Documentation
¶
Index ¶
- Constants
- Variables
- func GenB32ID() string
- func GenID() float64
- func ProcessLog(logctx Logging, l Log) (stop bool, err error)
- type ACL
- type Action
- func (a Action) IndentedString() (string, error)
- func (a Action) PrintCounters()
- func (a Action) Sign(keyid string, secring io.Reader) (sig string, err error)
- func (a Action) String() (str string, err error)
- func (a Action) ToTempFile() (filename string, err error)
- func (a Action) Validate() (err error)
- func (a Action) VerifyACL(acl ACL, keyring io.Reader) (err error)
- func (a Action) VerifySignatures(keyring io.Reader) (err error)
- type ActionCounters
- type Agent
- type AgentEnv
- type AgentEnvAWS
- type AgentsStats
- type AgentsVersionsSum
- type Command
- type Description
- type Investigator
- type Log
- type Logging
- type Operation
- type Permission
- type RunnerResult
- type Threat
Constants ¶
const ( AgtStatusOnline string = "online" AgtStatusUpgraded string = "upgraded" AgtStatusDestroyed string = "destroyed" AgtStatusOffline string = "offline" AgtStatusIdle string = "idle" )
const ( StatusSent string = "sent" StatusSuccess string = "success" StatusCancelled string = "cancelled" StatusExpired string = "expired" StatusFailed string = "failed" StatusTimeout string = "timeout" )
const ( // rabbitmq exchanges and common queues Mq_Ex_ToAgents = "toagents" Mq_Ex_ToSchedulers = "toschedulers" Mq_Ex_ToWorkers = "toworkers" Mq_Q_Heartbeat = "mig.agt.heartbeats" Mq_Q_Results = "mig.agt.results" // event queues Ev_Q_Agt_Auth_Fail = "agent.authentication.failure" Ev_Q_Agt_New = "agent.new" Ev_Q_Cmd_Res = "command.results" // dummy queue for scheduler heartbeats to the relays Ev_Q_Sched_Hb = "scheduler.heartbeat" )
const ( StatusActiveInvestigator string = "active" StatusDisabledInvestigator string = "disabled" )
const ( MODE_STDOUT = 1 << iota MODE_FILE MODE_SYSLOG )
const ActionVersion uint16 = 2
ActionVersion is the version of the syntax that is expected
Variables ¶
var Version string = "20160114-0.bde41c6"
Functions ¶
func GenID ¶
func GenID() float64
GenID() returns a float64 ID number that is unique to this process. The ID is initialized at the number of seconds since MIG's creation date, shifted 16 bits to the right and incremented by one every time a new ID is requested. The resulting value must fit in 53 bits of precision provided by the float64 type.
Types ¶
type ACL ¶
type ACL []Permission
type Action ¶
type Action struct {
ID float64 `json:"id"`
Name string `json:"name"`
Target string `json:"target"`
Description Description `json:"description,omitempty"`
Threat Threat `json:"threat,omitempty"`
ValidFrom time.Time `json:"validfrom"`
ExpireAfter time.Time `json:"expireafter"`
Operations []Operation `json:"operations"`
PGPSignatures []string `json:"pgpsignatures"`
Investigators []Investigator `json:"investigators,omitempty"`
Status string `json:"status,omitempty"`
StartTime time.Time `json:"starttime,omitempty"`
FinishTime time.Time `json:"finishtime,omitempty"`
LastUpdateTime time.Time `json:"lastupdatetime,omitempty"`
Counters ActionCounters `json:"counters,omitempty"`
SyntaxVersion uint16 `json:"syntaxversion,omitempty"`
}
an Action is the json object that is created by an investigator and provided to the MIG platform. It must be PGP signed.
func ActionFromFile ¶
ActionFromFile() reads an action from a local file on the file system and returns a mig.Action structure
func (Action) IndentedString ¶
Return the an indented JSON string representing the action suitable for display
func (Action) PrintCounters ¶
func (a Action) PrintCounters()
PrintCounters prints the counters of an action to stderr
func (Action) Sign ¶
Sign computes and returns the GPG signature of a MIG action in its stringified form
func (Action) ToTempFile ¶
ToTempFile writes an action into a generated temporary file and returns its filename
func (Action) Validate ¶
Validate verifies that the Action received contained all the necessary fields, and returns an error when it doesn't.
func (Action) VerifyACL ¶
VerifyACL controls that an action has been issued by investigators that have the right permissions. This function looks at each operation listed in the action, and find the corresponding permission. If no permission is found, the default one `default` is used. The first permission that is found to apply to an operation, but doesn't allow the operation to run, will fail the verification globally
type ActionCounters ¶
type ActionCounters struct {
Sent int `json:"sent,omitempty"`
Done int `json:"done,omitempty"`
InFlight int `json:"inflight,omitempty"`
Success int `json:"success,omitempty"`
Cancelled int `json:"cancelled,omitempty"`
Expired int `json:"expired,omitempty"`
Failed int `json:"failed,omitempty"`
TimeOut int `json:"timeout,omitempty"`
}
Some counters used to track the completion of an action
type Agent ¶
type Agent struct {
ID float64 `json:"id,omitempty"`
Name string `json:"name"`
QueueLoc string `json:"queueloc"`
Mode string `json:"mode"`
Version string `json:"version,omitempty"`
PID int `json:"pid,omitempty"`
StartTime time.Time `json:"starttime,omitempty"`
DestructionTime time.Time `json:"destructiontime,omitempty"`
HeartBeatTS time.Time `json:"heartbeatts,omitempty"`
Status string `json:"status,omitempty"`
Authorized bool `json:"authorized,omitempty"`
Env AgentEnv `json:"environment,omitempty"`
Tags interface{} `json:"tags,omitempty"`
}
Agent stores the description of an agent and serves as a canvas for heartbeat messages
type AgentEnv ¶
type AgentEnv struct {
Init string `json:"init,omitempty"`
Ident string `json:"ident,omitempty"`
OS string `json:"os,omitempty"`
Arch string `json:"arch,omitempty"`
IsProxied bool `json:"isproxied"`
Proxy string `json:"proxy,omitempty"`
Addresses []string `json:"addresses,omitempty"`
PublicIP string `json:"publicip,omitempty"`
AWS AgentEnvAWS `json:"aws,omitempty"`
}
AgentEnv stores basic information of the endpoint
type AgentEnvAWS ¶
type AgentEnvAWS struct {
InstanceID string `json:"instanceid,omitempty"`
LocalIPV4 string `json:"localipv4,omitempty"`
AMIID string `json:"amiid,omitempty"`
InstanceType string `json:"instancetype,omitempty"`
}
Stores AWS specific agent environment values
type AgentsStats ¶
type AgentsStats struct {
Timestamp time.Time `json:"timestamp"`
OnlineAgents float64 `json:"onlineagents"`
OnlineAgentsByVersion []AgentsVersionsSum `json:"onlineagentsbyversion"`
OnlineEndpoints float64 `json:"onlineendpoints"`
IdleAgents float64 `json:"idleagents"`
IdleAgentsByVersion []AgentsVersionsSum `json:"idleagentsbyversion"`
IdleEndpoints float64 `json:"idleendpoints"`
NewEndpoints float64 `json:"newendpoints"`
MultiAgentsEndpoints float64 `json:"multiagentsendpoints"`
DisappearedEndpoints float64 `json:"disappearedendpoints"`
FlappingEndpoints float64 `json:"flappingendpoints"`
}
type AgentsVersionsSum ¶
type Command ¶
type Command struct {
ID float64 `json:"id"`
Action Action `json:"action"`
Agent Agent `json:"agent"`
// Status can be one of:
// sent: the command has been sent by the scheduler to the agent
// success: the command has successfully ran on the agent and been returned to the scheduler
// cancelled: the command has been cancelled by the investigator
// expired: the command has been expired by the scheduler
// failed: the command has failed on the agent and been returned to the scheduler
// timeout: module execution has timed out, and the agent returned the command to the scheduler
Status string `json:"status"`
Results []modules.Result `json:"results"`
StartTime time.Time `json:"starttime"`
FinishTime time.Time `json:"finishtime"`
}
func CmdFromFile ¶
FromFile reads a command from a local file on the file system and return the mig.Command structure
type Description ¶
type Description struct {
Author string `json:"author,omitempty"`
Email string `json:"email,omitempty"`
URL string `json:"url,omitempty"`
Revision float64 `json:"revision,omitempty"`
}
a description is a simple object that contains detail about the action's author, and it's revision.
type Investigator ¶
type Investigator struct {
ID float64 `json:"id,omitempty"`
Name string `json:"name"`
PGPFingerprint string `json:"pgpfingerprint"`
PublicKey []byte `json:"publickey,omitempty"`
PrivateKey []byte `json:"privatekey,omitempty"`
Status string `json:"status"`
CreatedAt time.Time `json:"createdat"`
LastModified time.Time `json:"lastmodified"`
}
type Logging ¶
type Logging struct {
// configuration
Mode, Level, File, Host, Protocol, Facility string
Port int
// contains filtered or unexported fields
}
Logging stores the attributes needed to perform the logging
func InitLogger ¶
InitLogger prepares the context for logging based on the configuration in Logging
type Operation ¶
type Operation struct {
Module string `json:"module"`
Parameters interface{} `json:"parameters"`
// If WantCompressed is set in the operation, the parameters
// will be compressed in PostAction() when the client sends the
// action to the API. This will also result in IsCompressed being
// marked as true, so the receiving agent knows it must decompress
// the parameter data.
IsCompressed bool `json:"is_compressed,omitempty"`
WantCompressed bool `json:"want_compressed,omitempty"`
}
an operation is an object that maps to an agent module. the parameters of the operation are passed to the module as an argument, and thus their format depends on the module itself.
func (*Operation) CompressOperationParam ¶
Compress the parameters stored within an operation
func (*Operation) DecompressOperationParam ¶
Decompress the parameters stored within an operation
type Permission ¶
type RunnerResult ¶
type RunnerResult struct {
Action Action `json:"action"`
Commands []Command `json:"commands"`
EntityName string `json:"name"`
UsePlugin string `json:"plugin"`
}
Describes results that are produced by mig-runner
type Threat ¶
type Threat struct {
Ref string `json:"ref,omitempty"`
Level string `json:"level,omitempty"`
Family string `json:"family,omitempty"`
Type string `json:"type,omitempty"`
}
a threat provides the investigator with an idea of how dangerous a the compromission might be, if the indicators return positive
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
mig
command
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
mig-action-generator
command
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
mig-action-verifier
command
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
mig-agent-search
command
|
|
|
mig-console
command
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
This package implements interfaces to write modules for MIG.
|
This package implements interfaces to write modules for MIG. |
|
example
This is an example module.
|
This is an example module. |
|
file
The file module provides functions to scan a file system.
|
The file module provides functions to scan a file system. |
|
netstat
netstat is a module that retrieves network information about the endpoint, such as mac addresses, local and connected IPs, listening TCP and UDP sockets and peers
|
netstat is a module that retrieves network information about the endpoint, such as mac addresses, local and connected IPs, listening TCP and UDP sockets and peers |
|
scribe
scribe module implementation for MIG.
|
scribe module implementation for MIG. |
|
upgrade
The upgrade module is used to download and install a new version of the mig-agent.
|
The upgrade module is used to download and install a new version of the mig-agent. |
|
The PGP package is a helper around Golang's OpenPGP implementation
|
The PGP package is a helper around Golang's OpenPGP implementation |
|
gpgagent
Package gpgagent interacts with the local GPG Agent.
|
Package gpgagent interacts with the local GPG Agent. |
|
pinentry
Package pinentry interfaces with the pinentry(1) command to securely prompt the user for a password using whichever user interface the user is currently using.
|
Package pinentry interfaces with the pinentry(1) command to securely prompt the user for a password using whichever user interface the user is currently using. |
|
runner-plugins
|
|
|
runner-compliance
command
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
runner-scribe
command
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
mig-worker-agent-intel
command
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |
|
mig-worker-agent-verif
command
This Source Code Form is subject to the terms of the Mozilla Public License, v.
|
This Source Code Form is subject to the terms of the Mozilla Public License, v. |



