From 39c7b1e7d05927042ed61fe1851ccb37cc546fe1 Mon Sep 17 00:00:00 2001 From: Frikky Date: Wed, 15 Oct 2025 11:07:41 +0200 Subject: [PATCH] More default behavior orborus configs --- functions/onprem/orborus/go.sum | 4 +-- functions/onprem/orborus/orborus.go | 38 ++++++++++++++++++----------- 2 files changed, 26 insertions(+), 16 deletions(-) diff --git a/functions/onprem/orborus/go.sum b/functions/onprem/orborus/go.sum index f4575157..29bf0bc2 100644 --- a/functions/onprem/orborus/go.sum +++ b/functions/onprem/orborus/go.sum @@ -328,8 +328,8 @@ github.com/sendgrid/sendgrid-go v3.16.1+incompatible h1:zWhTmB0Y8XCDzeWIm2/BIt1G github.com/sendgrid/sendgrid-go v3.16.1+incompatible/go.mod h1:QRQt+LX/NmgVEvmdRw0VT/QgUn499+iza2FnDca9fg8= github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8= github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= -github.com/shuffle/shuffle-shared v0.9.29 h1:6f0liFf1a566FjX3d6eQjgYHhVfznHb8RyxM4QhfnUA= -github.com/shuffle/shuffle-shared v0.9.29/go.mod h1:PhDEizuz4SmJaSmy0+yrFWwD1mXVUsy8/knKlrqF1qw= +github.com/shuffle/shuffle-shared v0.9.30 h1:3CYvNyD7sTxdxoZjTVrtaDqFvSWQRKAFGaga6rPGf8A= +github.com/shuffle/shuffle-shared v0.9.30/go.mod h1:PhDEizuz4SmJaSmy0+yrFWwD1mXVUsy8/knKlrqF1qw= github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= diff --git a/functions/onprem/orborus/orborus.go b/functions/onprem/orborus/orborus.go index eb372e8a..e489f0e6 100755 --- a/functions/onprem/orborus/orborus.go +++ b/functions/onprem/orborus/orborus.go @@ -2125,14 +2125,25 @@ func main() { if len(os.Getenv("SHUFFLE_SKIP_PIPELINES")) == 0 { os.Setenv("SHUFFLE_SKIP_PIPELINES", "false") os.Setenv("SHUFFLE_PIPELINE_ENABLED", "true") + } + + if os.Getenv("SHUFFLE_SKIP_PIPELINES") != "true" && os.Getenv("SHUFFLE_PIPELINE_ENABLED") != "false" { + // Run in 15 seconds in a goroutine + go func() { + time.Sleep(15 * time.Second) + log.Printf("[INFO] Auto-downloading Sigma rules during startup") + ruleType := "sigma" + err := handleFileCategoryChange(ruleType) + if err != nil { + log.Printf("[WARNING] Failed downloading %s rules: %s", ruleType, err) + } + }() } - log.Println("[INFO] Setting up execution environment") - + log.Println("[INFO] Setting up execution environment for env '%s'", environment) // //FIXME if baseUrl == "" { baseUrl = "https://shuffler.io" - //baseUrl = "http://localhost:5001" } if len(orborusUuid) == 0 { @@ -2523,7 +2534,7 @@ func main() { os.Setenv("SHUFFLE_SKIP_PIPELINES", "false") tenzirDisabled = false - err = handleFileCategoryChange() + err = handleFileCategoryChange("sigma") if err != nil { log.Printf("[ERROR] Failed to download the file category: %s", err) } @@ -2533,7 +2544,7 @@ func main() { } else if incRequest.Type == "DISABLE_SIGMA_FOLDER" { log.Printf("[INFO] Got job to disable sigma rules") - err = removeFileCategory() + err = removeFileCategory("sigma") if err != nil { log.Printf("[ERROR] Failed to disable the sigma rules: %s", err) } @@ -3568,8 +3579,8 @@ func searchPipeline(identifier string) (string, error) { return "", errors.New("no existing pipeline found with name") } -func handleFileCategoryChange() error { - apiEndpoint := baseUrl + "/api/v1/files/namespaces/sigma" +func handleFileCategoryChange(ruleType string) error { + apiEndpoint := fmt.Sprintf("%s/api/v1/files/namespaces/%s", baseUrl, ruleType) req, err := http.NewRequest("GET", apiEndpoint, nil) if err != nil { return err @@ -3616,14 +3627,13 @@ func handleFileCategoryChange() error { } //log.Println("[DEBUG] ZIP file downloaded successfully.") - tenzirStorageFolder := os.Getenv("SHUFFLE_STORAGE_FOLDER") if len(tenzirStorageFolder) == 0 { tenzirStorageFolder = "/tmp/" } tenzirStorageFolder = strings.TrimRight(tenzirStorageFolder, "/") - sigmaPath := fmt.Sprintf("%s/sigma_rules", tenzirStorageFolder) + sigmaPath := fmt.Sprintf("%s/%s_rules", tenzirStorageFolder, ruleType) err = extractZIP("files.zip", sigmaPath) if err != nil { log.Printf("[ERROR] Failed to extract ZIP file: %s", err) @@ -3711,7 +3721,7 @@ func copyToTenzir(srcPath, destPath string) error { return nil } -func removeFileCategory() error { +func removeFileCategory(ruleType string) error { tenzirStorageFolder := os.Getenv("SHUFFLE_STORAGE_FOLDER") if len(tenzirStorageFolder) == 0 { tenzirStorageFolder = "/tmp/" @@ -3720,14 +3730,14 @@ func removeFileCategory() error { tenzirStorageFolder = strings.TrimRight(tenzirStorageFolder, "/") //sigmaPath := "/var/lib/tenzir/sigma_rules/*" - sigmaPath := fmt.Sprintf("%s/sigma_rules", tenzirStorageFolder) + rulePath := fmt.Sprintf("%s/%s_rules", tenzirStorageFolder, ruleType) - err := os.RemoveAll(sigmaPath) + err := os.RemoveAll(rulePath) if err != nil { - return fmt.Errorf("Error removing category files in %s: %v", sigmaPath, err) + return fmt.Errorf("Error removing category files in %s: %v", rulePath, err) } - log.Printf("[INFO] Removed all local category data in %s", sigmaPath) + log.Printf("[INFO] Removed all local category data in %s", rulePath) return nil }