Alert inspect improvement / Use correct CSV output when listing in raw format (#1127)
This commit is contained in:
parent
3105897f37
commit
9c8ca5c73a
|
@ -2,6 +2,7 @@ package main
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
|
"encoding/csv"
|
||||||
"encoding/json"
|
"encoding/json"
|
||||||
"fmt"
|
"fmt"
|
||||||
"net/url"
|
"net/url"
|
||||||
|
@ -48,36 +49,38 @@ func DecisionsFromAlert(alert *models.Alert) string {
|
||||||
func AlertsToTable(alerts *models.GetAlertsResponse, printMachine bool) error {
|
func AlertsToTable(alerts *models.GetAlertsResponse, printMachine bool) error {
|
||||||
|
|
||||||
if csConfig.Cscli.Output == "raw" {
|
if csConfig.Cscli.Output == "raw" {
|
||||||
|
csvwriter := csv.NewWriter(os.Stdout)
|
||||||
if printMachine {
|
if printMachine {
|
||||||
fmt.Printf("id,scope,value,reason,country,as,decisions,created_at,machine\n")
|
err := csvwriter.Write([]string{"id", "scope", "value", "reason", "country", "as", "decisions", "created_at", "machine"})
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
} else {
|
} else {
|
||||||
fmt.Printf("id,scope,value,reason,country,as,decisions,created_at\n")
|
err := csvwriter.Write([]string{"id", "scope", "value", "reason", "country", "as", "decisions", "created_at"})
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
}
|
}
|
||||||
for _, alertItem := range *alerts {
|
for _, alertItem := range *alerts {
|
||||||
if printMachine {
|
row := []string{
|
||||||
fmt.Printf("%v,%v,%v,%v,%v,%v,%v,%v,%v\n",
|
fmt.Sprintf("%d", alertItem.ID),
|
||||||
alertItem.ID,
|
*alertItem.Source.Scope,
|
||||||
*alertItem.Source.Scope,
|
*alertItem.Source.Value,
|
||||||
*alertItem.Source.Value,
|
*alertItem.Scenario,
|
||||||
*alertItem.Scenario,
|
alertItem.Source.Cn,
|
||||||
alertItem.Source.Cn,
|
alertItem.Source.AsNumber + " " + alertItem.Source.AsName,
|
||||||
alertItem.Source.AsNumber+" "+alertItem.Source.AsName,
|
DecisionsFromAlert(alertItem),
|
||||||
DecisionsFromAlert(alertItem),
|
*alertItem.StartAt,
|
||||||
*alertItem.StartAt,
|
}
|
||||||
alertItem.MachineID)
|
if printMachine {
|
||||||
} else {
|
row = append(row, alertItem.MachineID)
|
||||||
fmt.Printf("%v,%v,%v,%v,%v,%v,%v,%v\n",
|
}
|
||||||
alertItem.ID,
|
err := csvwriter.Write(row)
|
||||||
*alertItem.Source.Scope,
|
if err != nil {
|
||||||
*alertItem.Source.Value,
|
return err
|
||||||
*alertItem.Scenario,
|
|
||||||
alertItem.Source.Cn,
|
|
||||||
alertItem.Source.AsNumber+" "+alertItem.Source.AsName,
|
|
||||||
DecisionsFromAlert(alertItem),
|
|
||||||
*alertItem.StartAt)
|
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
csvwriter.Flush()
|
||||||
} else if csConfig.Cscli.Output == "json" {
|
} else if csConfig.Cscli.Output == "json" {
|
||||||
x, _ := json.MarshalIndent(alerts, "", " ")
|
x, _ := json.MarshalIndent(alerts, "", " ")
|
||||||
fmt.Printf("%s", string(x))
|
fmt.Printf("%s", string(x))
|
||||||
|
@ -143,7 +146,9 @@ func DisplayOneAlert(alert *models.Alert, withDetail bool) error {
|
||||||
fmt.Printf(" - Events Count : %d\n", *alert.EventsCount)
|
fmt.Printf(" - Events Count : %d\n", *alert.EventsCount)
|
||||||
fmt.Printf(" - Scope:Value: %s\n", scopeAndValue)
|
fmt.Printf(" - Scope:Value: %s\n", scopeAndValue)
|
||||||
fmt.Printf(" - Country : %s\n", alert.Source.Cn)
|
fmt.Printf(" - Country : %s\n", alert.Source.Cn)
|
||||||
fmt.Printf(" - AS : %s\n\n", alert.Source.AsName)
|
fmt.Printf(" - AS : %s\n", alert.Source.AsName)
|
||||||
|
fmt.Printf(" - Begin : %s\n", *alert.StartAt)
|
||||||
|
fmt.Printf(" - End : %s\n\n", *alert.StopAt)
|
||||||
foundActive := false
|
foundActive := false
|
||||||
table := tablewriter.NewWriter(os.Stdout)
|
table := tablewriter.NewWriter(os.Stdout)
|
||||||
table.SetHeader([]string{"ID", "scope:value", "action", "expiration", "created_at"})
|
table.SetHeader([]string{"ID", "scope:value", "action", "expiration", "created_at"})
|
||||||
|
|
|
@ -1,6 +1,7 @@
|
||||||
package main
|
package main
|
||||||
|
|
||||||
import (
|
import (
|
||||||
|
"encoding/csv"
|
||||||
"encoding/json"
|
"encoding/json"
|
||||||
"fmt"
|
"fmt"
|
||||||
"os"
|
"os"
|
||||||
|
@ -82,6 +83,11 @@ Note: This command requires database direct access, so is intended to be run on
|
||||||
}
|
}
|
||||||
fmt.Printf("%s", string(x))
|
fmt.Printf("%s", string(x))
|
||||||
} else if csConfig.Cscli.Output == "raw" {
|
} else if csConfig.Cscli.Output == "raw" {
|
||||||
|
csvwriter := csv.NewWriter(os.Stdout)
|
||||||
|
err := csvwriter.Write([]string{"name", "ip", "revoked", "last_pull", "type", "version"})
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("failed to write raw header: %s", err)
|
||||||
|
}
|
||||||
for _, b := range blockers {
|
for _, b := range blockers {
|
||||||
var revoked string
|
var revoked string
|
||||||
if !b.Revoked {
|
if !b.Revoked {
|
||||||
|
@ -89,8 +95,12 @@ Note: This command requires database direct access, so is intended to be run on
|
||||||
} else {
|
} else {
|
||||||
revoked = "pending"
|
revoked = "pending"
|
||||||
}
|
}
|
||||||
fmt.Printf("%s,%s,%s,%s,%s\n", b.Name, b.IPAddress, revoked, b.LastPull.Format(time.RFC3339), b.Version)
|
err := csvwriter.Write([]string{b.Name, b.IPAddress, revoked, b.LastPull.Format(time.RFC3339), b.Type, b.Version})
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("failed to write raw: %s", err)
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
csvwriter.Flush()
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
|
@ -139,7 +139,7 @@ func NewCollectionsCmd() *cobra.Command {
|
||||||
Args: cobra.ExactArgs(0),
|
Args: cobra.ExactArgs(0),
|
||||||
DisableAutoGenTag: true,
|
DisableAutoGenTag: true,
|
||||||
Run: func(cmd *cobra.Command, args []string) {
|
Run: func(cmd *cobra.Command, args []string) {
|
||||||
ListItem(cwhub.COLLECTIONS, args)
|
ListItem(cwhub.COLLECTIONS, args, false, true)
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
cmdCollectionsList.PersistentFlags().BoolVarP(&all, "all", "a", false, "List as well disabled items")
|
cmdCollectionsList.PersistentFlags().BoolVarP(&all, "all", "a", false, "List as well disabled items")
|
||||||
|
|
|
@ -2,6 +2,7 @@ package main
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
|
"encoding/csv"
|
||||||
"encoding/json"
|
"encoding/json"
|
||||||
"fmt"
|
"fmt"
|
||||||
"net/url"
|
"net/url"
|
||||||
|
@ -52,23 +53,32 @@ func DecisionsToTable(alerts *models.GetAlertsResponse) error {
|
||||||
alertItem.Decisions = newDecisions
|
alertItem.Decisions = newDecisions
|
||||||
}
|
}
|
||||||
if csConfig.Cscli.Output == "raw" {
|
if csConfig.Cscli.Output == "raw" {
|
||||||
fmt.Printf("id,source,ip,reason,action,country,as,events_count,expiration,simulated,alert_id\n")
|
csvwriter := csv.NewWriter(os.Stdout)
|
||||||
|
err := csvwriter.Write([]string{"id", "source", "ip", "reason", "action", "country", "as", "events_count", "expiration", "simulated", "alert_id"})
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
for _, alertItem := range *alerts {
|
for _, alertItem := range *alerts {
|
||||||
for _, decisionItem := range alertItem.Decisions {
|
for _, decisionItem := range alertItem.Decisions {
|
||||||
fmt.Printf("%v,%v,%v,%v,%v,%v,%v,%v,%v,%v,%v\n",
|
err := csvwriter.Write([]string{
|
||||||
decisionItem.ID,
|
fmt.Sprintf("%d", decisionItem.ID),
|
||||||
*decisionItem.Origin,
|
*decisionItem.Origin,
|
||||||
*decisionItem.Scope+":"+*decisionItem.Value,
|
*decisionItem.Scope + ":" + *decisionItem.Value,
|
||||||
*decisionItem.Scenario,
|
*decisionItem.Scenario,
|
||||||
*decisionItem.Type,
|
*decisionItem.Type,
|
||||||
alertItem.Source.Cn,
|
alertItem.Source.Cn,
|
||||||
alertItem.Source.AsNumber+" "+alertItem.Source.AsName,
|
alertItem.Source.AsNumber + " " + alertItem.Source.AsName,
|
||||||
*alertItem.EventsCount,
|
fmt.Sprintf("%d", *alertItem.EventsCount),
|
||||||
*decisionItem.Duration,
|
*decisionItem.Duration,
|
||||||
*decisionItem.Simulated,
|
fmt.Sprintf("%t", *decisionItem.Simulated),
|
||||||
alertItem.ID)
|
fmt.Sprintf("%d", alertItem.ID),
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
csvwriter.Flush()
|
||||||
} else if csConfig.Cscli.Output == "json" {
|
} else if csConfig.Cscli.Output == "json" {
|
||||||
x, _ := json.MarshalIndent(alerts, "", " ")
|
x, _ := json.MarshalIndent(alerts, "", " ")
|
||||||
fmt.Printf("%s", string(x))
|
fmt.Printf("%s", string(x))
|
||||||
|
|
|
@ -57,13 +57,13 @@ cscli hub update # Download list of available configurations from the hub
|
||||||
}
|
}
|
||||||
cwhub.DisplaySummary()
|
cwhub.DisplaySummary()
|
||||||
log.Printf("PARSERS:")
|
log.Printf("PARSERS:")
|
||||||
ListItem(cwhub.PARSERS, args)
|
ListItem(cwhub.PARSERS, args, true, true)
|
||||||
log.Printf("SCENARIOS:")
|
log.Printf("SCENARIOS:")
|
||||||
ListItem(cwhub.SCENARIOS, args)
|
ListItem(cwhub.SCENARIOS, args, true, false)
|
||||||
log.Printf("COLLECTIONS:")
|
log.Printf("COLLECTIONS:")
|
||||||
ListItem(cwhub.COLLECTIONS, args)
|
ListItem(cwhub.COLLECTIONS, args, true, false)
|
||||||
log.Printf("POSTOVERFLOWS:")
|
log.Printf("POSTOVERFLOWS:")
|
||||||
ListItem(cwhub.PARSERS_OVFLW, args)
|
ListItem(cwhub.PARSERS_OVFLW, args, true, false)
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
cmdHubList.PersistentFlags().BoolVarP(&all, "all", "a", false, "List as well disabled items")
|
cmdHubList.PersistentFlags().BoolVarP(&all, "all", "a", false, "List as well disabled items")
|
||||||
|
|
|
@ -2,6 +2,7 @@ package main
|
||||||
|
|
||||||
import (
|
import (
|
||||||
saferand "crypto/rand"
|
saferand "crypto/rand"
|
||||||
|
"encoding/csv"
|
||||||
"encoding/json"
|
"encoding/json"
|
||||||
"fmt"
|
"fmt"
|
||||||
"io/ioutil"
|
"io/ioutil"
|
||||||
|
@ -144,7 +145,11 @@ Note: This command requires database direct access, so is intended to be run on
|
||||||
}
|
}
|
||||||
fmt.Printf("%s", string(x))
|
fmt.Printf("%s", string(x))
|
||||||
} else if csConfig.Cscli.Output == "raw" {
|
} else if csConfig.Cscli.Output == "raw" {
|
||||||
fmt.Printf("machine_id,ip_address,updated_at,validated,version\n")
|
csvwriter := csv.NewWriter(os.Stdout)
|
||||||
|
err := csvwriter.Write([]string{"machine_id", "ip_address", "updated_at", "validated", "version"})
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("failed to write header: %s", err)
|
||||||
|
}
|
||||||
for _, w := range machines {
|
for _, w := range machines {
|
||||||
var validated string
|
var validated string
|
||||||
if w.IsValidated {
|
if w.IsValidated {
|
||||||
|
@ -152,8 +157,12 @@ Note: This command requires database direct access, so is intended to be run on
|
||||||
} else {
|
} else {
|
||||||
validated = "false"
|
validated = "false"
|
||||||
}
|
}
|
||||||
fmt.Printf("%s,%s,%s,%s,%s\n", w.MachineId, w.IpAddress, w.UpdatedAt.Format(time.RFC3339), validated, w.Version)
|
err := csvwriter.Write([]string{w.MachineId, w.IpAddress, w.UpdatedAt.Format(time.RFC3339), validated, w.Version})
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("failed to write raw output : %s", err)
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
csvwriter.Flush()
|
||||||
} else {
|
} else {
|
||||||
log.Errorf("unknown output '%s'", csConfig.Cscli.Output)
|
log.Errorf("unknown output '%s'", csConfig.Cscli.Output)
|
||||||
}
|
}
|
||||||
|
|
|
@ -132,7 +132,7 @@ cscli parsers remove crowdsecurity/sshd-logs
|
||||||
cscli parser list crowdsecurity/xxx`,
|
cscli parser list crowdsecurity/xxx`,
|
||||||
DisableAutoGenTag: true,
|
DisableAutoGenTag: true,
|
||||||
Run: func(cmd *cobra.Command, args []string) {
|
Run: func(cmd *cobra.Command, args []string) {
|
||||||
ListItem(cwhub.PARSERS, args)
|
ListItem(cwhub.PARSERS, args, false, true)
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
cmdParsersList.PersistentFlags().BoolVarP(&all, "all", "a", false, "List as well disabled items")
|
cmdParsersList.PersistentFlags().BoolVarP(&all, "all", "a", false, "List as well disabled items")
|
||||||
|
|
|
@ -130,7 +130,7 @@ func NewPostOverflowsCmd() *cobra.Command {
|
||||||
cscli postoverflows list crowdsecurity/xxx`,
|
cscli postoverflows list crowdsecurity/xxx`,
|
||||||
DisableAutoGenTag: true,
|
DisableAutoGenTag: true,
|
||||||
Run: func(cmd *cobra.Command, args []string) {
|
Run: func(cmd *cobra.Command, args []string) {
|
||||||
ListItem(cwhub.PARSERS_OVFLW, args)
|
ListItem(cwhub.PARSERS_OVFLW, args, false, true)
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
cmdPostOverflowsList.PersistentFlags().BoolVarP(&all, "all", "a", false, "List as well disabled items")
|
cmdPostOverflowsList.PersistentFlags().BoolVarP(&all, "all", "a", false, "List as well disabled items")
|
||||||
|
|
|
@ -132,7 +132,7 @@ cscli scenarios remove crowdsecurity/ssh-bf
|
||||||
cscli scenarios list crowdsecurity/xxx`,
|
cscli scenarios list crowdsecurity/xxx`,
|
||||||
DisableAutoGenTag: true,
|
DisableAutoGenTag: true,
|
||||||
Run: func(cmd *cobra.Command, args []string) {
|
Run: func(cmd *cobra.Command, args []string) {
|
||||||
ListItem(cwhub.SCENARIOS, args)
|
ListItem(cwhub.SCENARIOS, args, false, true)
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
cmdScenariosList.PersistentFlags().BoolVarP(&all, "all", "a", false, "List as well disabled items")
|
cmdScenariosList.PersistentFlags().BoolVarP(&all, "all", "a", false, "List as well disabled items")
|
||||||
|
|
|
@ -1,6 +1,7 @@
|
||||||
package main
|
package main
|
||||||
|
|
||||||
import (
|
import (
|
||||||
|
"encoding/csv"
|
||||||
"encoding/json"
|
"encoding/json"
|
||||||
"fmt"
|
"fmt"
|
||||||
"io/ioutil"
|
"io/ioutil"
|
||||||
|
@ -101,7 +102,7 @@ func setHubBranch() error {
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func ListItem(itemType string, args []string) {
|
func ListItem(itemType string, args []string, showType bool, showHeader bool) {
|
||||||
|
|
||||||
var hubStatus []map[string]string
|
var hubStatus []map[string]string
|
||||||
|
|
||||||
|
@ -131,13 +132,40 @@ func ListItem(itemType string, args []string) {
|
||||||
}
|
}
|
||||||
fmt.Printf("%s", string(x))
|
fmt.Printf("%s", string(x))
|
||||||
} else if csConfig.Cscli.Output == "raw" {
|
} else if csConfig.Cscli.Output == "raw" {
|
||||||
fmt.Printf("name,status,version,description\n")
|
csvwriter := csv.NewWriter(os.Stdout)
|
||||||
|
if showHeader {
|
||||||
|
if showType {
|
||||||
|
err := csvwriter.Write([]string{"name", "status", "version", "description", "type"})
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("failed to write header: %s", err)
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
err := csvwriter.Write([]string{"name", "status", "version", "description"})
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("failed to write header: %s", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
for _, v := range hubStatus {
|
for _, v := range hubStatus {
|
||||||
if v["local_version"] == "" {
|
if v["local_version"] == "" {
|
||||||
v["local_version"] = "n/a"
|
v["local_version"] = "n/a"
|
||||||
}
|
}
|
||||||
fmt.Printf("%s,%s,%s,%s\n", v["name"], v["status"], v["local_version"], v["description"])
|
row := []string{
|
||||||
|
v["name"],
|
||||||
|
v["status"],
|
||||||
|
v["local_version"],
|
||||||
|
v["description"],
|
||||||
|
}
|
||||||
|
if showType {
|
||||||
|
row = append(row, itemType)
|
||||||
|
}
|
||||||
|
err := csvwriter.Write(row)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("failed to write raw output : %s", err)
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
csvwriter.Flush()
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue