xcorrelator

Documentation

Index

• Variables
• func CheckIntelIP(ip string, connID uint64, th *apm.TraceHeader) (found bool, results []intel.Result)
• func CheckVulnIPPort(ip string, port int, th *apm.TraceHeader) (found bool, results []vuln.Result)
• func InitIntel(confDir string, cacheDuration int) error
• func InitVuln(confDir string, cacheDuration int) error
• type IntelSource
• type IntelSources
• type VulnSource
• type VulnSources

Variables

var (
	// IntelEnabled mark whether intel lookup is enabled
	IntelEnabled bool
)

var (
	// VulnEnabled mark whether vuln lookup is enabled
	VulnEnabled bool
)

Functions

func CheckIntelIP

func CheckIntelIP(ip string, connID uint64, th *apm.TraceHeader) (found bool, results []intel.Result)

CheckIntelIP lookup ip on threat intel references

func CheckVulnIPPort

func CheckVulnIPPort(ip string, port int, th *apm.TraceHeader) (found bool, results []vuln.Result)

CheckVulnIPPort lookup ip-port pair on vulnerability scan result references

func InitIntel

func InitIntel(confDir string, cacheDuration int) error

InitIntel initialize threat intel cross-correlation

func InitVuln

func InitVuln(confDir string, cacheDuration int) error

InitVuln initialize vulnerability scan result cross-correlation

Types

type IntelSource

type IntelSource struct {
	Name    string `json:"name"`
	Type    string `json:"type"`
	Enabled bool   `json:"enabled"`
	Plugin  string `json:"plugin"`
	Config  string `json:"config"`
}

IntelSource represents entry in intel_*.json config file

type IntelSources

type IntelSources struct {
	IntelSources []IntelSource `json:"intel_sources"`
}

IntelSources represents collection of IntelSource

type VulnSource

type VulnSource struct {
	Name    string `json:"name"`
	Type    string `json:"type"`
	Enabled bool   `json:"enabled"`
	URL     string `json:"url"`
	Plugin  string `json:"plugin"`
	Config  string `json:"config"`
}

VulnSource represents entry in vuln_*.json config file

type VulnSources

type VulnSources struct {
	VulnSources []VulnSource `json:"vuln_sources"`
}

VulnSources represents collection of VulnSource