/
package.go
174 lines (148 loc) · 4.36 KB
/
package.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
// Package report provides report service for veinmind-runner
// and veinmind-plugin
package report
import (
"os"
"time"
)
type Level uint32
const (
Low Level = iota
Medium
High
Critical
None
)
type DetectType uint32
const (
Image DetectType = iota
Container
)
type EventType uint32
const (
Risk EventType = iota
Invasion
Info
)
type AlertType uint32
const (
Vulnerability AlertType = iota
MaliciousFile
Backdoor
Sensitive
AbnormalHistory
Weakpass
Asset
Basic
)
type WeakpassService uint32
const (
SSH WeakpassService = iota
)
type AlertDetail struct {
MaliciousFileDetail *MaliciousFileDetail `json:"malicious_file_detail,omitempty"`
WeakpassDetail *WeakpassDetail `json:"weakpass_detail,omitempty"`
BackdoorDetail *BackdoorDetail `json:"backdoor_detail,omitempty"`
SensitiveFileDetail *SensitveFileDetail `json:"sensitive_file_detail,omitempty"`
SensitiveEnvDetail *SensitiveEnvDetail `json:"sensitive_env_detail,omitempty"`
HistoryDetail *HistoryDetail `json:"history_detail,omitempty"`
AssetDetail *AssetDetail `json:"asset_detail,omitempty"`
BasicDetail *BasicDetail `json:"basic_detail,omitempty"`
}
type FileDetail struct {
Path string `json:"path"`
Perm os.FileMode `json:"perm"`
Size int64 `json:"size"`
Gname string `json:"gname"`
Gid int64 `json:"gid"`
Uid int64 `json:"uid"`
Uname string `json:"uname"`
Ctim int64 `json:"ctim"`
Mtim int64 `json:"mtim"`
Atim int64 `json:"atim"`
}
type MaliciousFileDetail struct {
FileDetail
Engine string `json:"engine"`
MaliciousType string `json:"malicious_type"`
MaliciousName string `json:"malicious_name"`
}
type WeakpassDetail struct {
Username string `json:"username"`
Password string `json:"password"`
Service WeakpassService `json:"service"`
}
type BackdoorDetail struct {
FileDetail
Description string `json:"description"`
}
type SensitveFileDetail struct {
FileDetail
RuleID int64 `json:"rule_id"`
RuleName string `json:"rule_name"`
RuleDescription string `json:"rule_description"`
}
type SensitiveEnvDetail struct {
Key string `json:"key"`
Value string `json:"value"`
RuleID int64 `json:"rule_id"`
RuleName string `json:"rule_name"`
RuleDescription string `json:"rule_description"`
}
type HistoryDetail struct {
Instruction string `json:"instruction"`
Content string `json:"content"`
Description string `json:"description"`
}
type AssetDetail struct {
OS AssetOSDetail `json:"os"`
PackageInfos []AssetPackageDetails `json:"package_infos"`
Applications []AssetApplicationDetails `json:"applications"`
}
type AssetOSDetail struct {
Family string `json:"family"`
Name string `json:"name"`
Eosl bool `json:"EOSL,omitempty"`
}
type AssetPackageDetails struct {
FilePath string `json:"file_path"`
Packages []AssetPackageDetail `json:"packages"`
}
type AssetApplicationDetails struct {
Type string `json:"type"`
FilePath string `json:"file_path,omitempty"`
Packages []AssetPackageDetail `json:"packages"`
}
type AssetPackageDetail struct {
Name string `json:"name"`
Version string `json:"version"`
Release string `json:"release"`
Epoch int `json:"epoch"`
Arch string `json:"arch"`
SrcName string `json:"srcName"`
SrcVersion string `json:"srcVersion"`
SrcRelease string `json:"srcRelease"`
SrcEpoch int `json:"srcEpoch"`
Modularitylabel string `json:"modularitylabel"`
Indirect bool `json:"indirect"`
License string `json:"license"`
Layer string `json:"layer"`
}
type BasicDetail struct {
References []string `json:"references"`
CreatedTime int64 `json:"created_time"`
Env []string `json:"env"`
Entrypoint []string `json:"entrypoint"`
Cmd []string `json:"cmd"`
WorkingDir string `json:"working_dir"`
Author string `json:"author"`
}
type ReportEvent struct {
ID string `json:"id"`
Time time.Time `json:"time"`
Level Level `json:"level"`
DetectType DetectType `json:"detect_type"`
EventType EventType `json:"event_type"`
AlertType AlertType `json:"alert_type"`
AlertDetails []AlertDetail `json:"alert_details"`
}