crowdstrike

package
v1.58.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 27, 2025 License: BSD-3-Clause Imports: 23 Imported by: 0

Documentation

Overview

Copyright 2025 SGNL.ai, Inc.

Copyright 2025 SGNL.ai, Inc.

Copyright 2025 SGNL.ai, Inc.

Copyright 2025 SGNL.ai, Inc.

Copyright 2025 SGNL.ai, Inc.

Copyright 2025 SGNL.ai, Inc.

Copyright 2025 SGNL.ai, Inc.

Copyright 2025 SGNL.ai, Inc.

TODO: The contents of this file are unused at the moment. Do not remove. We need it for future improvements.

Copyright 2025 SGNL.ai, Inc.

Index

Constants

View Source
const (
	User             string = "user"
	Incident         string = "incident"
	Endpoint         string = "endpoint"
	Device           string = "endpoint_protection_device"
	EndpointIncident string = "endpoint_protection_incident"
	Detect           string = "endpoint_protection_detect"
	Alerts           string = "endpoint_protection_alert"
)
View Source
const (
	// MaxPageSize is the maximum page size allowed in a GetPage request.
	MaxPageSize = 1000
)

Variables

View Source
var (
	// ValidGraphQLEntityExternalIDs is a map of valid external IDs of entities that can be queried.
	// The map value is the Entity struct which contains the unique ID attribute.
	ValidGraphQLEntityExternalIDs = map[string]Entity{
		User: {
			UniqueIDAttrExternalID: "entityId",
			OrderByAttribute:       "RISK_SCORE",
		},
		Incident: {
			UniqueIDAttrExternalID: "incidentId",
			OrderByAttribute:       "END_TIME",
		},
		Endpoint: {
			UniqueIDAttrExternalID: "entityId",
			OrderByAttribute:       "RISK_SCORE",
		},
	}

	ValidRESTEntityExternalIDs = map[string]Entity{
		Device:           {},
		Detect:           {UseIntCursor: true},
		EndpointIncident: {UseIntCursor: true},
		Alerts:           {},
	}
)
View Source
var (
	EntityExternalIDToEndpoint = map[string]EndpointInfo{
		Device: {
			ListEndpoint: "devices/queries/devices-scroll/v1",
			GetEndpoint:  "devices/entities/devices/v2",
		},
		EndpointIncident: {
			ListEndpoint: "incidents/queries/incidents/v1",
			GetEndpoint:  "incidents/entities/incidents/GET/v1",
		},
		Detect: {
			ListEndpoint: "detects/queries/detects/v1",
			GetEndpoint:  "detects/entities/summaries/GET/v1",
		},

		Alerts: {
			GetEndpoint: "alerts/combined/alerts/v1",
		},
	}
)
View Source
var (
	SupportedAPIVersions = map[string]struct{}{
		"v1": {},
	}
)

Functions

func ConstructRESTEndpoint

func ConstructRESTEndpoint(request *Request, path string) (*string, *framework.Error)

func GetAttributePath

func GetAttributePath(input string) []string

func GetPageInfoAfter

func GetPageInfoAfter(pageInfo *PageInfo, n int) *string

This returns the PageInfo struct of the n deep layer, where 0 is the outermost layer. If n > number of layers or the pageInfo is nil, the function returns nil. If n < 0, the function returns the PageInfo of the outermost layer.

func NewAdapter

func NewAdapter(client Client) framework.Adapter[Config]

NewAdapter instantiates a new Adapter.

func ParseError

func ParseError(errors []ErrorItem) *framework.Error

func SetAfterParameter

func SetAfterParameter(value *string) string

Types

type Adapter

type Adapter struct {
	// Client provides access to the datasource.
	Client Client
}

Adapter implements the framework.Adapter interface to query pages of objects from datasources.

func (*Adapter) GetPage

func (a *Adapter) GetPage(ctx context.Context, request *framework.Request[Config]) framework.Response

GetPage is called by SGNL's ingestion service to query a page of objects from a datasource.

func (*Adapter) RequestPageFromDatasource

func (a *Adapter) RequestPageFromDatasource(
	ctx context.Context, request *framework.Request[Config],
) framework.Response

RequestPageFromDatasource requests a page of objects from a datasource.

func (*Adapter) ValidateGetPageRequest

func (a *Adapter) ValidateGetPageRequest(ctx context.Context, request *framework.Request[Config]) *framework.Error

ValidateGetPageRequest validates the fields of the GetPage Request.

type AlertsMeta added in v1.50.0

type AlertsMeta struct {
	Pagination AlertsPagination `json:"pagination"`
}

type AlertsPagination added in v1.50.0

type AlertsPagination struct {
	After string `json:"after"`
	Total int    `json:"total"`
}

type AlertsRequestBody added in v1.50.0

type AlertsRequestBody struct {
	Limit  int     `json:"limit"`
	After  *string `json:"after,omitempty"`
	Filter *string `json:"filter,omitempty"`
	Sort   *string `json:"sort,omitempty"`
}

type AlertsResponse added in v1.50.0

type AlertsResponse struct {
	Meta      AlertsMeta       `json:"meta"`
	Resources []map[string]any `json:"resources"`
	Errors    []ErrorItem      `json:"errors"`
}

type AttributeNode

type AttributeNode struct {
	Name         string
	Children     map[string]*AttributeNode
	IsFragment   bool
	FragmentType *FragmentType
}

AttributeNode stores the metadata required to build the inner part of the query for an entity.

func AttributeQueryBuilder

func AttributeQueryBuilder(
	entityConfig *framework.EntityConfig,
	rootName string,
) (*AttributeNode, *framework.Error)

func (*AttributeNode) AddChild

func (node *AttributeNode) AddChild(path []string, isFragment bool, fragmentType *FragmentType) *AttributeNode

AddChild adds a child to the current node and returns the child node.

func (*AttributeNode) BuildQuery

func (node *AttributeNode) BuildQuery() string

type Client

type Client interface {
	// GetPage returns a page of JSON objects from the datasource for the
	// requested entity.
	// Returns a (possibly empty) list of JSON objects, each object being
	// unmarshaled into a map by Golang's JSON unmarshaler.
	GetPage(ctx context.Context, request *Request) (*Response, *framework.Error)
}

Client is a client that allows querying the datasource which contains JSON objects.

func NewClient

func NewClient(client *http.Client) Client

NewClient returns a Client to query the datasource.

type Config

type Config struct {
	// Common configuration
	*config.CommonConfig

	APIVersion string            `json:"apiVersion,omitempty"`
	Archived   bool              `json:"archived,omitempty"`
	Enabled    bool              `json:"enabled,omitempty"`
	Filters    map[string]string `json:"filters,omitempty"`
}

Example Config:

{
   "apiVersion": "v1",
   "archived": false,
   "enabled": true,
   "filters": {
       "endpoint_protection_device": "platform:'Windows'"
   }
}

Config is the optional configuration passed in each GetPage calls to the adapter.

func (*Config) Validate

func (c *Config) Validate(_ context.Context) error

Validate ensures that a Config received in a GetPage call is valid.

type Datasource

type Datasource struct {
	Client *http.Client
}

Datasource directly implements a Client interface to allow querying an external datasource.

func (*Datasource) GetPage

func (d *Datasource) GetPage(ctx context.Context, request *Request) (*Response, *framework.Error)

type DatasourceResponse

type DatasourceResponse struct {
	Entities  ResponseItems `json:"entities"`
	Incidents ResponseItems `json:"incidents"`
}

type DetailedResourceRequestBody

type DetailedResourceRequestBody struct {
	Identifiers []string `json:"ids"`
}

type DetailedResourceResponse

type DetailedResourceResponse struct {
	Meta      MetaFields       `json:"meta"`
	Resources []map[string]any `json:"resources"`
	Errors    []ErrorItem      `json:"errors"`
}

type EndpointInfo

type EndpointInfo struct {
	ListEndpoint string
	GetEndpoint  string
}

The REST APIs of CrowdStrike are two level. A list endpoint is used to list entity IDs. A get endpoint is used to get detailed metadata of a specific entity. If a REST API has only one endpoint, it is considered as a get endpoint.

type EndpointQueryBuilder

type EndpointQueryBuilder struct {
	Archived bool
	Enabled  bool
	PageSize int64
	First    int64
}

func (*EndpointQueryBuilder) Build

func (b *EndpointQueryBuilder) Build(request *Request) (string, *framework.Error)

type Entity

type Entity struct {
	// UniqueIDAttrExternalID is the external ID of the entity's uniqueId attribute.
	UniqueIDAttrExternalID string

	// OrderByAttribute is the attribute to order the results by.
	OrderByAttribute string

	// UseIntCursor
	UseIntCursor bool
}

Entity contains entity specific information, such as the entity's unique ID attribute.

type ErrorItem

type ErrorItem struct {
	Code    int    `json:"code"`
	Message string `json:"message"`
}

type FragmentType

type FragmentType struct {
	Parent     string
	Name       string
	Attributes []string
}

type IncidentQueryBuilder

type IncidentQueryBuilder struct {
	First    int64
	PageSize int64
}

func (*IncidentQueryBuilder) Build

func (b *IncidentQueryBuilder) Build(request *Request) (string, *framework.Error)

type ListResourceResponse

type ListResourceResponse struct {
	Meta      MetaFields  `json:"meta"`
	Resources []string    `json:"resources"`
	Errors    []ErrorItem `json:"errors"`
}

type ListScrollResourceResponse

type ListScrollResourceResponse struct {
	Meta      ScrollMetaFields `json:"meta"`
	Resources []string         `json:"resources"`
	Errors    []ErrorItem      `json:"errors"`
}

type MetaFields

type MetaFields struct {
	PaginationInfo PaginationInfo `json:"pagination"`
}

type PageInfo

type PageInfo struct {
	HasNextPage bool   `json:"hasNextPage"`
	EndCursor   string `json:"endCursor"`
	// InnerPageInfo represents the paging details for the next nested level. (1 layer deeper)
	InnerPageInfo *PageInfo
}

func DecodePageInfo

func DecodePageInfo(cursor *string) (*PageInfo, *framework.Error)

type PaginationInfo

type PaginationInfo struct {
	Offset int `json:"offset"`
	Limit  int `json:"limit"`
	Total  int `json:"total"`
}

type QueryBuilder

type QueryBuilder interface {
	Build(*Request) (string, *framework.Error)
}

QueryBuilder is an interface that defines the method for building a query. Each entity has its own builder struct that contains the query parameters required to retrieve the entity.

func GetQueryBuilder

func GetQueryBuilder(request *Request, _ *PageInfo) (QueryBuilder, *framework.Error)

type Request

type Request struct {
	// BaseURL is the Base URL of the datasource to query.
	BaseURL string

	// Token is the Authorization token to use to authentication with the datasource.
	Token string

	// PageSize is the maximum number of objects to return from the entity.
	PageSize int64

	// EntityExternalID is the external ID of the entity.
	// The external ID should match the API's resource name.
	EntityExternalID string

	// A Falcon Query Language filter applicable for REST API based entities.
	// See more at https://falconpy.io/Usage/Falcon-Query-Language.html#operators
	Filter *string

	// GraphQLCursor identifies the first object of the page to return, as returned by
	// the last request for the entity. This field is used to paginate entities from GraphQL APIs.
	// Optional. If not set, return the first page for this entity.
	GraphQLCursor *pagination.CompositeCursor[string]

	// RESTCursor identifies the first object of the page to return, as returned by
	// the last request for the entity. This field is used to paginate entities from REST APIs.
	// Optional. If not set, return the first page for this entity.
	RESTCursor *pagination.CompositeCursor[string]

	// EntityConfig contains entity metadata and a list of attributes to request along with the current request.
	EntityConfig *framework.EntityConfig

	// Ordered is a boolean that indicates whether the results should be ordered.
	Ordered bool

	Config *Config

	// RequestTimeoutSeconds is the timeout duration for requests made to datasources.
	// This should be set to the number of seconds to wait before timing out.
	RequestTimeoutSeconds int
}

Request is a request to the datasource.

type Response

type Response struct {
	// StatusCode is an HTTP status code.
	StatusCode int

	// RetryAfterHeader is the Retry-After response HTTP header, if set.
	RetryAfterHeader string

	// Objects is the list of parsed entity objects returned from the datasource.	// May be empty.
	Objects []map[string]any

	// NextGraphQLCursor is the cursor that identifies the first object of the next
	// page for GraphQL APIs.
	// May be empty.
	NextGraphQLCursor *pagination.CompositeCursor[string]

	// NextRESTCursor is the cursor that identifies the first object of the next
	// page for REST APIs.
	// May be empty.
	NextRESTCursor *pagination.CompositeCursor[string]
}

type ResponseItems

type ResponseItems struct {
	Nodes    []map[string]interface{} `json:"nodes"`
	PageInfo PageInfo                 `json:"pageInfo"`
}

type ScrollMetaFields

type ScrollMetaFields struct {
	PaginationInfo ScrollPaginationInfo `json:"pagination"`
}

type ScrollPaginationInfo

type ScrollPaginationInfo struct {
	Offset string `json:"offset"`
	Limit  int    `json:"limit"`
	Total  int    `json:"total"`
}

"devices/queries/devices-scroll/v1" endpoint has a string offset.

type UserQueryBuilder

type UserQueryBuilder struct {
	Archived bool
	Enabled  bool
	PageSize int64
	First    int64
}

func (*UserQueryBuilder) Build

func (b *UserQueryBuilder) Build(request *Request) (string, *framework.Error)

Directories

Path Synopsis
dev

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL