ransomware_kill¶

The following methods allow for interaction with the ZTB Ransomware Kill API endpoints. Includes email template configuration and ransomware kill state (color: green, yellow, orange, red).

Methods are accessible via ztb.ransomware_kill

Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

class RansomwareKillAPI¶

Bases: APIClient

Client for the ZTB Ransomware Kill resource.

Provides operations for managing ransomware kill state and email templates in the Zero Trust Branch API.

Endpoints live under /api/v3/ransomware-kill.

get_email_template(site_id)¶

Get Ransomware email template by site id.

Parameters:: site_id (str) – The unique identifier of the site.
Returns:: (RansomwareKillEmailTemplate instance, Response, error).
Return type:: tuple

Examples

Get email template for a site:

>>> template, _, error = client.ztb.ransomware_kill.get_email_template("site-123")
>>> if error:
...     print(f"Error fetching template: {error}")
...     return
>>> print(template.as_dict())

get_state()¶

Get Ransomware kill state.

Returns:

(RansomwareKillState or RansomwareKillErrorPayload, Response, error).: On 200 Success: RansomwareKillState (cluster_token, token, result). On error/default: RansomwareKillErrorPayload (detail, errorCode, message, requestKey, statusCode).

Return type:

tuple

Examples

Get ransomware kill state:

>>> state, _, error = client.ztb.ransomware_kill.get_state()
>>> if error:
...     print(f"Error fetching state: {error}")
...     return
>>> if hasattr(state, "error_code") and state.error_code is not None:
...     print(f"API error: {state.message}")
... else:
...     print(state.cluster_token, state.token)

save_email_template(site_id, *, cluster_token=None, email_body=None, recipients=None, token=None, **kwargs)¶

Save email template message for a site.

Parameters:

site_id (str) – The unique identifier of the site.
cluster_token (str, optional) – Cluster token.
email_body (str, optional) – The body of the notification email.
recipients (str, optional) – Comma-separated list of recipient emails.
token (str, optional) – Authentication token.
**kwargs – Additional fields (snake_case) passed to the API.

Returns:

(RansomwareKillEmailTemplate instance, Response, error).

Return type:

tuple

Examples

Save email template:

>>> template, _, error = client.ztb.ransomware_kill.save_email_template(
...     site_id="site-123",
...     email_body="Ransomware detected. Please investigate.",
...     recipients="admin@example.com,security@example.com",
... )
>>> if error:
...     print(f"Error saving template: {error}")
...     return
>>> print(template.as_dict())

update_state(site_id, color)¶

Update Ransomware kill state for a site.

Parameters:

site_id (str) – The unique identifier of the site.
color (str) – The kill state color. One of: green, yellow, orange, red.

Returns:

(None, Response, error).

Return type:

tuple

Examples

Update ransomware kill state:

>>> _, _, error = client.ztb.ransomware_kill.update_state(
...     site_id="site-123",
...     color="yellow",
... )
>>> if error:
...     print(f"Error updating state: {error}")
...     return
>>> print("State updated successfully.")