parser

package
v0.0.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 18, 2017 License: MIT Imports: 18 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DestinationFile = iota
	DestinationSyslog
)

Variables

View Source 
var (
	NsgFileRegExp *regexp.Regexp
)

Functions

func GetProcessStatus 

func GetProcessStatus(w http.ResponseWriter, r *http.Request)

func ServeClient 

func ServeClient(client *AzureClient, ip string, port int)

Types

type AzureClient 

type AzureClient struct {
	Prefix          string
	ProcessStatus   ProcessStatus
	DataPath        string
	DestinationType int
	Concurrency     int
	// contains filtered or unexported fields
}

func NewAzureClient 

func NewAzureClient(accountName, accountKey, containerName, dataPath string) (AzureClient, error)

func (*AzureClient) GetBlobsByPrefix 

func (client *AzureClient) GetBlobsByPrefix(prefix string) ([]storage.Blob, error)

func (*AzureClient) LoadProcessStatus 

func (client *AzureClient) LoadProcessStatus() error

func (*AzureClient) LoadUnprocessedBlobs 

func (client *AzureClient) LoadUnprocessedBlobs(afterTime time.Time) (*[]NsgLogFile, ProcessStatus, error)

func (*AzureClient) ProcessBlobsAfter 

func (client *AzureClient) ProcessBlobsAfter(afterTime time.Time, parserClient NsgParserClient) error

This is the primary function for processing NSG Flow Blobs.

func (*AzureClient) ProcessStatusFileName 

func (client *AzureClient) ProcessStatusFileName() string

func (*AzureClient) SaveProcessStatus 

func (client *AzureClient) SaveProcessStatus() error

type FileClient 

type FileClient struct {
	DataPath string
}

func (*FileClient) Initialize 

func (client *FileClient) Initialize(dataPath string, azureClient *AzureClient) error

func (FileClient) ProcessNsgLogFile 

func (client FileClient) ProcessNsgLogFile(logFile *NsgLogFile, resultsChan chan NsgLogFile) error

type NsgFlowLog 

type NsgFlowLog struct {
	Timestamp       int64   `json:"time"`
	SystemID        *string `json:"systemId"`
	Category        *string `json:"category"`
	ResourceID      *string `json:"resourceId"`
	OperationName   *string `json:"operationName"`
	Rule            *string `json:"rule"`
	Mac             string  `json:"mac"`
	SourceIp        string  `json:"sourceIp"`
	DestinationIp   string  `json:"destinationIp"`
	SourcePort      string  `json:"sourcePort"`
	DestinationPort string  `json:"destinationPort"`
	Protocol        string  `json:"protocol"`
	TrafficFlow     string  `json:"trafficFlow"`
	Traffic         string  `json:"traffic"`
}

Flat Representation of each Flow tuple.

type NsgFlowLogs 

type NsgFlowLogs []NsgFlowLog

type NsgLog 

type NsgLog struct {
	Records Records `json:"records"`
}

NsgLog is the GO Struct representing the .json files produced by NSG Each NsgLog has multiple records. one per minute normally.

func (*NsgLog) ConvertToNsgFlowLogs 

func (nsgLog *NsgLog) ConvertToNsgFlowLogs() (NsgFlowLogs, error)

func (*NsgLog) GetFlowLogsAfter 

func (nsgLog *NsgLog) GetFlowLogsAfter(afterTime time.Time) (NsgFlowLogs, error)

type NsgLogFile 

type NsgLogFile struct {
	Name                   string       `json:name`
	Etag                   string       `json:etag`
	LastModified           time.Time    `json:last_modified`
	LastProcessed          time.Time    `json:last_processed`
	LastProcessedRecord    time.Time    `json:last_processed_record`
	LastProcessedTimeStamp int64        `json:last_processed_time`
	LastRecordCount        int          `json:last_count`
	LogTime                time.Time    "json:log_time"
	Blob                   storage.Blob `json:"-"`
	NsgLog                 *NsgLog      `json:"-"`
	NsgName                string       `json:nsg_name`
}

NsgLogFile represents individual .json Log files in azure

func NewNsgLogFile 

func NewNsgLogFile(blob storage.Blob) (NsgLogFile, error)

func (*NsgLogFile) LoadBlob 

func (logFile *NsgLogFile) LoadBlob() error

func (*NsgLogFile) Logger 

func (logFile *NsgLogFile) Logger() *log.Entry

func (*NsgLogFile) SaveToPath 

func (logFile *NsgLogFile) SaveToPath(path string) error

func (*NsgLogFile) ShortName 

func (logFile *NsgLogFile) ShortName() string

type NsgParserClient 

type NsgParserClient interface {
	ProcessNsgLogFile(*NsgLogFile, chan NsgLogFile) error
}

type NsgParserStatus 

type NsgParserStatus struct {
	GoVersion          string
	Version            string
	ProcessStatus      *ProcessStatus
	BuildDate          string
	BuildUser          string
	Revision           string
	ProcessedFlowCount int64
}

type ProcessStatus 

type ProcessStatus map[string]*NsgLogFile

func ReadProcessStatus 

func ReadProcessStatus(path, fileName string) (ProcessStatus, error)

type Record 

type Record struct {
	Time          time.Time `json:"time"`
	SystemID      string    `json:"systemId"`
	Category      string    `json:"category"`
	ResourceID    string    `json:"resourceId"`
	OperationName string    `json:"operationName"`
	Properties    struct {
		Version int `json:"Version"`
		Flows   []struct {
			Rule  string `json:"rule"`
			Flows []struct {
				Mac        string   `json:"mac"`
				FlowTuples []string `json:"flowTuples"`
			} `json:"flows"`
		} `json:"flows"`
	} `json:"properties"`
}

type Records 

type Records []Record

func (Records) After 

func (slice Records) After(afterTime time.Time) Records

func (Records) Len 

func (slice Records) Len() int

func (Records) Less 

func (slice Records) Less(i, j int) bool

func (Records) Swap 

func (slice Records) Swap(i, j int)

type SyslogClient 

type SyslogClient struct {
	// contains filtered or unexported fields
}

func (*SyslogClient) Initialize 

func (client *SyslogClient) Initialize(protocol, host, port string, azureClient *AzureClient) error

func (SyslogClient) ProcessNsgLogFile 

func (client SyslogClient) ProcessNsgLogFile(logFile *NsgLogFile, resultsChan chan NsgLogFile) error

func (*SyslogClient) SendEvent 

func (client *SyslogClient) SendEvent(flowLog NsgFlowLog) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.