Documentation
¶
Index ¶
- Constants
- type PebbleScanner
- func (s *PebbleScanner) AddSignature(sig *detection.Signature) error
- func (s *PebbleScanner) AddSignatures(sigs []*detection.Signature) error
- func (s *PebbleScanner) Close() error
- func (s *PebbleScanner) Compact() error
- func (s *PebbleScanner) CountSignatures() (int, error)
- func (s *PebbleScanner) DeleteSignature(id string) error
- func (s *PebbleScanner) ExportToJSON(jsonPath string) error
- func (s *PebbleScanner) GetMetadata(key string) (string, error)
- func (s *PebbleScanner) GetSignature(id string) (*detection.Signature, error)
- func (s *PebbleScanner) GetSignatureByTopology(topoHash string) (*detection.Signature, error)
- func (s *PebbleScanner) ListSignatureIDs() ([]string, error)
- func (s *PebbleScanner) MarkFalsePositive(id string, notes string) error
- func (s *PebbleScanner) MigrateFromJSON(jsonPath string) (int, error)
- func (s *PebbleScanner) RebuildIndexes() error
- func (s *PebbleScanner) ScanByEntropyRange(minEntropy, maxEntropy float64) ([]detection.Signature, error)
- func (s *PebbleScanner) ScanTopology(topo *topology.FunctionTopology, funcName string) ([]detection.ScanResult, error)
- func (s *PebbleScanner) ScanTopologyExact(topo *topology.FunctionTopology, funcName string) (*detection.ScanResult, error)
- func (s *PebbleScanner) SetMatchThreshold(threshold float64) error
- func (s *PebbleScanner) SetMetadata(key, value string) error
- func (s *PebbleScanner) SetThreshold(threshold float64)deprecated
- func (s *PebbleScanner) Stats() (*PebbleScannerStats, error)
- type PebbleScannerOptions
- type PebbleScannerStats
Constants ¶
const ( // CurrentSchemaVersion enforces database compatibility. A database whose // stored version differs from this constant is rejected: a newer version // cannot be understood, and an older version holds fingerprints produced by // an incompatible algorithm. Increment this whenever the serialization // format (Gob struct shape) OR the fingerprint/canonicalization algorithm // changes, since either makes previously stored signatures unmatchable. CurrentSchemaVersion = 4 )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type PebbleScanner ¶
type PebbleScanner struct {
// contains filtered or unexported fields
}
PebbleScanner is a signature store in a Pebble (LSM-tree) database: signatures keyed by ID, plus topology, fuzzy-hash and entropy indexes.
func NewPebbleScanner ¶
func NewPebbleScanner(dbPath string, opts PebbleScannerOptions) (*PebbleScanner, error)
NewPebbleScanner opens or creates a Pebble backed signature database.
func (*PebbleScanner) AddSignature ¶
func (s *PebbleScanner) AddSignature(sig *detection.Signature) error
AddSignature saves sig and its index entries in one batch, first giving it an ID (SFW-AUTO-<16 hex>) when it has none.
func (*PebbleScanner) AddSignatures ¶
func (s *PebbleScanner) AddSignatures(sigs []*detection.Signature) error
AddSignatures saves sigs and their index entries in one batch, first giving each signature without an ID one. Of several signatures with one ID, the last is saved. Replacing a stored signature removes the index entries its old hashes and entropy left.
func (*PebbleScanner) Close ¶
func (s *PebbleScanner) Close() error
func (*PebbleScanner) Compact ¶
func (s *PebbleScanner) Compact() error
func (*PebbleScanner) CountSignatures ¶
func (s *PebbleScanner) CountSignatures() (int, error)
func (*PebbleScanner) DeleteSignature ¶
func (s *PebbleScanner) DeleteSignature(id string) error
func (*PebbleScanner) ExportToJSON ¶
func (s *PebbleScanner) ExportToJSON(jsonPath string) error
ExportToJSON writes every signature in the JSON backend's format, so the export can be opened with --db <file>.json as well as re-imported with sfw migrate.
func (*PebbleScanner) GetMetadata ¶
func (s *PebbleScanner) GetMetadata(key string) (string, error)
func (*PebbleScanner) GetSignature ¶
func (s *PebbleScanner) GetSignature(id string) (*detection.Signature, error)
func (*PebbleScanner) GetSignatureByTopology ¶
func (s *PebbleScanner) GetSignatureByTopology(topoHash string) (*detection.Signature, error)
GetSignatureByTopology returns the first signature in the topology bucket of topoHash.
func (*PebbleScanner) ListSignatureIDs ¶
func (s *PebbleScanner) ListSignatureIDs() ([]string, error)
func (*PebbleScanner) MarkFalsePositive ¶
func (s *PebbleScanner) MarkFalsePositive(id string, notes string) error
func (*PebbleScanner) MigrateFromJSON ¶
func (s *PebbleScanner) MigrateFromJSON(jsonPath string) (int, error)
MigrateFromJSON streams the signatures array of a JSON signature database into the store in batches of 1000, returning how many it saved.
func (*PebbleScanner) RebuildIndexes ¶
func (s *PebbleScanner) RebuildIndexes() error
RebuildIndexes deletes every index entry and rewrites them from the stored signatures, streaming the signatures and committing every 1000 or rebuildBatchBytes. It does not recompute hashes, and a failure partway leaves the indexes incomplete.
func (*PebbleScanner) ScanByEntropyRange ¶
func (s *PebbleScanner) ScanByEntropyRange(minEntropy, maxEntropy float64) ([]detection.Signature, error)
ScanByEntropyRange returns the signatures whose entropy score is within [minEntropy, maxEntropy], read through the entropy index.
func (*PebbleScanner) ScanTopology ¶
func (s *PebbleScanner) ScanTopology(topo *topology.FunctionTopology, funcName string) ([]detection.ScanResult, error)
ScanTopology returns the signatures in topo's topology and fuzzy-hash buckets that it matches at or above the threshold, most confident first. It reads one snapshot.
func (*PebbleScanner) ScanTopologyExact ¶
func (s *PebbleScanner) ScanTopologyExact(topo *topology.FunctionTopology, funcName string) (*detection.ScanResult, error)
ScanTopologyExact returns the most confident match at or above the threshold among the signatures in topo's topology bucket only, or nil.
func (*PebbleScanner) SetMatchThreshold ¶ added in v7.5.0
func (s *PebbleScanner) SetMatchThreshold(threshold float64) error
SetMatchThreshold sets the minimum confidence a scan reports, 0 included. A value outside [0, 1], or NaN, is refused: NaN fails every comparison and would suppress every alert.
func (*PebbleScanner) SetMetadata ¶
func (s *PebbleScanner) SetMetadata(key, value string) error
func (*PebbleScanner) SetThreshold
deprecated
func (s *PebbleScanner) SetThreshold(threshold float64)
SetThreshold is SetMatchThreshold, except that invalid values are ignored: the previous threshold stays.
Deprecated: Use SetMatchThreshold, which reports an invalid value.
func (*PebbleScanner) Stats ¶
func (s *PebbleScanner) Stats() (*PebbleScannerStats, error)
type PebbleScannerOptions ¶
type PebbleScannerOptions struct {
// MatchThreshold is the minimum confidence a scan reports. 0 means the
// default, 0.75; set a threshold of 0 with SetMatchThreshold.
MatchThreshold float64
EntropyTolerance float64
ReadOnly bool
CacheSize int64
}
PebbleScannerOptions configures the PebbleScanner initialization.
func DefaultPebbleScannerOptions ¶
func DefaultPebbleScannerOptions() PebbleScannerOptions
DefaultPebbleScannerOptions returns sensible defaults for a standard deployment.
Source Files