mirror of
https://github.com/empayre/fleet.git
synced 2024-11-08 09:43:51 +00:00
d5f9fcaeb2
This PR adds support for file integrity monitoring. This is done by providing a simplified API that can be used to PATCH/GET FIM configurations. There is also code to build the FIM configuration to send back to osquery. Each PATCH request, if successful, replaces Fleet's existing FIM configuration. For example: curl -X "PATCH" "https://localhost:8080/api/v1/kolide/fim" \ -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uX2tleSI6IkVhaFhvZWswMGtWSEdaTTNCWndIMnhpYWxkNWZpcVFDR2hEcW1HK2UySmRNOGVFVE1DeTNTaUlFWmhZNUxhdW1ueFZDV2JiR1Bwdm5TKzdyK3NJUzNnPT0ifQ.SDCHAUA1vTuWGjXtcQds2GZLM27HAAiOUhR4WvgvTNY" \ -H "Content-Type: application/json; charset=utf-8" \ -d $'{ "interval": 500, "file_paths": { "etc": [ "/etc/%%" ], "users": [ "/Users/%/Library/%%", "/Users/%/Documents/%%" ], "usr": [ "/usr/bin/%%" ] } }'
28 lines
661 B
Go
28 lines
661 B
Go
package inmem
|
|
|
|
import (
|
|
"github.com/kolide/fleet/server/kolide"
|
|
)
|
|
|
|
func (d *Datastore) NewFIMSection(fp *kolide.FIMSection, opts ...kolide.OptionalArg) (*kolide.FIMSection, error) {
|
|
d.mtx.Lock()
|
|
defer d.mtx.Unlock()
|
|
fp.ID = d.nextID(fp)
|
|
d.filePaths[fp.ID] = fp
|
|
return fp, nil
|
|
}
|
|
|
|
func (d *Datastore) FIMSections() (kolide.FIMSections, error) {
|
|
d.mtx.Lock()
|
|
defer d.mtx.Unlock()
|
|
result := make(kolide.FIMSections)
|
|
for _, filePath := range d.filePaths {
|
|
result[filePath.SectionName] = append(result[filePath.SectionName], filePath.Paths...)
|
|
}
|
|
return result, nil
|
|
}
|
|
|
|
func (d *Datastore) ClearFIMSections() error {
|
|
panic("inmem is being deprecated")
|
|
}
|