falcon

Documentation

Index

• Constants
• Variables
• func AssertNoError(payloadErrors []*models.MsaAPIError) error
• func ErrorExplain(apiError error) string
• func NewClient(ac *ApiConfig) (*client.CrowdStrikeAPISpecification, error)
• type ApiConfig
  • func (ac *ApiConfig) BasePath() string
  • func (ac *ApiConfig) Host() string
• type CloudType
  • func Cloud(cloudString string) CloudType
  • func CloudValidate(cloudString string) (CloudType, error)
  • func (c CloudType) Host() string
• type CommonPayload
  • func ErrorExtractPayload(apiError error) CommonPayload
• type StreamingError
  • func (e StreamingError) Error() string
• type StreamingHandle
  • func NewStream(ctx context.Context, client *client.CrowdStrikeAPISpecification, appId string, ...) (*StreamingHandle, error)
  • func (sh *StreamingHandle) Close()

Constants

const (
	CloudUs1 = iota
	CloudUs2
	CloudEu1
	CloudUsGov1
)

Variables

var (
	Version = semver.MustParse("0.2.10")
)

Functions

func AssertNoError

func AssertNoError(payloadErrors []*models.MsaAPIError) error

AssertNoError converts MsaAPIError to golang errors Falcon API oftentimes returns payload structure that may include application errors within MsaAPIError list. For the users of the API it is often times desirable to convert the application errors from CrowdStrike platform to golang native errors to inform application flow.

func ErrorExplain

func ErrorExplain(apiError error) string

ErrorExplain extracts as much information from the error object as possible and returns as human readable string. This is useful for developers as gofalcon/falcon/client library is swagger generated and various error classes do not adhere to a common interface.

func NewClient

func NewClient(ac *ApiConfig) (*client.CrowdStrikeAPISpecification, error)

NewClient return newly configured API Client based on configuration supplied by user. NewClient function is preferred entry-point to gofalcon SDK.

Types

type ApiConfig

type ApiConfig struct {
	// Client ID used for authentication with CrowdStrike Falcon platform. *required*
	ClientId string
	// Client Secret used for authentication with CrowdStrike Falcon platform. *required*
	ClientSecret string
	// Optional: CID selector for cases when the ClientID/ClientSecret has access to multiple CIDs
	MemberCID string
	// This Context object will be used only when authenticating with the OAuth interface.
	Context context.Context
	// Cloud allows us to select Falcon Cloud to connect
	Cloud CloudType
	// HostOverride allows to override default host (default: api.crowdstrike.com)
	HostOverride string
	// BasePathOverride allows to override default base path (default: /)
	BasePathOverride string
	// Debug forces print out of all http traffic going through the API Runtime
	Debug bool
}

ApiConfig object is used to initialise and configure API Client. Together with NewClient function, ApiConfig provides preferred way to initiate API communication.

func (*ApiConfig) BasePath

func (ac *ApiConfig) BasePath() string

Host returns base URL path to be used by this ApiConfig

func (*ApiConfig) Host

func (ac *ApiConfig) Host() string

Host returns FQDN of CrowdStrike API Gateway to be used by this ApiConfig

type CloudType

type CloudType int

CloudType represents type of CrowdStrike Falcon cloud region.

func Cloud

func Cloud(cloudString string) CloudType

Cloud parses clould string (example: us-1, us-2, eu-1, us-gov-1, etc). If a string is not recognised CloudUs1 is returned.

func CloudValidate

func CloudValidate(cloudString string) (CloudType, error)

CloudValidate parses cloud string (example: us-1, us-2, eu-1, us-gov-1, etc.). Error is returned when string cannot be recognised

func (CloudType) Host

func (c CloudType) Host() string

Host returns default hostname for given cloud.

type CommonPayload

type CommonPayload interface {
	MarshalBinary() ([]byte, error)
}

CommonPayload is interface for *Payload structures in the gofalcon/falcon/client library.

func ErrorExtractPayload

func ErrorExtractPayload(apiError error) CommonPayload

ErrorExtractPayload pops out a .Payload member from the API Error (if included).

type StreamingError

type StreamingError struct {
	Fatal bool
	Err   error
}

StreamingError structure that holds original error and indicates whether the Error is likely fatal or not

func (StreamingError) Error

func (e StreamingError) Error() string

type StreamingHandle

type StreamingHandle struct {
	Events chan *streaming_models.EventItem
	Errors chan StreamingError
	// contains filtered or unexported fields
}

StreamingHandle is higher order type that allows for easy use of CrowdStrike Falcon Streaming API

func NewStream

func NewStream(ctx context.Context, client *client.CrowdStrikeAPISpecification, appId string, stream *models.MainAvailableStreamV2, offset uint64) (*StreamingHandle, error)

NewStream initializes new StreamingHandle and connects to the Streaming API. The streams need to be discovered first by event_streams.ListAvailableStreamsOAuth2() method. The appId must be an ID that is unique within your CrowdStrike account. Each running instance of your application must provide unique ID. The offset value can then be used to skip seen events, should the stream disconnect. Users are advised to use zero (0) value at start. Each event then contains its own offset.

func (*StreamingHandle) Close

func (sh *StreamingHandle) Close()

Close the StreamingHandle after use