Documentation
¶
Index ¶
- func ApplyFiltersToQuery(query map[string]interface{}, permFilters map[string]interface{}) (map[string]interface{}, bool, error)
- func GetDefaultPermissions() ([]byte, error)
- func MergeFilters(userQuery map[string]interface{}, permissionFilters map[string]interface{}) (map[string]interface{}, bool)
- func Validate(config *Config) error
- type AutomationPermissions
- type Config
- func (c *Config) GetAllowedAnalyzers(allAnalyzers []string) []string
- func (c *Config) GetAllowedResponders(allResponders []string) []string
- func (c *Config) GetToolFilters(toolName string) map[string]interface{}
- func (c *Config) IsAnalyzerAllowed(analyzerName string) bool
- func (c *Config) IsEntityOperationAllowed(entityType, operation string) bool
- func (c *Config) IsResponderAllowed(responderName string) bool
- func (c *Config) IsToolAllowed(toolName string) bool
- type EntityOperation
- type PermissionInfo
- type PermissionsSection
- type ToolPermission
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ApplyFiltersToQuery ¶
func ApplyFiltersToQuery(query map[string]interface{}, permFilters map[string]interface{}) (map[string]interface{}, bool, error)
ApplyFiltersToQuery applies permission filters to a TheHive query This is used by search and manage tools to ensure queries respect permissions
func GetDefaultPermissions ¶
GetDefaultPermissions returns the embedded default read-only permissions
func MergeFilters ¶
func MergeFilters(userQuery map[string]interface{}, permissionFilters map[string]interface{}) (map[string]interface{}, bool)
MergeFilters combines permission filters with user-provided query filters Returns the merged filter and a boolean indicating if permission filters were applied
Types ¶
type AutomationPermissions ¶
type AutomationPermissions struct {
Mode string `yaml:"mode"` // "allow_list" or "block_list"
Allowed []string `yaml:"allowed"`
Blocked []string `yaml:"blocked"`
}
AutomationPermissions defines analyzer or responder access
type Config ¶
type Config struct {
Version string `yaml:"version"`
Permissions PermissionsSection `yaml:"permissions"`
}
Config represents the complete permissions configuration
func LoadAdminForTesting ¶
func LoadAdminForTesting() *Config
LoadAdminForTesting returns an admin permissions configuration for testing purposes
func LoadDefault ¶
LoadDefault loads the embedded default read-only permissions
func LoadFromFile ¶
LoadFromFile loads and parses a permissions configuration from a file
func (*Config) GetAllowedAnalyzers ¶
GetAllowedAnalyzers returns list of allowed analyzer names
func (*Config) GetAllowedResponders ¶
GetAllowedResponders returns list of allowed responder names
func (*Config) GetToolFilters ¶
GetToolFilters returns the filters for a specific tool
func (*Config) IsAnalyzerAllowed ¶
IsAnalyzerAllowed checks if an analyzer is permitted based on global rules
func (*Config) IsEntityOperationAllowed ¶
IsEntityOperationAllowed checks if a specific operation on an entity type is permitted If no entity-specific permissions are configured, defaults to the tool's general allowed setting
func (*Config) IsResponderAllowed ¶
IsResponderAllowed checks if a responder is permitted based on global rules
func (*Config) IsToolAllowed ¶
IsToolAllowed checks if a tool is permitted
type EntityOperation ¶
type EntityOperation struct {
Create bool `yaml:"create"`
Update bool `yaml:"update"`
Delete bool `yaml:"delete"`
Comment bool `yaml:"comment"`
}
EntityOperation defines which operations are allowed for an entity type
type PermissionInfo ¶
type PermissionInfo struct {
Applied bool `json:"applied"`
FilterApplied bool `json:"filter_applied,omitempty"`
Message string `json:"message,omitempty"`
Restrictions []string `json:"restrictions,omitempty"`
}
PermissionInfo describes how permissions affected a response
func NewPermissionInfo ¶
func NewPermissionInfo() PermissionInfo
NewPermissionInfo creates a PermissionInfo with applied=false
func NewPermissionInfoDenied ¶
func NewPermissionInfoDenied(message string) PermissionInfo
NewPermissionInfoDenied creates a PermissionInfo for a denied operation
func NewPermissionInfoFiltered ¶
func NewPermissionInfoFiltered(message string) PermissionInfo
NewPermissionInfoFiltered creates a PermissionInfo for a filtered operation
func NewPermissionInfoRestricted ¶
func NewPermissionInfoRestricted(restrictions []string) PermissionInfo
NewPermissionInfoRestricted creates a PermissionInfo with restrictions list
type PermissionsSection ¶
type PermissionsSection struct {
Tools map[string]ToolPermission `yaml:"tools"`
Analyzers AutomationPermissions `yaml:"analyzers"`
Responders AutomationPermissions `yaml:"responders"`
}
PermissionsSection contains all permission categories
type ToolPermission ¶
type ToolPermission struct {
Allowed bool `yaml:"allowed"`
Filters map[string]interface{} `yaml:"filters,omitempty"`
EntityPermissions map[string]EntityOperation `yaml:"entity_permissions,omitempty"` // For manage-entities tool
}
ToolPermission defines access and filtering for a specific tool
Source Files