'''
watchLambda - Lambda Function Log Scanning Script
(c) Blueinfy solutions pvt. ltd.
This is beta version of the toolkit and it is in the development
phase.
==============================================================
'''

import argparse
import boto3, time, json, re

parser = argparse.ArgumentParser()

print('\n==============================================================')
print('watchLambda - Lambda Function Log Scanning Script (beta)')
print('(c) Blueinfy solutions pvt. ltd.')
print('==============================================================\n')


parser.add_argument('-f', action='store', dest='function',
                    help='use function for scan/invoke')

parser.add_argument('-r', action='store', dest='rules',
                    help='supply regex rule file')



results = parser.parse_args()

print(results.rules)
print(results.function)

if(results.function==None or results.rules==None):
	print(parser.parse_args(['-h']))

print("(+)Configuring Watcher ...")
print('	(-)Loading rules from file ...')

rules = open(results.rules,"r")
temp = rules.read()
checks = temp.split("\n")

client = boto3.client('logs')
groups = client.describe_log_groups()
list_groups = groups["logGroups"]
getloggroups = []

for j in list_groups:
	getloggroups.append(j["logGroupName"])

if(results.function!=None):
		for k in getloggroups:
			if(k.find(results.function)>0):
				print("(+)Scanning for signatures in "+k)
				res = client.filter_log_events(logGroupName=k)
				all_events = []
				all_events = res["events"]
				for i in all_events:
					for j in checks:
						
						m = re.search(j,i["message"],re.IGNORECASE)
						if m:
							print("(Found ==> )"+j)
							print(i["message"])