viewer

package

v5.1.2 Latest Latest Go to latest Published: Apr 2, 2026 License: GPL-3.0 Imports: 27 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/activecm/rita

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func BuildResultsQuery(filter *Filter, currentPage, pageSize int, minTimestamp time.Time) (string, clickhouse.Parameters, bool)
func CreateUI(_ *config.Config, db *database.DB, useCurrentTime bool, maxTimestamp time.Time, ...) error
func FormatToCSV(items []list.Item, relativeTimestamp time.Time) (string, error)
func GetCSVOutput(db *database.DB, minTimestamp, relativeTimestamp time.Time, search string, ...) (string, error)
func GetResults(db *database.DB, filter *Filter, currentPage, pageSize int, ...) ([]list.Item, bool, error)
func MakeList(items []list.Item, columns []column, width int, height int) listModel
func NewFooterModel(dbName string) footerModel
func NewSearchModel(initialValue string, width int) searchModel
func NewSidebarModel(maxTS time.Time, useCurrentTime bool, initialData *Item) sidebarModel
func Truncate(str string, style *lipgloss.Style) string
type Filter
- func ParseSearchInput(input string) (*Filter, string)
type FinishedLoadingResults
type FooterFlash
type Item
- func (i Item) FilterValue() string
- func (i *Item) GetBeacon() string
- func (i *Item) GetDst() string
- func (i *Item) GetFirstSeen(relativeTimestamp time.Time) string
- func (i *Item) GetPortProtoService() []string
- func (i *Item) GetPrevalence() string
- func (i *Item) GetSeverity(color bool) string
- func (i *Item) GetSrc() string
- func (i *Item) GetSubdomains() string
- func (i *Item) GetThreatIntel() string
- func (i *Item) GetTotalDuration() string
type MixtapeResult
type Model
- func NewModel(maxTimestamp, minTimestamp time.Time, useCurrentTime bool, db *database.DB) (*Model, error)
- func (m *Model) Init() tea.Cmd
- func (m *Model) Update(msg tea.Msg) (tea.Model, tea.Cmd)
- func (m *Model) View() string
type OperatorFilter
type StillLoadingResults
type UpdateItem

Constants ¶

This section is empty.

Variables ¶

View Source

var DebugMode bool // set true by rita if debug flag is passed in

Functions ¶

func BuildResultsQuery ¶

func BuildResultsQuery(filter *Filter, currentPage, pageSize int, minTimestamp time.Time) (string, clickhouse.Parameters, bool)

BuildResultsQuery builds a query for fetching mixtape results based on the filter and pagination parameters

func CreateUI ¶

func CreateUI(_ *config.Config, db *database.DB, useCurrentTime bool, maxTimestamp time.Time, minTimestamp time.Time) error

CreateUI creates the terminal UI

func FormatToCSV ¶

func FormatToCSV(items []list.Item, relativeTimestamp time.Time) (string, error)

func GetCSVOutput ¶

func GetCSVOutput(db *database.DB, minTimestamp, relativeTimestamp time.Time, search string, limit int) (string, error)

can pass in filter here so that users can pass in a search as a cmdline flag func GetCSVOutput(items []list.Item, relativeTimestamp time.Time) string {

func GetResults ¶

func GetResults(db *database.DB, filter *Filter, currentPage, pageSize int, minTimestamp time.Time) ([]list.Item, bool, error)

GetResults queries the database for mixtape results based on the filter and pagination parameters

func MakeList ¶

func MakeList(items []list.Item, columns []column, width int, height int) listModel

func NewFooterModel ¶

func NewFooterModel(dbName string) footerModel

func NewSearchModel ¶

func NewSearchModel(initialValue string, width int) searchModel

func NewSidebarModel ¶

func NewSidebarModel(maxTS time.Time, useCurrentTime bool, initialData *Item) sidebarModel

func Truncate ¶

func Truncate(str string, style *lipgloss.Style) string

Types ¶

type Filter ¶

type Filter struct {
	Src            string
	Dst            string
	Fqdn           string
	Severity       []OperatorFilter
	Count          OperatorFilter
	Beacon         OperatorFilter
	Duration       OperatorFilter
	Subdomains     OperatorFilter
	ThreatIntel    string
	SortSeverity   string
	SortBeacon     string
	SortDuration   string
	SortSubdomains string
	// For testing
	LastSeen     time.Time
	SortLastSeen string
}

func ParseSearchInput ¶

func ParseSearchInput(input string) (*Filter, string)

ParseSearchInput parses the search input and returns a filter struct

type FinishedLoadingResults ¶

type FinishedLoadingResults string

type FooterFlash ¶

type FooterFlash string

type Item ¶

type Item MixtapeResult

func (Item) FilterValue ¶

func (i Item) FilterValue() string

func (*Item) GetBeacon ¶

func (i *Item) GetBeacon() string

func (*Item) GetDst ¶

func (i *Item) GetDst() string

func (*Item) GetFirstSeen ¶

func (i *Item) GetFirstSeen(relativeTimestamp time.Time) string

func (*Item) GetPortProtoService ¶

func (i *Item) GetPortProtoService() []string

func (*Item) GetPrevalence ¶

func (i *Item) GetPrevalence() string

func (*Item) GetSeverity ¶

func (i *Item) GetSeverity(color bool) string

GetSeverity returns the severity of the mixtape result based on the final score and adds a color based on the severity level if color is set to true

func (*Item) GetSrc ¶

func (i *Item) GetSrc() string

func (*Item) GetSubdomains ¶

func (i *Item) GetSubdomains() string

func (*Item) GetThreatIntel ¶

func (i *Item) GetThreatIntel() string

func (*Item) GetTotalDuration ¶

func (i *Item) GetTotalDuration() string

type MixtapeResult ¶

type MixtapeResult struct {
	Src                      net.IP              `ch:"src" json:"src"`
	Dst                      net.IP              `ch:"dst" json:"dst"`
	FQDN                     string              `ch:"fqdn"`
	FinalScore               float64             `ch:"final_score"`
	Count                    uint64              `ch:"count"`
	ProxyCount               uint64              `ch:"proxy_count"`
	BeaconScore              float64             `ch:"beacon_score"`
	StrobeScore              float64             `ch:"strobe_score"`
	BeaconThreatScore        float64             `ch:"beacon_threat_score"`
	TotalDuration            float64             `ch:"total_duration"`
	LongConnScore            float64             `ch:"long_conn_score"`
	FirstSeen                time.Time           `ch:"first_seen_historical"`
	FirstSeenScore           float64             `ch:"first_seen_score"`
	Prevalence               float64             `ch:"prevalence"`
	PrevalenceScore          float64             `ch:"prevalence_score"`
	PrevalenceTotal          uint64              `ch:"prevalence_total"`
	NetworkSize              uint64              `ch:"network_size"`
	Subdomains               uint64              `ch:"subdomains"`
	PortProtoService         []string            `ch:"port_proto_service"`
	C2OverDNSScore           float64             `ch:"c2_over_dns_score"`
	C2OverDNSDirectConnScore float64             `ch:"c2_over_dns_direct_conn_score"`
	ThreatIntelScore         float64             `ch:"threat_intel_score"`
	ThreatIntelDataSizeScore float64             `ch:"threat_intel_data_size_score"`
	TotalBytes               uint64              `ch:"total_bytes"`
	TotalBytesFormatted      string              `ch:"total_bytes_formatted"`
	MissingHostHeaderScore   float64             `ch:"missing_host_header_score"`
	MissingHostCount         uint64              `ch:"missing_host_count"`
	ProxyIPs                 []net.IP            `ch:"proxy_ips"`
	Modifiers                []map[string]string `ch:"modifiers"`
	TotalModifierScore       float64             `ch:"total_modifier_score"`
}

type Model ¶

type Model struct {
	SearchBar *searchModel
	SideBar   sidebarModel
	List      listModel

	Footer footerModel

	ViewSearchHelp bool
	ViewHelp       bool
	// contains filtered or unexported fields
}

func NewModel ¶

func NewModel(maxTimestamp, minTimestamp time.Time, useCurrentTime bool, db *database.DB) (*Model, error)

NewModel creates a new model

func (*Model) Init ¶

func (m *Model) Init() tea.Cmd

Init initializes the model

func (*Model) Update ¶

func (m *Model) Update(msg tea.Msg) (tea.Model, tea.Cmd)

Update updates the model

func (*Model) View ¶

func (m *Model) View() string

View renders the model to the terminal

type OperatorFilter ¶

type OperatorFilter struct {
	Operator string
	Value    string
}

type StillLoadingResults ¶

type StillLoadingResults string

type UpdateItem ¶ added in v5.0.5

type UpdateItem *Item

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL