mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
471f25e470
This was previously handled correctly within the Fleet server datastores and API endpoints, but not returned to the actual osquery client. Fixes #338
83 lines
3.2 KiB
Go
83 lines
3.2 KiB
Go
package kolide
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
)
|
|
|
|
type OsqueryService interface {
|
|
EnrollAgent(ctx context.Context, enrollSecret, hostIdentifier string, hostDetails map[string](map[string]string)) (nodeKey string, err error)
|
|
AuthenticateHost(ctx context.Context, nodeKey string) (host *Host, err error)
|
|
GetClientConfig(ctx context.Context) (config map[string]interface{}, err error)
|
|
// GetDistributedQueries retrieves the distributed queries to run for
|
|
// the host in the provided context. These may be detail queries, label
|
|
// queries, or user-initiated distributed queries. A map from query
|
|
// name to query is returned. To enable the osquery "accelerated
|
|
// checkins" feature, a positive integer (number of seconds to activate
|
|
// for) should be returned. Returning 0 for this will not activate the
|
|
// feature.
|
|
GetDistributedQueries(ctx context.Context) (queries map[string]string, accelerate uint, err error)
|
|
SubmitDistributedQueryResults(ctx context.Context, results OsqueryDistributedQueryResults, statuses map[string]OsqueryStatus, messages map[string]string) (err error)
|
|
SubmitStatusLogs(ctx context.Context, logs []json.RawMessage) (err error)
|
|
SubmitResultLogs(ctx context.Context, logs []json.RawMessage) (err error)
|
|
//CarveBegin(ctx context.Context)
|
|
}
|
|
|
|
// OsqueryDistributedQueryResults represents the format of the results of an
|
|
// osquery distributed query.
|
|
type OsqueryDistributedQueryResults map[string][]map[string]string
|
|
|
|
// OsqueryStatus represents osquery status codes (0 = success, nonzero =
|
|
// failure)
|
|
type OsqueryStatus int
|
|
|
|
const (
|
|
// StatusOK is the success code returned by osquery
|
|
StatusOK OsqueryStatus = 0
|
|
)
|
|
|
|
// QueryContent is the format of a query stanza in an osquery configuration.
|
|
type QueryContent struct {
|
|
Query string `json:"query"`
|
|
Description string `json:"description,omitempty"`
|
|
Interval uint `json:"interval"`
|
|
Platform *string `json:"platform,omitempty"`
|
|
Version *string `json:"version,omitempty"`
|
|
Snapshot *bool `json:"snapshot,omitempty"`
|
|
Removed *bool `json:"removed,omitempty"`
|
|
Shard *uint `json:"shard,omitempty"`
|
|
Denylist *bool `json:"denylist,omitempty"`
|
|
}
|
|
|
|
type PermissiveQueryContent struct {
|
|
QueryContent
|
|
Interval interface{} `json:"interval"`
|
|
}
|
|
|
|
// Queries is a helper which represents the format of a set of queries in a pack.
|
|
type Queries map[string]QueryContent
|
|
|
|
type PermissiveQueries map[string]PermissiveQueryContent
|
|
|
|
// PackContent is the format of an osquery query pack.
|
|
type PackContent struct {
|
|
Platform string `json:"platform,omitempty"`
|
|
Version string `json:"version,omitempty"`
|
|
Shard uint `json:"shard,omitempty"`
|
|
Discovery []string `json:"discovery,omitempty"`
|
|
Queries Queries `json:"queries"`
|
|
}
|
|
|
|
type PermissivePackContent struct {
|
|
Platform string `json:"platform,omitempty"`
|
|
Version string `json:"version,omitempty"`
|
|
Shard uint `json:"shard,omitempty"`
|
|
Discovery []string `json:"discovery,omitempty"`
|
|
Queries PermissiveQueries `json:"queries"`
|
|
}
|
|
|
|
// Packs is a helper which represents the format of a list of osquery query packs.
|
|
type Packs map[string]PackContent
|
|
|
|
type PermissivePacks map[string]PermissivePackContent
|