Documentation
¶
Overview ¶
Package logger is a standardized event logging framework for the honeypot.
Index ¶
- Variables
- func ReadJSONLinesLog(r io.Reader, handler func(le *LogEntry)) error
- type BugReport
- type ConnectionLost
- func (*ConnectionLost) Descriptor() ([]byte, []int)deprecated
- func (msg *ConnectionLost) MarshalJSON() ([]byte, error)
- func (*ConnectionLost) ProtoMessage()
- func (x *ConnectionLost) ProtoReflect() protoreflect.Message
- func (x *ConnectionLost) Reset()
- func (x *ConnectionLost) String() string
- func (msg *ConnectionLost) UnmarshalJSON(b []byte) error
- type Credentials
- func (*Credentials) Descriptor() ([]byte, []int)deprecated
- func (x *Credentials) GetPassword() string
- func (x *Credentials) GetPrivateKey() []byte
- func (x *Credentials) GetUsername() string
- func (msg *Credentials) MarshalJSON() ([]byte, error)
- func (*Credentials) ProtoMessage()
- func (x *Credentials) ProtoReflect() protoreflect.Message
- func (x *Credentials) Reset()
- func (x *Credentials) String() string
- func (msg *Credentials) UnmarshalJSON(b []byte) error
- type CredentialsReport
- type Download
- func (*Download) Descriptor() ([]byte, []int)deprecated
- func (x *Download) GetCommand() []string
- func (x *Download) GetName() string
- func (x *Download) GetSource() string
- func (msg *Download) MarshalJSON() ([]byte, error)
- func (*Download) ProtoMessage()
- func (x *Download) ProtoReflect() protoreflect.Message
- func (x *Download) Reset()
- func (x *Download) String() string
- func (msg *Download) UnmarshalJSON(b []byte) error
- type DownloadReport
- type FilesystemOp
- func (*FilesystemOp) Descriptor() ([]byte, []int)deprecated
- func (msg *FilesystemOp) MarshalJSON() ([]byte, error)
- func (*FilesystemOp) ProtoMessage()
- func (x *FilesystemOp) ProtoReflect() protoreflect.Message
- func (x *FilesystemOp) Reset()
- func (x *FilesystemOp) String() string
- func (msg *FilesystemOp) UnmarshalJSON(b []byte) error
- type HoneypotEvent
- func (*HoneypotEvent) Descriptor() ([]byte, []int)deprecated
- func (x *HoneypotEvent) GetEventType() HoneypotEvent_Type
- func (msg *HoneypotEvent) MarshalJSON() ([]byte, error)
- func (*HoneypotEvent) ProtoMessage()
- func (x *HoneypotEvent) ProtoReflect() protoreflect.Message
- func (x *HoneypotEvent) Reset()
- func (x *HoneypotEvent) String() string
- func (msg *HoneypotEvent) UnmarshalJSON(b []byte) error
- type HoneypotEvent_Type
- func (HoneypotEvent_Type) Descriptor() protoreflect.EnumDescriptor
- func (x HoneypotEvent_Type) Enum() *HoneypotEvent_Type
- func (HoneypotEvent_Type) EnumDescriptor() ([]byte, []int)deprecated
- func (x HoneypotEvent_Type) Number() protoreflect.EnumNumber
- func (x HoneypotEvent_Type) String() string
- func (HoneypotEvent_Type) Type() protoreflect.EnumType
- type InteractionReport
- type InteractiveSession
- type InvalidInvocation
- func (*InvalidInvocation) Descriptor() ([]byte, []int)deprecated
- func (x *InvalidInvocation) GetCommand() []string
- func (x *InvalidInvocation) GetError() string
- func (x *InvalidInvocation) GetModSum() string
- func (x *InvalidInvocation) GetModVersion() string
- func (x *InvalidInvocation) GetSourceFile() string
- func (x *InvalidInvocation) GetSourceLine() uint32
- func (msg *InvalidInvocation) MarshalJSON() ([]byte, error)
- func (*InvalidInvocation) ProtoMessage()
- func (x *InvalidInvocation) ProtoReflect() protoreflect.Message
- func (x *InvalidInvocation) Reset()
- func (x *InvalidInvocation) String() string
- func (msg *InvalidInvocation) UnmarshalJSON(b []byte) error
- type InvalidInvocationReport
- type LogEntry
- func (*LogEntry) Descriptor() ([]byte, []int)deprecated
- func (x *LogEntry) GetConnectionLost() *ConnectionLost
- func (x *LogEntry) GetDownload() *Download
- func (x *LogEntry) GetFilesystemOperation() *FilesystemOp
- func (x *LogEntry) GetHoneypotEvent() *HoneypotEvent
- func (x *LogEntry) GetInvalidInvocation() *InvalidInvocation
- func (m *LogEntry) GetLogType() isLogEntry_LogType
- func (x *LogEntry) GetLoginAttempt() *LoginAttempt
- func (x *LogEntry) GetOpenFile() *OpenFile
- func (x *LogEntry) GetOpenTtyLog() *OpenTTYLog
- func (x *LogEntry) GetPanic() *Panic
- func (x *LogEntry) GetRunCommand() *RunCommand
- func (x *LogEntry) GetSessionId() string
- func (x *LogEntry) GetTerminalUpdate() *TerminalUpdate
- func (x *LogEntry) GetTimestampMicros() int64
- func (x *LogEntry) GetUnknownCommand() *UnknownCommand
- func (x *LogEntry) GetUsedCredentials() *Credentials
- func (msg *LogEntry) MarshalJSON() ([]byte, error)
- func (*LogEntry) ProtoMessage()
- func (x *LogEntry) ProtoReflect() protoreflect.Message
- func (x *LogEntry) Reset()
- func (x *LogEntry) String() string
- func (msg *LogEntry) UnmarshalJSON(b []byte) error
- type LogEntry_ConnectionLost
- type LogEntry_Download
- type LogEntry_FilesystemOperation
- type LogEntry_HoneypotEvent
- type LogEntry_InvalidInvocation
- type LogEntry_LoginAttempt
- type LogEntry_OpenFile
- type LogEntry_OpenTtyLog
- type LogEntry_Panic
- type LogEntry_RunCommand
- type LogEntry_TerminalUpdate
- type LogEntry_UnknownCommand
- type LogEntry_UsedCredentials
- type LogRecorder
- type LogType
- type Logger
- type LoginAttempt
- func (*LoginAttempt) Descriptor() ([]byte, []int)deprecated
- func (x *LoginAttempt) GetCommand() []string
- func (x *LoginAttempt) GetEnvironmentVariables() []string
- func (x *LoginAttempt) GetPassword() string
- func (x *LoginAttempt) GetPublicKey() []byte
- func (x *LoginAttempt) GetRawCommand() string
- func (x *LoginAttempt) GetRemoteAddr() string
- func (x *LoginAttempt) GetResult() OperationResult
- func (x *LoginAttempt) GetSubsystem() string
- func (x *LoginAttempt) GetUsername() string
- func (msg *LoginAttempt) MarshalJSON() ([]byte, error)
- func (*LoginAttempt) ProtoMessage()
- func (x *LoginAttempt) ProtoReflect() protoreflect.Message
- func (x *LoginAttempt) Reset()
- func (x *LoginAttempt) String() string
- func (msg *LoginAttempt) UnmarshalJSON(b []byte) error
- type LoginAttemptReport
- type OpenFile
- func (*OpenFile) Descriptor() ([]byte, []int)deprecated
- func (x *OpenFile) GetPath() string
- func (msg *OpenFile) MarshalJSON() ([]byte, error)
- func (*OpenFile) ProtoMessage()
- func (x *OpenFile) ProtoReflect() protoreflect.Message
- func (x *OpenFile) Reset()
- func (x *OpenFile) String() string
- func (msg *OpenFile) UnmarshalJSON(b []byte) error
- type OpenTTYLog
- func (*OpenTTYLog) Descriptor() ([]byte, []int)deprecated
- func (x *OpenTTYLog) GetName() string
- func (msg *OpenTTYLog) MarshalJSON() ([]byte, error)
- func (*OpenTTYLog) ProtoMessage()
- func (x *OpenTTYLog) ProtoReflect() protoreflect.Message
- func (x *OpenTTYLog) Reset()
- func (x *OpenTTYLog) String() string
- func (msg *OpenTTYLog) UnmarshalJSON(b []byte) error
- type OperationResult
- func (OperationResult) Descriptor() protoreflect.EnumDescriptor
- func (x OperationResult) Enum() *OperationResult
- func (OperationResult) EnumDescriptor() ([]byte, []int)deprecated
- func (x OperationResult) Number() protoreflect.EnumNumber
- func (x OperationResult) String() string
- func (OperationResult) Type() protoreflect.EnumType
- type Panic
- func (*Panic) Descriptor() ([]byte, []int)deprecated
- func (x *Panic) GetContext() string
- func (x *Panic) GetStacktrace() string
- func (msg *Panic) MarshalJSON() ([]byte, error)
- func (*Panic) ProtoMessage()
- func (x *Panic) ProtoReflect() protoreflect.Message
- func (x *Panic) Reset()
- func (x *Panic) String() string
- func (msg *Panic) UnmarshalJSON(b []byte) error
- type PanicReport
- type PathCounter
- type Report
- type RunCommand
- func (*RunCommand) Descriptor() ([]byte, []int)deprecated
- func (x *RunCommand) GetCommand() []string
- func (x *RunCommand) GetEnvironmentVariables() []string
- func (x *RunCommand) GetResolvedCommandPath() string
- func (msg *RunCommand) MarshalJSON() ([]byte, error)
- func (*RunCommand) ProtoMessage()
- func (x *RunCommand) ProtoReflect() protoreflect.Message
- func (x *RunCommand) Reset()
- func (x *RunCommand) String() string
- func (msg *RunCommand) UnmarshalJSON(b []byte) error
- type RunCommandReport
- type SessionLogger
- type StrCounter
- type TerminalUpdate
- func (*TerminalUpdate) Descriptor() ([]byte, []int)deprecated
- func (x *TerminalUpdate) GetHeight() int32
- func (x *TerminalUpdate) GetIsPty() bool
- func (x *TerminalUpdate) GetTerm() string
- func (x *TerminalUpdate) GetWidth() int32
- func (msg *TerminalUpdate) MarshalJSON() ([]byte, error)
- func (*TerminalUpdate) ProtoMessage()
- func (x *TerminalUpdate) ProtoReflect() protoreflect.Message
- func (x *TerminalUpdate) Reset()
- func (x *TerminalUpdate) String() string
- func (msg *TerminalUpdate) UnmarshalJSON(b []byte) error
- type UnknownCommand
- func (*UnknownCommand) Descriptor() ([]byte, []int)deprecated
- func (x *UnknownCommand) GetCommand() []string
- func (x *UnknownCommand) GetErrorMessage() string
- func (x *UnknownCommand) GetStatus() UnknownCommand_UnknownCommandStatus
- func (msg *UnknownCommand) MarshalJSON() ([]byte, error)
- func (*UnknownCommand) ProtoMessage()
- func (x *UnknownCommand) ProtoReflect() protoreflect.Message
- func (x *UnknownCommand) Reset()
- func (x *UnknownCommand) String() string
- func (msg *UnknownCommand) UnmarshalJSON(b []byte) error
- type UnknownCommandReport
- type UnknownCommand_UnknownCommandStatus
- func (UnknownCommand_UnknownCommandStatus) Descriptor() protoreflect.EnumDescriptor
- func (x UnknownCommand_UnknownCommandStatus) Enum() *UnknownCommand_UnknownCommandStatus
- func (UnknownCommand_UnknownCommandStatus) EnumDescriptor() ([]byte, []int)deprecated
- func (x UnknownCommand_UnknownCommandStatus) Number() protoreflect.EnumNumber
- func (x UnknownCommand_UnknownCommandStatus) String() string
- func (UnknownCommand_UnknownCommandStatus) Type() protoreflect.EnumType
Constants ¶
This section is empty.
Variables ¶
var ( OperationResult_name = map[int32]string{ 0: "UNKNOWN", 1: "SUCCESS", 2: "FAILURE", } OperationResult_value = map[string]int32{ "UNKNOWN": 0, "SUCCESS": 1, "FAILURE": 2, } )
Enum value maps for OperationResult.
var ( UnknownCommand_UnknownCommandStatus_name = map[int32]string{ 0: "UNKNOWN", 1: "NOT_FOUND", 2: "NOT_IMPLEMENTED", 3: "LOOKUP_ERROR", } UnknownCommand_UnknownCommandStatus_value = map[string]int32{ "UNKNOWN": 0, "NOT_FOUND": 1, "NOT_IMPLEMENTED": 2, "LOOKUP_ERROR": 3, } )
Enum value maps for UnknownCommand_UnknownCommandStatus.
var ( HoneypotEvent_Type_name = map[int32]string{ 0: "UNKNOWN", 1: "START", 2: "TERMINATE", } HoneypotEvent_Type_value = map[string]int32{ "UNKNOWN": 0, "START": 1, "TERMINATE": 2, } )
Enum value maps for HoneypotEvent_Type.
var File_log_proto protoreflect.FileDescriptor
Functions ¶
Types ¶
type BugReport ¶
type BugReport struct { LogEntries int InvalidInvocations *PathCounter `json:"invalid_invocations"` UnknownCommands *PathCounter `json:"unknown_commands"` Panics []*Panic `json:"panics"` }
BugReport pulls events that are likely bugs in the honeypot.
func NewBugReport ¶
func NewBugReport() *BugReport
type ConnectionLost ¶
type ConnectionLost struct {
// contains filtered or unexported fields
}
func (*ConnectionLost) Descriptor
deprecated
func (*ConnectionLost) Descriptor() ([]byte, []int)
Deprecated: Use ConnectionLost.ProtoReflect.Descriptor instead.
func (*ConnectionLost) MarshalJSON ¶
func (msg *ConnectionLost) MarshalJSON() ([]byte, error)
MarshalJSON implements json.Marshaler
func (*ConnectionLost) ProtoMessage ¶
func (*ConnectionLost) ProtoMessage()
func (*ConnectionLost) ProtoReflect ¶
func (x *ConnectionLost) ProtoReflect() protoreflect.Message
func (*ConnectionLost) Reset ¶
func (x *ConnectionLost) Reset()
func (*ConnectionLost) String ¶
func (x *ConnectionLost) String() string
func (*ConnectionLost) UnmarshalJSON ¶
func (msg *ConnectionLost) UnmarshalJSON(b []byte) error
UnmarshalJSON implements json.Unmarshaler
type Credentials ¶
type Credentials struct { // Username used to authenticate. Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"` // Password used to authenticate. Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"` // Private key used to authenticate. PrivateKey []byte `protobuf:"bytes,3,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"` // contains filtered or unexported fields }
A set of credentials that the honeypot collected.
func (*Credentials) Descriptor
deprecated
func (*Credentials) Descriptor() ([]byte, []int)
Deprecated: Use Credentials.ProtoReflect.Descriptor instead.
func (*Credentials) GetPassword ¶
func (x *Credentials) GetPassword() string
func (*Credentials) GetPrivateKey ¶
func (x *Credentials) GetPrivateKey() []byte
func (*Credentials) GetUsername ¶
func (x *Credentials) GetUsername() string
func (*Credentials) MarshalJSON ¶
func (msg *Credentials) MarshalJSON() ([]byte, error)
MarshalJSON implements json.Marshaler
func (*Credentials) ProtoMessage ¶
func (*Credentials) ProtoMessage()
func (*Credentials) ProtoReflect ¶
func (x *Credentials) ProtoReflect() protoreflect.Message
func (*Credentials) Reset ¶
func (x *Credentials) Reset()
func (*Credentials) String ¶
func (x *Credentials) String() string
func (*Credentials) UnmarshalJSON ¶
func (msg *Credentials) UnmarshalJSON(b []byte) error
UnmarshalJSON implements json.Unmarshaler
type CredentialsReport ¶
type CredentialsReport struct { }
type Download ¶
type Download struct { // Name of the download. Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` // Source of the download. Source string `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"` // Command that generated the download. Command []string `protobuf:"bytes,3,rep,name=command,proto3" json:"command,omitempty"` // contains filtered or unexported fields }
Information about a downloaded file.
func (*Download) Descriptor
deprecated
func (*Download) GetCommand ¶
func (*Download) MarshalJSON ¶
MarshalJSON implements json.Marshaler
func (*Download) ProtoMessage ¶
func (*Download) ProtoMessage()
func (*Download) ProtoReflect ¶
func (x *Download) ProtoReflect() protoreflect.Message
func (*Download) UnmarshalJSON ¶
UnmarshalJSON implements json.Unmarshaler
type DownloadReport ¶
type DownloadReport struct { Count int `json:"count"` Sources StrCounter `json:"sources"` CommandNames StrCounter `json:"command_counts"` }
type FilesystemOp ¶
type FilesystemOp struct {
// contains filtered or unexported fields
}
func (*FilesystemOp) Descriptor
deprecated
func (*FilesystemOp) Descriptor() ([]byte, []int)
Deprecated: Use FilesystemOp.ProtoReflect.Descriptor instead.
func (*FilesystemOp) MarshalJSON ¶
func (msg *FilesystemOp) MarshalJSON() ([]byte, error)
MarshalJSON implements json.Marshaler
func (*FilesystemOp) ProtoMessage ¶
func (*FilesystemOp) ProtoMessage()
func (*FilesystemOp) ProtoReflect ¶
func (x *FilesystemOp) ProtoReflect() protoreflect.Message
func (*FilesystemOp) Reset ¶
func (x *FilesystemOp) Reset()
func (*FilesystemOp) String ¶
func (x *FilesystemOp) String() string
func (*FilesystemOp) UnmarshalJSON ¶
func (msg *FilesystemOp) UnmarshalJSON(b []byte) error
UnmarshalJSON implements json.Unmarshaler
type HoneypotEvent ¶
type HoneypotEvent struct { // Context about what was going on before the panic. EventType HoneypotEvent_Type `protobuf:"varint,1,opt,name=event_type,json=eventType,proto3,enum=HoneypotEvent_Type" json:"event_type,omitempty"` // contains filtered or unexported fields }
Information about a honeypot status.
func (*HoneypotEvent) Descriptor
deprecated
func (*HoneypotEvent) Descriptor() ([]byte, []int)
Deprecated: Use HoneypotEvent.ProtoReflect.Descriptor instead.
func (*HoneypotEvent) GetEventType ¶
func (x *HoneypotEvent) GetEventType() HoneypotEvent_Type
func (*HoneypotEvent) MarshalJSON ¶
func (msg *HoneypotEvent) MarshalJSON() ([]byte, error)
MarshalJSON implements json.Marshaler
func (*HoneypotEvent) ProtoMessage ¶
func (*HoneypotEvent) ProtoMessage()
func (*HoneypotEvent) ProtoReflect ¶
func (x *HoneypotEvent) ProtoReflect() protoreflect.Message
func (*HoneypotEvent) Reset ¶
func (x *HoneypotEvent) Reset()
func (*HoneypotEvent) String ¶
func (x *HoneypotEvent) String() string
func (*HoneypotEvent) UnmarshalJSON ¶
func (msg *HoneypotEvent) UnmarshalJSON(b []byte) error
UnmarshalJSON implements json.Unmarshaler
type HoneypotEvent_Type ¶
type HoneypotEvent_Type int32
const ( HoneypotEvent_UNKNOWN HoneypotEvent_Type = 0 HoneypotEvent_START HoneypotEvent_Type = 1 // Honeypot started HoneypotEvent_TERMINATE HoneypotEvent_Type = 2 // Honeypot shutting down. )
func (HoneypotEvent_Type) Descriptor ¶
func (HoneypotEvent_Type) Descriptor() protoreflect.EnumDescriptor
func (HoneypotEvent_Type) Enum ¶
func (x HoneypotEvent_Type) Enum() *HoneypotEvent_Type
func (HoneypotEvent_Type) EnumDescriptor
deprecated
func (HoneypotEvent_Type) EnumDescriptor() ([]byte, []int)
Deprecated: Use HoneypotEvent_Type.Descriptor instead.
func (HoneypotEvent_Type) Number ¶
func (x HoneypotEvent_Type) Number() protoreflect.EnumNumber
func (HoneypotEvent_Type) String ¶
func (x HoneypotEvent_Type) String() string
func (HoneypotEvent_Type) Type ¶
func (HoneypotEvent_Type) Type() protoreflect.EnumType
type InteractionReport ¶
type InteractionReport struct {
// contains filtered or unexported fields
}
func (*InteractionReport) MarshalJSON ¶
func (i *InteractionReport) MarshalJSON() ([]byte, error)
MarshalJSON implemnts custom JSON marshaler.
func (*InteractionReport) Update ¶
func (i *InteractionReport) Update(le *LogEntry)
type InteractiveSession ¶
type InteractiveSession struct { Login struct { Username string `json:"username"` Password string `json:"password"` PublicKey []byte `json:"public_key,omitempty"` RemoteAddr string `json:"remote_addr,omitempty"` } `json:"login"` TTYLog string `json:"tty_log"` LogEntries int `json:"log_entries"` TerminalName string `json:"terminal_name"` IsPty bool `json:"is_pty"` Commands []string `json:"commands"` Downloads []string `json:"downloads"` }
func (*InteractiveSession) Update ¶
func (i *InteractiveSession) Update(le *LogEntry)
type InvalidInvocation ¶
type InvalidInvocation struct { Command []string `protobuf:"bytes,1,rep,name=command,proto3" json:"command,omitempty"` Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"` // The name of the file logging the error. SourceFile string `protobuf:"bytes,3,opt,name=source_file,json=sourceFile,proto3" json:"source_file,omitempty"` // The line of the file logging the error. SourceLine uint32 `protobuf:"varint,4,opt,name=source_line,json=sourceLine,proto3" json:"source_line,omitempty"` // The module version of the program. ModVersion string `protobuf:"bytes,5,opt,name=mod_version,json=modVersion,proto3" json:"mod_version,omitempty"` // The checksum of the program. ModSum string `protobuf:"bytes,6,opt,name=mod_sum,json=modSum,proto3" json:"mod_sum,omitempty"` // contains filtered or unexported fields }
A potential missing Honeypot feature, should be reported or fixed.
func (*InvalidInvocation) Descriptor
deprecated
func (*InvalidInvocation) Descriptor() ([]byte, []int)
Deprecated: Use InvalidInvocation.ProtoReflect.Descriptor instead.
func (*InvalidInvocation) GetCommand ¶
func (x *InvalidInvocation) GetCommand() []string
func (*InvalidInvocation) GetError ¶
func (x *InvalidInvocation) GetError() string
func (*InvalidInvocation) GetModSum ¶
func (x *InvalidInvocation) GetModSum() string
func (*InvalidInvocation) GetModVersion ¶
func (x *InvalidInvocation) GetModVersion() string
func (*InvalidInvocation) GetSourceFile ¶
func (x *InvalidInvocation) GetSourceFile() string
func (*InvalidInvocation) GetSourceLine ¶
func (x *InvalidInvocation) GetSourceLine() uint32
func (*InvalidInvocation) MarshalJSON ¶
func (msg *InvalidInvocation) MarshalJSON() ([]byte, error)
MarshalJSON implements json.Marshaler
func (*InvalidInvocation) ProtoMessage ¶
func (*InvalidInvocation) ProtoMessage()
func (*InvalidInvocation) ProtoReflect ¶
func (x *InvalidInvocation) ProtoReflect() protoreflect.Message
func (*InvalidInvocation) Reset ¶
func (x *InvalidInvocation) Reset()
func (*InvalidInvocation) String ¶
func (x *InvalidInvocation) String() string
func (*InvalidInvocation) UnmarshalJSON ¶
func (msg *InvalidInvocation) UnmarshalJSON(b []byte) error
UnmarshalJSON implements json.Unmarshaler
type InvalidInvocationReport ¶
type InvalidInvocationReport struct {
CommandNames StrCounter `json:"command_counts"`
}
type LogEntry ¶
type LogEntry struct { // Timestamp of the log event in micros since the UNIX epoch. TimestampMicros int64 `protobuf:"varint,1,opt,name=timestamp_micros,json=timestampMicros,proto3" json:"timestamp_micros,omitempty"` // Unique session identifier for the log message. Blank if the event // wasn't in the context of a session. SessionId string `protobuf:"bytes,2,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"` // Types that are assignable to LogType: // *LogEntry_LoginAttempt // *LogEntry_FilesystemOperation // *LogEntry_OpenTtyLog // *LogEntry_ConnectionLost // *LogEntry_RunCommand // *LogEntry_UnknownCommand // *LogEntry_TerminalUpdate // *LogEntry_OpenFile // *LogEntry_InvalidInvocation // *LogEntry_UsedCredentials // *LogEntry_Download // *LogEntry_Panic // *LogEntry_HoneypotEvent LogType isLogEntry_LogType `protobuf_oneof:"log_type"` // contains filtered or unexported fields }
func (*LogEntry) Descriptor
deprecated
func (*LogEntry) GetConnectionLost ¶
func (x *LogEntry) GetConnectionLost() *ConnectionLost
func (*LogEntry) GetDownload ¶
func (*LogEntry) GetFilesystemOperation ¶
func (x *LogEntry) GetFilesystemOperation() *FilesystemOp
func (*LogEntry) GetHoneypotEvent ¶
func (x *LogEntry) GetHoneypotEvent() *HoneypotEvent
func (*LogEntry) GetInvalidInvocation ¶
func (x *LogEntry) GetInvalidInvocation() *InvalidInvocation
func (*LogEntry) GetLogType ¶
func (m *LogEntry) GetLogType() isLogEntry_LogType
func (*LogEntry) GetLoginAttempt ¶
func (x *LogEntry) GetLoginAttempt() *LoginAttempt
func (*LogEntry) GetOpenFile ¶
func (*LogEntry) GetOpenTtyLog ¶
func (x *LogEntry) GetOpenTtyLog() *OpenTTYLog
func (*LogEntry) GetRunCommand ¶
func (x *LogEntry) GetRunCommand() *RunCommand
func (*LogEntry) GetSessionId ¶
func (*LogEntry) GetTerminalUpdate ¶
func (x *LogEntry) GetTerminalUpdate() *TerminalUpdate
func (*LogEntry) GetTimestampMicros ¶
func (*LogEntry) GetUnknownCommand ¶
func (x *LogEntry) GetUnknownCommand() *UnknownCommand
func (*LogEntry) GetUsedCredentials ¶
func (x *LogEntry) GetUsedCredentials() *Credentials
func (*LogEntry) MarshalJSON ¶
MarshalJSON implements json.Marshaler
func (*LogEntry) ProtoMessage ¶
func (*LogEntry) ProtoMessage()
func (*LogEntry) ProtoReflect ¶
func (x *LogEntry) ProtoReflect() protoreflect.Message
func (*LogEntry) UnmarshalJSON ¶
UnmarshalJSON implements json.Unmarshaler
type LogEntry_ConnectionLost ¶
type LogEntry_ConnectionLost struct {
ConnectionLost *ConnectionLost `protobuf:"bytes,18,opt,name=connection_lost,json=connectionLost,proto3,oneof"`
}
type LogEntry_Download ¶
type LogEntry_Download struct {
Download *Download `protobuf:"bytes,25,opt,name=download,proto3,oneof"`
}
type LogEntry_FilesystemOperation ¶
type LogEntry_FilesystemOperation struct {
FilesystemOperation *FilesystemOp `protobuf:"bytes,16,opt,name=filesystem_operation,json=filesystemOperation,proto3,oneof"`
}
type LogEntry_HoneypotEvent ¶
type LogEntry_HoneypotEvent struct {
HoneypotEvent *HoneypotEvent `protobuf:"bytes,27,opt,name=honeypot_event,json=honeypotEvent,proto3,oneof"`
}
type LogEntry_InvalidInvocation ¶
type LogEntry_InvalidInvocation struct {
InvalidInvocation *InvalidInvocation `protobuf:"bytes,23,opt,name=invalid_invocation,json=invalidInvocation,proto3,oneof"`
}
type LogEntry_LoginAttempt ¶
type LogEntry_LoginAttempt struct { // An attempt to log in to the honeypot. LoginAttempt *LoginAttempt `protobuf:"bytes,15,opt,name=login_attempt,json=loginAttempt,proto3,oneof"` // ID < 16 for fast proto decoding. }
type LogEntry_OpenFile ¶
type LogEntry_OpenFile struct {
OpenFile *OpenFile `protobuf:"bytes,22,opt,name=open_file,json=openFile,proto3,oneof"`
}
type LogEntry_OpenTtyLog ¶
type LogEntry_OpenTtyLog struct {
OpenTtyLog *OpenTTYLog `protobuf:"bytes,17,opt,name=open_tty_log,json=openTtyLog,proto3,oneof"`
}
type LogEntry_Panic ¶
type LogEntry_Panic struct {
Panic *Panic `protobuf:"bytes,26,opt,name=panic,proto3,oneof"`
}
type LogEntry_RunCommand ¶
type LogEntry_RunCommand struct {
RunCommand *RunCommand `protobuf:"bytes,19,opt,name=run_command,json=runCommand,proto3,oneof"`
}
type LogEntry_TerminalUpdate ¶
type LogEntry_TerminalUpdate struct {
TerminalUpdate *TerminalUpdate `protobuf:"bytes,21,opt,name=terminal_update,json=terminalUpdate,proto3,oneof"`
}
type LogEntry_UnknownCommand ¶
type LogEntry_UnknownCommand struct {
UnknownCommand *UnknownCommand `protobuf:"bytes,20,opt,name=unknown_command,json=unknownCommand,proto3,oneof"`
}
type LogEntry_UsedCredentials ¶
type LogEntry_UsedCredentials struct {
UsedCredentials *Credentials `protobuf:"bytes,24,opt,name=used_credentials,json=usedCredentials,proto3,oneof"`
}
type LogRecorder ¶
LogRecorder is a callback that stores events in an external datastore.
type Logger ¶
type Logger struct {
Record LogRecorder
}
Logger captures interaction event logs for the honeypot to determine its performance.
func NewJsonLinesLogRecorder ¶
NewJsonLinesLogRecorder creates a Logger that exports logs in newline delimited JSON object format.
func (*Logger) NewSession ¶
func (l *Logger) NewSession(sessionID string) *SessionLogger
NewSession creates a logger with attached session ID.
func (*Logger) Sessionless ¶
func (l *Logger) Sessionless() *SessionLogger
NewSession creates a logger with attached session ID.
type LoginAttempt ¶
type LoginAttempt struct { // The result of the login attempt. Result OperationResult `protobuf:"varint,1,opt,name=result,proto3,enum=OperationResult" json:"result,omitempty"` // The username the login attempted to use. Username string `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"` // Public key of the login attempt in SSH wire format PublicKey []byte `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"` // Password used in the login attempt. Password string `protobuf:"bytes,4,opt,name=password,proto3" json:"password,omitempty"` // Remote address of the machine. RemoteAddr string `protobuf:"bytes,5,opt,name=remote_addr,json=remoteAddr,proto3" json:"remote_addr,omitempty"` // Environment variables in key=value format. EnvironmentVariables []string `protobuf:"bytes,6,rep,name=environment_variables,json=environmentVariables,proto3" json:"environment_variables,omitempty"` // Shell parsed command string. Command []string `protobuf:"bytes,7,rep,name=command,proto3" json:"command,omitempty"` // Raw command string as passed to SSH. RawCommand string `protobuf:"bytes,8,opt,name=raw_command,json=rawCommand,proto3" json:"raw_command,omitempty"` // The SSH subsystem requested. Subsystem string `protobuf:"bytes,9,opt,name=subsystem,proto3" json:"subsystem,omitempty"` // contains filtered or unexported fields }
func (*LoginAttempt) Descriptor
deprecated
func (*LoginAttempt) Descriptor() ([]byte, []int)
Deprecated: Use LoginAttempt.ProtoReflect.Descriptor instead.
func (*LoginAttempt) GetCommand ¶
func (x *LoginAttempt) GetCommand() []string
func (*LoginAttempt) GetEnvironmentVariables ¶
func (x *LoginAttempt) GetEnvironmentVariables() []string
func (*LoginAttempt) GetPassword ¶
func (x *LoginAttempt) GetPassword() string
func (*LoginAttempt) GetPublicKey ¶
func (x *LoginAttempt) GetPublicKey() []byte
func (*LoginAttempt) GetRawCommand ¶
func (x *LoginAttempt) GetRawCommand() string
func (*LoginAttempt) GetRemoteAddr ¶
func (x *LoginAttempt) GetRemoteAddr() string
func (*LoginAttempt) GetResult ¶
func (x *LoginAttempt) GetResult() OperationResult
func (*LoginAttempt) GetSubsystem ¶
func (x *LoginAttempt) GetSubsystem() string
func (*LoginAttempt) GetUsername ¶
func (x *LoginAttempt) GetUsername() string
func (*LoginAttempt) MarshalJSON ¶
func (msg *LoginAttempt) MarshalJSON() ([]byte, error)
MarshalJSON implements json.Marshaler
func (*LoginAttempt) ProtoMessage ¶
func (*LoginAttempt) ProtoMessage()
func (*LoginAttempt) ProtoReflect ¶
func (x *LoginAttempt) ProtoReflect() protoreflect.Message
func (*LoginAttempt) Reset ¶
func (x *LoginAttempt) Reset()
func (*LoginAttempt) String ¶
func (x *LoginAttempt) String() string
func (*LoginAttempt) UnmarshalJSON ¶
func (msg *LoginAttempt) UnmarshalJSON(b []byte) error
UnmarshalJSON implements json.Unmarshaler
type LoginAttemptReport ¶
type LoginAttemptReport struct { // List of passwords and their counts. Passwords StrCounter `json:"passwords"` // List of usernames and their counts. Usernames StrCounter `json:"usernames"` // List of login attempt results and their counts. Results StrCounter `json:"results"` }
type OpenFile ¶
type OpenFile struct { // Path of the file that was opened. Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"` // contains filtered or unexported fields }
func (*OpenFile) Descriptor
deprecated
func (*OpenFile) MarshalJSON ¶
MarshalJSON implements json.Marshaler
func (*OpenFile) ProtoMessage ¶
func (*OpenFile) ProtoMessage()
func (*OpenFile) ProtoReflect ¶
func (x *OpenFile) ProtoReflect() protoreflect.Message
func (*OpenFile) UnmarshalJSON ¶
UnmarshalJSON implements json.Unmarshaler
type OpenTTYLog ¶
type OpenTTYLog struct { Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` // contains filtered or unexported fields }
func (*OpenTTYLog) Descriptor
deprecated
func (*OpenTTYLog) Descriptor() ([]byte, []int)
Deprecated: Use OpenTTYLog.ProtoReflect.Descriptor instead.
func (*OpenTTYLog) GetName ¶
func (x *OpenTTYLog) GetName() string
func (*OpenTTYLog) MarshalJSON ¶
func (msg *OpenTTYLog) MarshalJSON() ([]byte, error)
MarshalJSON implements json.Marshaler
func (*OpenTTYLog) ProtoMessage ¶
func (*OpenTTYLog) ProtoMessage()
func (*OpenTTYLog) ProtoReflect ¶
func (x *OpenTTYLog) ProtoReflect() protoreflect.Message
func (*OpenTTYLog) Reset ¶
func (x *OpenTTYLog) Reset()
func (*OpenTTYLog) String ¶
func (x *OpenTTYLog) String() string
func (*OpenTTYLog) UnmarshalJSON ¶
func (msg *OpenTTYLog) UnmarshalJSON(b []byte) error
UnmarshalJSON implements json.Unmarshaler
type OperationResult ¶
type OperationResult int32
const ( OperationResult_UNKNOWN OperationResult = 0 OperationResult_SUCCESS OperationResult = 1 OperationResult_FAILURE OperationResult = 2 )
func (OperationResult) Descriptor ¶
func (OperationResult) Descriptor() protoreflect.EnumDescriptor
func (OperationResult) Enum ¶
func (x OperationResult) Enum() *OperationResult
func (OperationResult) EnumDescriptor
deprecated
func (OperationResult) EnumDescriptor() ([]byte, []int)
Deprecated: Use OperationResult.Descriptor instead.
func (OperationResult) Number ¶
func (x OperationResult) Number() protoreflect.EnumNumber
func (OperationResult) String ¶
func (x OperationResult) String() string
func (OperationResult) Type ¶
func (OperationResult) Type() protoreflect.EnumType
type Panic ¶
type Panic struct { // Context about what was going on before the panic. Context string `protobuf:"bytes,1,opt,name=context,proto3" json:"context,omitempty"` // Stacktrace of the panic. Stacktrace string `protobuf:"bytes,2,opt,name=stacktrace,proto3" json:"stacktrace,omitempty"` // contains filtered or unexported fields }
Information about a panic.
func (*Panic) Descriptor
deprecated
func (*Panic) GetContext ¶
func (*Panic) GetStacktrace ¶
func (*Panic) MarshalJSON ¶
MarshalJSON implements json.Marshaler
func (*Panic) ProtoMessage ¶
func (*Panic) ProtoMessage()
func (*Panic) ProtoReflect ¶
func (x *Panic) ProtoReflect() protoreflect.Message
func (*Panic) UnmarshalJSON ¶
UnmarshalJSON implements json.Unmarshaler
type PanicReport ¶
type PanicReport struct {
Contexts []string `json:"contexts"`
}
type PathCounter ¶
type PathCounter struct {
// contains filtered or unexported fields
}
PathCounter counts the number of strings seen.
func NewPathCounter ¶
func NewPathCounter(cols ...string) *PathCounter
func (*PathCounter) Increment ¶
func (ctr *PathCounter) Increment(toAdd ...string)
Increment adds one to the given key.
func (*PathCounter) MarshalJSON ¶
func (ctr *PathCounter) MarshalJSON() ([]byte, error)
MarshalJSON implemnts custom JSON marshaler.
type Report ¶
type Report struct { LogEntries int `json:"log_entries"` InvalidEntries StrCounter `json:"unknown_log_entries,omitempty"` LoginAttempt LoginAttemptReport `json:"login_attempt_report"` RunCommand RunCommandReport `json:"run_command_report"` UnknownCommand UnknownCommandReport `json:"unknown_command_report"` InvalidInvocation InvalidInvocationReport `json:"invalid_invocation_report"` Credentials CredentialsReport `json:"credential_report"` Download DownloadReport `json:"download_report"` Panic PanicReport `json:"panic_report"` }
Report holds statistics about the logged events.
type RunCommand ¶
type RunCommand struct { // Shell parsed command string. Command []string `protobuf:"bytes,1,rep,name=command,proto3" json:"command,omitempty"` // Environment variables in key=value format. EnvironmentVariables []string `protobuf:"bytes,2,rep,name=environment_variables,json=environmentVariables,proto3" json:"environment_variables,omitempty"` // Path to the resolved command. ResolvedCommandPath string `protobuf:"bytes,4,opt,name=resolved_command_path,json=resolvedCommandPath,proto3" json:"resolved_command_path,omitempty"` // contains filtered or unexported fields }
func (*RunCommand) Descriptor
deprecated
func (*RunCommand) Descriptor() ([]byte, []int)
Deprecated: Use RunCommand.ProtoReflect.Descriptor instead.
func (*RunCommand) GetCommand ¶
func (x *RunCommand) GetCommand() []string
func (*RunCommand) GetEnvironmentVariables ¶
func (x *RunCommand) GetEnvironmentVariables() []string
func (*RunCommand) GetResolvedCommandPath ¶
func (x *RunCommand) GetResolvedCommandPath() string
func (*RunCommand) MarshalJSON ¶
func (msg *RunCommand) MarshalJSON() ([]byte, error)
MarshalJSON implements json.Marshaler
func (*RunCommand) ProtoMessage ¶
func (*RunCommand) ProtoMessage()
func (*RunCommand) ProtoReflect ¶
func (x *RunCommand) ProtoReflect() protoreflect.Message
func (*RunCommand) Reset ¶
func (x *RunCommand) Reset()
func (*RunCommand) String ¶
func (x *RunCommand) String() string
func (*RunCommand) UnmarshalJSON ¶
func (msg *RunCommand) UnmarshalJSON(b []byte) error
UnmarshalJSON implements json.Unmarshaler
type RunCommandReport ¶
type RunCommandReport struct { // Name of the resolved command ResolvedCommandPaths StrCounter `json:"resolved_command_names"` // Name of the command CommandNames StrCounter `json:"command_names"` }
type SessionLogger ¶
type SessionLogger struct { *Logger // contains filtered or unexported fields }
SessionLogger logs messages with a shared session ID.
func (*SessionLogger) Record ¶
func (l *SessionLogger) Record(event LogType) error
func (*SessionLogger) SessionID ¶
func (l *SessionLogger) SessionID() string
type StrCounter ¶
type StrCounter struct {
// contains filtered or unexported fields
}
StrCounter counts the number of strings seen.
func (*StrCounter) Increment ¶
func (s *StrCounter) Increment(toAdd string)
Increment adds one to the given key.
func (StrCounter) MarshalJSON ¶
func (s StrCounter) MarshalJSON() ([]byte, error)
MarshalJSON implemnts custom JSON marshaler.
type TerminalUpdate ¶
type TerminalUpdate struct { // Width of the terminal in characters. Width int32 `protobuf:"varint,1,opt,name=width,proto3" json:"width,omitempty"` // Height of the terminal in charactres. Height int32 `protobuf:"varint,2,opt,name=height,proto3" json:"height,omitempty"` // Name of the connected terminal. Term string `protobuf:"bytes,3,opt,name=term,proto3" json:"term,omitempty"` // Whether the terminal is a PTY. IsPty bool `protobuf:"varint,4,opt,name=is_pty,json=isPty,proto3" json:"is_pty,omitempty"` // contains filtered or unexported fields }
func (*TerminalUpdate) Descriptor
deprecated
func (*TerminalUpdate) Descriptor() ([]byte, []int)
Deprecated: Use TerminalUpdate.ProtoReflect.Descriptor instead.
func (*TerminalUpdate) GetHeight ¶
func (x *TerminalUpdate) GetHeight() int32
func (*TerminalUpdate) GetIsPty ¶
func (x *TerminalUpdate) GetIsPty() bool
func (*TerminalUpdate) GetTerm ¶
func (x *TerminalUpdate) GetTerm() string
func (*TerminalUpdate) GetWidth ¶
func (x *TerminalUpdate) GetWidth() int32
func (*TerminalUpdate) MarshalJSON ¶
func (msg *TerminalUpdate) MarshalJSON() ([]byte, error)
MarshalJSON implements json.Marshaler
func (*TerminalUpdate) ProtoMessage ¶
func (*TerminalUpdate) ProtoMessage()
func (*TerminalUpdate) ProtoReflect ¶
func (x *TerminalUpdate) ProtoReflect() protoreflect.Message
func (*TerminalUpdate) Reset ¶
func (x *TerminalUpdate) Reset()
func (*TerminalUpdate) String ¶
func (x *TerminalUpdate) String() string
func (*TerminalUpdate) UnmarshalJSON ¶
func (msg *TerminalUpdate) UnmarshalJSON(b []byte) error
UnmarshalJSON implements json.Unmarshaler
type UnknownCommand ¶
type UnknownCommand struct { // Shell parsed command string. Command []string `protobuf:"bytes,1,rep,name=command,proto3" json:"command,omitempty"` // The reason the command was unknown. Status UnknownCommand_UnknownCommandStatus `protobuf:"varint,2,opt,name=status,proto3,enum=UnknownCommand_UnknownCommandStatus" json:"status,omitempty"` // Any associated error message. ErrorMessage string `protobuf:"bytes,3,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"` // contains filtered or unexported fields }
func (*UnknownCommand) Descriptor
deprecated
func (*UnknownCommand) Descriptor() ([]byte, []int)
Deprecated: Use UnknownCommand.ProtoReflect.Descriptor instead.
func (*UnknownCommand) GetCommand ¶
func (x *UnknownCommand) GetCommand() []string
func (*UnknownCommand) GetErrorMessage ¶
func (x *UnknownCommand) GetErrorMessage() string
func (*UnknownCommand) GetStatus ¶
func (x *UnknownCommand) GetStatus() UnknownCommand_UnknownCommandStatus
func (*UnknownCommand) MarshalJSON ¶
func (msg *UnknownCommand) MarshalJSON() ([]byte, error)
MarshalJSON implements json.Marshaler
func (*UnknownCommand) ProtoMessage ¶
func (*UnknownCommand) ProtoMessage()
func (*UnknownCommand) ProtoReflect ¶
func (x *UnknownCommand) ProtoReflect() protoreflect.Message
func (*UnknownCommand) Reset ¶
func (x *UnknownCommand) Reset()
func (*UnknownCommand) String ¶
func (x *UnknownCommand) String() string
func (*UnknownCommand) UnmarshalJSON ¶
func (msg *UnknownCommand) UnmarshalJSON(b []byte) error
UnmarshalJSON implements json.Unmarshaler
type UnknownCommandReport ¶
type UnknownCommandReport struct { CommandNames StrCounter `json:"command_names"` CommandStatuses StrCounter `json:"command_statuses"` }
type UnknownCommand_UnknownCommandStatus ¶
type UnknownCommand_UnknownCommandStatus int32
const ( UnknownCommand_UNKNOWN UnknownCommand_UnknownCommandStatus = 0 UnknownCommand_NOT_FOUND UnknownCommand_UnknownCommandStatus = 1 // Not found in $PATH. UnknownCommand_NOT_IMPLEMENTED UnknownCommand_UnknownCommandStatus = 2 // Executable found, but not implemented. UnknownCommand_LOOKUP_ERROR UnknownCommand_UnknownCommandStatus = 3 // Error looking up the command.. )
func (UnknownCommand_UnknownCommandStatus) Descriptor ¶
func (UnknownCommand_UnknownCommandStatus) Descriptor() protoreflect.EnumDescriptor
func (UnknownCommand_UnknownCommandStatus) Enum ¶
func (x UnknownCommand_UnknownCommandStatus) Enum() *UnknownCommand_UnknownCommandStatus
func (UnknownCommand_UnknownCommandStatus) EnumDescriptor
deprecated
func (UnknownCommand_UnknownCommandStatus) EnumDescriptor() ([]byte, []int)
Deprecated: Use UnknownCommand_UnknownCommandStatus.Descriptor instead.
func (UnknownCommand_UnknownCommandStatus) Number ¶
func (x UnknownCommand_UnknownCommandStatus) Number() protoreflect.EnumNumber
func (UnknownCommand_UnknownCommandStatus) String ¶
func (x UnknownCommand_UnknownCommandStatus) String() string
func (UnknownCommand_UnknownCommandStatus) Type ¶
func (UnknownCommand_UnknownCommandStatus) Type() protoreflect.EnumType