datastore

Documentation

Index

• Variables
• func CheckCharCode(s string) string
• func CloseLogDB()
• func ForEachLog(t string, st, et int64, callBack func(log *LogEnt) bool)
• func ForEachNotify(st, et int64, callBack func(n *NotifyEnt) bool)
• func ForEachSigmaConfig(callBack func(c string, d []byte))
• func ForEachSigmaRules(callBack func(c []byte, path string))
• func GenClientCert(cert, key, cn string)
• func GenServerCert(cert, key, cn string)
• func GetMIBValueString(name string, variable *gosnmp.SnmpPDU, raw bool) string
• func LoadMIBDB()
• func OpenLogDB()
• func PrintDateAndTime(i interface{}) string
• func PrintHintedMIBIntVal(val int32, hint string, us bool) string
• func PrintIPAddress(i interface{}) string
• func PrintMIBStringVal(i interface{}) string
• func SaveLogs(t string, logs []*LogEnt)
• func SaveNotify(n *NotifyEnt)
• type ConfigEnt
• type LogEnt
• type LogType
• type MIBInfo
  • func FindMIBInfo(name string) *MIBInfo
• type MIBModuleEnt
• type MIBTreeEnt
• type MIBTypeEnt
• type NotifyEnt

Variables

var MIBDB *gomibdb.MIBDB

var MIBInfoMap = make(map[string]*MIBInfo)

var MIBModules = []*MIBModuleEnt{}

var MIBTree = []*MIBTreeEnt{}

var MIBTypeMap = make(map[string]MIBTypeEnt)

Functions

func CheckCharCode

func CheckCharCode(s string) string

func CloseLogDB

func CloseLogDB()

CloseLogDB : close log database

func ForEachLog

func ForEachLog(t string, st, et int64, callBack func(log *LogEnt) bool)

ForEachLogs : for each logs

func ForEachNotify

func ForEachNotify(st, et int64, callBack func(n *NotifyEnt) bool)

func ForEachSigmaConfig

func ForEachSigmaConfig(callBack func(c string, d []byte))

ForEachSigmaConfig : for each sigma config data

func ForEachSigmaRules

func ForEachSigmaRules(callBack func(c []byte, path string))

ForEachSigmaRules : call back with sigma rule data

func GenClientCert

func GenClientCert(cert, key, cn string)

func GenServerCert

func GenServerCert(cert, key, cn string)

func GetMIBValueString

func GetMIBValueString(name string, variable *gosnmp.SnmpPDU, raw bool) string

func LoadMIBDB

func LoadMIBDB()

func OpenLogDB

func OpenLogDB()

OpenLogDB : open log database

func PrintDateAndTime

func PrintDateAndTime(i interface{}) string

DISPLAY-HINT "2d-1d-1d,1d:1d:1d.1d,1a1d:1d"

func PrintHintedMIBIntVal

func PrintHintedMIBIntVal(val int32, hint string, us bool) string

func PrintIPAddress

func PrintIPAddress(i interface{}) string

func PrintMIBStringVal

func PrintMIBStringVal(i interface{}) string

func SaveLogs

func SaveLogs(t string, logs []*LogEnt)

SaveLogs : save log to database

func SaveNotify

func SaveNotify(n *NotifyEnt)

Types

type ConfigEnt

type ConfigEnt struct {
	LogPath       string `yaml:"logPath"`
	SyslogUDPPort int    `yaml:"syslogUDPPort"`
	SyslogTCPPort int    `yaml:"syslogTCPPort"`
	NetFlowPort   int    `yaml:"netflowPort"`
	SNMPTrapPort  int    `yaml:"snmpTrapPort"`
	// Windows log
	WinEventLogChannel       string `yaml:"winEventLogChannel"`
	WinEventLogCheckInterval int    `yaml:"winEventLogCheckInterval"`
	WinEventLogCheckStart    int    `yaml:"winEventLogCheckStart"`
	WinRemote                string `yaml:"winRemote"`
	WinUser                  string `yaml:"winUser"`
	WinPassword              string `yaml:"winPassword"`
	WinAuth                  string `yaml:"winAuth"`
	WinLogSJIS               bool   `yaml:"winSJIS"`
	// Dst
	SyslogDst     []string `yaml:"syslogDst"`
	TrapDst       []string `yaml:"trapDst"`
	TrapCommunity string   `yaml:"trapCommunity"`
	// Log retention period (hours)
	LogRetention int `yaml:"logRetention"`
	// Notify retention period (days)
	NotifyRetention int `yaml:"notifyRetention"`
	// GROK
	GrokPat []string `yaml:"grockPat"`
	GrokDef string   `yaml:"grokDef"`
	// Named capture
	NamedCaptures string `yaml:"namedCaptures"`
	// Key/Vaue parse
	KeyValParse bool `yaml:"keyValParse"`
	// Sigma
	SigmaRules     string `yaml:"sigmaRules"`
	SigmaConfigs   string `yaml:"sigmaConfigs"`
	SigmaSkipError bool   `yaml:"sigmaSkipError"`
	// SNMP MIB
	MIBPath string `yaml:"mibPath"`
	// Debug
	Debug bool `yaml:"debug"`
}

var Config ConfigEnt

type LogEnt

type LogEnt struct {
	Time int64
	Type LogType
	Src  string
	Log  string
}

type LogType

type LogType int

const (
	Syslog LogType = iota
	NetFlow
	SnmpTrap
	WindowsEventLog
)

type MIBInfo

type MIBInfo struct {
	OID         string
	Status      string
	Type        string
	Enum        string
	Defval      string
	Units       string
	Index       string
	Description string
	EnumMap     map[int]string
	Hint        string
}

func FindMIBInfo

func FindMIBInfo(name string) *MIBInfo

type MIBModuleEnt

type MIBModuleEnt struct {
	Type  string // int | ext
	File  string
	Name  string
	Error string
}

読み込んだMIBのリスト

type MIBTreeEnt

type MIBTreeEnt struct {
	OID      string `json:"oid"`
	Name     string `json:"name"`
	MIBInfo  *MIBInfo
	Children []*MIBTreeEnt `json:"children"`
}

type MIBTypeEnt

type MIBTypeEnt struct {
	Enum    string
	EnumMap map[int]string
	Hint    string
}

type NotifyEnt

type NotifyEnt struct {
	// Log
	Time int64
	Type LogType
	Log  string
	Src  string
	// Sigma rule
	ID    string
	Title string
	Tags  string
	Level string
}