exprhelpers

Documentation

Index

• Variables
• func Atof(x string) float64
• func CrowdsecCTI(ip string) (*cticlient.SmokeItem, error)
• func CrowdsecCTIInitCache(size int, ttl time.Duration)
• func File(filename string) []string
• func FileInit(fileFolder string, filename string, fileType string) error
• func Get(arr []string, index int) string
• func GetDecisionsCount(value string) int
• func GetDecisionsSinceCount(value string, since string) int
• func GetExprEnv(ctx map[string]interface{}) map[string]interface{}
• func Init(databaseClient *database.Client) error
• func InitCrowdsecCTI(Key *string, TTL *time.Duration, Size *int, LogLevel *log.Level) error
• func IpInRange(ip string, ipRange string) bool
• func IpToRange(ip string, cidr string) string
• func IsIP(ip string) bool
• func IsIPV4(ip string) bool
• func IsIPV6(ip string) bool
• func JsonExtract(jsblob string, target string) string
• func JsonExtractLib(jsblob string, target ...string) string
• func JsonExtractObject(jsblob string, target string) map[string]interface{}
• func JsonExtractSlice(jsblob string, target string) []interface{}
• func JsonExtractUnescape(jsblob string, target ...string) string
• func KeyExists(key string, dict map[string]interface{}) bool
• func LookupHost(value string) []string
• func Lower(s string) string
• func ParseUnix(value string) string
• func ParseUnixTime(value string) (time.Time, error)
• func ParseUri(uri string) map[string][]string
• func PathEscape(s string) string
• func PathUnescape(s string) string
• func QueryEscape(s string) string
• func QueryUnescape(s string) string
• func RegexpInFile(data string, filename string) bool
• func ShutdownCrowdsecCTI()
• func TimeNow() string
• func ToJson(obj interface{}) string
• func Upper(s string) string
• func XMLGetAttributeValue(xmlString string, path string, attributeName string) string
• func XMLGetNodeValue(xmlString string, path string) string
• type ExprDebugger
  • func NewDebugger(filter string, exprEnv expr.Option) (*ExprDebugger, error)
  • func (e *ExprDebugger) Run(logger *logrus.Entry, filterResult bool, exprEnv map[string]interface{})

Variables

var CTIApiEnabled = true

this is set for non-recoverable errors, such as 403 when querying API or empty API key

var CTIApiKey = ""

var CTIBackOffDuration time.Duration = 5 * time.Minute

var CTIBackOffUntil time.Time

when hitting quotas or auth errors, we temporarily disable the API

var CTICache gcache.Cache

Cache for responses

var CTIUrl = "https://cti.api.crowdsec.net"

var CTIUrlSuffix = "/v2/smoke/"

var CacheExpiration time.Duration

Functions

func Atof

func Atof(x string) float64

func CrowdsecCTI

func CrowdsecCTI(ip string) (*cticlient.SmokeItem, error)

func CrowdsecCTIInitCache

func CrowdsecCTIInitCache(size int, ttl time.Duration)

func File

func File(filename string) []string

func FileInit

func FileInit(fileFolder string, filename string, fileType string) error

func Get

func Get(arr []string, index int) string

func GetDecisionsCount

func GetDecisionsCount(value string) int

func GetDecisionsSinceCount

func GetDecisionsSinceCount(value string, since string) int

func GetExprEnv

func GetExprEnv(ctx map[string]interface{}) map[string]interface{}

func Init

func Init(databaseClient *database.Client) error

func InitCrowdsecCTI

func InitCrowdsecCTI(Key *string, TTL *time.Duration, Size *int, LogLevel *log.Level) error

func IpInRange

func IpInRange(ip string, ipRange string) bool

func IpToRange

func IpToRange(ip string, cidr string) string

func IsIP

func IsIP(ip string) bool

func IsIPV4

func IsIPV4(ip string) bool

func IsIPV6

func IsIPV6(ip string) bool

func JsonExtract

func JsonExtract(jsblob string, target string) string

func JsonExtractLib

func JsonExtractLib(jsblob string, target ...string) string

func JsonExtractObject

func JsonExtractObject(jsblob string, target string) map[string]interface{}

func JsonExtractSlice

func JsonExtractSlice(jsblob string, target string) []interface{}

func JsonExtractUnescape

func JsonExtractUnescape(jsblob string, target ...string) string

func KeyExists

func KeyExists(key string, dict map[string]interface{}) bool

func LookupHost

func LookupHost(value string) []string

func Lower

func Lower(s string) string

func ParseUnix

func ParseUnix(value string) string

func ParseUnixTime

func ParseUnixTime(value string) (time.Time, error)

func ParseUri

func ParseUri(uri string) map[string][]string

func PathEscape

func PathEscape(s string) string

func PathUnescape

func PathUnescape(s string) string

func QueryEscape

func QueryEscape(s string) string

func QueryUnescape

func QueryUnescape(s string) string

func RegexpInFile

func RegexpInFile(data string, filename string) bool

func ShutdownCrowdsecCTI

func ShutdownCrowdsecCTI()

func TimeNow

func TimeNow() string

func ToJson

func ToJson(obj interface{}) string

func Upper

func Upper(s string) string

func XMLGetAttributeValue

func XMLGetAttributeValue(xmlString string, path string, attributeName string) string

func XMLGetNodeValue

func XMLGetNodeValue(xmlString string, path string) string

Types

type ExprDebugger

type ExprDebugger struct {
	// contains filtered or unexported fields
}

ExprDebugger contains the list of expression to be run when debugging an expression filter

func NewDebugger

func NewDebugger(filter string, exprEnv expr.Option) (*ExprDebugger, error)

NewDebugger is the exported function that build the debuggers expressions

func (*ExprDebugger) Run

func (e *ExprDebugger) Run(logger *logrus.Entry, filterResult bool, exprEnv map[string]interface{})

Run display the content of each variable of a filter by evaluating them with expr, again the expr environment given in parameter