marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

made the sigma rule disable logic better and simple

Browse Source
This commit is contained in:
Hari Krishna
2024-06-14 05:04:24 +00:00
committed by satti-hari-krishna-reddy
parent f081e907b3
commit e1e0e4ad9c
1 changed files with 12 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
functions/onprem/orborus/orborus.go
+12 -55
View File
@@ -2033,7 +2033,7 @@ func main() {
} else if incRequest.Type == "DISABLE_SIGMA_FILE" {
fileName := incRequest.ExecutionArgument
err = disableSigmaRule(fileName)
err = removeFile(fileName)
if err != nil {
log.Printf("[ERROR] Failed to disable the sigma file %s, reason: %s", fileName, err)
}
@@ -2041,18 +2041,11 @@ func main() {
toBeRemoved.Data = append(toBeRemoved.Data, incRequest)
} else if incRequest.Type == "DISABLE_SIGMA_RULES" {
err := manageSigmaFolder("disable")
err := removeAllFiles()
if err != nil {
log.Printf("[ERROR] Failed to disable the sigma rules: %s", err)
}
toBeRemoved.Data = append(toBeRemoved.Data, incRequest)
} else if incRequest.Type == "ENABLE_SIGMA_RULES" {
err := manageSigmaFolder("enable")
if err != nil {
log.Printf("[ERROR] Failed to enable the sigma rules: %s", err)
}
toBeRemoved.Data = append(toBeRemoved.Data, incRequest)
} else {
newrequests = append(newrequests, incRequest)
@@ -3029,7 +3022,7 @@ func copyToTenzir(srcPath, destPath string) error {
return nil
}
func disableSigmaRule(fileName string) error {
func removeFile(fileName string) error {
containerName := "tenzir-node"
srcPath := fmt.Sprintf("/var/lib/tenzir/sigma_rules/%s", fileName)
@@ -3038,57 +3031,21 @@ func disableSigmaRule(fileName string) error {
return fmt.Errorf("source file does not exist: %v", err)
}
rmCmd := exec.Command("docker", "exec", "-u", "root", containerName, "rm", srcPath)
if err := rmCmd.Run(); err != nil {
return fmt.Errorf("error removing file: %v", err)
}
return nil
return removePath(containerName, srcPath)
}
func manageSigmaFolder(action string) error {
func removeAllFiles() error {
containerName := "tenzir-node"
sigmaPath := "/var/lib/tenzir/sigma_rules"
sigmaPath := "/var/lib/tenzir/sigma_rules/*"
if action == "disable" {
return removePath(containerName, sigmaPath)
}
checkSigmaCmd := exec.Command("docker", "exec", containerName, "test", "-d", sigmaPath)
if err := checkSigmaCmd.Run(); err != nil {
return fmt.Errorf("sigma_files directory does not exist: %v", err)
}
// Rename sigma_files to disabled_sigma
renameCmd := exec.Command("docker", "exec", "-u", "root", containerName, "mv", sigmaPath, disabledPath)
if err := renameCmd.Run(); err != nil {
return fmt.Errorf("error renaming sigma_files to disabled_sigma: %v", err)
}
// Create a new sigma_files directory
createCmd := exec.Command("docker", "exec", "-u", "root", containerName, "mkdir", sigmaPath)
if err := createCmd.Run(); err != nil {
return fmt.Errorf("error creating new sigma_files directory: %v", err)
}
} else if action == "enable" {
checkDisabledCmd := exec.Command("docker", "exec", containerName, "test", "-d", disabledPath)
if err := checkDisabledCmd.Run(); err != nil {
return fmt.Errorf("disabled_sigma directory does not exist: %v", err)
}
removeCmd := exec.Command("docker", "exec", "-u", "root", containerName, "rm", "-rf", sigmaPath)
if err := removeCmd.Run(); err != nil {
return fmt.Errorf("error removing existing sigma_files directory: %v", err)
}
// Rename disabled_sigma back to sigma_files
renameBackCmd := exec.Command("docker", "exec", "-u", "root", containerName, "mv", disabledPath, sigmaPath)
if err := renameBackCmd.Run(); err != nil {
return fmt.Errorf("error renaming disabled_sigma back to sigma_files: %v", err)
}
} else {
return fmt.Errorf("invalid action: %s", action)
func removePath(containerName, path string) error {
rmCmd := exec.Command("docker", "exec", "-u", "root", containerName, "rm", "-r", path)
if err := rmCmd.Run(); err != nil {
return fmt.Errorf("error removing path: %v", err)
}
return nil
}