mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
d5f9fcaeb2
This PR adds support for file integrity monitoring. This is done by providing a simplified API that can be used to PATCH/GET FIM configurations. There is also code to build the FIM configuration to send back to osquery. Each PATCH request, if successful, replaces Fleet's existing FIM configuration. For example: curl -X "PATCH" "https://localhost:8080/api/v1/kolide/fim" \ -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uX2tleSI6IkVhaFhvZWswMGtWSEdaTTNCWndIMnhpYWxkNWZpcVFDR2hEcW1HK2UySmRNOGVFVE1DeTNTaUlFWmhZNUxhdW1ueFZDV2JiR1Bwdm5TKzdyK3NJUzNnPT0ifQ.SDCHAUA1vTuWGjXtcQds2GZLM27HAAiOUhR4WvgvTNY" \ -H "Content-Type: application/json; charset=utf-8" \ -d $'{ "interval": 500, "file_paths": { "etc": [ "/etc/%%" ], "users": [ "/Users/%/Library/%%", "/Users/%/Documents/%%" ], "usr": [ "/usr/bin/%%" ] } }'
30 lines
845 B
Go
30 lines
845 B
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/kolide/fleet/server/kolide"
|
|
)
|
|
|
|
func (mw metricsMiddleware) GetFIM(ctx context.Context) (cfg *kolide.FIMConfig, err error) {
|
|
defer func(begin time.Time) {
|
|
lvs := []string{"method", "GetFIM", "error", fmt.Sprint(err != nil)}
|
|
mw.requestCount.With(lvs...).Add(1)
|
|
mw.requestLatency.With(lvs...).Observe(time.Since(begin).Seconds())
|
|
}(time.Now())
|
|
cfg, err = mw.Service.GetFIM(ctx)
|
|
return cfg, err
|
|
}
|
|
|
|
func (mw metricsMiddleware) ModifyFIM(ctx context.Context, fim kolide.FIMConfig) (err error) {
|
|
defer func(begin time.Time) {
|
|
lvs := []string{"method", "ModifyFIM", "error", fmt.Sprint(err != nil)}
|
|
mw.requestCount.With(lvs...).Add(1)
|
|
mw.requestLatency.With(lvs...).Observe(time.Since(begin).Seconds())
|
|
}(time.Now())
|
|
err = mw.Service.ModifyFIM(ctx, fim)
|
|
return err
|
|
}
|