scan

Documentation

Index

• Variables
• func GetFileSystemPathsForContainer(containerID string, namespace string) ([]byte, error)
• func ScanFile(s *Scanner, f *os.File, iocs *[]output.IOCFound, layer string) error
• func ScanFilePath(s *Scanner, path string, iocs *[]output.IOCFound, layer string) (err error)
• type ContainerExtractionResult
• type ContainerScan
• type ImageExtractionResult
• type ImageScan
• type Scanner
  • func New(opts *config.Options, yaraconfig *config.Config, yaraScannerIn *yara.Scanner, ...) *Scanner
  • func (s *Scanner) ExtractAndScanContainer(ctx *tasks.ScanContext, containerID string, namespace string) ([]output.IOCFound, error)
  • func (s *Scanner) ExtractAndScanContainerStream(ctx *tasks.ScanContext, containerID string, namespace string) (chan output.IOCFound, error)
  • func (s *Scanner) ExtractAndScanFromTar(ctx *tasks.ScanContext, tarFolder string) (*ImageExtractionResult, error)
  • func (s *Scanner) ExtractAndScanImage(ctx *tasks.ScanContext, image string) (*ImageExtractionResult, error)
  • func (s *Scanner) ExtractAndScanImageStream(ctx *tasks.ScanContext, image string) (chan output.IOCFound, error)
  • func (s *Scanner) ScanIOCInDir(layer string, baseDir string, fullDir string, matchedRuleSet map[uint]uint, ...) error
  • func (s *Scanner) ScanIOCInDirStream(layer string, baseDir string, fullDir string, matchedRuleSet map[uint]uint, ...) (chan output.IOCFound, error)
  • func (s *Scanner) SetImageName(imageName string)

Variables

var (
	ErrmaxMalwaresExceeded = errors.New("number of secrets exceeded max-secrets")
)

Functions

func GetFileSystemPathsForContainer

func GetFileSystemPathsForContainer(containerID string, namespace string) ([]byte, error)

func ScanFile

func ScanFile(s *Scanner, f *os.File, iocs *[]output.IOCFound, layer string) error

func ScanFilePath

func ScanFilePath(s *Scanner, path string, iocs *[]output.IOCFound, layer string) (err error)

Types

type ContainerExtractionResult

type ContainerExtractionResult struct {
	IOC         []output.IOCFound
	ContainerID string
}

type ContainerScan

type ContainerScan struct {
	// contains filtered or unexported fields
}

type ImageExtractionResult

type ImageExtractionResult struct {
	IOCs    []output.IOCFound
	ImageID string
}

type ImageScan

type ImageScan struct {
	// contains filtered or unexported fields
}

type Scanner

type Scanner struct {
	*config.Options
	*config.Config

	YaraScanner *yara.Scanner
	ScanID      string
}

func New

func New(opts *config.Options, yaraconfig *config.Config,
	yaraScannerIn *yara.Scanner, scanID string) *Scanner

func (*Scanner) ExtractAndScanContainer

func (s *Scanner) ExtractAndScanContainer(ctx *tasks.ScanContext, containerID string, namespace string) ([]output.IOCFound, error)

func (*Scanner) ExtractAndScanContainerStream

func (s *Scanner) ExtractAndScanContainerStream(ctx *tasks.ScanContext, containerID string, namespace string) (chan output.IOCFound, error)

func (*Scanner) ExtractAndScanFromTar

func (s *Scanner) ExtractAndScanFromTar(ctx *tasks.ScanContext, tarFolder string) (*ImageExtractionResult, error)

func (*Scanner) ExtractAndScanImage

func (s *Scanner) ExtractAndScanImage(ctx *tasks.ScanContext, image string) (*ImageExtractionResult, error)

func (*Scanner) ExtractAndScanImageStream

func (s *Scanner) ExtractAndScanImageStream(ctx *tasks.ScanContext, image string) (chan output.IOCFound, error)

func (*Scanner) ScanIOCInDir

func (s *Scanner) ScanIOCInDir(layer string, baseDir string, fullDir string, matchedRuleSet map[uint]uint, iocs *[]output.IOCFound, isContainerRunTime bool, scanCtx *tasks.ScanContext) error

ScanIOCsInDir Scans a given directory recursively to find all IOCs inside any file in the dir @parameters layer - layer ID, if we are scanning directory inside container image baseDir - Parent directory fullDir - Complete path of the directory to be scanned isFirstIOC - indicates if some IOCs are already printed, used to properly format json @returns []output.IOCFound - List of all IOCs found Error - Errors if any. Otherwise, returns nil

func (*Scanner) ScanIOCInDirStream

func (s *Scanner) ScanIOCInDirStream(layer string, baseDir string, fullDir string, matchedRuleSet map[uint]uint, isContainerRunTime bool, scanCtx *tasks.ScanContext) (chan output.IOCFound, error)

func (*Scanner) SetImageName

func (s *Scanner) SetImageName(imageName string)