core

Documentation

Index

• func CountPipelineSteps(item Config) int
• func LintPipeline(item Config) error
• func WalkPipeline(item Config, in []Step, cb WalkCallback)
• type Config
  • func LoadAndLint(filePath string) (Config, error)
  • func LoadDSLFile(filePath string) (Config, error)
• type FindConfig
• type ImportConfig
• type OutputConfig
• type PipelineConfig
• type ProcessConfig
• type Runargs
  • func NewRunargs() *Runargs
  • func (r *Runargs) Fix() error
  • func (r *Runargs) Validate() error
• type Splunkargs
• type Step
• type WalkCallback

Functions

func CountPipelineSteps

func CountPipelineSteps(item Config) int

func LintPipeline

func LintPipeline(item Config) error

func WalkPipeline

func WalkPipeline(item Config, in []Step, cb WalkCallback)

Types

type Config

type Config struct {
	ArchivesPasswords []string `hcl:"archives_passwords,optional"`
	// TemporaryFolder   string         `hcl:"temporary_folder"`
	Pipeline PipelineConfig `hcl:"pipeline,block"`

	Packages []PipelineConfig `hcl:"package,block"`
}

func LoadAndLint

func LoadAndLint(filePath string) (Config, error)

func LoadDSLFile

func LoadDSLFile(filePath string) (Config, error)

type FindConfig

type FindConfig struct {
	Name       string `hcl:"name,label"`
	Decompress bool   `hcl:"decompress,optional"`

	InputPaths     []string `hcl:"input_paths,optional"`
	SkipInputPaths []string `hcl:"skip_input_paths,optional"`

	ContinueWith          []string `hcl:"continue_with,optional"`
	RemoveAfterDecompress bool     `hcl:"remove_after_decompress,optional"`

	InputMimes []string `hcl:"input_mimes,optional"`

	DecompressWorkersCount int `hcl:"decompress_workers_count,optional"`

	// Extracts  []ExtractConfig `hcl:"extract,block"`
	Finds     []FindConfig    `hcl:"find,block"`
	Processes []ProcessConfig `hcl:"process,block"`
	Imports   []ImportConfig  `hcl:"import,block"`
}

type ImportConfig

type ImportConfig struct {
	Name    string         `hcl:"name,label"`
	Imports []ImportConfig `hcl:"import,block"`
}

type OutputConfig

type OutputConfig struct {
	Type     string `hcl:"type,label"`
	Address  string `hcl:"address"`
	Username string `hcl:"username"`
	Password string `hcl:"password"`
}

type PipelineConfig

type PipelineConfig struct {
	Name string `hcl:"name,label"`

	// Extracts  []ExtractConfig `hcl:"extract,block"`
	Finds     []FindConfig    `hcl:"find,block"`
	Processes []ProcessConfig `hcl:"process,block"`
	Imports   []ImportConfig  `hcl:"import,block"`
}

type ProcessConfig

type ProcessConfig struct {
	Name       string            `hcl:"name,label"`
	Sourcetype string            `hcl:"sourcetype,optional"`
	Config     map[string]string `hcl:"config,optional"`
}

type Runargs

type Runargs struct {
	LogFile          string
	Verbose          bool
	ProcessorTimeout int
	WorkersCount     uint32

	Targets      []string
	PipelineFile string
	Tag          string

	Splunk       Splunkargs
	OutputFolder string

	// SigmaFolder			string
	// YaraFolder			string
	TempFolder string
}

func NewRunargs

func NewRunargs() *Runargs

func (*Runargs) Fix

func (r *Runargs) Fix() error

func (*Runargs) Validate

func (r *Runargs) Validate() error

type Splunkargs

type Splunkargs struct {
	Disabled bool
	Index    string
	Address  string
	Token    string
}

type Step

type Step struct {
	CurrentFolder string
	NextArtifact  string
	Name          string
}

type WalkCallback

type WalkCallback func(interface{}, []Step) []Step