Aaron Meihm
097d405e06
update gitignore, no need to explicitly ignore cfg files
2017-10-15 22:30:20 -05:00
Aaron Meihm
497c5b687e
Merge pull request #404 from ameihm0912/agtid-path
...
agent: use path.Join instead of string concat to construct agtid/ok
2017-10-15 15:57:17 -05:00
Aaron Meihm
05d2e2ccdf
agent: use path.Join instead of string concat to construct agtid/ok
2017-10-15 15:47:56 -05:00
Aaron Meihm
3f053d476a
Merge pull request #403 from ameihm0912/readme-update
...
update README for audit changes
2017-09-21 16:23:06 -05:00
Aaron Meihm
c160fd9aa5
update README for audit changes
2017-09-21 16:21:52 -05:00
Aaron Meihm
2ee625a09c
Merge pull request #391 from ameihm0912/audit-module
...
Addition of base dispatch and audit modules
2017-09-21 16:12:52 -05:00
Aaron Meihm
c8f12b65f1
dispatch: rename Details to Event
2017-09-21 15:47:40 -05:00
Aaron Meihm
a532a39f12
dispatch: update documentation with various new parameters for SNS
2017-09-21 15:18:13 -05:00
Aaron Meihm
ea08e7ec53
dispatch: remove region configuration parameter
...
The region will by defaulted to the region the instance is executing in.
2017-09-21 15:17:46 -05:00
Aaron Meihm
ff9f893005
dispatch: optionally format records for mozdef
2017-09-21 14:29:43 -05:00
Aaron Meihm
b4949aa1fd
dispatch: add start of sns output mode
2017-09-20 16:00:48 -05:00
Aaron Meihm
f26172fea5
vendor aws-sdk-go
2017-09-20 15:31:11 -05:00
Aaron Meihm
de2094390f
modulepack: add audit and dispatch modules
2017-09-20 15:08:28 -05:00
Aaron Meihm
5a6b98887d
audit: add descriptions around rate and backlog limit options in doc
2017-09-20 15:04:02 -05:00
Aaron Meihm
ab29f79ae9
dispatch: generate warning if messages are being dropped
2017-09-20 15:04:02 -05:00
Aaron Meihm
263c517f1d
audit: make buffering channel size configurable
2017-09-20 15:04:02 -05:00
Aaron Meihm
c53ddf51c8
audit: make including raw audit message optional
2017-09-20 15:04:02 -05:00
Aaron Meihm
51d17d6494
add audit and dispatch modules to test target
2017-09-20 15:04:02 -05:00
Aaron Meihm
bb845cbd1e
dispatch: wrap dispatched message in record header
2017-09-20 15:00:41 -05:00
Aaron Meihm
bcc795666f
send tags and environment with persist module config
2017-09-20 15:00:41 -05:00
Aaron Meihm
dbb9fcce39
fswatch: use new alerting channel for alerts
2017-09-20 15:00:41 -05:00
Aaron Meihm
11d8638cfa
update other persistent modules for new alert channel in handler
2017-09-20 15:00:41 -05:00
Aaron Meihm
3fb3e9745d
add audit and dispatch modules for Linux
...
This adds two new modules, audit and dispatch with additional
modifications to the agent.
The audit module can be used to read and parse the kernel audit trail on
Linux systems. The agent can then log the audit messages, or write them
to the dispatch module.
The dispatch module is a general module used for alert forwarding from
the agent. If the dispatch module is running, any alerts the agent
receives from persistent modules will be forwarded to the active
dispatch module, where the dispatch module can write the message to a
remote endpoint.
2017-09-20 15:00:41 -05:00
Aaron Meihm
31a6fbf5e1
vendor mozilla libaudit-go
2017-09-20 15:00:41 -05:00
Aaron Meihm
00d70ad6c5
Merge pull request #402 from ameihm0912/remove-unused-tools
...
remove a couple unused scripts from tools
2017-09-20 14:44:09 -05:00
Aaron Meihm
4e028f29dc
Merge branch 'master' into remove-unused-tools
2017-09-20 14:43:36 -05:00
Aaron Meihm
0955f035f2
Merge pull request #401 from ameihm0912/client-improve
...
Improvements to client tools
2017-09-20 14:41:38 -05:00
Aaron Meihm
3e5f6d4039
client: add missing comments to exported functions
2017-09-20 14:30:45 -05:00
Aaron Meihm
5d620756d0
client: fix comments on a number of additional functions
2017-09-20 14:30:45 -05:00
Aaron Meihm
4f72e1a7de
client: godoc comment ReadEnvConfiguration
2017-09-20 14:30:45 -05:00
Aaron Meihm
816b6802cc
client: remove punctuation and newlines from error strings
2017-09-20 14:30:45 -05:00
Aaron Meihm
2d2a2417ff
client: godoc comment for ClientPassphrase
2017-09-20 14:30:45 -05:00
Aaron Meihm
405b1e73a3
client: comment macro functions
2017-09-20 14:30:45 -05:00
Aaron Meihm
68bdc01a39
client: comment exported client configuration types
2017-09-20 14:30:45 -05:00
Aaron Meihm
29b3bd69be
client: improve configuration generator
...
Clean up the configuration generator function, handle some error
conditions better and make the output a bit nicer.
2017-09-20 14:30:45 -05:00
Aaron Meihm
0c6bec060d
client: return proper errors from FindHomedir
...
Return an error from FindHomedir rather then panic with no context.
Also, modify one case here to use path.Join instead of expecting UNIX
filesystem layout.
2017-09-20 14:30:39 -05:00
Aaron Meihm
f99cc05252
client: differentiate ENOENT when reading configuration file
2017-09-20 12:55:27 -05:00
Aaron Meihm
33a0a4ee8f
mig-cmd: handle SIGINT nicer when interrupting an action
...
Use WaitGroups to avoid interleaving text if an action is cancelled.
This did not occur all the time, but this change should provide for more
consistent behavior.
mig-console didn't handle this at all; add a comment around this as well
and adjust mig-console to provide the additional extra parameter
required.
2017-09-19 17:20:59 -05:00
Aaron Meihm
c6ec604c0f
mig-cmd: include extra linefeed when action follow is interrupted
...
Prefix a linefeed to avoid mixing the notification on the same line as
the progress indicator.
2017-09-19 14:56:46 -05:00
Aaron Meihm
7ddc896ae2
mig-cmd: fix comment typo
2017-09-19 14:48:48 -05:00
Aaron Meihm
642c5cf9b3
mig-cmd: suppress default target warning using targetfound or targetnotfound
2017-09-19 14:43:37 -05:00
Aaron Meihm
47906f5c1e
mig-cmd: reformat usage output for consistency
2017-09-19 14:32:10 -05:00
Aaron Meihm
0a3cdfa0fd
mig-cmd: omit second value from range which is not required
2017-09-19 14:14:20 -05:00
Aaron Meihm
e1d11cdf05
mig-cmd: default to all online agents if no target is specified
2017-09-19 14:09:52 -05:00
Aaron Meihm
c73be87b43
mig-cmd: add a package comment
2017-09-19 13:55:33 -05:00
Aaron Meihm
73deb14de3
remove a couple unused scripts from tools
2017-09-19 13:08:57 -05:00
Aaron Meihm
1d5d2fbdc4
Merge pull request #400 from ameihm0912/config-ref-modpack
...
doc: include a reference to modulepack in the config guide
2017-09-19 13:03:06 -05:00
Aaron Meihm
6d7a6d8691
doc: include a reference to modulepack in the config guide
...
Add a reference to the modulepack package in the configuratino guide
that can help determine what tags to use to get certain module
configurations in the agent and clients.
2017-09-19 13:01:06 -05:00
Aaron Meihm
e9679d71db
Merge pull request #399 from ameihm0912/configguide
...
Refresh configuration guide
2017-09-19 12:35:56 -05:00
Aaron Meihm
f8774104b1
doc: note module parameters when building clients in config guide
2017-09-19 12:26:01 -05:00