Usage

Notes

• API docs are available on localhost:{PORT}/redoc.
• HTTPie (http) is used in the following sections.

Create a rule

$ echo -n '{"yaml": "title: test\ndescription: test\ndetection:\n  selection:\n    foo: bar\n  allowed_user:\n    user:\n      - alice\n      - bob\n  condition: selection and not allowed_user"}' | http POST localhost:8000/api/v1/rules/
{
    "createdAt": "2022-07-19T22:00:11.032101",
    "id": "01G8C7KJGR8X9XZJ391FS0K624",
    "parsed": {
        "description": "test",
        "detection": {
            "allowed_user": {
                "user": [
                    "alice",
                    "bob"
                ]
            },
            "condition": "selection and not allowed_user",
            "selection": {
                "foo": "bar"
            }
        },
        "title": "test"
    },
    "sha256": "ab898e2e5cff5c1bf9313f46709ff367271980aaf0dc512be965361c4d7ac389",
    "yaml": "title: test\ndescription: test\ndetection:\n  selection:\n    foo: bar\n  allowed_user:\n    user:\n      - alice\n      - bob\n  condition: selection and not allowed_user"
}

Feed an event

# this event matches with the rule created
# so you will get alert logs
$ http localhost:8000/api/v1/events/ event[foo]=bar event[user]=charlie
[
    {
        "event": {
            "foo": "bar",
            "user": "charlie"
        },
        "id": "01G8C88PNV7R8W627YBC6EKB5W",
        "rule": {
            "createdAt": "2022-07-19T22:00:11.032101",
            "id": "01G8C7KJGR8X9XZJ391FS0K624",
            "parsed": {
                "description": "test",
                "detection": {
                    "allowed_user": {
                        "user": [
                            "alice",
                            "bob"
                        ]
                    },
                    "condition": "selection and not allowed_user",
                    "selection": {
                        "foo": "bar"
                    }
                },
                "title": "test"
            },
            "sha256": "ab898e2e5cff5c1bf9313f46709ff367271980aaf0dc512be965361c4d7ac389",
            "yaml": "title: test\ndescription: test\ndetection:\n  selection:\n    foo: bar\n  allowed_user:\n    user:\n      - alice\n      - bob\n  condition: selection and not allowed_user"
        }
    }
]

# this event does not match with the rule
# so you will get an empty list
$ http localhost:8000/api/v1/events/ event[foo]=bar event[user]=alice
[]

Check alert logs

$ http localhost:8000/api/v1/logs/

Create an emitter

You can create an emitter which sends an HTTP request based on alerts.

# this will create an emitter which sends an HTTP "POST" request to "http://localhost:8000" when an alert log belongs to the rule "01G88AA1BS395WY94GN8J8BEJH" is created
$ http localhost:8000/api/v1/emitters/ ruleId=01G88AA1BS395WY94GN8J8BEJH url=http://localhost:8000 method=POST
{
    "createdAt": "2022-07-19T22:16:26.270463",
    "headers": {
        "content-type": "application/json"
    },
    "id": "01G8C8HAWYJ1HAQRS884JNHX83",
    "method": "POST",
    "ruleId": "01G88AA1BS395WY94GN8J8BEJH",
    "template": "{\n\"event\": {{ event|tojson }},\n\"rule\": {{ rule|tojson }}\n}",
    "url": "http://localhost:8000"
}

You can change the request body by customizing template (Jinja2 template).

The default format is:

{
  "event": {{ event|tojson }},
  "rule": {{ rule|tojson }}
}

And it will generate the following JSON:

{
		"event": {
				"foo": "bar",
				"user": "charlie"
		},
		"rule": {
				"createdAt": "2022-07-19T22:00:11.032101",
				"id": "01G8C7KJGR8X9XZJ391FS0K624",
				"parsed": {
						"description": "test",
						"detection": {
								"allowed_user": {
										"user": [
												"alice",
												"bob"
										]
								},
								"condition": "selection and not allowed_user",
								"selection": {
										"foo": "bar"
								}
						},
						"title": "test"
				},
				"sha256": "ab898e2e5cff5c1bf9313f46709ff367271980aaf0dc512be965361c4d7ac389",
				"yaml": "title: test\ndescription: test\ndetection:\n  selection:\n    foo: bar\n  allowed_user:\n    user:\n      - alice\n      - bob\n  condition: selection and not allowed_user"
		}
}