"], 
                     polltime = config["polltime"], collector = config["collector"], writer = config["writer"], parameters = config.get("parameters", ""))
    
    logger.debug("Measured server = %s." % opcserver)
    logger.debug("Measuring the items = %s." % measures)

    try:
        msg = opc.runMeasure(opcserver, measures)
        logger.debug("Measuring is done [%s]." % msg)
    except Exception as ex:
        logger.critical("Request error as ex = %s" % ex)

def getCredentials(sessionKey):
    myapp = 'tanium'
    try:
    # list all credentials
        entities = entity.getEntities(['admin', 'passwords'], namespace=myapp,
                                  owner='nobody', sessionKey=sessionKey)
    except Exception, e:
        raise Exception("Could not get %s credentials from splunk. Error: %s" % (myapp, str(e)))

 def getExistingExtractions(self, constraint=None):
    search = "type=inline"
    if constraint != None:
       search = "%s AND %s" % (search, constraint)
       
    entities = en.getEntities('data/props/extractions', namespace=self._namespace, owner=self._owner,
                              search=search,  count=-1, sessionKey=self._sessionKey)
    return entities

def _config_dict(session_key, attempt=0):
    """
    :param session_key: A session key for calls to Splunk functions.
    :param attempt:     The number of the attempt to get the dictionary.
                         Defaults to 0.
    :return:            A dictionary containing Splunk config info.
    """
    if attempt > 19 or not session_key:
        return {}

    try:
        # list all credentials
        password_entities = entity.getEntities(['admin', 'passwords'], namespace='code42',
                                               owner='nobody', sessionKey=session_key)
        config_console_entities = entity.getEntities(['code42', 'config', 'console'], namespace='code42',
                                                     owner='nobody', sessionKey=session_key)
        config_script_entities = entity.getEntities(['code42', 'config', 'script'], namespace='code42',
                                                    owner='nobody', sessionKey=session_key)
    except Exception as exception:
        raise Exception("Could not get code42 credentials from splunk. Error: %s" % (str(exception)))

    config = {}
    try:
        result = [item for _, item in password_entities.items() if 'username' in item and 'clear_password' in item][0]
        config['username'] = result['username']
        config['password'] = result['clear_password']

        result = [item for _, item in config_console_entities.items() if 'hostname' in item and 'port' in item][0]
        config['hostname'] = result['hostname']
        config['port'] = result['port']
        config['verify_ssl'] = result['verify_ssl'] == 'true'
        config['collect_analytics'] = result['collect_analytics'] == 'true'

        result = [item for _, item in config_script_entities.items() if 'devices' in item][0]
        config['devices'] = result['devices']
    except IndexError:
        pass

    keys = ['username', 'password', 'hostname', 'verify_ssl', 'port', 'devices']
    all_in_config = all([(key in config) for key in keys])
    if not all_in_config:
        time.sleep(1)
        return _config_dict(session_key, attempt + 1)
    else:
        return config

    def _buildConfDict(self):
        """Build configuration dictionary that we will use """
        if self.splunkEmbedded and not STANDALONE:
            self.logger.info('Retrieving eventgen configurations from /configs/eventgen')
            self._confDict = entity.getEntities('configs/eventgen', count=-1, sessionKey=self.sessionKey)
        else:
            self.logger.info('Retrieving eventgen configurations with ConfigParser()')
            # We assume we're in a bin directory and that there are default and local directories
            conf = ConfigParser()
            # Make case sensitive
            conf.optionxform = str
            currentdir = os.getcwd()

            # If we're running standalone (and thusly using configParser)
            # only pick up eventgen-standalone.conf.
            conffiles = [ ]
            if len(sys.argv) > 1:
                if len(sys.argv[1]) > 0:
                    if os.path.exists(sys.argv[1]):
                        conffiles = [os.path.join(self.grandparentdir, 'default', 'eventgen.conf'),
                                    sys.argv[1]]
            if len(conffiles) == 0:
                conffiles = [os.path.join(self.grandparentdir, 'default', 'eventgen.conf'),
                            os.path.join(self.grandparentdir, 'local', 'eventgen.conf')]

            self.logger.debug('Reading configuration files for non-splunkembedded: %s' % conffiles)
            conf.read(conffiles)

            sections = conf.sections()
            ret = { }
            orig = { }
            for section in sections:
                ret[section] = dict(conf.items(section))
                # For compatibility with Splunk's configs, need to add the app name to an eai:acl key
                ret[section]['eai:acl'] = { 'app': self.grandparentdir.split(os.sep)[-1] }
                # orig[section] = dict(conf.items(section))
                # ret[section] = { }
                # for item in orig[section]:
                #     results = re.match('(token\.\d+)\.(\w+)', item)
                #     if results != None:
                #         ret[section][item] = orig[section][item]
                #     else:
                #         if item.lower() in [x.lower() for x in self._validSettings]:
                #             newitem = self._validSettings[[x.lower() for x in self._validSettings].index(item.lower())]
                #         ret[section][newitem] = orig[section][item]
            self._confDict = ret

        # Have to look in the data structure before normalization between what Splunk returns
        # versus what ConfigParser returns.
        logobj = logging.getLogger('eventgen')
        if self._confDict['global']['debug'].lower() == 'true' \
                or self._confDict['global']['debug'].lower() == '1':
            logobj.setLevel(logging.DEBUG)
        if self._confDict['global']['verbose'].lower() == 'true' \
                or self._confDict['global']['verbose'].lower() == '1':
            logobj.setLevel(logging.DEBUGV)
        self.logger.debug("ConfDict returned %s" % pprint.pformat(dict(self._confDict)))

def load_db(config):
    ents = en.getEntities(["admin","conf-inputs"], namespace="splunk-demo-opcda", owner="nobody", sessionKey=config["session_key"], hostPath=config["server_uri"])
    # logger.debug("%s" % ents)
    for dbn, dbv in [(n, v) for n, v in ents.items() if n.startswith("database://")]:
        name = dbn.replace("database://", "")
        logger.debug("name=%s" % name)
        logger.debug("values=%s" % dbv)
        jdbc.updateDatabase(name, dbv["dburl"], dbv["jdbcdriver"], dbv["user"], dbv["password"], dbv["parameters"])
        

def execute():
    import crawl_factory
    results = []
    try:
        
        args = { 'add-all':'fail'} ## 'name':'file_crawler'}
        keywords, options = splunk.Intersplunk.getKeywordsAndOptions()
        args.update(options)

        results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
        results = [] # we don't care about incoming results

        sessionKey = settings.get("sessionKey", None)
        owner      = settings.get("owner", None)
        namespace  = settings.get("namespace", None)
        ########TEST#####################
        # sessionKey = splunk.auth.getSessionKey('admin', 'changeme')
        ########TEST####################
        
        mgr = CrawlerManager(sessionKey, owner, namespace, args)

        if len(keywords) == 0:
            logger.warn("No crawl type specified.  Defaulting to crawling 'files'.")
            keywords = ["files"]
        
        # name = args['name']
        # add crawler for each keyword
        for name in keywords:
            crawler = crawl_factory.getCrawler(name, mgr, args)
            if crawler == None:
                splunk.Intersplunk.generateErrorResults("Unknown crawler '%s'.  Legal values are: %s" % (name, crawl_factory.getCrawlerNames()))
                return
            mgr.addCrawler(crawler)
            
        # do crawl
        actions = mgr.execute()

        monitors = en.getEntities('/data/inputs/monitor', sessionKey=sessionKey, owner=owner, namespace=namespace)
        
        # convert actions to results -- just a dictionary of attributes
        for action in actions:
            result = action.getAttrs()
            status = "not_added"
            try:
                if not action.valid(sessionKey, owner, namespace, monitors):
                    status = "added"
            except:
                status = "unknown"
            result['status'] = status
            results.append(result)
        # outputresults
        splunk.Intersplunk.outputResults(results)
    except Exception, e:
        import traceback
        stack =  traceback.format_exc()
        splunk.Intersplunk.generateErrorResults(str(e))
        logger.error(str(e) + ". Traceback: " + str(stack))

def get_firewall_apikey(session_key):
    """Given a splunk session_key returns a clear text API Key from a splunk password container"""
    try:
        entities = entity.getEntities(['admin', 'passwords'], namespace=APPNAME, owner='nobody', sessionKey=session_key)
    except Exception as e:
        exit_with_error("Could not get %s credentials from splunk. Error: %s" % (APPNAME, str(e)))
    for i, c in entities.items():
        if c['username'] == 'firewall_api_key':
            return c['clear_password']
    raise NoCredentialsFound

def execute():
    results = []
    try:
        results, dummyresults, settings = si.getOrganizedResults()

        # default values
        args = {"namespace": "search"}
        # get commandline args
        keywords, options = si.getKeywordsAndOptions()
        # override default args with settings from search kernel
        args.update(settings)
        # override default args with commandline args
        args.update(options)

        sessionKey = args.get("sessionKey", None)
        owner = args.get("owner", "admin")
        namespace = args.get("namespace", None)

        if namespace.lower() == "none":
            namespace = None

        messages = {}

        if sessionKey == None:
            # this shouldn't happen, but it's useful for testing.
            try:
                sessionKey = sa.getSessionKey("admin", "changeme")
                si.addWarnMessage(
                    messages, "No session given to 'tune' command. Using default admin account and password."
                )
            except splunk.AuthenticationFailed, e:
                si.addErrorMessage(messages, "No session given to 'tune' command.")
                return

        if len(keywords) != 1:
            usage()

        # e.g., '/data/inputs/monitor'
        entity = keywords[0]
        logger.info("Entity: %s Args: %s" % (entity, args))

        results = []  # we don't care about incoming results
        try:
            entitys = en.getEntities(entity, sessionKey=sessionKey, owner=owner, namespace=namespace, count=-1)
            for name, entity in entitys.items():
                try:
                    myapp = entity["eai:acl"]["app"]
                    if namespace != None and myapp != namespace:
                        continue
                except:
                    continue  # if no eai:acl/app, filter out
                result = entityToResult(name, entity)
                results.append(result)
        except splunk.ResourceNotFound, e2:
            pass

    def save_risks(self, contents, **kwargs):

        logger.info("Saving risks...")

        user = cherrypy.session['user']['name']
        sessionKey = cherrypy.session.get('sessionKey')
        splunk.setDefault('sessionKey', sessionKey)
        

        config = {}
        config['index'] = 'risks'
        
        restconfig = entity.getEntities('configs/risk_manager', count=-1, sessionKey=sessionKey)
        if len(restconfig) > 0:
            if 'index' in restconfig['settings']:
                config['index'] = restconfig['settings']['index']

        logger.debug("Global settings: %s" % config)

        # Parse the JSON
        parsed_contents = json.loads(contents)
        logger.debug("Contents: %s" % contents)

        for entry in parsed_contents:
            if '_key' in entry and entry['_key'] != None:

                uri = '/servicesNS/nobody/risk_manager/storage/collections/data/risks/' + entry['_key']
                
                # Get current risk
                serverResponse, risk = rest.simpleRequest(uri, sessionKey=sessionKey)
                logger.debug("Current risk: %s" % risk)
                risk = json.loads(risk)

                # Update risk if score has changed
                if int(risk['risk_score']) != int(entry['risk_score']):
                    logger.info("Updating risk_object_type=%s risk_object=%s to score=%s." % (entry['risk_object_type'], entry['risk_object'], entry['risk_score']))
                    del entry['_key']
                    if 'risk_id' in risk:
                        entry['risk_id'] = risk['risk_id']
                    else:
                        entry['risk_id'] = str(uuid.uuid4())
                        risk['risk_id'] = entry['risk_id']
                    entryStr = json.dumps(entry)

                    serverResponse, serverContent = rest.simpleRequest(uri, sessionKey=sessionKey, jsonargs=entryStr)
                    logger.debug("Updated entry. serverResponse was ok")

                    now = datetime.datetime.now().isoformat()
                    event = 'time="%s" risk_id="%s" action="update_risk_score" alert="Risk Score Tuner" user="%s" risk_object_type="%s" risk_object="%s" risk_score="%s" previous_risk_score="%s"' % (now, risk['risk_id'], user, entry['risk_object_type'], entry['risk_object'], entry['risk_score'], risk['risk_score'])
                    logger.debug("Event will be: %s" % event)
                    input.submit(event, hostname = socket.gethostname(), sourcetype = 'risk_scoring', source = 'helpers.py', index = config['index'])
                else:
                    logger.info("Won't update risk_object_type=%s risk_object=%s, since score didn't change." % (entry['risk_object_type'], entry['risk_object']))

        return 'Done'

    def _write_log_entry(self, sessionKey, user, post_data):
        logger.debug("START _write_log_entry()")

        required = ['incident_id', 'log_action', 'origin']
        missing = [r for r in required if r not in post_data]
        if missing:
            return self.response("Missing required arguments: %s" % missing, httplib.BAD_REQUEST)

        incident_id = post_data.pop('incident_id')
        log_action  = post_data.pop('log_action')

    	comment         = post_data.get('comment', '')
    	origin          = post_data.get('origin', '')
    	severity        = post_data.get('severity', 'INFO')
    	owner           = post_data.get('owner', '')
    	previous_owner  = post_data.get('previous_owner', '')
    	status          = post_data.get('status', '')
    	previous_status = post_data.get('status', '')
    	job_id          = post_data.get('job_id', '')
    	result_id       = post_data.get('result_id', '')

        now = datetime.datetime.now().isoformat()

        # Get Index
    	config = {}
        config['index'] = 'main'

        restconfig = entity.getEntities('configs/alert_manager', count=-1, sessionKey=sessionKey)
        if len(restconfig) > 0:
            if 'index' in restconfig['settings']:
                config['index'] = restconfig['settings']['index']


        comment = comment.replace('\n', '<br />').replace('\r', '')
        event_id = hashlib.md5(incident_id + now).hexdigest()

        event = ''
        if (log_action == "comment"):
            event = 'time=%s severity="%s" origin="%s" event_id="%s" user="%s" action="comment" incident_id="%s" comment="%s"' % (now, severity, origin, event_id, user, incident_id, comment)
        elif (log_action == "change"):
            event = 'time=%s severity="%s" origin="%s" event_id="%s" user="%s" action="comment" incident_id="%s" job_id="%s" result_id="%s" status="%s" previous_status="%s"' % (now, severity, origin, event_id, user, incident_id, job_id, result_id, status, previous_status)

        logger.debug("Event will be: %s" % event)
        event = event.encode('utf8')

        try:
            splunk.setDefault('sessionKey', sessionKey)
            input.submit(event, hostname = socket.gethostname(), sourcetype = 'incident_change', source = 'helper.py', index = config['index'])
            return self.response('Action logged', httplib.OK)

        except Exception as e:
            msg = 'Unhandled Exception: {}'.format(str(e))
            logger.exception(msg)
            return self.response(msg, httplib.INTERNAL_SERVER_ERROR)

def getWildFireAPIKey(sessionKey):
  '''Given a splunk sesionKey returns a clear text API Key from a splunk password container'''
  # this is the folder name for the app and not the app's common name
  myapp = 'SplunkforPaloAltoNetworks'
  try:
    entities = entity.getEntities(['admin', 'passwords'], namespace=myapp, owner='nobody', sessionKey=sessionKey)
  except Exception, e:
    stack =  traceback.format_exc()
    logger.warn(stack)
    logger.warn("entity exception")
    raise Exception("Could not get %s credentials from splunk. Error: %s" % (myapp, str(e)))

 def all(self):
     app, user = self._namespace_and_owner()
     
     return en.getEntities(self._endpoint,
                           namespace=app,
                           owner=user,
                           sessionKey=self.getSessionKey(),
                           count=self.maxCount+self.posOffset,
                           sort_key=self.sortByKey,
                           sort_dir=self.getSortDir(),
                           offset=self.posOffset)