sysmon

Documentation

Index

• func LoadSysmonModules(basePath string, modulesPath []string) (map[string]EventFiltersContainer, error)
• type Condition
• type Conditions
  • func (c Conditions) Len() int
  • func (c Conditions) Less(i, j int) bool
  • func (c Conditions) Swap(i, j int)
• type EventFilter
  • func (e EventFilter) GenRuleID()
  • func (e EventFilter) RemoveRuleNames()
  • func (e EventFilter) Sort()
• type EventFilteringRules
• type EventFiltersContainer
• type Rule
• type RuleGroup
• type SysmonConfig
  • func AddModulesToConfig(sysmonConfig SysmonConfig, sysmonModules map[string]EventFiltersContainer, ...) (SysmonConfig, error)
  • func GenerateBaseSysmonConfig(cfg config.Config, buildVersion string) (SysmonConfig, error)

Functions

func LoadSysmonModules

func LoadSysmonModules(basePath string, modulesPath []string) (map[string]EventFiltersContainer, error)

Types

type Condition

type Condition struct {
	XMLName       xml.Name
	NameAttr      string `xml:"name,attr,omitempty"`
	ConditionAttr string `xml:"condition,attr"`
	Value         string `xml:",innerxml"`
}

Generic Condition

type Conditions

type Conditions []Condition

Sorting implementation for Condition 1. Condition Tag Name, 2. Value

func (Conditions) Len

func (c Conditions) Len() int

func (Conditions) Less

func (c Conditions) Less(i, j int) bool

func (Conditions) Swap

func (c Conditions) Swap(i, j int)

type EventFilter

type EventFilter struct {
	XMLName    xml.Name
	OnMatchAtt string     `xml:"onmatch,attr"`
	Conditions Conditions `xml:",any"`
	Rules      []Rule     `xml:"Rule,omitempty"`
}

ProcessCreate, FileCreateTime...

func (EventFilter) GenRuleID

func (e EventFilter) GenRuleID()

Replaces condition and rule names with id

func (EventFilter) RemoveRuleNames

func (e EventFilter) RemoveRuleNames()

Removes rule name

func (EventFilter) Sort

func (e EventFilter) Sort()

type EventFilteringRules

type EventFilteringRules struct {
	RuleGroups []RuleGroup `xml:"RuleGroup"`
}

type EventFiltersContainer

type EventFiltersContainer struct {
	Includes EventFilter
	Excludes EventFilter
}

DTO to easier work with the individual filters

type Rule

type Rule struct {
	XMLName           xml.Name
	NameAttr          string     `xml:"name,attr,omitempty"`
	GroupRelationAttr string     `xml:"groupRelation,attr"`
	Conditions        Conditions `xml:",any"`
}

Subrule

type RuleGroup

type RuleGroup struct {
	EventFilters      EventFilter `xml:",any"`
	GroupRelationAttr string      `xml:"groupRelation,attr,omitempty"`
}

type SysmonConfig

type SysmonConfig struct {
	XMLName                xml.Name
	Comment                string              `xml:",comment"`
	SchemaversionAttr      string              `xml:"schemaversion,attr"`
	ArchiveDirectory       string              `xml:"ArchiveDirectory,omitempty"`
	CheckRevocation        bool                `xml:"CheckRevocation,omitempty"`
	CopyOnDeleteExtensions string              `xml:"CopyOnDeleteExtensions,omitempty"`
	CopyOnDeletePE         bool                `xml:"CopyOnDeletePE,omitempty"`
	CopyOnDeleteProcesses  string              `xml:"CopyOnDeleteProcesses,omitempty"`
	CopyOnDeleteSIDs       string              `xml:"CopyOnDeleteSIDs,omitempty"`
	DnsLookup              bool                `xml:"DnsLookup,omitempty"`
	DriverName             string              `xml:"DriverName,omitempty"`
	HashAlgorithms         string              `xml:"HashAlgorithms,omitempty"`
	EventFiltering         EventFilteringRules `xml:"EventFiltering"`
}

SysmonConfig ...

func AddModulesToConfig

func AddModulesToConfig(sysmonConfig SysmonConfig, sysmonModules map[string]EventFiltersContainer, cfg []config.EventFilter, generateRuleIds bool, removeRuleNames bool) (SysmonConfig, error)

func GenerateBaseSysmonConfig

func GenerateBaseSysmonConfig(cfg config.Config, buildVersion string) (SysmonConfig, error)