mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
d5f9fcaeb2
This PR adds support for file integrity monitoring. This is done by providing a simplified API that can be used to PATCH/GET FIM configurations. There is also code to build the FIM configuration to send back to osquery. Each PATCH request, if successful, replaces Fleet's existing FIM configuration. For example: curl -X "PATCH" "https://localhost:8080/api/v1/kolide/fim" \ -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uX2tleSI6IkVhaFhvZWswMGtWSEdaTTNCWndIMnhpYWxkNWZpcVFDR2hEcW1HK2UySmRNOGVFVE1DeTNTaUlFWmhZNUxhdW1ueFZDV2JiR1Bwdm5TKzdyK3NJUzNnPT0ifQ.SDCHAUA1vTuWGjXtcQds2GZLM27HAAiOUhR4WvgvTNY" \ -H "Content-Type: application/json; charset=utf-8" \ -d $'{ "interval": 500, "file_paths": { "etc": [ "/etc/%%" ], "users": [ "/Users/%/Library/%%", "/Users/%/Documents/%%" ], "usr": [ "/usr/bin/%%" ] } }'
33 lines
658 B
Go
33 lines
658 B
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"github.com/kolide/fleet/server/kolide"
|
|
)
|
|
|
|
func (lm loggingMiddleware) GetFIM(ctx context.Context) (cfg *kolide.FIMConfig, err error) {
|
|
defer func(begin time.Time) {
|
|
lm.logger.Log(
|
|
"method", "GetFIM",
|
|
"err", err,
|
|
"took", time.Since(begin),
|
|
)
|
|
}(time.Now())
|
|
cfg, err = lm.Service.GetFIM(ctx)
|
|
return cfg, err
|
|
}
|
|
|
|
func (lm loggingMiddleware) ModifyFIM(ctx context.Context, fim kolide.FIMConfig) (err error) {
|
|
defer func(begin time.Time) {
|
|
lm.logger.Log(
|
|
"method", "ModifyFIM",
|
|
"err", err,
|
|
"took", time.Since(begin),
|
|
)
|
|
}(time.Now())
|
|
err = lm.Service.ModifyFIM(ctx, fim)
|
|
return err
|
|
}
|