xcorrelator

package
v0.32.4 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Feb 14, 2022 License: GPL-3.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var (
	// IntelEnabled mark whether intel lookup is enabled
	IntelEnabled bool
)
View Source
var (
	// VulnEnabled mark whether vuln lookup is enabled
	VulnEnabled bool
)

Functions

func CheckIntelIP

func CheckIntelIP(ip string, connID uint64, th *apm.TraceHeader) (found bool, results []intel.Result)

CheckIntelIP lookup ip on threat intel references

func CheckVulnIPPort

func CheckVulnIPPort(ip string, port int, th *apm.TraceHeader) (found bool, results []vuln.Result)

CheckVulnIPPort lookup ip-port pair on vulnerability scan result references

func InitIntel

func InitIntel(confDir string, cacheDuration int) error

InitIntel initialize threat intel cross-correlation

func InitVuln

func InitVuln(confDir string, cacheDuration int) error

InitVuln initialize vulnerability scan result cross-correlation

Types

type IntelSource added in v0.4.1

type IntelSource struct {
	Name    string `json:"name"`
	Type    string `json:"type"`
	Enabled bool   `json:"enabled"`
	Plugin  string `json:"plugin"`
	Config  string `json:"config"`
}

IntelSource represents entry in intel_*.json config file

type IntelSources added in v0.4.1

type IntelSources struct {
	IntelSources []IntelSource `json:"intel_sources"`
}

IntelSources represents collection of IntelSource

type VulnSource added in v0.4.1

type VulnSource struct {
	Name    string `json:"name"`
	Type    string `json:"type"`
	Enabled bool   `json:"enabled"`
	URL     string `json:"url"`
	Plugin  string `json:"plugin"`
	Config  string `json:"config"`
}

VulnSource represents entry in vuln_*.json config file

type VulnSources added in v0.4.1

type VulnSources struct {
	VulnSources []VulnSource `json:"vuln_sources"`
}

VulnSources represents collection of VulnSource

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL