exprhelpers

Documentation

Index

• Variables
• func Atof(x string) float64
• func CrowdsecCTI(ip string) (*cticlient.SmokeItem, error)
• func CrowdsecCTIInitCache(size int, ttl time.Duration)
• func Distance(lat1 string, long1 string, lat2 string, long2 string) (float64, error)
• func File(filename string) []string
• func FileInit(fileFolder string, filename string, fileType string) error
• func Get(arr []string, index int) string
• func GetDecisionsCount(value string) int
• func GetDecisionsSinceCount(value string, since string) int
• func GetExprEnv(ctx map[string]interface{}) map[string]interface{}
• func Init(databaseClient *database.Client) error
• func InitCrowdsecCTI(Key *string, TTL *time.Duration, Size *int, LogLevel *log.Level) error
• func IpInRange(ip string, ipRange string) bool
• func IpToRange(ip string, cidr string) string
• func IsIP(ip string) bool
• func IsIPV4(ip string) bool
• func IsIPV6(ip string) bool
• func JsonExtract(jsblob string, target string) string
• func JsonExtractLib(jsblob string, target ...string) string
• func JsonExtractObject(jsblob string, target string) map[string]interface{}
• func JsonExtractSlice(jsblob string, target string) []interface{}
• func JsonExtractUnescape(jsblob string, target ...string) string
• func KeyExists(key string, dict map[string]interface{}) bool
• func LookupHost(value string) []string
• func Lower(s string) string
• func Match(pattern, name string) bool
• func ParseUnix(value string) string
• func ParseUnixTime(value string) (time.Time, error)
• func ParseUri(uri string) map[string][]string
• func PathEscape(s string) string
• func PathUnescape(s string) string
• func QueryEscape(s string) string
• func QueryUnescape(s string) string
• func RegexpCacheInit(filename string, CacheCfg types.DataSource) error
• func RegexpInFile(data string, filename string) bool
• func ShutdownCrowdsecCTI()
• func TimeNow() string
• func ToJson(obj interface{}) string
• func ToString(value interface{}) string
• func UpdateRegexpCacheMetrics()
• func Upper(s string) string
• func XMLGetAttributeValue(xmlString string, path string, attributeName string) string
• func XMLGetNodeValue(xmlString string, path string) string
• type ExprDebugger
  • func NewDebugger(filter string, exprEnv expr.Option) (*ExprDebugger, error)
  • func (e *ExprDebugger) Run(logger *logrus.Entry, filterResult bool, exprEnv map[string]interface{})

Variables

var CTIApiEnabled = true

this is set for non-recoverable errors, such as 403 when querying API or empty API key

var CTIApiKey = ""

var CTIBackOffDuration time.Duration = 5 * time.Minute

var CTIBackOffUntil time.Time

when hitting quotas or auth errors, we temporarily disable the API

var CTICache gcache.Cache

Cache for responses

var CTIUrl = "https://cti.api.crowdsec.net"

var CTIUrlSuffix = "/v2/smoke/"

var CacheExpiration time.Duration

var RegexpCacheMetrics = prometheus.NewGaugeVec(
	prometheus.GaugeOpts{
		Name: "cs_regexp_cache_size",
		Help: "Entries per regexp cache.",
	},
	[]string{"name"},
)

prometheus

Functions

func Atof

func Atof(x string) float64

func CrowdsecCTI

func CrowdsecCTI(ip string) (*cticlient.SmokeItem, error)

func CrowdsecCTIInitCache

func CrowdsecCTIInitCache(size int, ttl time.Duration)

func Distance

func Distance(lat1 string, long1 string, lat2 string, long2 string) (float64, error)

func File

func File(filename string) []string

func FileInit

func FileInit(fileFolder string, filename string, fileType string) error

func Get

func Get(arr []string, index int) string

func GetDecisionsCount

func GetDecisionsCount(value string) int

func GetDecisionsSinceCount

func GetDecisionsSinceCount(value string, since string) int

func GetExprEnv

func GetExprEnv(ctx map[string]interface{}) map[string]interface{}

func Init

func Init(databaseClient *database.Client) error

func InitCrowdsecCTI

func InitCrowdsecCTI(Key *string, TTL *time.Duration, Size *int, LogLevel *log.Level) error

func IpInRange

func IpInRange(ip string, ipRange string) bool

func IpToRange

func IpToRange(ip string, cidr string) string

func IsIP

func IsIP(ip string) bool

func IsIPV4

func IsIPV4(ip string) bool

func IsIPV6

func IsIPV6(ip string) bool

func JsonExtract

func JsonExtract(jsblob string, target string) string

func JsonExtractLib

func JsonExtractLib(jsblob string, target ...string) string

func JsonExtractObject

func JsonExtractObject(jsblob string, target string) map[string]interface{}

func JsonExtractSlice

func JsonExtractSlice(jsblob string, target string) []interface{}

func JsonExtractUnescape

func JsonExtractUnescape(jsblob string, target ...string) string

func KeyExists

func KeyExists(key string, dict map[string]interface{}) bool

func LookupHost

func LookupHost(value string) []string

func Lower

func Lower(s string) string

func Match

func Match(pattern, name string) bool

func ParseUnix

func ParseUnix(value string) string

func ParseUnixTime

func ParseUnixTime(value string) (time.Time, error)

func ParseUri

func ParseUri(uri string) map[string][]string

func PathEscape

func PathEscape(s string) string

func PathUnescape

func PathUnescape(s string) string

func QueryEscape

func QueryEscape(s string) string

func QueryUnescape

func QueryUnescape(s string) string

func RegexpCacheInit

func RegexpCacheInit(filename string, CacheCfg types.DataSource) error

func RegexpInFile

func RegexpInFile(data string, filename string) bool

func ShutdownCrowdsecCTI

func ShutdownCrowdsecCTI()

func TimeNow

func TimeNow() string

func ToJson

func ToJson(obj interface{}) string

func ToString

func ToString(value interface{}) string

func UpdateRegexpCacheMetrics

func UpdateRegexpCacheMetrics()

UpdateCacheMetrics is called directly by the prom handler

func Upper

func Upper(s string) string

func XMLGetAttributeValue

func XMLGetAttributeValue(xmlString string, path string, attributeName string) string

func XMLGetNodeValue

func XMLGetNodeValue(xmlString string, path string) string

Types

type ExprDebugger

type ExprDebugger struct {
	// contains filtered or unexported fields
}

ExprDebugger contains the list of expression to be run when debugging an expression filter

func NewDebugger

func NewDebugger(filter string, exprEnv expr.Option) (*ExprDebugger, error)

NewDebugger is the exported function that build the debuggers expressions

func (*ExprDebugger) Run

func (e *ExprDebugger) Run(logger *logrus.Entry, filterResult bool, exprEnv map[string]interface{})

Run display the content of each variable of a filter by evaluating them with expr, again the expr environment given in parameter