made the file disabling logic in orborus easy

This commit is contained in:
Hari Krishna
2024-06-14 04:45:20 +00:00
committed by satti-hari-krishna-reddy
parent f8c786b9ec
commit f081e907b3
2 changed files with 20 additions and 43 deletions
+3 -3
View File
@@ -416,9 +416,9 @@ const App = (message, props) => {
} }
/> />
<Route <Route
exact exact
path="/detections/sigma" path="/detections/sigma"
element={<DetectionDashBoard globalUrl={globalUrl} />} element={<DetectionDashBoard globalUrl={globalUrl} />}
/> />
<Route <Route
exact exact
+17 -40
View File
@@ -2033,22 +2033,14 @@ func main() {
} else if incRequest.Type == "DISABLE_SIGMA_FILE" { } else if incRequest.Type == "DISABLE_SIGMA_FILE" {
fileName := incRequest.ExecutionArgument fileName := incRequest.ExecutionArgument
err = manageSigmaRule(fileName, "disable") err = disableSigmaRule(fileName)
if err != nil { if err != nil {
log.Printf("[ERROR] Failed to disable the sigma file %s, reason: %s", fileName, err) log.Printf("[ERROR] Failed to disable the sigma file %s, reason: %s", fileName, err)
} }
toBeRemoved.Data = append(toBeRemoved.Data, incRequest) toBeRemoved.Data = append(toBeRemoved.Data, incRequest)
} else if incRequest.Type == "ENABLE_SIGMA_FILE" { } else if incRequest.Type == "DISABLE_SIGMA_RULES" {
fileName := incRequest.ExecutionArgument
err = manageSigmaRule(fileName, "enable")
if err != nil {
log.Printf("[ERROR] Failed to enable the sigma file %s, reason: %s",fileName, err)
}
toBeRemoved.Data = append(toBeRemoved.Data, incRequest)
} else if incRequest.Type == "DISABLE_SIGMA_RULES" {
err := manageSigmaFolder("disable") err := manageSigmaFolder("disable")
if err != nil { if err != nil {
log.Printf("[ERROR] Failed to disable the sigma rules: %s", err) log.Printf("[ERROR] Failed to disable the sigma rules: %s", err)
@@ -2441,6 +2433,11 @@ func handlePipeline(incRequest shuffle.ExecutionRequest) error {
log.Printf("[ERROR] Failed to create pipeline: %s", err) log.Printf("[ERROR] Failed to create pipeline: %s", err)
return err return err
} }
err = handleFileCategoryChange()
if err != nil {
log.Printf("[ERROR] Failed to download rules: %s", err)
return err
}
} else if incRequest.Type == "PIPELINE_DELETE" { } else if incRequest.Type == "PIPELINE_DELETE" {
log.Printf("[INFO] Should delete pipeline %#v", identifier) log.Printf("[INFO] Should delete pipeline %#v", identifier)
pipelineId, err := searchPipeline(identifier) pipelineId, err := searchPipeline(identifier)
@@ -2686,13 +2683,15 @@ func createPipeline(command, identifier string) (string, error) {
// command = command[:startIndex] + baseUrl + command[endIndex:] // command = command[:startIndex] + baseUrl + command[endIndex:]
// } // }
// } // }
command = "from file /var/lib/tenzir/sysmon_logs.ndjson read json | sigma /var/lib/tenzir/rule.yaml | to https://shuffler.io/api/v1/hooks/webhook_d295c43a-e322-4afc-9a59-af167ae7c190"
requestBody := map[string]interface{}{ requestBody := map[string]interface{}{
"definition": command, "definition": command,
"name": identifier, "name": identifier,
"hidden": false, "hidden": false,
"autostart": map[string]bool{ "autostart": map[string]bool{
"created": true, "created": true,
"completed": true, "completed": false,
"failed": true, "failed": true,
}, },
"autodelete": map[string]bool{ "autodelete": map[string]bool{
@@ -2913,7 +2912,7 @@ func searchPipeline(identifier string) (string, error) {
func handleFileCategoryChange() error{ func handleFileCategoryChange() error{
apiEndpoint := baseUrl+"/api/v1/files/namespaces/sigma" apiEndpoint := baseUrl+"/api/v1/files/namespaces/sigma"
apiKey := "23e57313-5f0f-4a20-bddd-a9059c980adf" apiKey := "12e7150e-1e03-4834-a839-de4688f50ad0"
req, err := http.NewRequest("GET", apiEndpoint, nil) req, err := http.NewRequest("GET", apiEndpoint, nil)
if err != nil { if err != nil {
@@ -3030,39 +3029,18 @@ func copyToTenzir(srcPath, destPath string) error {
return nil return nil
} }
func manageSigmaRule(fileName, action string) error { func disableSigmaRule(fileName string) error {
containerName := "tenzir-node" containerName := "tenzir-node"
srcPath := "" srcPath := fmt.Sprintf("/var/lib/tenzir/sigma_rules/%s", fileName)
destPath := ""
switch action {
case "disable":
srcPath = fmt.Sprintf("/var/lib/tenzir/sigma_files/%s", fileName)
destPath = "/var/lib/tenzir/disabled_rules"
case "enable":
srcPath = fmt.Sprintf("/var/lib/tenzir/disabled_rules/%s", fileName)
destPath = "/var/lib/tenzir/sigma_files"
default:
return fmt.Errorf("invalid action: %s", action)
}
checkSrcCmd := exec.Command("docker", "exec", containerName, "test", "-f", srcPath) checkSrcCmd := exec.Command("docker", "exec", containerName, "test", "-f", srcPath)
if err := checkSrcCmd.Run(); err != nil { if err := checkSrcCmd.Run(); err != nil {
return fmt.Errorf("source file does not exist: %v", err) return fmt.Errorf("source file does not exist: %v", err)
} }
checkDestCmd := exec.Command("docker", "exec", containerName, "test", "-d", destPath) rmCmd := exec.Command("docker", "exec", "-u", "root", containerName, "rm", srcPath)
if err := checkDestCmd.Run(); err != nil { if err := rmCmd.Run(); err != nil {
mkdirCmd := exec.Command("docker", "exec", "-u", "root", containerName, "mkdir", "-p", destPath) return fmt.Errorf("error removing file: %v", err)
if err := mkdirCmd.Run(); err != nil {
return fmt.Errorf("error creating destination directory in container: %v", err)
}
}
// Move the file to the destination directory or shall we copy it and then remove the file from source dir
mvCmd := exec.Command("docker", "exec", "-u", "root", containerName, "mv", srcPath, destPath)
if err := mvCmd.Run(); err != nil {
return fmt.Errorf("error moving file: %v", err)
} }
return nil return nil
@@ -3070,8 +3048,7 @@ func manageSigmaRule(fileName, action string) error {
func manageSigmaFolder(action string) error { func manageSigmaFolder(action string) error {
containerName := "tenzir-node" containerName := "tenzir-node"
sigmaPath := "/var/lib/tenzir/sigma_files" sigmaPath := "/var/lib/tenzir/sigma_rules"
disabledPath := "/var/lib/tenzir/disabled_sigma"
if action == "disable" { if action == "disable" {