|
| 1 | +package cmd |
| 2 | + |
| 3 | +import ( |
| 4 | + "encoding/json" |
| 5 | + "fmt" |
| 6 | + "regexp" |
| 7 | + "strings" |
| 8 | + |
| 9 | + "github.com/lacework/go-sdk/api" |
| 10 | + "github.com/pkg/errors" |
| 11 | +) |
| 12 | + |
| 13 | +const remediateComponentName string = "remediate" |
| 14 | + |
| 15 | +// isRemediateInstalled returns true if the remediate component is installed |
| 16 | +func (c *cliState) isRemediateInstalled() bool { |
| 17 | + return c.IsComponentInstalled(remediateComponentName) |
| 18 | +} |
| 19 | + |
| 20 | +// getTemplateIdentifiers runs the remediate component to retrieve a list |
| 21 | +// of remediation template identifiers |
| 22 | +func getRemediationTemplateIDs() ([]string, error) { |
| 23 | + remediate, found := cli.LwComponents.GetComponent(remediateComponentName) |
| 24 | + if !found { |
| 25 | + return []string{}, errors.New("remediate component not found") |
| 26 | + } |
| 27 | + |
| 28 | + // set up environment variables |
| 29 | + envs := []string{ |
| 30 | + fmt.Sprintf("LW_COMPONENT_NAME=%s", remediateComponentName), |
| 31 | + "LW_JSON=true", |
| 32 | + "LW_NONINTERACTIVE=true", |
| 33 | + } |
| 34 | + for _, e := range cli.envs() { |
| 35 | + // don't let LW_JSON / LW_NONINTERACTIVE through here |
| 36 | + if strings.HasPrefix(e, "LW_JSON=") || strings.HasPrefix(e, "LW_NONINTERACTIVE=") { |
| 37 | + continue |
| 38 | + } |
| 39 | + envs = append(envs, e) |
| 40 | + } |
| 41 | + stdout, stderr, err := remediate.RunAndReturn([]string{"ls", "templates"}, nil, envs...) |
| 42 | + if err != nil { |
| 43 | + cli.Log.Debugw("remediate error details", "stderr", stderr) |
| 44 | + return []string{}, err |
| 45 | + } |
| 46 | + |
| 47 | + var templates []map[string]interface{} |
| 48 | + err = json.Unmarshal([]byte(stdout), &templates) |
| 49 | + if err != nil { |
| 50 | + return []string{}, err |
| 51 | + } |
| 52 | + |
| 53 | + templateIDs := []string{} |
| 54 | + for _, template := range templates { |
| 55 | + v, ok := template["id"] |
| 56 | + if !ok { |
| 57 | + continue |
| 58 | + } |
| 59 | + s, ok := v.(string) |
| 60 | + if !ok { |
| 61 | + continue |
| 62 | + } |
| 63 | + templateIDs = append(templateIDs, s) |
| 64 | + } |
| 65 | + return templateIDs, nil |
| 66 | +} |
| 67 | + |
| 68 | +// filterFixableAlerts identifies which alerts have corresponding remediation template IDs |
| 69 | +// and returns those which don't |
| 70 | +func filterFixableAlerts(alerts api.Alerts, templateIDs []string) api.Alerts { |
| 71 | + fixableAlerts := api.Alerts{} |
| 72 | + for _, alert := range alerts { |
| 73 | + if alert.PolicyID == "" { |
| 74 | + continue |
| 75 | + } |
| 76 | + found := false |
| 77 | + // Historically alerts did not consistently populate policyID and |
| 78 | + // templates were named arbitrarily. |
| 79 | + // If and when policies explicitly reference templates we will no longer need |
| 80 | + // any inference logic. |
| 81 | + for _, id := range templateIDs { |
| 82 | + if id == alert.PolicyID { |
| 83 | + fixableAlerts = append(fixableAlerts, alert) |
| 84 | + found = true |
| 85 | + break |
| 86 | + } |
| 87 | + } |
| 88 | + if found { |
| 89 | + continue |
| 90 | + } |
| 91 | + // Another interesting problem that we have is that policyIDs are dynamic |
| 92 | + // For instance, on dev7 policy lwcustom-11 is dev7-lwcustom-11 |
| 93 | + // On some other environment it might be someother-lwcustom-11 |
| 94 | + dynamicIDRE := regexp.MustCompile(`^\w+-\d+$`) |
| 95 | + // Iterate through the templates looking for those with dynamic policy IDs |
| 96 | + for _, id := range templateIDs { |
| 97 | + if dynamicIDRE.MatchString(id) { |
| 98 | + // if the policyID of the alert ends with -<id> |
| 99 | + // i.e. if dev7-lwcustom-11 endswith -lwcustom-11 |
| 100 | + if strings.HasSuffix(alert.PolicyID, fmt.Sprintf("-%s", id)) { |
| 101 | + fixableAlerts = append(fixableAlerts, alert) |
| 102 | + break |
| 103 | + } |
| 104 | + } |
| 105 | + } |
| 106 | + } |
| 107 | + return fixableAlerts |
| 108 | +} |
0 commit comments