@@ -16,75 +16,92 @@ func main() {
1616 var osQuerySockPath , configPath string
1717
1818 flag .StringVar (& configPath , "config" , "conf.json" , "the path to the json configuration defining checks" )
19- flag .StringVar (& osQuerySockPath , "osquery" , "/var/osquery/osquery.em" , "the path to the osquery socket" )
19+ flag .StringVar (& osQuerySockPath , "osquery" , "/var/osquery/osquery.em" , "the path to the osquery socket" )
2020 flag .Parse ()
2121
2222 client , err := osquery .NewClient (osQuerySockPath , 10 * time .Second )
2323 if err != nil {
24- log .Fatalf ("could not create osquery client %q" , err )
24+ log .Fatalf ("could not create osquery client %q" , err )
2525 }
2626 defer client .Close ()
2727
2828 buff , err := os .ReadFile (configPath )
2929 if err != nil {
30- log .Fatalf ("could not read config file %q" , err )
30+ log .Fatalf ("could not read config file %q" , err )
3131 }
3232 var config AnalysisConfig
3333 if err := json .NewDecoder (bytes .NewBuffer (buff )).Decode (& config ); err != nil {
34- log .Fatalf ("could not decode config file %q" , err )
34+ log .Fatalf ("could not decode config file %q" , err )
3535 }
3636
3737 datas , err := collect (client , config .Collectors )
3838 if err != nil {
39- log .Fatalf ("collection step failed %q" , err )
39+ log .Fatalf ("collection step failed %q" , err )
4040 }
4141
4242 for _ , check := range config .Checks {
43+ log .Printf ("check %s" , check .Description )
4344 data , ok := datas [check .CollectorID ]
4445 if ! ok {
45- log .Fatalf ("no collector %q for check %q" , check .CollectorID , check .Description )
46+ log .Fatalf ("no collector %q" , check .CollectorID )
47+ }
48+ for _ , condition := range check .Conditions {
49+ passed , err := expression .Evaluate (data , condition .Predicate )
50+ if err != nil {
51+ log .Fatalf ("an error occured %q evaluating predicate %q" , err , condition .Predicate )
52+ }
53+ if passed {
54+ log .Printf ("%s: %s" , condition .Type , condition .Message )
55+ }
4656 }
4757
4858 }
49-
5059}
5160
5261type Collector struct {
5362 ID string `json:"id"`
5463 // Expression retrieve data from OSQuery
5564 Expression string `json:"expression"`
56-
5765}
5866
5967type Condition struct {
60- Type string `json:"type"`
68+ Type string `json:"type"`
6169 Predicate string `json:"predicate"`
62- Message string `json:"message"`
70+ Message string `json:"message"`
6371}
6472
6573type Check struct {
66- CollectorID string `json:"collector-id"`
67- Description string `json:"description"`
68- Conditions []Condition `json:"conditions"`
69-
74+ CollectorID string `json:"collector-id"`
75+ Description string `json:"description"`
76+ Conditions []Condition `json:"conditions"`
7077}
7178
7279type AnalysisConfig struct {
7380 Collectors []Collector `json:"collectors"`
74- Checks []Check `json:"checks"`
75-
81+ Checks []Check `json:"checks"`
7682}
7783
7884type collectorMap map [string ]interface {}
7985
80- func collect (client * osquery.ExtensionManagerClient , collectors []Collector )(collectorMap , error ) {
86+ // convert []map[string]string to something analyze can handle []interface{} where interface{} is map[string]interface{}
87+ func collect (client * osquery.ExtensionManagerClient , collectors []Collector ) (collectorMap , error ) {
8188 results := make (collectorMap )
8289 for _ , coll := range collectors {
83- result , err := client .QueryRows (coll .Expression )
90+ rows , err := client .QueryRows (coll .Expression )
8491 if err != nil {
8592 return nil , err
8693 }
87- results [coll .ID ] = result
94+ var objects []interface {}
95+ for _ , row := range rows {
96+ object := make (map [string ]interface {})
97+ for k , v := range row {
98+ object [k ] = v
99+ }
100+ objects = append (objects , object )
101+
102+ }
103+ results [coll .ID ] = objects
104+
88105 }
89106 return results , nil
90107}
0 commit comments