Skip to content

Commit 684e11c

Browse files
qjeromeqjerome
committed
Endpoint configuration implemented in admin API
1 parent 2305403 commit 684e11c

20 files changed

+2682
-2057
lines changed

‎.github/coverage/coverage.txt

+85-81
Large diffs are not rendered by default.

‎agent/agent.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ func NewAgent(c *config.Agent) (h *Agent, err error) {
167167
}
168168

169169
// loading forwarder config
170-
if h.forwarder, err = client.NewForwarder(h.ctx, h.config.FwdConfig); err != nil {
170+
if h.forwarder, err = client.NewForwarder(h.ctx, &h.config.FwdConfig); err != nil {
171171
return
172172
}
173173

‎agent/config/canary.go

+10-10
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,19 @@ import (
66

77
// Canary configuration
88
type Canary struct {
9-
HideFiles bool `toml:"hide-files" comment:"Flag to set to hide files"`
10-
HideDirectories bool `toml:"hide-dirs" comment:"Flag to set to hide directories"`
11-
SetAuditACL bool `toml:"set-audit-acl" comment:"Set Audit ACL to the canary directories, sub-directories and files to generate File System audit events\n https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-system"`
12-
Directories []string `toml:"directories" comment:"Directories where canary files will be created"`
13-
Files []string `toml:"files" comment:"Canary files to monitor. Files will be created if not existing"`
14-
Delete bool `toml:"delete" comment:"Whether to delete or not the canary files when service stops"`
9+
HideFiles bool `json:"hide-files" toml:"hide-files" comment:"Flag to set to hide files"`
10+
HideDirectories bool `json:"hide-dirs" toml:"hide-dirs" comment:"Flag to set to hide directories"`
11+
SetAuditACL bool `json:"set-audit-acl" toml:"set-audit-acl" comment:"Set Audit ACL to the canary directories, sub-directories and files to generate File System audit events\n https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-system"`
12+
Directories []string `json:"directories" toml:"directories" comment:"Directories where canary files will be created"`
13+
Files []string `json:"files" toml:"files" comment:"Canary files to monitor. Files will be created if not existing"`
14+
Delete bool `json:"delete" toml:"delete" comment:"Whether to delete or not the canary files when service stops"`
1515
createdDir *datastructs.SyncedSet
1616
}
1717

1818
// Canaries structure holding canary configuration
1919
type Canaries struct {
20-
Enable bool `toml:"enable" comment:"Enable canary files management"`
21-
Actions []string `toml:"actions" comment:"Actions to apply when a canary file is touched"`
22-
Whitelist []string `toml:"whitelist" comment:"Process images being allowed to touch the canaries"`
23-
Canaries []*Canary `toml:"group" comment:"Canary files to create at every run"`
20+
Enable bool `json:"enable" toml:"enable" comment:"Enable canary files management"`
21+
Actions []string `json:"actions" toml:"actions" comment:"Actions to apply when a canary file is touched"`
22+
Whitelist []string `json:"whitelist" toml:"whitelist" comment:"Process images being allowed to touch the canaries"`
23+
Canaries []*Canary `json:"group" toml:"group" comment:"Canary files to create at every run"`
2424
}

‎agent/config/config.go

+35-36
Original file line numberDiff line numberDiff line change
@@ -27,33 +27,33 @@ var (
2727
)
2828

2929
type Actions struct {
30-
AvailableActions []string `toml:"available-actions" commented:"true" comment:"List of available actions (here as a memo for easier configuration, but it is not used in any way by the engine)"`
31-
Low []string `toml:"low" comment:"Default actions to be taken when event criticality is in [1; 4]"`
32-
Medium []string `toml:"medium" comment:"Default actions to be taken when event criticality is in [5; 7]"`
33-
High []string `toml:"high" comment:"Default actions to be taken when event criticality is in [8; 9]"`
34-
Critical []string `toml:"critical" comment:"Default actions to be taken when event criticality is 10"`
30+
AvailableActions []string `json:"available-actions" toml:"available-actions" commented:"true" comment:"List of available actions (here as a memo for easier configuration, but it is not used in any way by the engine)"`
31+
Low []string `json:"low" toml:"low" comment:"Default actions to be taken when event criticality is in [1; 4]"`
32+
Medium []string `json:"medium" toml:"medium" comment:"Default actions to be taken when event criticality is in [5; 7]"`
33+
High []string `json:"high" toml:"high" comment:"Default actions to be taken when event criticality is in [8; 9]"`
34+
Critical []string `json:"critical" toml:"critical" comment:"Default actions to be taken when event criticality is 10"`
3535
}
3636

3737
// Dump structure definition
3838
type Dump struct {
39-
Dir string `toml:"dir" comment:"Directory used to store dumps"`
40-
MaxDumps int `toml:"max-dumps" comment:"Maximum number of dumps per process"` // maximum number of dump per GUID
41-
Compression bool `toml:"compression" comment:"Enable dumps compression"`
42-
DumpUntracked bool `toml:"dump-untracked" comment:"Dumps untracked process. Untracked processes are missing\n enrichment information and may generate unwanted dumps"` // whether or not we should dump untracked processes, if true it would create many FPs
39+
Dir string `json:"dir" toml:"dir" comment:"Directory used to store dumps"`
40+
MaxDumps int `json:"max-dumps" toml:"max-dumps" comment:"Maximum number of dumps per process"` // maximum number of dump per GUID
41+
Compression bool `json:"compression" toml:"compression" comment:"Enable dumps compression"`
42+
DumpUntracked bool `json:"dump-untracked" toml:"dump-untracked" comment:"Dumps untracked process. Untracked processes are missing\n enrichment information and may generate unwanted dumps"` // whether or not we should dump untracked processes, if true it would create many FPs
4343
}
4444

4545
// Sysmon holds Sysmon related configuration
4646
type Sysmon struct {
47-
Bin string `toml:"bin" comment:"Path to Sysmon binary"`
48-
ArchiveDirectory string `toml:"archive-directory" comment:"Path to Sysmon Archive directory"`
49-
CleanArchived bool `toml:"clean-archived" comment:"Delete files older than 5min archived by Sysmon"`
47+
Bin string `json:"bin" toml:"bin" comment:"Path to Sysmon binary"`
48+
ArchiveDirectory string `json:"archive-directory" toml:"archive-directory" comment:"Path to Sysmon Archive directory"`
49+
CleanArchived bool `json:"clean-archived" toml:"clean-archived" comment:"Delete files older than 5min archived by Sysmon"`
5050
}
5151

5252
// Rules holds rules configuration
5353
type Rules struct {
54-
RulesDB string `toml:"rules-db" comment:"Path to Gene rules database"`
55-
ContainersDB string `toml:"containers-db" comment:"Path to Gene rules containers\n (c.f. Gene documentation)"`
56-
UpdateInterval time.Duration `toml:"update-interval" comment:"Update interval at which rules should be pulled from manager\n NB: only applies if a manager server is configured"`
54+
RulesDB string `json:"rules-db" toml:"rules-db" comment:"Path to Gene rules database"`
55+
ContainersDB string `json:"containers-db" toml:"containers-db" comment:"Path to Gene rules containers\n (c.f. Gene documentation)"`
56+
UpdateInterval time.Duration `json:"update-interval" toml:"update-interval" comment:"Update interval at which rules should be pulled from manager\n NB: only applies if a manager server is configured"`
5757
}
5858

5959
func (c *Rules) RulesPaths() (path, sha256Path string) {
@@ -64,9 +64,9 @@ func (c *Rules) RulesPaths() (path, sha256Path string) {
6464

6565
// Audit holds Windows audit configuration
6666
type Audit struct {
67-
Enable bool `toml:"enable" comment:"Enable following Audit Policies or not"`
68-
AuditPolicies []string `toml:"audit-policies" comment:"Audit Policies to enable (c.f. auditpol /get /category:* /r)"`
69-
AuditDirs []string `toml:"audit-dirs" comment:"Set Audit ACL to directories, sub-directories and files to generate File System audit events\n https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-system)"`
67+
Enable bool `json:"enable" toml:"enable" comment:"Enable following Audit Policies or not"`
68+
AuditPolicies []string `json:"audit-policies" toml:"audit-policies" comment:"Audit Policies to enable (c.f. auditpol /get /category:* /r)"`
69+
AuditDirs []string `json:"audit-dirs" toml:"audit-dirs" comment:"Set Audit ACL to directories, sub-directories and files to generate File System audit events\n https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-file-system)"`
7070
}
7171

7272
// Configure configures the desired audit policies
@@ -111,23 +111,22 @@ func (c *Audit) Restore() {
111111

112112
// Agent structure
113113
type Agent struct {
114-
//Channels []string `toml:"channels" comment:"Windows log channels to listen to. Either channel names\n can be used (i.e. Microsoft-Windows-Sysmon/Operational) or aliases"`
115-
DatabasePath string `toml:"db-path" comment:"Path to local database root directory"`
116-
CritTresh int `toml:"criticality-treshold" comment:"Dumps/forward only events above criticality threshold\n or filtered events (i.e. Gene filtering rules)"`
117-
EnableHooks bool `toml:"en-hooks" comment:"Enable enrichment hooks and dump hooks"`
118-
EnableFiltering bool `toml:"en-filters" comment:"Enable event filtering (log filtered events, not only alerts)\n See documentation: https://github.com/0xrawsec/gene"`
119-
Logfile string `toml:"logfile" comment:"Logfile used to log messages generated by the engine"` // for WHIDS log messages (not alerts)
120-
LogAll bool `toml:"log-all" comment:"Log any incoming event passing through the engine"` // log all events to logfile (used for debugging)
121-
Endpoint bool `toml:"endpoint" comment:"True if current host is the endpoint on which logs are generated\n Example: turn this off if running on a WEC"`
122-
EtwConfig *Etw `toml:"etw" comment:"ETW configuration"`
123-
FwdConfig *config.Forwarder `toml:"forwarder" comment:"Forwarder configuration"`
124-
Sysmon *Sysmon `toml:"sysmon" comment:"Sysmon related settings"`
125-
Actions *Actions `toml:"actions" comment:"Default actions to apply to events, depending on their criticality"`
126-
Dump *Dump `toml:"dump" comment:"Dump related settings"`
127-
Report *Report `toml:"reporting" comment:"Reporting related settings"`
128-
RulesConfig *Rules `toml:"rules" comment:"Gene rules related settings\n Gene repo: https://github.com/0xrawsec/gene\n Gene rules repo: https://github.com/0xrawsec/gene-rules"`
129-
AuditConfig *Audit `toml:"audit" comment:"Windows auditing configuration"`
130-
CanariesConfig *Canaries `toml:"canaries" comment:"Canary files configuration"`
114+
DatabasePath string `json:"db-path" toml:"db-path" comment:"Path to local database root directory"`
115+
CritTresh int `json:"criticality-treshold" toml:"criticality-treshold" comment:"Dumps/forward only events above criticality threshold\n or filtered events (i.e. Gene filtering rules)" `
116+
EnableHooks bool `json:"en-hooks" toml:"en-hooks" comment:"Enable enrichment hooks and dump hooks"`
117+
EnableFiltering bool `json:"en-filters" toml:"en-filters" comment:"Enable event filtering (log filtered events, not only alerts)\n See documentation: https://github.com/0xrawsec/gene" `
118+
Logfile string `json:"logfile" toml:"logfile" comment:"Logfile used to log messages generated by the engine"` // for WHIDS log messages (not alerts)
119+
LogAll bool `json:"log-all" toml:"log-all" comment:"Log any incoming event passing through the engine" ` // log all events to logfile (used for debugging)
120+
Endpoint bool `json:"endpoint" toml:"endpoint" comment:"True if current host is the endpoint on which logs are generated\n Example: turn this off if running on a WEC"`
121+
EtwConfig Etw `json:"etw" toml:"etw" comment:"ETW configuration"`
122+
FwdConfig config.Forwarder `json:"forwarder" toml:"forwarder" comment:"Forwarder configuration"`
123+
Sysmon Sysmon `json:"sysmon" toml:"sysmon" comment:"Sysmon related settings"`
124+
Actions Actions `json:"actions" toml:"actions" comment:"Default actions to apply to events, depending on their criticality"`
125+
Dump Dump `json:"dump" toml:"dump" comment:"Dump related settings"`
126+
Report Report `json:"report" toml:"reporting" comment:"Reporting related settings"`
127+
RulesConfig Rules `json:"rules" toml:"rules" comment:"Gene rules related settings\n Gene repo: https://github.com/0xrawsec/gene\n Gene rules repo: https://github.com/0xrawsec/gene-rules"`
128+
AuditConfig Audit `json:"audit" toml:"audit" comment:"Windows auditing configuration"`
129+
CanariesConfig Canaries `json:"canaries" toml:"canaries" comment:"Canary files configuration"`
131130
}
132131

133132
// LoadsHIDSConfig loads a HIDS configuration from a file
@@ -144,7 +143,7 @@ func LoadsHIDSConfig(path string) (c Agent, err error) {
144143

145144
// IsForwardingEnabled returns true if a forwarder is actually configured to forward logs
146145
func (c *Agent) IsForwardingEnabled() bool {
147-
return *c.FwdConfig != emptyForwarderConfig && !c.FwdConfig.Local
146+
return c.FwdConfig != emptyForwarderConfig && !c.FwdConfig.Local
148147
}
149148

150149
// Prepare creates directory used in the config if not existing

‎agent/config/etw.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ package config
22

33
type Etw struct {
44
// set as private not to support it officially as Microsoft-Windows-Kernel-File generates too many events
5-
enTraceFile bool `toml:"trace-files" comment:"Enable file read/write events via an optimized Microsoft-Windows-Kernel-File provider"`
6-
Providers []string `toml:"providers" comment:"ETW providers to enable in the EDR autologger setting"`
7-
Traces []string `toml:"traces" comment:"Additional ETW traces to retrieve events"`
5+
enTraceFile bool `json:"trace-files" toml:"trace-files" comment:"Enable file read/write events via an optimized Microsoft-Windows-Kernel-File provider"`
6+
Providers []string `json:"providers" toml:"providers" comment:"ETW providers to enable in the EDR autologger setting"`
7+
Traces []string `json:"traces" toml:"traces" comment:"Additional ETW traces to retrieve events"`
88
}

‎agent/config/reports.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ var (
6363

6464
// OSQuery holds configuration about OSQuery tool
6565
type OSQuery struct {
66-
Tables []string `toml:"tables" comment:"OSQuery tables to add to the report"`
66+
Tables []string `json:"tables" toml:"tables" comment:"OSQuery tables to add to the report"`
6767
}
6868

6969
// PrepareCommands builds up osquery commands
@@ -84,10 +84,10 @@ func (c *OSQuery) PrepareCommands() (cmds []ReportCommand) {
8484

8585
// Report holds report configuration
8686
type Report struct {
87-
EnableReporting bool `toml:"en-reporting" comment:"Enables IR reporting"`
88-
OSQuery OSQuery `toml:"osquery" comment:"OSQuery configuration"`
89-
Commands []ReportCommand `toml:"commands" comment:"Commands to execute in addition to the OSQuery ones" commented:"true"`
90-
CommandTimeout time.Duration `toml:"timeout" comment:"Timeout after which every command expires (to prevent too long commands)"`
87+
EnableReporting bool `json:"en-reporting" toml:"en-reporting" comment:"Enables IR reporting"`
88+
OSQuery OSQuery `json:"osquery" toml:"osquery" comment:"OSQuery configuration"`
89+
Commands []ReportCommand `json:"commands" toml:"commands" comment:"Commands to execute in addition to the OSQuery ones" commented:"true"`
90+
CommandTimeout time.Duration `json:"timeout" toml:"timeout" comment:"Timeout after which every command expires (to prevent too long commands)"`
9191
}
9292

9393
// PrepareCommands builds up all commands to run

‎agent/defaults.go

+9-9
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ func BuildDefaultConfig(root string) *config.Agent {
1414
logDir := filepath.Join(root, "Logs")
1515

1616
return &config.Agent{
17-
RulesConfig: &config.Rules{
17+
RulesConfig: config.Rules{
1818
RulesDB: filepath.Join(root, "Database", "Rules"),
1919
ContainersDB: filepath.Join(root, "Database", "Containers"),
2020
UpdateInterval: 60 * time.Second,
2121
},
2222

23-
FwdConfig: &clientConfig.Forwarder{
23+
FwdConfig: clientConfig.Forwarder{
2424
Local: true,
2525
Client: clientConfig.Client{
2626
MaxUploadSize: api.DefaultMaxUploadSize,
@@ -30,7 +30,7 @@ func BuildDefaultConfig(root string) *config.Agent {
3030
RotationInterval: time.Hour * 5,
3131
},
3232
},
33-
EtwConfig: &config.Etw{
33+
EtwConfig: config.Etw{
3434
Providers: []string{
3535
"Microsoft-Windows-Sysmon",
3636
"Microsoft-Windows-Windows Defender",
@@ -39,25 +39,25 @@ func BuildDefaultConfig(root string) *config.Agent {
3939
},
4040
Traces: []string{"Eventlog-Security"},
4141
},
42-
Sysmon: &config.Sysmon{
42+
Sysmon: config.Sysmon{
4343
Bin: "C:\\Windows\\Sysmon64.exe",
4444
ArchiveDirectory: "C:\\Sysmon\\",
4545
CleanArchived: true,
4646
},
47-
Actions: &config.Actions{
47+
Actions: config.Actions{
4848
AvailableActions: AvailableActions,
4949
Low: []string{},
5050
Medium: []string{"brief", "filedump", "regdump"},
5151
High: []string{"report", "filedump", "regdump"},
5252
Critical: []string{"report", "filedump", "regdump", "memdump"},
5353
},
54-
Dump: &config.Dump{
54+
Dump: config.Dump{
5555
Dir: filepath.Join(root, "Dumps"),
5656
Compression: true,
5757
MaxDumps: 4,
5858
DumpUntracked: false,
5959
},
60-
Report: &config.Report{
60+
Report: config.Report{
6161
EnableReporting: false,
6262
OSQuery: config.OSQuery{
6363
Tables: []string{"processes", "services", "scheduled_tasks", "drivers", "startup_items", "process_open_sockets"}},
@@ -69,10 +69,10 @@ func BuildDefaultConfig(root string) *config.Agent {
6969
}},
7070
CommandTimeout: 60 * time.Second,
7171
},
72-
AuditConfig: &config.Audit{
72+
AuditConfig: config.Audit{
7373
AuditPolicies: []string{"File System"},
7474
},
75-
CanariesConfig: &config.Canaries{
75+
CanariesConfig: config.Canaries{
7676
Enable: false,
7777
Canaries: []*config.Canary{
7878
{

‎agent/hook_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ func TestHooks(t *testing.T) {
138138
defer os.RemoveAll(tmp)
139139

140140
c := BuildDefaultConfig(tmp)
141-
c.Actions = &config.Actions{
141+
c.Actions = config.Actions{
142142
AvailableActions: AvailableActions,
143143
Low: []string{},
144144
Medium: []string{},

0 commit comments

Comments
 (0)