tis-audit-machine-start-stop

package           : tis-audit-machine-start-stop
version           : 0-0
architecture      : all
section           : base
priority          : optional
name              : 
categories        : audit
maintainer        : WAPT Team,Tranquil IT
description       : This package audits workstation startup and shutdown events. It collects Windows system events related to machine start, clean shutdown, and unexpected shutdown, then stores them in WAPT audit data for tracking and reporting purposes.
depends           : 
conflicts         : 
maturity          : PROD
locale            : all
target_os         : windows
min_wapt_version  : 
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : Ce paquet audite les événements de démarrage et d’arrêt du poste. Il collecte les événements système Windows liés au démarrage, à l’arrêt propre et à l’arrêt inattendu de la machine, puis les enregistre dans les données d’audit WAPT à des fins de suivi et de reporting.
description_pl    : 
description_de    : 
description_es    : 
description_pt    : 
description_it    : 
description_nl    : 
description_ru    : 
audit_schedule    : 
editor            : 
keywords          : 
licence           : 
homepage          : 
package_uuid      : 8876207c-fef1-4513-8c62-af0481c2f9f4
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
min_os_version    : 
max_os_version    : 
icon_sha256sum    : b973200181b0a6cafa5f1428e13569e741326548f4a69bd5fdddf12748552eb2
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature_date    : 2026-06-17T15:12:49.000000
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,min_os_version,max_os_version,icon_sha256sum,signer,signer_fingerprint,signature_date,signed_attributes
signature         : lWlEDxMIeB6jkjADNPBzvMG0wyO0e/HRM2/u6YuW9jOOv7PVFYAesd/3kBC/KkUMqQUwltFfOLOYmKapaJa1Usnj5AGevFHF8QjxQGOpRsKBuf5WGLEDBswmd9UMDgG9vEKbD6tLT0Bc2lH7QeXFzIXk77ynSzkgYoK6CvE8eZPIEeE2hKpIHcgAV+7qgQLvp/d1+3Ososoi5rdmuWohk4pysnZQQfiFhyyqHEBHMh9/LMRDYI/TJc/KlvaKO1HO+zLaSfGUM+OmmN2s2xL7JK5hz2CHgYDsplxniJ0wqLjM1VL1XBJS/XzJc6YsLyqvvha4PpMGBx0ULXr5JILy5w==

# -*- coding: utf-8 -*-
from setuphelpers import *
import wmi
from datetime import datetime, timedelta
import calendar

def install():

    pass

def audit():

    name_key = "machine-start-stop"

    wmi_o = wmi.WMI('.')

    v = WAPT.read_audit_data(name_key,name_key,include_expired_data=False)

    if not v:
        since = datetime.utcnow() - timedelta(days=3650)
    else:
        since = datetime.fromisoformat(v['date_utc'])

    since_wmi = since.strftime('%Y%m%d%H%M%S.000000+000')
    wql = (
    "SELECT * FROM Win32_NTLogEvent WHERE Logfile='System' "
    "AND (EventCode='6005' OR EventCode='6006' OR EventCode='6008') "
    "AND TimeGenerated >= '%s'" % since_wmi
    )

    # Query WMI object.
    wql_r = wmi_o.query(wql)
    wql_r.reverse()

    for event in wql_r:

        if event.EventCode == 6005:
            typeevent = 'Computer-Start'

        elif event.EventCode == 6006:
            typeevent = 'Computer-Stop'

        elif event.EventCode == 6008:
            typeevent = 'Computer-Stop-Unexpected'

        realdate = event.TimeGenerated.split('.')[0]
        humandate = datetime.strptime(realdate, '%Y%m%d%H%M%S')
        humandate_now = datetime.fromtimestamp(calendar.timegm(humandate.timetuple()))

        WAPT.write_audit_data(
            name_key,
            name_key,
            value={
                "date_utc": humandate,
                "date_now" : humandate_now,
                "typeevent": typeevent,

            },
            keep_days=3650,
            value_date=humandate,
            max_count=None
        )

    return "OK"

38d056ab130f7bf7c481c12636a4e9959de36561d3dfcbe54c6e3571bc0c1dc3 : WAPT/certificate.crt
9595578ac98f986c0f29952f6318856007fe3deb8eb1cefd2a4e572acbb183a3 : WAPT/control
b973200181b0a6cafa5f1428e13569e741326548f4a69bd5fdddf12748552eb2 : WAPT/icon.png
fd346b4c99081ddec3dc8ee2b37344efb0e17c930cf4e7d714417ec16f101d14 : luti.json
0d09e74532c396a7dd2f28a0e9fd05f24dfc0c44a352e620a2229703d4eedd8b : setup.py