ece

Documentation

Index

• Constants
• type ECE
  • func NewECE(maxAge time.Duration, logFile string, maxLogSize int, maxLogBackups int, ...) *ECE
  • func (ece *ECE) AddEvent(message string) (err error)
  • func (ece *ECE) DelayNotify(reqId string)
  • func (ece *ECE) RemoveEvent(reqId string) *Event
  • func (ece *ECE) RetrieveEvent(reqId string) *Event
  • func (ece *ECE) Shutdown() (err error)
  • func (ece *ECE) Start() (err error)
  • func (ece *ECE) Wait()
  • func (ece *ECE) WriteEvent(reqId string) (err error)
• type Event
• type OutputEvent
• type OutputWaf
• type RequestEntry
  • func UnmarshalWeb(message string) (web RequestEntry, err error)
• type WafEntry
  • func UnmarshalWaf(message string) (waf WafEntry, err error)

Constants

const ECE_TLS_CRT_PATH_ENV_VAR = "ECE_TLS_CRT_PATH"

const ECE_TLS_KEY_PATH_ENV_VAR = "ECE_TLS_KEY_PATH"

Types

type ECE

type ECE struct {
	sync.RWMutex
	Events map[string]*Event

	Ttl     time.Duration
	Debug   bool
	Address string
	// contains filtered or unexported fields
}

ECE The Event Correlation Engine itself

func NewECE

func NewECE(maxAge time.Duration, logFile string, maxLogSize int, maxLogBackups int, maxLogAge int, logCompress bool, address string) *ECE

NewECE Creates a new ECE.

func (*ECE) AddEvent

func (ece *ECE) AddEvent(message string) (err error)

AddEvent parses the event text, then looks it up in the internal cache. If it's there, it adds the appropriate record to the existing event. If not, it creates one and sets it's timeout.

func (*ECE) DelayNotify

func (ece *ECE) DelayNotify(reqId string)

DelayNotify is intended to run from a goroutine. It sets a timer equal to the ttl, and then writes the event after the timer expires.

func (*ECE) RemoveEvent

func (ece *ECE) RemoveEvent(reqId string) *Event

RemoveEvent removes the event from the internal cache

func (*ECE) RetrieveEvent

func (ece *ECE) RetrieveEvent(reqId string) *Event

RetrieveEvent returns the event for the request id, or nil if it doesn't exist

func (*ECE) Shutdown

func (ece *ECE) Shutdown() (err error)

func (*ECE) Start

func (ece *ECE) Start() (err error)

func (*ECE) Wait

func (ece *ECE) Wait()

func (*ECE) WriteEvent

func (ece *ECE) WriteEvent(reqId string) (err error)

WriteEvent writes the event to the log

type Event

type Event struct {
	WafEntries     []WafEntry
	RequestEntries []RequestEntry
	// contains filtered or unexported fields
}

Event Struct representing an entire firewall event, containing generally 1 web event and 0 or more waf events

type OutputEvent

type OutputEvent struct {
	ServiceId            string      `json:"service_id"`
	RequestId            string      `json:"request_id"`
	StartTime            string      `json:"start_time"`
	FastlyInfo           string      `json:"fastly_info"`
	Datacenter           string      `json:"datacenter"`
	ClientIp             string      `json:"client_ip"`
	ReqMethod            string      `json:"req_method"`
	ReqURI               string      `json:"req_uri"`
	ReqHHost             string      `json:"req_h_host"`
	ReqHUserAgent        string      `json:"req_h_user_agent"`
	ReqHAcceptEncoding   string      `json:"req_h_accept_encoding"`
	ReqHeaderBytes       string      `json:"req_header_bytes"`
	ReqBodyBytes         string      `json:"req_body_bytes"`
	RuleIds              []int       `json:"rule_ids"`
	WafLogged            string      `json:"waf_logged"`
	WafBlocked           string      `json:"waf_blocked"`
	WafFailures          string      `json:"waf_failures"`
	WafExecuted          string      `json:"waf_executed"`
	AnomalyScore         string      `json:"anomaly_score"`
	SqlInjectionScore    string      `json:"sql_injection_score"`
	RfiScore             string      `json:"rfi_score"`
	LfiScore             string      `json:"lfi_score"`
	RceScore             string      `json:"rce_score"`
	PhpInjectionScore    string      `json:"php_injection_score"`
	SessionFixationScore string      `json:"session_fixation_score"`
	HTTPViolationScore   string      `json:"http_violation_score"`
	XSSScore             string      `json:"xss_score"`
	RespStatus           string      `json:"resp_status"`
	RespBytes            string      `json:"resp_bytes"`
	RespHeaderBytes      string      `json:"resp_header_bytes"`
	RespBodyBytes        string      `json:"resp_body_bytes"`
	WafEvents            []OutputWaf `json:"waf_events"`
	ThrottlingRule       string      `json:"throttling_rule"`
	Throttled            int         `json:"throttled"`
	TlsProtocol          string      `json:"tls_protocol"`
	TlsCipher            string      `json:"tls_cipher"`
}

OutputEvent is simply the marshal format for the outputted merged event

type OutputWaf

type OutputWaf struct {
	RuleId       string `json:"rule_id"`
	Severity     string `json:"severity"`
	AnomalyScore string `json:"anomaly_score"`
	LogData      string `json:"logdata"`
	WafMessage   string `json:"waf_message"`
}

OutputWaf is the output format for the waf event

type RequestEntry

type RequestEntry struct {
	EventType            string `json:"event_type"`
	ServiceId            string `json:"service_id"`
	RequestId            string `json:"request_id"`
	StartTime            string `json:"start_time"`
	FastlyInfo           string `json:"fastly_info"`
	Datacenter           string `json:"datacenter"`
	ClientIp             string `json:"client_ip"`
	ReqMethod            string `json:"req_method"`
	ReqURI               string `json:"req_uri"`
	ReqHHost             string `json:"req_h_host"`
	ReqHUserAgent        string `json:"req_h_user_agent"`
	ReqHAcceptEncoding   string `json:"req_h_accept_encoding"`
	ReqHeaderBytes       string `json:"req_header_bytes"`
	ReqBodyBytes         string `json:"req_body_bytes"`
	WafLogged            string `json:"waf_logged"`
	WafBlocked           string `json:"waf_blocked"`
	WafFailures          string `json:"waf_failures"`
	WafExecuted          string `json:"waf_executed"`
	AnomalyScore         string `json:"anomaly_score"`
	SqlInjectionScore    string `json:"sql_injection_score"`
	RfiScore             string `json:"rfi_score"`
	LfiScore             string `json:"lfi_score"`
	RceScore             string `json:"rce_score"`
	PhpInjectionScore    string `json:"php_injection_score"`
	SessionFixationScore string `json:"session_fixation_score"`
	HTTPViolationScore   string `json:"http_violation_score"`
	XSSScore             string `json:"xss_score"`
	RespStatus           string `json:"resp_status"`
	RespBytes            string `json:"resp_bytes"`
	RespHeaderBytes      string `json:"resp_header_bytes"`
	RespBodyBytes        string `json:"resp_body_bytes"`
	ThrottlingRule       string `json:"throttling_rule"`
	TlsProtocol          string `json:"tls_protocol"`
	TlsCipher            string `json:"tls_cipher"`
}

RequestEntry a struct representing a Web Event

func UnmarshalWeb

func UnmarshalWeb(message string) (web RequestEntry, err error)

UnmarshalWeb unmarshals the log json into a RequestEntry Object

type WafEntry

type WafEntry struct {
	EventType    string `json:"event_type"`
	RequestId    string `json:"request_id"`
	RuleId       string `json:"rule_id"`
	Severity     string `json:"severity"`
	AnomalyScore string `json:"anomaly_score"`
	LogData      string `json:"logdata"`
	WafMessage   string `json:"waf_message"`
}

WafEntry a struct representing a Waf Log Entry

func UnmarshalWaf

func UnmarshalWaf(message string) (waf WafEntry, err error)

UnmarshalWaf unmarshals the log json into a WafEntry Object