Documentation
¶
Index ¶
- Constants
- type Entry
- type Manager
- func (m *Manager) CloseSession(sessionID uint) error
- func (m *Manager) CreateSession(env environments.TLSEnvironment, node nodes.OsqueryNode, creator string) (Session, error)
- func (m *Manager) GetRequest(sessionID, requestID uint) (Request, error)
- func (m *Manager) GetSession(sessionID uint) (Session, error)
- func (m *Manager) ListDirectory(sessionID uint, target string, timeout time.Duration) (Request, error)
- func (m *Manager) PrimingRequest(sessionID uint) (Request, error)
- func (m *Manager) RefreshRequestStatus(requestID uint) (Request, error)
- func (m *Manager) RequestMetadataRows(requestID uint) ([]map[string]any, error)
- func (m *Manager) RequestResults(requestID uint) ([]Entry, error)
- func (m *Manager) SetLogReader(r logging.LogReader)
- func (m *Manager) StatPath(sessionID uint, target string, timeout time.Duration) (Request, error)
- func (m *Manager) SubmitPrimingRequest(sessionID uint, timeout time.Duration) (Request, error)
- func (m *Manager) TouchSession(sessionID uint) (Session, error)
- type Request
- type Session
Constants ¶
const ( ActionList = "list" ActionStat = "stat" ActionPriming = "priming" StatusQueued = "queued" StatusCompleted = "completed" StatusError = "error" StatusExpired = "expired" )
const ( // PrimingMetadataSQL is the read-only osquery statement dispatched // when a file explorer session is opened. Its presence in the node's // pending distributed queue lets the TLS QueryRead handler return an // accelerated interval when acceleration is enabled — so the node // switches to fast polling before the operator expands the first // directory — and it also surfaces live osquery runtime metadata into // the session. PrimingMetadataSQL = "select version, build_platform, build_distro, start_time, config_valid, optimizations from osquery_info" )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Entry ¶
type Entry struct {
Path string `json:"path"`
Filename string `json:"filename"`
Directory string `json:"directory"`
Type string `json:"type"`
Size int64 `json:"size,omitempty"`
Mode string `json:"mode,omitempty"`
UID string `json:"uid,omitempty"`
GID string `json:"gid,omitempty"`
MTime int64 `json:"mtime,omitempty"`
ATime int64 `json:"atime,omitempty"`
CTime int64 `json:"ctime,omitempty"`
}
type Manager ¶
func (*Manager) CloseSession ¶
func (*Manager) CreateSession ¶
func (m *Manager) CreateSession(env environments.TLSEnvironment, node nodes.OsqueryNode, creator string) (Session, error)
func (*Manager) GetRequest ¶
func (*Manager) ListDirectory ¶
func (*Manager) PrimingRequest ¶ added in v0.5.6
PrimingRequest returns the most recent priming request for a session, or gorm.ErrRecordNotFound if none exists.
func (*Manager) RefreshRequestStatus ¶
func (*Manager) RequestMetadataRows ¶ added in v0.5.6
RequestMetadataRows returns the raw result rows for a priming metadata request (the osquery_info SELECT). Unlike RequestResults, which decodes file columns into Entry structs, this returns the rows as generic maps so the API can pass the osquery_info columns (version, build_platform, start_time, ...) straight through to the frontend.
func (*Manager) SetLogReader ¶ added in v0.5.6
SetLogReader wires a LogReader (DB- or S3-backed). When unset, the manager falls back to NewDBLogReader(m.DB) so existing callers keep the legacy DB-backed behavior.
func (*Manager) SubmitPrimingRequest ¶ added in v0.5.6
SubmitPrimingRequest dispatches the file explorer priming metadata query for the session. The priming query is a hidden FileExplorerQueryType distributed query whose presence in the node's pending queue lets the TLS QueryRead handler return an accelerated interval when acceleration is enabled — so the node switches to fast polling before the operator expands the first directory — and it also surfaces live osquery runtime metadata into the session UI.
Priming requests are excluded from the per-session pending cap so a still-running priming query never gates the first directory listing.
type Request ¶
type Request struct {
ID uint `gorm:"primarykey" json:"id"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
DeletedAt gorm.DeletedAt `gorm:"index" json:"-"`
SessionID uint `gorm:"not null;index" json:"session_id"`
Action string `gorm:"not null;index" json:"action"`
Path string `gorm:"not null" json:"path"`
TranslatedSQL string `json:"translated_sql"`
DistributedQueryName string `gorm:"index" json:"distributed_query_name,omitempty"`
Status string `gorm:"not null;index" json:"status"`
Error string `json:"error,omitempty"`
Priming bool `gorm:"not null;default:false;index" json:"priming"`
CompletedAt *time.Time `json:"completed_at,omitempty"`
ExpiredAt *time.Time `json:"expired_at,omitempty"`
}
type Session ¶
type Session struct {
ID uint `gorm:"primarykey" json:"id"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
DeletedAt gorm.DeletedAt `gorm:"index" json:"-"`
EnvironmentID uint `gorm:"not null;index" json:"environment_id"`
// Environment is the env UUID used as the S3 key prefix when the
// log reader is S3-backed. Populated at session creation; the DB
// reader ignores it.
Environment string `gorm:"index" json:"environment"`
NodeID uint `gorm:"not null;index" json:"node_id"`
NodeUUID string `gorm:"not null;index" json:"node_uuid"`
Creator string `gorm:"not null;index" json:"creator"`
Platform string `json:"platform"`
Root string `gorm:"not null" json:"root"`
Active bool `gorm:"not null;default:true" json:"active"`
ClosedAt *time.Time `json:"closed_at,omitempty"`
}
Source Files