-
Notifications
You must be signed in to change notification settings - Fork 98
/
email_addresses.go
74 lines (64 loc) · 2.06 KB
/
email_addresses.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
package table
import (
"context"
"strings"
"github.com/go-kit/kit/log"
"github.com/kolide/osquery-go"
"github.com/kolide/osquery-go/plugin/table"
"github.com/pkg/errors"
)
func EmailAddresses(client *osquery.ExtensionManagerClient, logger log.Logger) *table.Plugin {
columns := []table.ColumnDefinition{
table.TextColumn("email"),
table.TextColumn("domain"),
}
t := &emailAddressesTable{
onePasswordAccountsTable: &onePasswordAccountsTable{client: client, logger: logger},
chromeUserProfilesTable: &chromeUserProfilesTable{client: client, logger: logger},
}
return table.NewPlugin("kolide_email_addresses", columns, t.generateEmailAddresses)
}
type emailAddressesTable struct {
onePasswordAccountsTable *onePasswordAccountsTable
chromeUserProfilesTable *chromeUserProfilesTable
}
func (t *emailAddressesTable) generateEmailAddresses(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
var results []map[string]string
// add results from chrome profiles
chromeResults, err := t.chromeUserProfilesTable.generate(ctx, queryContext)
if err != nil {
return nil, errors.Wrap(err, "get email addresses from chrome state")
}
for _, result := range chromeResults {
email := result["email"]
// chrome profiles don't require an email skip ones without emails
if email == "" {
continue
}
results = addEmailToResults(email, results)
}
// add results from 1password
onePassResults, err := t.onePasswordAccountsTable.generate(ctx, queryContext)
if err != nil {
return nil, errors.Wrap(err, "adding email results from 1password config")
}
for _, onePassResult := range onePassResults {
results = addEmailToResults(onePassResult["user_email"], results)
}
return results, nil
}
func emailDomain(email string) string {
parts := strings.Split(email, "@")
switch len(parts) {
case 0:
return email
default:
return parts[len(parts)-1]
}
}
func addEmailToResults(email string, results []map[string]string) []map[string]string {
return append(results, map[string]string{
"email": email,
"domain": emailDomain(email),
})
}