Documentation
¶
Overview ¶
Package edr defines the pluggable EDR provider interface and registry used by the Netmaker EDR posture-check feature.
Index ¶
- Constants
- Variables
- func ActiveProviderID(ctx context.Context) (string, error)
- func CrowdStrikeContainedFromStatus(status string) bool
- func CrowdStrikeHealthyFromStatus(status string) bool
- func GetActive(ctx context.Context) (*schema.Integration, error)
- func LookupErrorCode(err error) string
- func MatchHostToEndpoint(providerID string, h schema.Host, ep ManagedEndpoint) (matchedBy string, ok bool)
- func RedactConfig(providerID string, configJSON json.RawMessage) (json.RawMessage, error)
- func RefreshHostEDRState(ctx context.Context, h schema.Host) error
- func Register(name, display string, f Factory)
- func RegisterCapabilities(name string, c Capabilities)
- func RiskExceeds(maxAllowed, actual RiskLevel) bool
- func RunEDRSync(ctx context.Context) error
- func RunEDRSyncForPosture(ctx context.Context) error
- func RunEDRSyncForce(ctx context.Context) error
- func SerialMatch(hostSerial, deviceSerial string) bool
- func SyncHostEDRState(ctx context.Context, hostID string) error
- func ValidateConfig(providerID string, configJSON json.RawMessage) error
- func WazuhHealthyFromStatus(status string) bool
- type Capabilities
- type CrowdStrikeConfig
- type DefenderConfig
- type Factory
- type HostEndpointLookup
- type ManagedEndpoint
- type Provider
- type ProviderType
- type RiskLevel
- func ComputeRiskLevel(s VendorSignals) RiskLevel
- func CrowdStrikeRiskFromStatus(status string) RiskLevel
- func DefenderRiskFromScore(score string) RiskLevel
- func ParseRiskLevel(level string) RiskLevel
- func SentinelOneRiskFromAgent(infected bool, networkQuarantine bool, activeThreats int) RiskLevel
- func WazuhRiskFromStatus(status string) RiskLevel
- type SentinelOneConfig
- type SerialLookup
- type SyncSettings
- type VendorSignals
- type WazuhConfig
Constants ¶
const ( ProviderDefender = "defender" ProviderCrowdStrike = "crowdstrike" ProviderSentinelOne = "sentinelone" ProviderWazuh = "wazuh" )
const ( RiskNone = "none" RiskLow = "low" RiskMedium = "medium" RiskHigh = "high" RiskCritical = "critical" RiskUnknown = "unknown" )
Risk levels in ascending severity order.
Variables ¶
var (
ErrDeviceNotFoundInEDR = errors.New("device_not_found_in_edr")
)
Functions ¶
func CrowdStrikeContainedFromStatus ¶
CrowdStrikeContainedFromStatus reports whether Falcon status is contained.
func CrowdStrikeHealthyFromStatus ¶
CrowdStrikeHealthyFromStatus reports good operations per Falcon (status normal).
func LookupErrorCode ¶
func MatchHostToEndpoint ¶
func RedactConfig ¶
func RedactConfig(providerID string, configJSON json.RawMessage) (json.RawMessage, error)
func RefreshHostEDRState ¶
RefreshHostEDRState syncs EDR posture state for a single host before join or registration posture evaluation. It does not honour the global sync rate limit.
func RegisterCapabilities ¶
func RegisterCapabilities(name string, c Capabilities)
func RiskExceeds ¶
RiskExceeds reports whether actual risk is strictly greater than max allowed.
func RunEDRSync ¶
func RunEDRSyncForPosture ¶
RunEDRSyncForPosture runs a full EDR sync before the posture evaluation cycle, ignoring sync_enabled and the rate limit.
func RunEDRSyncForce ¶
func SerialMatch ¶
SerialMatch reports whether two serial numbers refer to the same device.
func SyncHostEDRState ¶
SyncHostEDRState refreshes EDR posture state for one host from the active provider. Called after check-in when device-matching identifiers change.
func ValidateConfig ¶
func ValidateConfig(providerID string, configJSON json.RawMessage) error
func WazuhHealthyFromStatus ¶
WazuhHealthyFromStatus reports whether a Wazuh agent is connected and reporting.
Types ¶
type Capabilities ¶
type Capabilities struct {
ReportsRisk bool
}
Capabilities advertises optional provider features.
func CapabilitiesFor ¶
func CapabilitiesFor(name string) Capabilities
type CrowdStrikeConfig ¶
type CrowdStrikeConfig struct {
SyncSettings
BaseURL string `json:"base_url"`
ClientID string `json:"client_id"`
ClientSecret string `json:"client_secret"`
}
CrowdStrikeConfig is stored in integrations_v1.config for CrowdStrike Falcon.
type DefenderConfig ¶
type DefenderConfig struct {
SyncSettings
TenantID string `json:"tenant_id"`
ClientID string `json:"client_id"`
ClientSecret string `json:"client_secret"`
}
DefenderConfig is stored in integrations_v1.config for Microsoft Defender for Endpoint.
type HostEndpointLookup ¶
type HostEndpointLookup interface {
LookupForHost(ctx context.Context, h schema.Host) (ManagedEndpoint, string, error)
}
HostEndpointLookup resolves a host using provider-specific filtered queries (e.g. serial_number) without listing the full fleet.
type ManagedEndpoint ¶
type ManagedEndpoint struct {
ProviderDeviceID string
SerialNumber string
Hostname string
EntraDeviceID string
AgentInstalled bool
AgentHealthy bool
RiskLevel RiskLevel
ThreatCount int
ActiveThreats bool
Isolated bool
Contained bool
LastSeen time.Time
RawVendorData json.RawMessage
}
ManagedEndpoint is the provider-agnostic view of an endpoint returned by EDR integrations. Normalized posture fields are populated by each provider.
type Provider ¶
type Provider interface {
Name() string
Capabilities() Capabilities
Verify(ctx context.Context) error
ListManagedEndpoints(ctx context.Context) ([]ManagedEndpoint, error)
}
Provider is the minimal contract every EDR integration must satisfy.
type ProviderType ¶
type ProviderType struct {
Name string `json:"name"`
Display string `json:"display"`
ReportsRisk bool `json:"reports_risk"`
}
ProviderType describes a registered provider for API listing.
func ListProviderTypes ¶
func ListProviderTypes() []ProviderType
type RiskLevel ¶
type RiskLevel string
RiskLevel is the vendor-agnostic endpoint risk classification.
func ComputeRiskLevel ¶
func ComputeRiskLevel(s VendorSignals) RiskLevel
ComputeRiskLevel maps vendor signals to a vendor-agnostic risk level.
func CrowdStrikeRiskFromStatus ¶
CrowdStrikeRiskFromStatus maps Falcon containment status to normalized level. Documented values: normal, containment_pending, contained, lift_containment_pending.
func DefenderRiskFromScore ¶
DefenderRiskFromScore maps Microsoft Defender riskScore to normalized level.
func ParseRiskLevel ¶
ParseRiskLevel normalizes a risk level string.
func SentinelOneRiskFromAgent ¶
SentinelOneRiskFromAgent maps SentinelOne agent fields to vendor risk hint.
func WazuhRiskFromStatus ¶
WazuhRiskFromStatus maps Wazuh agent status to vendor risk hint.
type SentinelOneConfig ¶
type SentinelOneConfig struct {
SyncSettings
ConsoleURL string `json:"console_url"`
APIToken string `json:"api_token"`
}
SentinelOneConfig is stored in integrations_v1.config for SentinelOne.
type SerialLookup ¶
type SerialLookup interface {
LookupBySerial(ctx context.Context, serial string) (ManagedEndpoint, error)
}
SerialLookup is implemented by EDR providers that can resolve a host by serial_number via a targeted API query instead of listing all endpoints.
type SyncSettings ¶
type SyncSettings struct {
SyncEnabled bool `json:"sync_enabled"`
SyncIntervalMinutes int `json:"sync_interval_minutes"`
}
SyncSettings are shared across EDR provider configs.
func ParseSyncSettings ¶
func ParseSyncSettings(providerID string, configJSON json.RawMessage) (SyncSettings, error)
type VendorSignals ¶
type VendorSignals struct {
AgentInstalled bool
AgentHealthy bool
Isolated bool
Contained bool
ActiveThreats bool
ActiveMalware bool
ActiveRansomware bool
ThreatCount int
VendorRiskLevel RiskLevel
}
VendorSignals are provider-specific inputs normalized into RiskLevel.
type WazuhConfig ¶
type WazuhConfig struct {
SyncSettings
ManagerURL string `json:"manager_url"`
Username string `json:"username"`
Password string `json:"password"`
InsecureSkipVerify bool `json:"insecure_skip_verify"`
}
WazuhConfig is stored in integrations_v1.config for Wazuh.
func ParseWazuhConfig ¶
func ParseWazuhConfig(configJSON json.RawMessage) (WazuhConfig, error)
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package crowdstrike implements an EDR provider backed by CrowdStrike Falcon.
|
Package crowdstrike implements an EDR provider backed by CrowdStrike Falcon. |
|
Package defender implements an EDR provider backed by Microsoft Defender for Endpoint via the WindowsDefenderATP API.
|
Package defender implements an EDR provider backed by Microsoft Defender for Endpoint via the WindowsDefenderATP API. |
|
Package sentinelone implements an EDR provider backed by SentinelOne.
|
Package sentinelone implements an EDR provider backed by SentinelOne. |
|
Package wazuh implements an EDR provider backed by the Wazuh server API.
|
Package wazuh implements an EDR provider backed by the Wazuh server API. |