Documentation
¶
Index ¶
- Variables
- func DefaultDeleteSource(ctx context.Context, in *Source, db *gorm.DB) error
- func DefaultDeleteSourceSet(ctx context.Context, in []*Source, db *gorm.DB) error
- type Source
- func DefaultApplyFieldMaskSource(ctx context.Context, patchee *Source, patcher *Source, ...) (*Source, error)
- func DefaultCreateSource(ctx context.Context, in *Source, db *gorm.DB) (*Source, error)
- func DefaultListSource(ctx context.Context, db *gorm.DB) ([]*Source, error)
- func DefaultPatchSetSource(ctx context.Context, objects []*Source, updateMasks []*field_mask.FieldMask, ...) ([]*Source, error)
- func DefaultPatchSource(ctx context.Context, in *Source, updateMask *field_mask.FieldMask, db *gorm.DB) (*Source, error)
- func DefaultReadSource(ctx context.Context, in *Source, db *gorm.DB) (*Source, error)
- func DefaultStrictUpdateSource(ctx context.Context, in *Source, db *gorm.DB) (*Source, error)
- func (*Source) Descriptor() ([]byte, []int)deprecated
- func (x *Source) GetArgs() string
- func (x *Source) GetCracker() string
- func (x *Source) GetCreatedAt() *timestamppb.Timestamp
- func (x *Source) GetFilename() string
- func (x *Source) GetId() string
- func (x *Source) GetProfileName() string
- func (x *Source) GetServiceId() string
- func (x *Source) GetSessionId() string
- func (x *Source) GetTool() string
- func (x *Source) GetType() SourceType
- func (x *Source) GetUpdatedAt() *timestamppb.Timestamp
- func (x *Source) GetVersion() string
- func (*Source) ProtoMessage()
- func (x *Source) ProtoReflect() protoreflect.Message
- func (x *Source) Reset()
- func (x *Source) String() string
- func (m *Source) ToORM(ctx context.Context) (SourceORM, error)
- type SourceORM
- type SourceORMWithAfterCreate_
- type SourceORMWithAfterDeleteSet
- type SourceORMWithAfterDelete_
- type SourceORMWithAfterListFind
- type SourceORMWithAfterReadFind
- type SourceORMWithAfterStrictUpdateSave
- type SourceORMWithBeforeCreate_
- type SourceORMWithBeforeDeleteSet
- type SourceORMWithBeforeDelete_
- type SourceORMWithBeforeListApplyQuery
- type SourceORMWithBeforeListFind
- type SourceORMWithBeforeReadApplyQuery
- type SourceORMWithBeforeReadFind
- type SourceORMWithBeforeStrictUpdateCleanup
- type SourceORMWithBeforeStrictUpdateSave
- type SourceType
- type SourceWithAfterPatchSave
- type SourceWithAfterToORM
- type SourceWithAfterToPB
- type SourceWithBeforePatchApplyFieldMask
- type SourceWithBeforePatchRead
- type SourceWithBeforePatchSave
- type SourceWithBeforeToORM
- type SourceWithBeforeToPB
Constants ¶
This section is empty.
Variables ¶
var ( SourceType_name = map[int32]string{ 0: "Manual", 1: "Import", 2: "Cracked", 3: "Service", 4: "Scan", 5: "C2", } SourceType_value = map[string]int32{ "Manual": 0, "Import": 1, "Cracked": 2, "Service": 3, "Scan": 4, "C2": 5, } )
Enum value maps for SourceType.
var File_provenance_pb_source_proto protoreflect.FileDescriptor
Functions ¶
func DefaultDeleteSource ¶
Types ¶
type Source ¶
type Source struct {
// @gotags: display:"ID" readonly:"true" strict:"yes"
Id string `protobuf:"bytes,1,opt,name=Id,proto3" json:"Id,omitempty" display:"ID" readonly:"true" strict:"yes"`
// @gotags: display:"Created at" readonly:"true"
CreatedAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=CreatedAt,proto3" json:"CreatedAt,omitempty" display:"Created at" readonly:"true"`
// @gotags: display:"Updated at" readonly:"true"
UpdatedAt *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=UpdatedAt,proto3" json:"UpdatedAt,omitempty" display:"Updated at" readonly:"true"`
// Tool - The name of the contributing tool ("nmap", "metasploit", "sliver",
// "hashcat", ...). Empty for a manual/API contribution. This is the primary key a
// consuming tool filters on to scope a query to its own data.
// @gotags: display:"Tool"
Tool string `protobuf:"bytes,10,opt,name=Tool,proto3" json:"Tool,omitempty" display:"Tool"`
// Type - The class of contribution (manual, import, scan, cracked, service, c2).
// @gotags: display:"Type"
Type SourceType `protobuf:"varint,11,opt,name=Type,proto3,enum=provenance.SourceType" json:"Type,omitempty" display:"Type"`
// SessionId - The attacker-infrastructure session/operator the contribution ran under.
// (Carried over from credential.Origin.SessionId and scan.Run.SessionId.)
SessionId string `protobuf:"bytes,12,opt,name=SessionId,proto3" json:"SessionId,omitempty"`
// Version - The version of the contributing tool. (From scan.Run.Version.)
// @gotags: display:"Version"
Version string `protobuf:"bytes,13,opt,name=Version,proto3" json:"Version,omitempty" display:"Version"`
// Args - The full invocation/arguments that produced the contribution — e.g. the raw
// nmap args. (From scan.Run.Args.)
Args string `protobuf:"bytes,14,opt,name=Args,proto3" json:"Args,omitempty"`
// ProfileName - A named profile/preset the tool ran under, if any. (From scan.Run.ProfileName.)
ProfileName string `protobuf:"bytes,15,opt,name=ProfileName,proto3" json:"ProfileName,omitempty"`
// Filename - For imports: the basename of the file the objects were loaded from.
// Because only a basename is available, a Filename may recur across contributions.
// (Carried over from credential.Origin.Filename.)
// @gotags: display:"File"
Filename string `protobuf:"bytes,20,opt,name=Filename,proto3" json:"Filename,omitempty" display:"File"`
// Cracker - For cracked credentials: the name of the cracking tool.
// (Carried over from credential.Origin.Cracker.)
Cracker string `protobuf:"bytes,30,opt,name=Cracker,proto3" json:"Cracker,omitempty"`
// ServiceId - Soft reference (uuid) to the network.Service the objects were gathered
// from, when applicable (mirrors credential.Origin.Service). Held as a plain id rather
// than a belongs_to relation on purpose: network.Service carries its own `Sources`
// m2m back to this type, and a real relation here would create a proto import cycle
// (provenance <-> network). Resolve it via a Service query when the full object is needed.
ServiceId string `protobuf:"bytes,40,opt,name=ServiceId,proto3" json:"ServiceId,omitempty"`
// contains filtered or unexported fields
}
Source - A single contribution event: one tool (scanner, C2 framework, cracker, manual entry, or file import) writing objects into the shared AIMS store. Every merge-unit object — host.Host, host.Port, network.Service, network.Address, credential.Core, credential.Login — is joined many-to-many to the Sources that contributed or enriched it. This lets a tool that consumes AIMS as a library scope a query to only the data it produced ("give me my objects"), and — crucially for the "many tools, one object instance" thesis — lets provenance survive the merge fold as a UNION of contributors rather than being overwritten by the last writer.
Source generalizes credential.Origin (its Type / Cracker / Filename / SessionId / Service fields are carried here) into one cross-domain provenance object. The rich per-domain producers — scan.Run (Scanner/Args/Version/ProfileName) and c2.Agent (Tool) — are specializations that own a Source; the enum SourceType folds credential.OriginType together with the scan and c2 producer classes.
func DefaultApplyFieldMaskSource ¶
func DefaultApplyFieldMaskSource(ctx context.Context, patchee *Source, patcher *Source, updateMask *field_mask.FieldMask, prefix string, db *gorm.DB) (*Source, error)
DefaultApplyFieldMaskSource patches an pbObject with patcher according to a field mask.
func DefaultCreateSource ¶
DefaultCreateSource executes a basic gorm create call
func DefaultListSource ¶
DefaultListSource executes a gorm list call
func DefaultPatchSetSource ¶
func DefaultPatchSetSource(ctx context.Context, objects []*Source, updateMasks []*field_mask.FieldMask, db *gorm.DB) ([]*Source, error)
DefaultPatchSetSource executes a bulk gorm update call with patch behavior
func DefaultPatchSource ¶
func DefaultPatchSource(ctx context.Context, in *Source, updateMask *field_mask.FieldMask, db *gorm.DB) (*Source, error)
DefaultPatchSource executes a basic gorm update call with patch behavior
func DefaultReadSource ¶
func DefaultStrictUpdateSource ¶
DefaultStrictUpdateSource clears / replaces / appends first level 1:many children and then executes a gorm update call
func (*Source) Descriptor
deprecated
func (*Source) GetCracker ¶
func (*Source) GetCreatedAt ¶
func (x *Source) GetCreatedAt() *timestamppb.Timestamp
func (*Source) GetFilename ¶
func (*Source) GetProfileName ¶
func (*Source) GetServiceId ¶
func (*Source) GetSessionId ¶
func (*Source) GetType ¶
func (x *Source) GetType() SourceType
func (*Source) GetUpdatedAt ¶
func (x *Source) GetUpdatedAt() *timestamppb.Timestamp
func (*Source) GetVersion ¶
func (*Source) ProtoMessage ¶
func (*Source) ProtoMessage()
func (*Source) ProtoReflect ¶
func (x *Source) ProtoReflect() protoreflect.Message
type SourceORM ¶
type SourceORM struct {
Args string
Cracker string
CreatedAt *time.Time
Filename string
Id string `gorm:"type:uuid;primaryKey"`
ProfileName string
ServiceId string `gorm:"type:uuid"`
SessionId string
Tool string
Type int32
UpdatedAt *time.Time
Version string
}
func (*SourceORM) BeforeCreate ¶
BeforeCreate - GORM-specific autogenerated helpers.
type SourceType ¶
type SourceType int32
SourceType - The class of a provenance Source. Generalizes credential.OriginType (Manual / Import / CrackedPassword / Service) with the scan- and c2-oriented producers.
const ( // Manual - A manually added object (CLI arguments, API calls, hand entry). SourceType_Manual SourceType = 0 // Import - Objects loaded from a file (nmap XML, a JSON/XML export, a credential dump). SourceType_Import SourceType = 1 // Cracked - Credentials cracked from another credential.Core. // (credential.OriginType.CrackedPassword.) SourceType_Cracked SourceType = 2 // Service - Objects gathered by interacting with a live service // (e.g. Metasploit auxiliary/exploit modules). (credential.OriginType.Service.) SourceType_Service SourceType = 3 // Scan - Objects produced by a scanner run (scan.Run: nmap, sx, zgrab, ...). SourceType_Scan SourceType = 4 // C2 - Objects produced by a command-and-control implant/framework (c2.Agent). SourceType_C2 SourceType = 5 )
func (SourceType) Descriptor ¶
func (SourceType) Descriptor() protoreflect.EnumDescriptor
func (SourceType) Enum ¶
func (x SourceType) Enum() *SourceType
func (SourceType) EnumDescriptor
deprecated
func (SourceType) EnumDescriptor() ([]byte, []int)
Deprecated: Use SourceType.Descriptor instead.
func (SourceType) Number ¶
func (x SourceType) Number() protoreflect.EnumNumber
func (SourceType) String ¶
func (x SourceType) String() string
func (SourceType) Type ¶
func (SourceType) Type() protoreflect.EnumType
type SourceWithAfterToORM ¶
SourceAfterToORM called after default ToORM code
type SourceWithAfterToPB ¶
SourceAfterToPB called after default ToPB code
type SourceWithBeforeToORM ¶
SourceBeforeToORM called before default ToORM code