Граф коммитов

1849 Коммитов

Автор SHA1 Сообщение Дата
Aaron Meihm 097d405e06 update gitignore, no need to explicitly ignore cfg files 2017-10-15 22:30:20 -05:00
Aaron Meihm 497c5b687e Merge pull request #404 from ameihm0912/agtid-path
agent: use path.Join instead of string concat to construct agtid/ok
2017-10-15 15:57:17 -05:00
Aaron Meihm 05d2e2ccdf agent: use path.Join instead of string concat to construct agtid/ok 2017-10-15 15:47:56 -05:00
Aaron Meihm 3f053d476a Merge pull request #403 from ameihm0912/readme-update
update README for audit changes
2017-09-21 16:23:06 -05:00
Aaron Meihm c160fd9aa5 update README for audit changes 2017-09-21 16:21:52 -05:00
Aaron Meihm 2ee625a09c Merge pull request #391 from ameihm0912/audit-module
Addition of base dispatch and audit modules
2017-09-21 16:12:52 -05:00
Aaron Meihm c8f12b65f1 dispatch: rename Details to Event 2017-09-21 15:47:40 -05:00
Aaron Meihm a532a39f12 dispatch: update documentation with various new parameters for SNS 2017-09-21 15:18:13 -05:00
Aaron Meihm ea08e7ec53 dispatch: remove region configuration parameter
The region will by defaulted to the region the instance is executing in.
2017-09-21 15:17:46 -05:00
Aaron Meihm ff9f893005 dispatch: optionally format records for mozdef 2017-09-21 14:29:43 -05:00
Aaron Meihm b4949aa1fd dispatch: add start of sns output mode 2017-09-20 16:00:48 -05:00
Aaron Meihm f26172fea5 vendor aws-sdk-go 2017-09-20 15:31:11 -05:00
Aaron Meihm de2094390f modulepack: add audit and dispatch modules 2017-09-20 15:08:28 -05:00
Aaron Meihm 5a6b98887d audit: add descriptions around rate and backlog limit options in doc 2017-09-20 15:04:02 -05:00
Aaron Meihm ab29f79ae9 dispatch: generate warning if messages are being dropped 2017-09-20 15:04:02 -05:00
Aaron Meihm 263c517f1d audit: make buffering channel size configurable 2017-09-20 15:04:02 -05:00
Aaron Meihm c53ddf51c8 audit: make including raw audit message optional 2017-09-20 15:04:02 -05:00
Aaron Meihm 51d17d6494 add audit and dispatch modules to test target 2017-09-20 15:04:02 -05:00
Aaron Meihm bb845cbd1e dispatch: wrap dispatched message in record header 2017-09-20 15:00:41 -05:00
Aaron Meihm bcc795666f send tags and environment with persist module config 2017-09-20 15:00:41 -05:00
Aaron Meihm dbb9fcce39 fswatch: use new alerting channel for alerts 2017-09-20 15:00:41 -05:00
Aaron Meihm 11d8638cfa update other persistent modules for new alert channel in handler 2017-09-20 15:00:41 -05:00
Aaron Meihm 3fb3e9745d add audit and dispatch modules for Linux
This adds two new modules, audit and dispatch with additional
modifications to the agent.

The audit module can be used to read and parse the kernel audit trail on
Linux systems. The agent can then log the audit messages, or write them
to the dispatch module.

The dispatch module is a general module used for alert forwarding from
the agent. If the dispatch module is running, any alerts the agent
receives from persistent modules will be forwarded to the active
dispatch module, where the dispatch module can write the message to a
remote endpoint.
2017-09-20 15:00:41 -05:00
Aaron Meihm 31a6fbf5e1 vendor mozilla libaudit-go 2017-09-20 15:00:41 -05:00
Aaron Meihm 00d70ad6c5 Merge pull request #402 from ameihm0912/remove-unused-tools
remove a couple unused scripts from tools
2017-09-20 14:44:09 -05:00
Aaron Meihm 4e028f29dc Merge branch 'master' into remove-unused-tools 2017-09-20 14:43:36 -05:00
Aaron Meihm 0955f035f2 Merge pull request #401 from ameihm0912/client-improve
Improvements to client tools
2017-09-20 14:41:38 -05:00
Aaron Meihm 3e5f6d4039 client: add missing comments to exported functions 2017-09-20 14:30:45 -05:00
Aaron Meihm 5d620756d0 client: fix comments on a number of additional functions 2017-09-20 14:30:45 -05:00
Aaron Meihm 4f72e1a7de client: godoc comment ReadEnvConfiguration 2017-09-20 14:30:45 -05:00
Aaron Meihm 816b6802cc client: remove punctuation and newlines from error strings 2017-09-20 14:30:45 -05:00
Aaron Meihm 2d2a2417ff client: godoc comment for ClientPassphrase 2017-09-20 14:30:45 -05:00
Aaron Meihm 405b1e73a3 client: comment macro functions 2017-09-20 14:30:45 -05:00
Aaron Meihm 68bdc01a39 client: comment exported client configuration types 2017-09-20 14:30:45 -05:00
Aaron Meihm 29b3bd69be client: improve configuration generator
Clean up the configuration generator function, handle some error
conditions better and make the output a bit nicer.
2017-09-20 14:30:45 -05:00
Aaron Meihm 0c6bec060d client: return proper errors from FindHomedir
Return an error from FindHomedir rather then panic with no context.
Also, modify one case here to use path.Join instead of expecting UNIX
filesystem layout.
2017-09-20 14:30:39 -05:00
Aaron Meihm f99cc05252 client: differentiate ENOENT when reading configuration file 2017-09-20 12:55:27 -05:00
Aaron Meihm 33a0a4ee8f mig-cmd: handle SIGINT nicer when interrupting an action
Use WaitGroups to avoid interleaving text if an action is cancelled.
This did not occur all the time, but this change should provide for more
consistent behavior.

mig-console didn't handle this at all; add a comment around this as well
and adjust mig-console to provide the additional extra parameter
required.
2017-09-19 17:20:59 -05:00
Aaron Meihm c6ec604c0f mig-cmd: include extra linefeed when action follow is interrupted
Prefix a linefeed to avoid mixing the notification on the same line as
the progress indicator.
2017-09-19 14:56:46 -05:00
Aaron Meihm 7ddc896ae2 mig-cmd: fix comment typo 2017-09-19 14:48:48 -05:00
Aaron Meihm 642c5cf9b3 mig-cmd: suppress default target warning using targetfound or targetnotfound 2017-09-19 14:43:37 -05:00
Aaron Meihm 47906f5c1e mig-cmd: reformat usage output for consistency 2017-09-19 14:32:10 -05:00
Aaron Meihm 0a3cdfa0fd mig-cmd: omit second value from range which is not required 2017-09-19 14:14:20 -05:00
Aaron Meihm e1d11cdf05 mig-cmd: default to all online agents if no target is specified 2017-09-19 14:09:52 -05:00
Aaron Meihm c73be87b43 mig-cmd: add a package comment 2017-09-19 13:55:33 -05:00
Aaron Meihm 73deb14de3 remove a couple unused scripts from tools 2017-09-19 13:08:57 -05:00
Aaron Meihm 1d5d2fbdc4 Merge pull request #400 from ameihm0912/config-ref-modpack
doc: include a reference to modulepack in the config guide
2017-09-19 13:03:06 -05:00
Aaron Meihm 6d7a6d8691 doc: include a reference to modulepack in the config guide
Add a reference to the modulepack package in the configuratino guide
that can help determine what tags to use to get certain module
configurations in the agent and clients.
2017-09-19 13:01:06 -05:00
Aaron Meihm e9679d71db Merge pull request #399 from ameihm0912/configguide
Refresh configuration guide
2017-09-19 12:35:56 -05:00
Aaron Meihm f8774104b1 doc: note module parameters when building clients in config guide 2017-09-19 12:26:01 -05:00