Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable loading of concepts from disk #1102

Merged
merged 12 commits into from Oct 22, 2020
Merged

Enable loading of concepts from disk #1102

merged 12 commits into from Oct 22, 2020

Conversation

tobim
Copy link
Member

@tobim tobim commented Oct 20, 2020

TODO:

  • Integration Test
  • Changelog entry

@tobim tobim added the feature New functionality label Oct 20, 2020
@tobim tobim requested a review from mavam October 20, 2020 21:18
@tobim tobim marked this pull request as ready for review October 20, 2020 21:19
Copy link
Member

@mavam mavam left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work overall.

It would be great if we can test an ill-formed concept definition as well.

schema/ecs.yaml Show resolved Hide resolved
libvast/vast/schema.hpp Outdated Show resolved Hide resolved
libvast/src/taxonomies.cpp Outdated Show resolved Hide resolved
libvast/src/system/type_registry.cpp Outdated Show resolved Hide resolved
libvast/src/system/type_registry.cpp Outdated Show resolved Hide resolved
libvast/src/system/type_registry.cpp Outdated Show resolved Hide resolved
libvast/src/system/type_registry.cpp Outdated Show resolved Hide resolved
libvast/src/system/spawn_type_registry.cpp Outdated Show resolved Hide resolved
libvast/src/schema.cpp Outdated Show resolved Hide resolved
libvast/src/schema.cpp Outdated Show resolved Hide resolved
@tobim tobim force-pushed the tdhtf/ch1682/load-concepts branch 5 times, most recently from 1decade to fe174ca Compare October 22, 2020 08:27
// Local commands need access to the node actor.
// This is a side-channel to communicate the self pointer into the spawn- and
// send-command functions, whose interfaces are constrained by the command
// factory.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you see a way to get rid of this wart at some point in the future?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In retrospect, the invocation based interface to the node turned out as less elegant that we'd hoped. I would like to replace it with something more type-safe at some point, but that will require one or two design sessions first.

CHANGELOG.md Outdated Show resolved Hide resolved
@mavam
Copy link
Member

mavam commented Oct 22, 2020

I tested the feature with a custom URL concept that pulls data from Zeek and Suricata logs:

- concept:
    name: url
    fields:
      - zeek.http.uri
      - suricata.http.http.url

Nice work! Just cosmetic stuff to be fixed.

@tobim tobim merged commit 8a02bd6 into master Oct 22, 2020
@tobim tobim deleted the tdhtf/ch1682/load-concepts branch October 22, 2020 15:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New functionality
Projects
None yet
2 participants