Event Queries using a domain specific language

[glaslos]

We introduce the term Queries for filters and labels.

Goals:

• Being able to filter events by more than just destination port.
• Instead of filtering events, apply a label to an event. E.g. assign a protocol to an event.
• When picking Apply, add the filter to a list of filters.
• User should be able to delete a filter.
• User should be able to edit a filter.
• On a new event, apply all filters and labels.

Approach:

• Consider wireshark https://wiki.wireshark.org/DisplayFilters as an option for the syntax .
• Consider waxeye for DSL https://waxeye-org.github.io/waxeye/index.html
• Consider using js-dsl for DSL https://venkatperi.github.io/js-dsl/
• Consider chevrotain (although I had some dependency issues, see dsl branch)

Branch:

• I started a little on this, branch here: https://github.com/glaslos/ochi/tree/dsl (some issues handling the library as dependency)

Example Queries:

• tcp.port eq 25 (shows only TCP traffic with destination port 25)
• ip.src eq 192.168.0.0/16 (show only traffic from IPs in this subnet)

[glaslos]

Completed with #46