class_docstr: OneLogin StreamAlert App
class_docstr_tok: ["OneLogin","StreamAlert","App"]
docstr: Get all events from the endpoint for this timeframe
  
  Returns:
      [
          {
              'id': <int:id>,
              'created_at': <str:created_at>,
              'account_id': <int:account_id>,
              'user_id': <int:user_id>,
              'event_type_id': <int:event_type_id>,
              'notes': <str:notes>,
              'ipaddr': <str:ipaddr>,
              'actor_user_id': <int:actor_user_id>,
              'assuming_acting_user_id': null,
              'role_id': <int:role_id>,
              'app_id': <int:app_id>,
              'group_id': <int:group_id>,
              'otp_device_id': <int:otp_device_id>,
              'policy_id': <int:policy_id>,
              'actor_system': <str:actor_system>,
              'custom_message': <str:custom_message>,
              'role_name': <str:role_name>,
              'app_name': <str:app_name>,
              'group_name': <str:group_name>,
              'actor_user_name': <str:actor_user_name>,
              'user_name': <str:user_name>,
              'policy_name': <str:policy_name>,
              'otp_device_name': <str:otp_device_name>,
              'operation_name': <str:operation_name>,
              'directory_sync_run_id': <int:directory_sync_run_id>,
              'directory_id': <int:directory_id>,
              'resolution': <str:resolution>,
              'client_id': <int:client_id>,
              'resource_type_id': <int:resource_type_id>,
              'error_description': <str:error_description>
          }
      ]
docstr_tok: ["Get","all","events","from","the","endpoint","for","this","timeframe","Returns",":","[","{","'id","'",":","<","int",":","id",">",",","'created_at","'",":","<","str",":","created_at",">",",","'account_id","'",":","<","int",":","account_id",">",",","'user_id","'",":","<","int",":","user_id",">",",","'event_type_id","'",":","<","int",":","event_type_id",">",",","'notes","'",":","<","str",":","notes",">",",","'ipaddr","'",":","<","str",":","ipaddr",">",",","'actor_user_id","'",":","<","int",":","actor_user_id",">",",","'assuming_acting_user_id","'",":","null",",","'role_id","'",":","<","int",":","role_id",">",",","'app_id","'",":","<","int",":","app_id",">",",","'group_id","'",":","<","int",":","group_id",">",",","'otp_device_id","'",":","<","int",":","otp_device_id",">",",","'policy_id","'",":","<","int",":","policy_id",">",",","'actor_system","'",":","<","str",":","actor_system",">",",","'custom_message","'",":","<","str",":","custom_message",">",",","'role_name","'",":","<","str",":","role_name",">",",","'app_name","'",":","<","str",":","app_name",">",",","'group_name","'",":","<","str",":","group_name",">",",","'actor_user_name","'",":","<","str",":","actor_user_name",">",",","'user_name","'",":","<","str",":","user_name",">",",","'policy_name","'",":","<","str",":","policy_name",">",",","'otp_device_name","'",":","<","str",":","otp_device_name",">",",","'operation_name","'",":","<","str",":","operation_name",">",",","'directory_sync_run_id","'",":","<","int",":","directory_sync_run_id",">",",","'directory_id","'",":","<","int",":","directory_id",">",",","'resolution","'",":","<","str",":","resolution",">",",","'client_id","'",":","<","int",":","client_id",">",",","'resource_type_id","'",":","<","int",":","resource_type_id",">",",","'error_description","'",":","<","str",":","error_description",">","}","]"]
code: def _get_onelogin_events(self):
      """Get all events from the endpoint for this timeframe
  
      Returns:
          [
              {
                  'id': <int:id>,
                  'created_at': <str:created_at>,
                  'account_id': <int:account_id>,
                  'user_id': <int:user_id>,
                  'event_type_id': <int:event_type_id>,
                  'notes': <str:notes>,
                  'ipaddr': <str:ipaddr>,
                  'actor_user_id': <int:actor_user_id>,
                  'assuming_acting_user_id': null,
                  'role_id': <int:role_id>,
                  'app_id': <int:app_id>,
                  'group_id': <int:group_id>,
                  'otp_device_id': <int:otp_device_id>,
                  'policy_id': <int:policy_id>,
                  'actor_system': <str:actor_system>,
                  'custom_message': <str:custom_message>,
                  'role_name': <str:role_name>,
                  'app_name': <str:app_name>,
                  'group_name': <str:group_name>,
                  'actor_user_name': <str:actor_user_name>,
                  'user_name': <str:user_name>,
                  'policy_name': <str:policy_name>,
                  'otp_device_name': <str:otp_device_name>,
                  'operation_name': <str:operation_name>,
                  'directory_sync_run_id': <int:directory_sync_run_id>,
                  'directory_id': <int:directory_id>,
                  'resolution': <str:resolution>,
                  'client_id': <int:client_id>,
                  'resource_type_id': <int:resource_type_id>,
                  'error_description': <str:error_description>
              }
          ]
      """
      # Make sure we have authentication headers
      if not self._auth_headers:
          LOGGER.error("[%s] No authentication headers set", self)
          return False
  
      # Are we just getting events or getting paginated events?
      if self._next_page_url:
          params = None
          request_url = self._next_page_url
      else:
          params = {"since": self._last_timestamp}
          request_url = self._events_endpoint()
  
      result, response = self._make_get_request(
          request_url, self._auth_headers, params
      )
  
      if not result:
          # If we hit the rate limit, update the sleep time
          if response and response.get("status"):
              r_status = response.get("status")
              if (
                  r_status["code"] == 400
                  and r_status["message"] == "rate_limit_exceeded"
              ):
                  self._set_rate_limit_sleep()
  
          return False
  
      # Fail if response is invalid
      if not response:
          LOGGER.error("[%s] Received invalid response", self)
          return False
  
      # Set pagination link, if there is any
      self._next_page_url = response["pagination"]["next_link"]
      self._more_to_poll = bool(self._next_page_url)
  
      # Adjust the last seen event, if the events list is not empty
      if not response["data"]:
          LOGGER.info("[%s] Received empty list of events", self)
          return False
  
      self._last_timestamp = response["data"][-1]["created_at"]
  
      # Return the list of events to the caller so they can be send to the batcher
      return response["data"]
  
file_path: streamalert/streamalert/apps/_apps/onelogin.py
imports: import re
  from .None import AppIntegration, StreamAlertApp, get_logger
label_desc: Use image node_id 11 for calling the OneLoginApp obj's underlying member method code with example usage: obj._get_onelogin_events() and returns: response, False, False, False, False