Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
698 lines (626 sloc) 16.6 KB
package retraced
import (
"bytes"
"encoding/json"
"fmt"
"html/template"
"io/ioutil"
"log"
"net/http"
"strconv"
"strings"
"time"
)
type StructuredQuery struct {
Action string
CRUD string
ReceivedStart time.Time
ReceivedEnd time.Time
CreatedStart time.Time
CreatedEnd time.Time
ActorName string
ActorID string
Description string
Location string
}
func maybeRFC3339(t time.Time) string {
if t.IsZero() {
return ""
}
return t.Format(time.RFC3339)
}
func (sq *StructuredQuery) String() string {
var params []string
if sq.Action != "" {
param := fmt.Sprintf("action:%q", sq.Action)
params = append(params, param)
}
if sq.CRUD != "" {
param := fmt.Sprintf("crud:%q", sq.CRUD)
params = append(params, param)
}
received := fmt.Sprintf("%s,%s", maybeRFC3339(sq.ReceivedStart), maybeRFC3339(sq.ReceivedEnd))
if received != "," {
params = append(params, "received:"+received)
}
created := fmt.Sprintf("%s,%s", maybeRFC3339(sq.CreatedStart), maybeRFC3339(sq.CreatedEnd))
if created != "," {
params = append(params, "created:"+created)
}
if sq.ActorID != "" {
param := fmt.Sprintf("actor.id:%s", sq.ActorID)
params = append(params, param)
}
if sq.ActorName != "" {
param := fmt.Sprintf("actor.name:%q" + sq.ActorName)
params = append(params, param)
}
if sq.Description != "" {
param := fmt.Sprintf("description:%q", sq.Description)
params = append(params, param)
}
if sq.Location != "" {
param := fmt.Sprintf("location:%q", sq.Location)
params = append(params, param)
}
return strings.Join(params, " ")
}
// EventNode represents an event returned from the Retraced GraphQL API. Some
// fields are identical to the reported Event field and others are modified or
// added.
type EventNode struct {
// ID is the uuid generated by the Retraced API when the event was
// reported.
ID string `json:"id"`
// Action is the reported Action.
Action string `json:"action"`
// Group contains an augmented form of the reported group: if the
// reported event included a group.ID and no group.Name, but the group
// Name could be inferred from the group.ID at the time of creation,
// then group.Name will be defined.
Group *Group `json:"group"`
// Created is the reported Created timestamp.
Created time.Time `json:"created"`
// CRUD is the reported CRUD field.
CRUD string
// Target is an augmented form of the reported target. If the reported
// event included a target.ID, then target.Name, target.Type,
// target.Href, and target.Fields will be populated with any data known
// about the target at the time the event was reported.
Target *Target `json:"target"`
// Description is the reported Description.
Description string `json:"description"`
// SourceIP is the reported SourceIP.
SourceIP string `json:"source_ip"`
// Actor is an augmented form of the reported actor. If the reported
// event included an actor.ID, then actor.Name, actor.Href, and
// actor.Fields will be populated with any data known about the actor
// at the time the event was reported.
Actor *Actor `json:"actor"`
// Fields contains the reported Fields.
Fields Fields `json:"fields"`
// IsFailure is the reported IsFailure flag.
IsFailure bool `json:"is_failure"`
// IsAnonymous is the reported IsAnonymous flag.
IsAnonymous bool `json:"is_anonymous"`
// Component is the reported Component.
Component string `json:"component"`
// Version is the reported Version.
Version string `json:"version"`
// Display the holds the display templates for the event.
Display *Display `json:"display"`
// Country is populated from the reported SourceIP.
Country string `json:"country"`
// LocSubdiv1 is populated from the reported SourceIP.
LocSubdiv1 string `json:"loc_subdiv1"`
// LocSubdiv2 is populated from the reported SourceIP.
LocSubdiv2 string `json:"loc_subdiv2"`
// Received is the timestamp the Retraced API received the reported event.
Received time.Time `json:"received"`
// CanonicalTime is the reported Created timestamp if defined, else the
// Received time.
CanonicalTime time.Time `json:"canonical_time"`
// Raw is the json of the original reported event.
Raw string `json:"raw"`
}
// https://preview.retraced.io/documentation/advanced-retraced/display-templates/
type Display struct {
Markdown string `json:"markdown"`
}
// EventNodeMask specifies fields to retrieve in a GraphQL search.
type EventNodeMask struct {
ID bool
Action bool
CRUD bool
Description bool
IsFailure bool
IsAnonymous bool
SourceIP bool
Country bool
LocSubdiv1 bool
LocSubdiv2 bool
Received bool
Created bool
CanonicalTime bool
Component bool
Version bool
Fields bool
Raw bool
GroupID bool
GroupName bool
ActorID bool
ActorName bool
ActorHref bool
ActorFields bool
TargetID bool
TargetName bool
TargetHref bool
TargetType bool
TargetFields bool
DisplayMarkdown bool
}
// AnyGroup is true iff any group field (id or name) is on.
func (mask *EventNodeMask) AnyGroup() bool {
return mask.GroupID || mask.GroupName
}
// AnyActor is true iff any actor field is on.
func (mask *EventNodeMask) AnyActor() bool {
return mask.ActorID || mask.ActorName || mask.ActorHref || mask.ActorFields
}
// AnyTarget is true iff any target field is on.
func (mask *EventNodeMask) AnyTarget() bool {
return mask.TargetID || mask.TargetName || mask.TargetHref || mask.TargetType || mask.TargetFields
}
// AnyDisplay is true iff any display field is on.
func (mask *EventNodeMask) AnyDisplay() bool {
return mask.DisplayMarkdown
}
var searchTmplSource = `query Search($query: String!, $last: Int, $before: String) {
search(query: $query, last: $last, before: $before) {
totalCount,
pageInfo {
hasPreviousPage
}
edges {
cursor
node {
{{if .ID -}} id {{- end}}
{{if .Action -}} action {{- end}}
{{if .CRUD -}} crud {{- end}}
{{if .Description -}} description {{- end}}
{{if .IsFailure -}} is_failure {{- end}}
{{if .IsAnonymous -}} is_anonymous {{- end}}
{{if .SourceIP -}} source_ip {{- end}}
{{if .Country -}} country {{- end}}
{{if .LocSubdiv1 -}} loc_subdiv1 {{- end}}
{{if .LocSubdiv2 -}} loc_subdiv2 {{- end}}
{{if .Received -}} received {{- end}}
{{if .Created -}} created {{- end}}
{{if .CanonicalTime -}} canonical_time {{- end}}
{{if .Component -}} component {{- end}}
{{if .Version -}} version {{- end}}
{{if .Raw -}} raw {{- end}}
{{if .Fields -}} fields {
key
value
} {{- end}}
{{if .AnyGroup -}} group {
{{if .GroupID -}} id {{- end}}
{{if .GroupName -}} name {{- end}}
}{{end}}
{{if .AnyActor -}} actor {
{{if .ActorID -}} id {{- end}}
{{if .ActorName -}} name {{- end}}
{{if .ActorHref -}} href {{- end}}
{{if .ActorFields -}} fields {
key
value
} {{- end}}
}{{end}}
{{if .AnyTarget -}} target {
{{if .TargetID -}} id {{- end}}
{{if .TargetName -}} name {{- end}}
{{if .TargetHref -}} href {{- end}}
{{if .TargetType -}} type {{- end}}
{{if .TargetFields -}} fields {
key
value
} {{- end}}
}{{end}}
{{if .AnyDisplay -}} display{
{{if .DisplayMarkdown }}markdown{{end}}
}{{end}}
}
}
}
}`
var searchTmpl = template.Must(template.New("search").Parse(searchTmplSource))
// SearchOpQuery generates the graphQL query body string for a search operation.
func (mask *EventNodeMask) SearchOpQuery() (string, error) {
var buf bytes.Buffer
err := searchTmpl.Execute(&buf, mask)
if err != nil {
return "", err
}
return buf.String(), nil
}
// CSVHeaders generates a row of header fields
func (mask *EventNodeMask) CSVHeaders() []string {
var headers []string
if mask.ID {
headers = append(headers, "id")
}
if mask.Action {
headers = append(headers, "action")
}
if mask.CRUD {
headers = append(headers, "crud")
}
if mask.Description {
headers = append(headers, "description")
}
if mask.IsFailure {
headers = append(headers, "is_failure")
}
if mask.IsAnonymous {
headers = append(headers, "is_anonymous")
}
if mask.SourceIP {
headers = append(headers, "source_ip")
}
if mask.Country {
headers = append(headers, "country")
}
if mask.LocSubdiv1 {
headers = append(headers, "loc_subdiv1")
}
if mask.LocSubdiv2 {
headers = append(headers, "loc_subdiv2")
}
if mask.Received {
headers = append(headers, "received")
}
if mask.Created {
headers = append(headers, "created")
}
if mask.CanonicalTime {
headers = append(headers, "canonical_time")
}
if mask.Component {
headers = append(headers, "component")
}
if mask.Version {
headers = append(headers, "version")
}
if mask.Fields {
headers = append(headers, "fields")
}
if mask.Raw {
headers = append(headers, "raw")
}
if mask.GroupID {
headers = append(headers, "group_id")
}
if mask.GroupName {
headers = append(headers, "group_name")
}
if mask.ActorID {
headers = append(headers, "actor_id")
}
if mask.ActorName {
headers = append(headers, "actor_name")
}
if mask.ActorHref {
headers = append(headers, "actor_href")
}
if mask.ActorFields {
headers = append(headers, "actor_fields")
}
if mask.TargetID {
headers = append(headers, "target_id")
}
if mask.TargetName {
headers = append(headers, "target_name")
}
if mask.TargetHref {
headers = append(headers, "target_href")
}
if mask.TargetType {
headers = append(headers, "target_type")
}
if mask.TargetFields {
headers = append(headers, "target_fields")
}
if mask.DisplayMarkdown {
headers = append(headers, "display_markdown")
}
return headers
}
// CSVRow formats an event as a csv row
func (mask *EventNodeMask) CSVRow(e *EventNode) []string {
var fields []string
if mask.ID {
fields = append(fields, e.ID)
}
if mask.Action {
fields = append(fields, e.Action)
}
if mask.CRUD {
fields = append(fields, e.CRUD)
}
if mask.Description {
fields = append(fields, e.Description)
}
if mask.IsFailure {
fields = append(fields, strconv.FormatBool(e.IsFailure))
}
if mask.IsAnonymous {
fields = append(fields, strconv.FormatBool(e.IsAnonymous))
}
if mask.SourceIP {
fields = append(fields, e.SourceIP)
}
if mask.Country {
fields = append(fields, e.Country)
}
if mask.LocSubdiv1 {
fields = append(fields, e.LocSubdiv1)
}
if mask.LocSubdiv2 {
fields = append(fields, e.LocSubdiv2)
}
if mask.Received {
fields = append(fields, e.Received.Format(time.RFC3339))
}
if mask.Created {
fields = append(fields, e.Created.Format(time.RFC3339))
}
if mask.CanonicalTime {
fields = append(fields, e.CanonicalTime.Format(time.RFC3339))
}
if mask.Component {
fields = append(fields, e.Component)
}
if mask.Version {
fields = append(fields, e.Version)
}
if mask.Fields {
fields = append(fields, e.Fields.String())
}
if mask.Raw {
fields = append(fields, e.Raw)
}
if mask.GroupID {
var groupID string
if e.Group != nil {
groupID = e.Group.ID
}
fields = append(fields, groupID)
}
if mask.GroupName {
var groupName string
if e.Group != nil {
groupName = e.Group.Name
}
fields = append(fields, groupName)
}
if mask.ActorID {
var actorID string
if e.Actor != nil {
actorID = e.Actor.ID
}
fields = append(fields, actorID)
}
if mask.ActorName {
var actorName string
if e.Actor != nil {
actorName = e.Actor.Name
}
fields = append(fields, actorName)
}
if mask.ActorHref {
var actorHref string
if e.Actor != nil {
actorHref = e.Actor.Href
}
fields = append(fields, actorHref)
}
if mask.ActorFields {
var actorFields string
if e.Actor != nil {
actorFields = e.Actor.Fields.String()
}
fields = append(fields, actorFields)
}
if mask.TargetID {
var targetID string
if e.Target != nil {
targetID = e.Target.ID
}
fields = append(fields, targetID)
}
if mask.TargetName {
var targetName string
if e.Target != nil {
targetName = e.Target.Name
}
fields = append(fields, targetName)
}
if mask.TargetHref {
var targetHref string
if e.Target != nil {
targetHref = e.Target.Href
}
fields = append(fields, targetHref)
}
if mask.TargetType {
var targetType string
if e.Target != nil {
targetType = e.Target.Type
}
fields = append(fields, targetType)
}
if mask.TargetFields {
var targetFields string
if e.Target != nil {
targetFields = e.Target.Fields.String()
}
fields = append(fields, targetFields)
}
if mask.DisplayMarkdown {
var displayMarkdown string
if e.Display != nil {
displayMarkdown = e.Display.Markdown
}
fields = append(fields, displayMarkdown)
}
return fields
}
type graphQLSearchVariables struct {
Last int `json:"last,omitempty"`
Before string `json:"before,omitempty"`
Query string `json:"query"`
}
type graphQLSearchBody struct {
Query string `json:"query"`
Variables *graphQLSearchVariables `json:"variables,omitempty"`
}
type pageInfo struct {
HasPreviousPage bool `json:"hasPreviousPage"`
}
type EventEdge struct {
Cursor string `json:"cursor"`
Node *EventNode `json:"node"`
}
type graphQLSearch struct {
TotalCount int `json:"totalCount"`
PageInfo pageInfo `json:"pageInfo"`
Edges []*EventEdge `json:"edges"`
}
type graphQLSearchData struct {
Search graphQLSearch `json:"search"`
}
type graphQLSearchRoot struct {
Data graphQLSearchData `json:"data"`
}
// EventsConnection handles cursor-based pagination over query results.
type EventsConnection struct {
url string
authorization string
structuredQuery *StructuredQuery
mask *EventNodeMask
cursors []string
pageSize int
httpClient *http.Client
// If this connection's mask specifies fields in a nested struct, then
// that struct will be non-nil for results. For example, if the mask
// specifies GroupID, then Group will be non-nil even on events reported
// without a group ID.
currentResults []*EventNode
totalCount int
// 1-indexed
currentPageNumber int
}
func (ec *EventsConnection) NextPage() error {
return ec.call()
}
func (ec *EventsConnection) TotalPages() int {
pages := ec.totalCount / ec.pageSize
if ec.totalCount%ec.pageSize != 0 {
pages++
}
return pages
}
func (ec *EventsConnection) HasNextPage() bool {
return ec.currentPageNumber < ec.TotalPages()
}
func (ec *EventsConnection) HasPreviousPage() bool {
return ec.currentPageNumber > 1
}
func (ec *EventsConnection) CurrentPageNumber() int {
return ec.currentPageNumber
}
func (ec *EventsConnection) CurrentResults() []*EventNode {
return ec.currentResults
}
func (ec *EventsConnection) TotalCount() int {
return ec.totalCount
}
// cursor returns the last item in EventsConnection.cursors
func (ec *EventsConnection) cursor() string {
n := len(ec.cursors)
if n == 0 {
ec.cursors = []string{""}
n = 1
}
return ec.cursors[n-1]
}
func (ec *EventsConnection) call() error {
graphQLQuery, err := ec.mask.SearchOpQuery()
if err != nil {
return err
}
eventQuery := ""
if ec.structuredQuery != nil {
eventQuery = ec.structuredQuery.String()
}
encoded, err := json.Marshal(&graphQLSearchBody{
Query: graphQLQuery,
Variables: &graphQLSearchVariables{
Last: ec.pageSize,
Before: ec.cursor(),
Query: eventQuery,
},
})
if err != nil {
return err
}
req, err := http.NewRequest("POST", ec.url, bytes.NewBuffer(encoded))
if err != nil {
return err
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", ec.authorization)
req.Header.Set("Accept", "application/json")
resp, err := ec.httpClient.Do(req)
if err != nil {
return err
}
defer resp.Body.Close()
if resp.StatusCode != http.StatusOK {
if body, err := ioutil.ReadAll(resp.Body); err == nil {
log.Printf("GraphQL error response: %s", body)
}
return fmt.Errorf("Unexpected response from retraced api endpoint %s: %d", req.URL.String(), resp.StatusCode)
}
root := &graphQLSearchRoot{}
err = json.NewDecoder(resp.Body).Decode(root)
if err != nil {
return err
}
ec.totalCount = root.Data.Search.TotalCount
ec.currentPageNumber = len(ec.cursors)
hits := len(root.Data.Search.Edges)
events := make([]*EventNode, 0, hits)
for i, edge := range root.Data.Search.Edges {
event := edge.Node
if ec.mask.AnyGroup() && event.Group == nil {
event.Group = &Group{}
}
if ec.mask.AnyActor() && event.Actor == nil {
event.Actor = &Actor{}
}
if ec.mask.AnyTarget() && event.Target == nil {
event.Target = &Target{}
}
if ec.mask.AnyDisplay() && event.Display == nil {
event.Display = &Display{}
}
events = append(events, edge.Node)
if root.Data.Search.PageInfo.HasPreviousPage && i == hits-1 {
ec.cursors = append(ec.cursors, edge.Cursor)
}
}
ec.currentResults = events
return nil
}
You can’t perform that action at this time.