api

Documentation

Index

• func DecodeRequestBody(r *http.Request, value interface{}) error
• type AlertGroupQueryParameters
  • func (a *AlertGroupQueryParameters) ToCoreAlertGroupQueryParams() (core.AlertGroupQueryParams, error)
• type ApiContext
  • func NewApiContext(appContext *appcontext.AppContext, sessionStore *sessions.SessionStore, ...) *ApiContext
  • func (c *ApiContext) AlertGroupArchiveHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) AlertsHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) ArchiveEventHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) CommentOnAlertGroupHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) CommentOnEventHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) ConfigHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) DeEscalateAlertGroupHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) DeEscalateEventHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) EscalateAlertGroupHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) EscalateEventHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) Eve2PcapHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) EventQueryHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) FindFlowHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) FlowHistogram(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) GetEventByIdHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) InitRoutes(router *router.Router)
  • func (c *ApiContext) LoginHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) LoginOptions(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) LogoutHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) NetflowHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) QueryHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) ReportAggs(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) ReportDnsRequestRrnames(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) ReportHistogram(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) SubmitHandler(w *ResponseWriter, r *http.Request) error
  • func (c *ApiContext) VersionHandler(w *ResponseWriter, r *http.Request) error
• type ApiError
  • func (e ApiError) Error() string
• type CommentOnAlertGroupRequest
• type CommentOnEventIdRequest
• type CommonRequestArgs
• type ConfigResponse
• type LoginOptionsResponse
• type LoginSuccessResponse
• type ResponseWriter
  • func NewResponseWriter(w http.ResponseWriter) *ResponseWriter
  • func (w *ResponseWriter) Ok() error
  • func (w *ResponseWriter) OkJSON(response interface{}) error
  • func (w *ResponseWriter) StatusJSON(status int, response interface{}) error
• type SubmitResponse
• type VersionResponse

Functions

func DecodeRequestBody

func DecodeRequestBody(r *http.Request, value interface{}) error

DecodeRequestBody is a helper function to decoder request bodies into a particular interface.

Types

type AlertGroupQueryParameters

type AlertGroupQueryParameters struct {
	SignatureId  uint64 `json:"signature_id"`
	SrcIp        string `json:"src_ip"`
	DestIp       string `json:"dest_ip"`
	MinTimestamp string `json:"min_timestamp"`
	MaxTimestamp string `json:"max_timestamp"`
}

func (*AlertGroupQueryParameters) ToCoreAlertGroupQueryParams

func (a *AlertGroupQueryParameters) ToCoreAlertGroupQueryParams() (core.AlertGroupQueryParams, error)

type ApiContext

type ApiContext struct {
	// contains filtered or unexported fields
}

func NewApiContext

func NewApiContext(appContext *appcontext.AppContext,
	sessionStore *sessions.SessionStore, authenticator auth.Authenticator) *ApiContext

func (*ApiContext) AlertGroupArchiveHandler

func (c *ApiContext) AlertGroupArchiveHandler(w *ResponseWriter, r *http.Request) error

/api/1/alert-group/archive

func (*ApiContext) AlertsHandler

func (c *ApiContext) AlertsHandler(w *ResponseWriter, r *http.Request) error

AlertsHandler handles GET requests to /api/1/alerts. This is the handler for the Inbox, Escalated and Alerts view queries.

Accepted query parameters:

tags: a list of tags alerts must have, or must not have; must have tags
    are prefixed with a "-".

query_string: a query string alerts must match, exact format depends
    on the database used.

time_range: a duration strings (ie: 60s) representing the time before now,
    until now that alerts must match.

min_ts: specify the earliest timestamp for the range of the query,
    format: YYYY-MM-DDTHH:MM:SS.UUUUUUZ
            YYYY-MM-DDTHH:MM:SS.UUUUUU-0600

max_ts: specify the latest timestamp for the range of the query.
    format: YYYY-MM-DDTHH:MM:SS.UUUUUUZ
            YYYY-MM-DDTHH:MM:SS.UUUUUU-0600

func (*ApiContext) ArchiveEventHandler

func (c *ApiContext) ArchiveEventHandler(w *ResponseWriter, r *http.Request) error

Archive a single event.

func (*ApiContext) CommentOnAlertGroupHandler

func (c *ApiContext) CommentOnAlertGroupHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) CommentOnEventHandler

func (c *ApiContext) CommentOnEventHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) ConfigHandler

func (c *ApiContext) ConfigHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) DeEscalateAlertGroupHandler

func (c *ApiContext) DeEscalateAlertGroupHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) DeEscalateEventHandler

func (c *ApiContext) DeEscalateEventHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) EscalateAlertGroupHandler

func (c *ApiContext) EscalateAlertGroupHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) EscalateEventHandler

func (c *ApiContext) EscalateEventHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) Eve2PcapHandler

func (c *ApiContext) Eve2PcapHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) EventQueryHandler

func (c *ApiContext) EventQueryHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) FindFlowHandler

func (c *ApiContext) FindFlowHandler(w *ResponseWriter, r *http.Request) error

Find the flow matching the provided paramters, useful for finding the flow for an event.

func (*ApiContext) FlowHistogram

func (c *ApiContext) FlowHistogram(w *ResponseWriter, r *http.Request) error

Parameters:

sub_aggs: comma separated list of sub-aggregations, values include:
            - app_proto

func (*ApiContext) GetEventByIdHandler

func (c *ApiContext) GetEventByIdHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) InitRoutes

func (c *ApiContext) InitRoutes(router *router.Router)

func (*ApiContext) LoginHandler

func (c *ApiContext) LoginHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) LoginOptions

func (c *ApiContext) LoginOptions(w *ResponseWriter, r *http.Request) error

func (*ApiContext) LogoutHandler

func (c *ApiContext) LogoutHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) NetflowHandler

func (c *ApiContext) NetflowHandler(w *ResponseWriter, r *http.Request) error

func (*ApiContext) QueryHandler

func (c *ApiContext) QueryHandler(w *ResponseWriter, r *http.Request) error

QueryHandler passes the request to an Elastic Search search and returns the raw result.

func (*ApiContext) ReportAggs

func (c *ApiContext) ReportAggs(w *ResponseWriter, r *http.Request) error

func (*ApiContext) ReportDnsRequestRrnames

func (c *ApiContext) ReportDnsRequestRrnames(w *ResponseWriter, r *http.Request) error

func (*ApiContext) ReportHistogram

func (c *ApiContext) ReportHistogram(w *ResponseWriter, r *http.Request) error

func (*ApiContext) SubmitHandler

func (c *ApiContext) SubmitHandler(w *ResponseWriter, r *http.Request) error

Consumes events from agents and adds them to the database.

func (*ApiContext) VersionHandler

func (c *ApiContext) VersionHandler(w *ResponseWriter, r *http.Request) error

type ApiError

type ApiError struct {
	Status  int    `json:"status"`
	Message string `json:"message"`
}

func (ApiError) Error

func (e ApiError) Error() string

type CommentOnAlertGroupRequest

type CommentOnAlertGroupRequest struct {
	AlertGroup AlertGroupQueryParameters `json:"alert_group"`
	Comment    string                    `json:"comment"`
}

type CommentOnEventIdRequest

type CommentOnEventIdRequest struct {
	Comment string `json:"comment"`
}

type CommonRequestArgs

type CommonRequestArgs struct {
	MinTs       time.Time
	MaxTs       time.Time
	TimeRange   string
	QueryString string
	Size        int64
	EventType   string
}

type ConfigResponse

type ConfigResponse struct {
	ElasticSearchIndex string                   `json:"ElasticSearchIndex"`
	EventServices      []map[string]interface{} `json:"event-services"`
	Extra              map[string]interface{}   `json:"extra"`
	Features           map[string]bool          `json:"features"`
	Defaults           map[string]interface{}   `json:"defaults,omitempty"`
}

type LoginOptionsResponse

type LoginOptionsResponse struct {
	Authentication struct {
		Required bool     `json:"required"`
		Types    []string `json:"types,omitempty"`
	} `json:"authentication"`
	Message string `json:"login_message"`
}

type LoginSuccessResponse

type LoginSuccessResponse struct {
	SessionID string `json:"session_id"`
}

type ResponseWriter

type ResponseWriter struct {
	http.ResponseWriter
}

func NewResponseWriter

func NewResponseWriter(w http.ResponseWriter) *ResponseWriter

func (*ResponseWriter) Ok

func (w *ResponseWriter) Ok() error

Ok writes an Ok status to the client.

func (*ResponseWriter) OkJSON

func (w *ResponseWriter) OkJSON(response interface{}) error

func (*ResponseWriter) StatusJSON

func (w *ResponseWriter) StatusJSON(status int, response interface{}) error

type SubmitResponse

type SubmitResponse struct {
	Count int
}

type VersionResponse

type VersionResponse struct {
	Version  string `json:"version"`
	Revision string `json:"revision"`
}