rules

Apr 30, 2021

Changes in this version

type CompiledRule

+ Actions []string

type Rule

+ Actions []string

Dec 23, 2020

Changes in this version

type CompiledRule

+ Attack []Attack

Nov 5, 2020

Changes in this version

type CompiledRule

+ Filter bool

type MetaSection

+ Filter bool

Aug 13, 2019

Changes in this version

+ func Pretty(c *ConditionElement, group bool) string

+ func PrettySplit(split []*ConditionElement) string

type ConditionElement

+ Prev *ConditionElement

+ func (c *ConditionElement) Pretty(group bool) string

+ func (ce *ConditionElement) GetGroup() []*ConditionElement

+ func (ce *ConditionElement) GetLevels(lvl int) [][]*ConditionElement

+ func (ce *ConditionElement) MaxLevel() (lvl int)

+ func (ce *ConditionElement) Prioritize()

+ func (ce *ConditionElement) Simplify()

Jul 31, 2019

Changes in this version

type ContainerDB

+ func (c *ContainerDB) AddStringToContainer(name string, values ...string)

+ func (c *ContainerDB) ContainsString(name string, value string) bool

+ func (c *ContainerDB) String() string

Jun 4, 2019

Changes in this version

+ type Attack struct

+ Description string

+ ID string

+ Reference string

+ Tactic string

type CompiledRule

+ Attck []Attack

type MetaSection

+ Attack []Attack

Feb 11, 2019

Changes in this version

+ const TypeNegate

+ const TypeOperand

+ const TypeOperator

+ var ErrContainerAlreadyExists = fmt.Errorf("Already existing container")

+ var ErrEOT = fmt.Errorf("End of tokens")

+ var ErrEmptyToken = fmt.Errorf("Empty token")

+ var ErrUnexpectedToken = fmt.Errorf("Unexpected tokens")

+ var ErrUnkOperator = fmt.Errorf("Unknown operator")

+ func Compute(ce *ConditionElement, operands OperandReader) bool

+ func GetOperands(ce *ConditionElement) []string

+ func IsContainerMatch(s string) bool

+ func IsFieldMatch(s string) bool

+ type CompiledRule struct

+ AtomMap datastructs.SyncedMap

+ Channels datastructs.SyncedSet

+ Computers datastructs.SyncedSet

+ Conditions *ConditionElement

+ Criticality int

+ Disabled bool

+ EventIDs datastructs.SyncedSet

+ Name string

+ Tags datastructs.SyncedSet

+ Traces []*Trace

+ func Load(b []byte, containers *ContainerDB) (*CompiledRule, error)

+ func NewCompiledRule() (er CompiledRule)

+ func (er *CompiledRule) AddMatcher(m Matcher)

+ func (er *CompiledRule) Match(event *evtx.GoEvtxMap) bool

+ func (er *CompiledRule) SetContainers(containers *ContainerDB)

+ type ConditionElement struct

+ Group int

+ Level int

+ Negate bool

+ Next *ConditionElement

+ Operand string

+ Operator rune

+ Type int

+ func (c *ConditionElement) DebugString() string

+ func (c *ConditionElement) String() string

+ type ContainerDB map[string]*datastructs.SyncedSet

+ func NewContainers() *ContainerDB

+ func (c *ContainerDB) AddContainer(name string, container *datastructs.SyncedSet) error

+ func (c *ContainerDB) AddNewContainer(name string) error

+ func (c *ContainerDB) AddToContainer(name string, values ...interface{})

+ func (c *ContainerDB) Contains(name string, value string) bool

+ func (c *ContainerDB) Get(name string) (*datastructs.SyncedSet, bool)

+ func (c *ContainerDB) Has(name string) bool

+ func (c *ContainerDB) Len(name string) int

+ type ContainerMatch struct

+ Container string

+ Name string

+ Operand string

+ Regexp string

+ RexName string

+ func NewContainerMatch() *ContainerMatch

+ func ParseContainerMatch(extract string) (ae *ContainerMatch, err error)

+ func (c *ContainerMatch) Compile() (err error)

+ func (c *ContainerMatch) Extract(ev *evtx.GoEvtxMap) (string, bool)

+ func (c *ContainerMatch) ExtractFromString(s string) (string, bool)

+ func (c *ContainerMatch) GetName() string

+ func (c *ContainerMatch) Match(ev *evtx.GoEvtxMap) bool

+ func (c *ContainerMatch) SetContainerDB(db *ContainerDB)

+ func (c *ContainerMatch) String() string

+ type EventOpReader struct

+ func (oe *EventOpReader) Read(operand string) (value bool, ok bool)

+ type FieldMatch struct

+ Name string

+ Operand string

+ Operator string

+ Value string

+ func NewFieldMatch(name, operand, operator, value string) *FieldMatch

+ func ParseFieldMatch(rule string) (ar FieldMatch, err error)

+ func (f *FieldMatch) Compile() error

+ func (f *FieldMatch) GetName() string

+ func (f *FieldMatch) Match(se *evtx.GoEvtxMap) bool

+ func (f *FieldMatch) String() string

+ type Matcher interface

+ GetName func() string

+ Match func(*evtx.GoEvtxMap) bool

+ type MetaSection struct

+ Channels []string

+ Computers []string

+ Criticality int

+ Disable bool

+ EventIDs []int64

+ Traces []string

+ type OperandMap map[string]bool

+ func (om OperandMap) Read(operand string) (value, ok bool)

+ type OperandReader interface

+ Read func(string) (bool, bool)

+ type Rule struct

+ Condition string

+ Matches []string

+ Meta MetaSection

+ Name string

+ Tags []string

+ func NewRule() Rule

+ func (jr *Rule) Compile(containers *ContainerDB) (*CompiledRule, error)

+ func (jr *Rule) IsDisabled() bool

+ func (jr *Rule) JSON() (string, error)

+ func (jr *Rule) ReplaceTemplate(tm *TemplateMap)

+ type Template struct

+ Name string

+ Value string

+ func ParseTemplate(tplString string) (tpl Template, err error)

+ func (t *Template) Replace(s string) (new string)

+ type TemplateMap struct

+ func NewTemplateMap() *TemplateMap

+ func (tm *TemplateMap) AddTemplate(t *Template)

+ func (tm *TemplateMap) GetTemplate(name string) (ok bool, tpl *Template)

+ func (tm *TemplateMap) LoadReader(r io.Reader) error

+ func (tm *TemplateMap) ReplaceAll(s string) (new string)

+ type Tokenizer struct

+ func NewTokenizer(condition string) (c Tokenizer)

+ func (t *Tokenizer) NextExpectedToken(expects ...string) (token string, err error)

+ func (t *Tokenizer) NextToken() (token string, err error)

+ func (t *Tokenizer) ParseCondition(group, level int) (c ConditionElement, err error)

+ type Trace struct

+ Channels []string

+ EventIDs []int64

+ Name string

+ Operand string

+ Operator string

+ Value string

+ func NewTrace(name string) *Trace

+ func ParseTrace(name, trace string) (*Trace, error)

+ func (t *Trace) Compile(trigger *CompiledRule, value string) (*CompiledRule, error)

+ func (t *Trace) Hash() string

+ func (t *Trace) HashWithValue(value string) string

+ func (t *Trace) Path() *evtx.GoEvtxPath