4f29ce2ee7
* Add CTI API helpers in expr * Allow profiles to have an `on_error` option to profiles Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
28 lines
551 B
Go
28 lines
551 B
Go
package csplugin
|
|
|
|
import (
|
|
"text/template"
|
|
|
|
"github.com/crowdsecurity/crowdsec/pkg/exprhelpers"
|
|
"github.com/crowdsecurity/crowdsec/pkg/models"
|
|
)
|
|
|
|
var helpers = template.FuncMap{
|
|
"GetMeta": func(a *models.Alert, metaName string) []string {
|
|
var metaValues []string
|
|
for _, evt := range a.Events {
|
|
for _, meta := range evt.Meta {
|
|
if meta.Key == metaName {
|
|
metaValues = append(metaValues, meta.Value)
|
|
}
|
|
}
|
|
}
|
|
return metaValues
|
|
},
|
|
"CrowdsecCTI": exprhelpers.CrowdsecCTI,
|
|
}
|
|
|
|
func funcMap() template.FuncMap {
|
|
return helpers
|
|
}
|