output

Documentation

Index

• Constants
• Variables
• func ExitOnSeverity(severity string, count int, failOnCount int)
• func FailOn(details SevCount, failOnHighCount int, failOnMediumCount int, ...)
• func GetHostname() string
• func IngestMalwareScanResults(malwareScanMsg string, index string) error
• func MalwaresToMalwareInfo(out IOCFound) *pb.MalwareInfo
• func MalwaresToMalwareInfos(out []IOCFound) []*pb.MalwareInfo
• func PrintColoredIOC(iocs []IOCFound, isFirstIOC *bool)
• func WriteScanData(malwares []*pb.MalwareInfo, scanID string)
• func WriteScanStatus(status, scanID, scanMessage string)
• func WriteTableOutput(report *[]IOCFound) error
• type IOCFound
• type JSONDirIOCOutput
  • func (dirOutput *JSONDirIOCOutput) GetIOC() []IOCFound
  • func (dirOutput *JSONDirIOCOutput) SetIOC(ioc []IOCFound)
  • func (dirOutput *JSONDirIOCOutput) SetTime()
  • func (dirOutput JSONDirIOCOutput) WriteJSON() error
  • func (dirOutput JSONDirIOCOutput) WriteTable() error
• type JSONImageIOCOutput
  • func (imageOutput *JSONImageIOCOutput) GetIOC() []IOCFound
  • func (imageOutput *JSONImageIOCOutput) SetIOC(ioc []IOCFound)
  • func (imageOutput *JSONImageIOCOutput) SetImageID(imageID string)
  • func (imageOutput *JSONImageIOCOutput) SetImageName(imageName string)
  • func (imageOutput *JSONImageIOCOutput) SetTime()
  • func (imageOutput JSONImageIOCOutput) WriteJSON() error
  • func (imageOutput JSONImageIOCOutput) WriteTable() error
• type MalwareScanDoc
• type Publisher
  • func NewPublisher(url string, port string, key string) (*Publisher, error)
  • func (p *Publisher) IngestSecretScanResults(scanID string, malwares []IOCFound) error
  • func (p *Publisher) PublishScanError(scanID, errMsg string)
  • func (p *Publisher) PublishScanStatusMessage(scanID, message, status string)
  • func (p *Publisher) PublishScanStatusPeriodic(scanID, status string)
  • func (p *Publisher) SendReport(hostname, imageName, containerID, nodeType string)
  • func (p *Publisher) StartScan(nodeID, nodeType string) string
  • func (p *Publisher) StopPublishScanStatus()
• type SevCount
  • func CountBySeverity(report []IOCFound) SevCount

Constants

const (
	HIGH   = "high"
	MEDIUM = "medium"
	LOW    = "low"
)

severity

const (
	Indent = "  " // Indentation for Json printing
)

Variables

var (
	MgmtConsoleURL string
	ToaeKey        string
)

Functions

func ExitOnSeverity

func ExitOnSeverity(severity string, count int, failOnCount int)

func FailOn

func FailOn(details SevCount, failOnHighCount int, failOnMediumCount int, failOnLowCount int, failOnCount int)

func GetHostname

func GetHostname() string

func IngestMalwareScanResults

func IngestMalwareScanResults(malwareScanMsg string, index string) error

func MalwaresToMalwareInfo

func MalwaresToMalwareInfo(out IOCFound) *pb.MalwareInfo

func MalwaresToMalwareInfos

func MalwaresToMalwareInfos(out []IOCFound) []*pb.MalwareInfo

func PrintColoredIOC

func PrintColoredIOC(iocs []IOCFound, isFirstIOC *bool)

func WriteScanData

func WriteScanData(malwares []*pb.MalwareInfo, scanID string)

func WriteScanStatus

func WriteScanStatus(status, scanID, scanMessage string)

func WriteTableOutput

func WriteTableOutput(report *[]IOCFound) error

Types

type IOCFound

type IOCFound struct {
	LayerID          string   `json:"Image Layer ID,omitempty"`
	RuleName         string   `json:"Matched Rule Name,omitempty"`
	StringsToMatch   []string `json:"Matched Part,omitempty"`
	CategoryName     []string `json:"Category,omitempty"`
	Severity         string   `json:"Severity,omitempty"`
	SeverityScore    float64  `json:"Severity Score,omitempty"`
	FileSeverity     string   `json:"FileSeverity,omitempty"`
	FileSevScore     float64  `json:"File Severity Score,omitempty"`
	CompleteFilename string   `json:"Full File Name,omitempty"`
	Meta             []string `json:"rule meta"`

	MetaRules map[string]string `json:"rule metadata"`
	Summary   string            `json:"Summary,omitempty"`
	Class     string            `json:"Class,omitempty"`
}

type JSONDirIOCOutput

type JSONDirIOCOutput struct {
	Timestamp time.Time
	DirName   string `json:"Directory Name"`
	IOC       []IOCFound
}

func (*JSONDirIOCOutput) GetIOC

func (dirOutput *JSONDirIOCOutput) GetIOC() []IOCFound

func (*JSONDirIOCOutput) SetIOC

func (dirOutput *JSONDirIOCOutput) SetIOC(ioc []IOCFound)

func (*JSONDirIOCOutput) SetTime

func (dirOutput *JSONDirIOCOutput) SetTime()

func (JSONDirIOCOutput) WriteJSON

func (dirOutput JSONDirIOCOutput) WriteJSON() error

func (JSONDirIOCOutput) WriteTable

func (dirOutput JSONDirIOCOutput) WriteTable() error

type JSONImageIOCOutput

type JSONImageIOCOutput struct {
	Timestamp   time.Time
	ImageName   string `json:"Image Name"`
	ImageID     string `json:"Image ID"`
	ContainerID string `json:"Container ID"`
	IOC         []IOCFound
}

func (*JSONImageIOCOutput) GetIOC

func (imageOutput *JSONImageIOCOutput) GetIOC() []IOCFound

func (*JSONImageIOCOutput) SetIOC

func (imageOutput *JSONImageIOCOutput) SetIOC(ioc []IOCFound)

func (*JSONImageIOCOutput) SetImageID

func (imageOutput *JSONImageIOCOutput) SetImageID(imageID string)

func (*JSONImageIOCOutput) SetImageName

func (imageOutput *JSONImageIOCOutput) SetImageName(imageName string)

func (*JSONImageIOCOutput) SetTime

func (imageOutput *JSONImageIOCOutput) SetTime()

func (JSONImageIOCOutput) WriteJSON

func (imageOutput JSONImageIOCOutput) WriteJSON() error

func (JSONImageIOCOutput) WriteTable

func (imageOutput JSONImageIOCOutput) WriteTable() error

type MalwareScanDoc

type MalwareScanDoc struct {
	*pb.MalwareInfo
	ScanID    string `json:"scan_id,omitempty"`
	Timestamp string `json:"timestamp,omitempty"`
}

type Publisher

type Publisher struct {
	// contains filtered or unexported fields
}

func NewPublisher

func NewPublisher(url string, port string, key string) (*Publisher, error)

func (*Publisher) IngestSecretScanResults

func (p *Publisher) IngestSecretScanResults(scanID string, malwares []IOCFound) error

func (*Publisher) PublishScanError

func (p *Publisher) PublishScanError(scanID, errMsg string)

func (*Publisher) PublishScanStatusMessage

func (p *Publisher) PublishScanStatusMessage(scanID, message, status string)

func (*Publisher) PublishScanStatusPeriodic

func (p *Publisher) PublishScanStatusPeriodic(scanID, status string)

func (*Publisher) SendReport

func (p *Publisher) SendReport(hostname, imageName, containerID, nodeType string)

func (*Publisher) StartScan

func (p *Publisher) StartScan(nodeID, nodeType string) string

func (*Publisher) StopPublishScanStatus

func (p *Publisher) StopPublishScanStatus()

type SevCount

type SevCount struct {
	Total  int
	High   int
	Medium int
	Low    int
}

func CountBySeverity

func CountBySeverity(report []IOCFound) SevCount