Documentation
¶
Index ¶
- Constants
- func DefaultCWD(platform string) string
- type Command
- type HistoryEntry
- type Manager
- func (m *Manager) CloseSession(sessionID uint) error
- func (m *Manager) CommandResults(commandID uint) ([]map[string]any, error)
- func (m *Manager) CreateSession(env environments.TLSEnvironment, node nodes.OsqueryNode, creator string) (Session, error)
- func (m *Manager) GetCommand(sessionID, commandID uint) (Command, error)
- func (m *Manager) GetSession(sessionID uint) (Session, error)
- func (m *Manager) History(envID, nodeID uint, creator string, limit int) ([]HistoryEntry, error)
- func (m *Manager) PrimingCommand(sessionID uint) (Command, error)
- func (m *Manager) RefreshCommandStatus(commandID uint) (Command, error)
- func (m *Manager) SetLogReader(r logging.LogReader)
- func (m *Manager) SubmitCommand(sessionID uint, input string, osqueryModeOpt ...bool) (Command, ParsedCommand, error)
- func (m *Manager) SubmitCommandWithTimeout(sessionID uint, input string, timeout time.Duration, osqueryModeOpt ...bool) (Command, ParsedCommand, error)
- func (m *Manager) SubmitPrimingCommand(sessionID uint, timeout time.Duration) (Command, error)
- func (m *Manager) TouchSession(sessionID uint) (Session, error)
- type ParsedCommand
- type Session
Constants ¶
const ( CommandLocal = "local" CommandRemote = "remote" CommandCarve = "carve" CommandMode = "mode" CommandExitMode = "exit-mode" StatusQueued = "queued" StatusDelivered = "delivered" StatusCompleted = "completed" StatusError = "error" StatusExpired = "expired" )
const PrimingMetadataSQL = "select version, build_platform, build_distro, start_time, config_valid, optimizations from osquery_info"
PrimingMetadataSQL is the read-only osquery statement dispatched when a console session is opened. Its purpose is twofold:
- Be present in the node's pending distributed queue so that the next QueryRead can return an accelerated interval when acceleration is enabled — the node switches to fast polling before the user types their first command.
- Surface live metadata (osquery version, build platform, start time, uptime) into the session UI so the operator sees fresh values rather than the last-seen DB snapshot.
It is a single statement (no semicolons) so validateSelect stays happy and osquery treats it atomically.
Variables ¶
This section is empty.
Functions ¶
func DefaultCWD ¶
Types ¶
type Command ¶
type Command struct {
ID uint `gorm:"primarykey" json:"id"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
DeletedAt gorm.DeletedAt `gorm:"index" json:"-"`
SessionID uint `gorm:"not null;index" json:"session_id"`
Input string `gorm:"not null" json:"input"`
TranslatedSQL string `json:"translated_sql"`
DistributedQueryName string `gorm:"index" json:"distributed_query_name,omitempty"`
Status string `gorm:"not null;index" json:"status"`
Error string `json:"error,omitempty"`
Priming bool `gorm:"not null;default:false;index" json:"priming"`
DeliveredAt *time.Time `json:"delivered_at,omitempty"`
CompletedAt *time.Time `json:"completed_at,omitempty"`
ExpiredAt *time.Time `json:"expired_at,omitempty"`
}
type HistoryEntry ¶
type Manager ¶
func (*Manager) CloseSession ¶
func (*Manager) CommandResults ¶
func (*Manager) CreateSession ¶
func (m *Manager) CreateSession(env environments.TLSEnvironment, node nodes.OsqueryNode, creator string) (Session, error)
func (*Manager) GetCommand ¶
func (*Manager) PrimingCommand ¶ added in v0.5.6
PrimingCommand returns the most recent priming command for a session, or gorm.ErrRecordNotFound if none exists.
func (*Manager) RefreshCommandStatus ¶
func (*Manager) SetLogReader ¶ added in v0.5.6
SetLogReader wires a LogReader (DB- or S3-backed). When unset, the manager falls back to NewDBLogReader(m.DB) so existing callers keep the legacy DB-backed behavior.
func (*Manager) SubmitCommand ¶
func (*Manager) SubmitCommandWithTimeout ¶
func (*Manager) SubmitPrimingCommand ¶ added in v0.5.6
SubmitPrimingCommand dispatches the console priming metadata query for the session. The priming query is a hidden ConsoleQueryType distributed query whose presence in the node's pending queue lets the TLS QueryRead handler return an accelerated interval when acceleration is enabled — so the node switches to fast polling before the operator types their first command.
Unlike SubmitCommand, priming commands are not mutually exclusive with each other or with user commands: a fresh session may legitimately have a priming query in flight when the user submits their first real command, and SubmitCommandWithTimeout's pending-count ignores priming rows for exactly that reason.
The returned Command is marked Priming=true so the API layer can surface it separately from operator history.
type ParsedCommand ¶
type ParsedCommand struct {
Kind string `json:"kind"`
Command string `json:"command"`
Mode string `json:"mode,omitempty"`
Path string `json:"path,omitempty"`
SQL string `json:"sql,omitempty"`
Output string `json:"output,omitempty"`
Message string `json:"message,omitempty"`
}
func Parse ¶
func Parse(input, cwd, platform string) (ParsedCommand, error)
func ParseInput ¶
func ParseInput(input, cwd, platform string, osqueryMode bool) (ParsedCommand, error)
type Session ¶
type Session struct {
ID uint `gorm:"primarykey" json:"id"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
DeletedAt gorm.DeletedAt `gorm:"index" json:"-"`
EnvironmentID uint `gorm:"not null;index" json:"environment_id"`
// Environment is the env UUID used as the S3 key prefix when the
// log reader is S3-backed. Populated at session creation from the
// env record; the DB reader ignores it.
Environment string `gorm:"index" json:"environment"`
NodeID uint `gorm:"not null;index" json:"node_id"`
NodeUUID string `gorm:"not null;index" json:"node_uuid"`
Creator string `gorm:"not null;index" json:"creator"`
CWD string `gorm:"not null" json:"cwd"`
Platform string `json:"platform"`
Active bool `gorm:"not null;default:true" json:"active"`
ClosedAt *time.Time `json:"closed_at,omitempty"`
}
Source Files