file_integrity

package
v0.0.0-...-90b854d Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 6, 2019 License: Apache-2.0 Imports: 37 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ActionTriggersAnalysis 

func ActionTriggersAnalysis(action Action) bool

func New 

func New(base mb.BaseMetricSet) (mb.MetricSet, error)

New returns a new file.MetricSet.

func ParseProxyURL 

func ParseProxyURL(raw string) (*url.URL, error)

copied from: elastic/beats/libbeat/outputs/elasticsearch/url.go

Types

type AnalysisReport 

type AnalysisReport struct {
	CorellationId string        `json:"corellationId"`
	RequestId     string        `json:"requestId"`
	JobStatus     JobStatus     `json:"jobStatus"`
	JobId         string        `json:"jobId"`
	Report        Report        `json:"report"`
	AnalysisStats AnalysisStats `json:"analysis_stats"`
}

type AnalysisStats 

type AnalysisStats struct {
	TotalSeconds float64     `json:"total_seconds"`
	QueryStats   []QueryStat `json:"query_stats"`
}

func (*AnalysisStats) AddQueryStat 

func (stats *AnalysisStats) AddQueryStat(url *url.URL, d time.Duration)

type AnalysisType 

type AnalysisType string

-------------------------------------------------------------------------------------- 

const (
	STATIC  AnalysisType = "static"
	DYNAMIC AnalysisType = "dynamic"
)

type AuthenticationResponse 

type AuthenticationResponse struct {
	AccessToken string `json:"access_token"`
	ExpiresIn   int    `json:"expires_in"`
	TokenType   string `json:"token_type"`
	ExpiresAt   time.Time
}

type Config 

type Config struct {
	Paths               []string        `config:"paths" validate:"required"`
	HashTypes           []HashType      `config:"hash_types"`
	MaxFileSize         string          `config:"max_file_size"`
	MaxFileSizeBytes    uint64          `config:",ignore"`
	ScanAtStart         bool            `config:"scan_at_start"`
	ScanRatePerSec      string          `config:"scan_rate_per_sec"`
	ScanRateBytesPerSec uint64          `config:",ignore"`
	Recursive           bool            `config:"recursive"` // Recursive enables recursive monitoring of directories.
	ExcludeFiles        []match.Matcher `config:"exclude_files"`
	IncludeFiles        []match.Matcher `config:"include_files"`
	Intelix             IntelixConfig   `config:"intelix" validate:"required"`
}

Config contains the configuration parameters for the file integrity metricset.

func (*Config) IsExcludedPath 

func (c *Config) IsExcludedPath(path string) bool

IsExcludedPath checks if a path matches the exclude_files regular expressions.

func (*Config) IsIncludedPath 

func (c *Config) IsIncludedPath(path string) bool

IsIncludedPath checks if a path matches the include_files regular expressions.

func (*Config) Validate 

func (c *Config) Validate() error

Validate validates the config data and return an error explaining all the problems with the config. This method modifies the given config.

type Digest 

type Digest []byte

Digest is a output of a hash function.

func (Digest) MarshalText 

func (d Digest) MarshalText() ([]byte, error)

MarshalText encodes the digest to a hexadecimal representation of itself.

func (Digest) String 

func (d Digest) String() string

String returns the digest value in lower-case hexadecimal form.

type ErrorResponse 

type ErrorResponse struct {
	CorellationId string `json:"corellationId"`
	RequestId     string `json:"requestId"`
	Error         string `json:"error"`
	Message       string `json:"message"`
	CreatedAt     string `json:"createdAt"`
}

type Event 

type Event struct {
	Timestamp     time.Time              `json:"timestamp"`             // Time of event.
	Path          string                 `json:"path"`                  // The path associated with the event.
	TargetPath    string                 `json:"target_path,omitempty"` // Target path for symlinks.
	Info          *Metadata              `json:"info"`                  // File metadata (if the file exists).
	Source        Source                 `json:"source"`                // Source of the event.
	Action        Action                 `json:"action"`                // Action (like created, updated).
	Hashes        map[HashType]Digest    `json:"hash,omitempty"`        // File hashes.
	LookupResults map[string]interface{} `json:"intelix,omitempty"`     // Intelix lookup results
	// contains filtered or unexported fields
}

Event describe the filesystem change and includes metadata about the file.

func NewEvent 

func NewEvent(
	path string,
	action Action,
	source Source,
	maxFileSize uint64,
	hashTypes []HashType,
) Event

NewEvent creates a new Event. Any errors that occur are included in the returned Event.

func NewEventFromFileInfo 

func NewEventFromFileInfo(
	path string,
	info os.FileInfo,
	err error,
	action Action,
	source Source,
	maxFileSize uint64,
	hashTypes []HashType,
) Event

NewEventFromFileInfo creates a new Event based on data from a os.FileInfo object that has already been created. Any errors that occur are included in the returned Event.

func (*Event) AddLookupResult 

func (e *Event) AddLookupResult(key string, result interface{})

type EventProducer 

type EventProducer interface {
	// Start starts the event producer and writes events to the returned
	// channel. When the producer is finished it will close the returned
	// channel. If the returned event channel is not drained the producer will
	// block (possibly causing data loss). The producer can be stopped
	// prematurely by closing the provided done channel. An error is returned
	// if the producer fails to start.
	Start(done <-chan struct{}) (<-chan Event, error)
}

EventProducer produces events.

type FileLookupResponse 

type FileLookupResponse struct {
	CorellationId   string        `json:"corellationId"`
	RequestId       string        `json:"requestId"`
	ReputationScore int           `json:"reputationScore"`
	DetectionName   string        `json:"detectionName"`
	Ttl             int           `json:"ttl"`
	AnalysisStats   AnalysisStats `json:"analysis_stats"`
}

type HashType 

type HashType string

HashType identifies a cryptographic algorithm. 

const (
	BLAKE2B_256 HashType = "blake2b_256"
	BLAKE2B_384 HashType = "blake2b_384"
	BLAKE2B_512 HashType = "blake2b_512"
	MD5         HashType = "md5"
	SHA1        HashType = "sha1"
	SHA224      HashType = "sha224"
	SHA256      HashType = "sha256"
	SHA384      HashType = "sha384"
	SHA3_224    HashType = "sha3_224"
	SHA3_256    HashType = "sha3_256"
	SHA3_384    HashType = "sha3_384"
	SHA3_512    HashType = "sha3_512"
	SHA512      HashType = "sha512"
	SHA512_224  HashType = "sha512_224"
	SHA512_256  HashType = "sha512_256"
	XXH64       HashType = "xxh64"
)

Enum of hash types.

func (*HashType) Unpack 

func (t *HashType) Unpack(v string) error

Unpack unpacks a string to a HashType for config parsing.

type Intelix 

type Intelix struct {
	// contains filtered or unexported fields
}

func (*Intelix) Analysis 

func (i *Intelix) Analysis(analysisType AnalysisType, size uint64, filePath string) (*AnalysisReport, error)

func (*Intelix) MalwareLookup 

func (i *Intelix) MalwareLookup(sha256 Digest) (*FileLookupResponse, error)

type IntelixAnalysisCOnfig 

type IntelixAnalysisCOnfig struct {
	// TODO: use human friendly units, https://godoc.org/github.com/alecthomas/units
	MinSize            uint64 `config:"min_size" validate:"required"`
	MaxSize            uint64 `config:"max_size" validate:"required"`
	ReportPollInterval int    `config:"report_poll_interval" validate:"required"`
	AnalysisTimeout    int    `config:"analysis_timeout" validate:"required"`
}

type IntelixConfig 

type IntelixConfig struct {
	Credentials                       IntelixCredentials    `config:"credentials" validate:"required"`
	Urls                              IntelixUrls           `config:"urls" validate:"required"`
	QueryTimeout                      int                   `config:"query_timeout" validate:"required"`
	StaticAnalysisReputationThreshold int                   `config:"static_analysis_reputation_threshold" validate:"required"`
	DynamicAnalysisScoreThreshold     int                   `config:"dynamic_analysis_score_threshold" validate:"required"`
	StaticAnalysisConig               IntelixAnalysisCOnfig `config:"static_analysis" validate:"required"`
	DynamicAnalysisConfig             IntelixAnalysisCOnfig `config:"dynamic_analysis" validate:"required"`
}

type IntelixCredentials 

type IntelixCredentials struct {
	ClientId     string `config:"clientId" validate:"required"`
	ClientSecret string `config:"clientSecret" validate:"required"`
}

type IntelixScanner 

type IntelixScanner interface {
	MalwareLookup(sha256 Digest) (*FileLookupResponse, error)
	Analysis(analysisType AnalysisType, size uint64, filePath string) (*AnalysisReport, error)
}

--------------------------------------------------------------------------------------

func NewIntelix 

func NewIntelix(c *IntelixConfig) (IntelixScanner, error)

type IntelixUrls 

type IntelixUrls struct {
	Proxy      string `config:"proxy_url"`
	AuthUrl    string `config:"auth_url" validate:"required"`
	IntelixUrl string `config:"intelix_url" validate:"required"`
}

type JobStatus 

type JobStatus string

-------------------------------------------------------------------------------------- 

const (
	IN_PROGRESS JobStatus = "IN_PROGRESS"
	SUCCESS     JobStatus = "SUCCESS"
	ERROR       JobStatus = "ERROR"
)

type Metadata 

type Metadata struct {
	Inode  uint64      `json:"inode"`
	UID    uint32      `json:"uid"`
	GID    uint32      `json:"gid"`
	SID    string      `json:"sid"`
	Owner  string      `json:"owner"`
	Group  string      `json:"group"`
	Size   uint64      `json:"size"`
	MTime  time.Time   `json:"mtime"`  // Last modification time.
	CTime  time.Time   `json:"ctime"`  // Last metadata change time.
	Type   Type        `json:"type"`   // File type (dir, file, symlink).
	Mode   os.FileMode `json:"mode"`   // Permissions
	SetUID bool        `json:"setuid"` // setuid bit (POSIX only)
	SetGID bool        `json:"setgid"` // setgid bit (POSIX only)
	Origin []string    `json:"origin"` // External origin info for the file (MacOS only)
}

Metadata contains file metadata.

type MetricSet 

type MetricSet struct {
	mb.BaseMetricSet
	// contains filtered or unexported fields
}

MetricSet for monitoring file integrity.

func (*MetricSet) Close 

func (ms *MetricSet) Close() error

Close cleans up the MetricSet when it finishes.

func (*MetricSet) Lookup 

func (ms *MetricSet) Lookup(event *Event)

func (*MetricSet) Run 

func (ms *MetricSet) Run(reporter mb.PushReporterV2)

Run runs the MetricSet. The method will not return control to the caller until it is finished (to stop it close the reporter.Done() channel).

type QueryStat 

type QueryStat struct {
	QueryType QueryType `json:"query_type"`
	Seconds   float64   `json:"total_seconds"`
}

type QueryType 

type QueryType string
const (
	MALWARE        QueryType = "malware"
	STATIC_QUERY   QueryType = "static"
	STATIC_REPORT  QueryType = "static_report"
	DYNAMIC_QUERY  QueryType = "dynamic"
	DYNAMIC_REPORT QueryType = "dynamic_report"
)

type Report 

type Report struct {
	// Common fields
	Submission      string
	AnalysisType    string
	AnalysisSubject interface{}
	Score           int
	// Static analysis fields
	AnalysisSummary    interface{} `json:"analysis_summary,omitempty"`
	ContainerAnalysis  interface{} `json:"container_analysis,omitempty"`
	Detection          interface{} `json:"detection,omitempty"`
	DocumentAnalysis   interface{} `json:"document_analysis,omitempty"`
	MlAggregateResults interface{} `json:"ml_aggregate_results,omitempty"`
	MlFile             interface{} `json:"ml_file,omitempty"`
	MlFilepath         interface{} `json:"ml_filepath,omitempty"`
	MlInputs           interface{} `json:"ml_inputs,omitempty"`
	PeAnalysis         interface{} `json:"pe_analysis,omitempty"`
	Reputation         interface{} `json:"reputation,omitempty"`
	Target             interface{} `json:"target,omitempty"`
	// Dynamic analysis Fields
	MaliciousActivity        interface{}    `json:"malicious_activity,omitempty"`
	MaliciousClassifications interface{}    `json:"malicious_classifications,omitempty"`
	DetonationInfo           interface{}    `json:"detonation_info,omitempty"`
	Files                    interface{}    `json:"files,omitempty"`
	Processes                interface{}    `json:"processes,omitempty"`
	Registry                 interface{}    `json:"registry,omitempty"`
	Network                  interface{}    `json:"network,omitempty"`
	Screenshots              []string       `json:"screenshots,omitempty"`
	ScreenshotMap            map[int]string `json:"screenshot,omitempty"`
	ActivityTree             interface{}    `json:"activity_tree,omitempty"`
}

type Source 

type Source uint8

Source identifies the source of an event (i.e. what triggered it). 

const (
	// SourceScan identifies events triggered by a file system scan.
	SourceScan Source = iota
	// SourceFSNotify identifies events triggered by a notification from the
	// file system.
	SourceFSNotify
)

func (Source) MarshalText 

func (s Source) MarshalText() ([]byte, error)

MarshalText marshals the Source to a textual representation of itself.

func (Source) String 

func (s Source) String() string

type Type 

type Type uint8

Type identifies the file type (e.g. dir, file, symlink). 

const (
	UnknownType Type = iota // Typically seen in deleted notifications where the object is gone.
	FileType
	DirType
	SymlinkType
)

Enum of possible file.Types.

func (Type) MarshalText 

func (t Type) MarshalText() ([]byte, error)

MarshalText marshals the Type to a textual representation of itself.

func (Type) String 

func (t Type) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.