Skip to content

Commit fda4258

Browse files
javutojavuto
authored
Merge pull request jmpsec#11 from jmpsec/osquery-upgrade
A lot of changes everywhere
2 parents 10b1e83 + e0ac952 commit fda4258

File tree

38 files changed

+878
-348
lines changed

38 files changed

+878
-348
lines changed

‎cmd/admin/handlers-get.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -850,6 +850,8 @@ func nodeHandler(w http.ResponseWriter, r *http.Request) {
850850
funcMap := template.FuncMap{
851851
"pastTimeAgo": pastTimeAgo,
852852
"jsonRawIndent": jsonRawIndent,
853+
"statusLogsLink": statusLogsLink,
854+
"resultLogsLink": resultLogsLink,
853855
}
854856
// Prepare template
855857
t, err := template.New("node.html").Funcs(funcMap).ParseFiles(

‎cmd/admin/json-carves.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,9 @@ func jsonCarvesHandler(w http.ResponseWriter, r *http.Request) {
9191
status = queries.StatusComplete
9292
}
9393
progress := make(CarveProgress)
94-
progress["total"] = q.Expected
95-
progress["completed"] = q.Executions
94+
progress["expected"] = q.Expected
95+
progress["executions"] = q.Executions
96+
progress["errors"] = q.Errors
9697
data := make(CarveData)
9798
data["path"] = q.Path
9899
data["name"] = q.Name

‎cmd/admin/json-queries.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ func jsonQueryHandler(w http.ResponseWriter, r *http.Request) {
8585
data := make(QueryData)
8686
data["query"] = q.Query
8787
data["name"] = q.Name
88+
data["link"] = queryResultLink(q.Name)
8889
// Preparing query targets
8990
ts, _ := queriesmgr.GetTargets(q.Name)
9091
_ts := []QueryTarget{}

‎cmd/admin/main.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ const (
3131
// Service name
3232
serviceName string = projectName + "-" + settings.ServiceAdmin
3333
// Service version
34-
serviceVersion string = "0.1.6"
34+
serviceVersion string = "0.1.7"
3535
// Service description
3636
serviceDescription string = "Admin service for osctrl"
3737
// Application description
@@ -51,7 +51,7 @@ const (
5151
// Default SAML configuration file
5252
samlConfigurationFile string = "config/saml.json"
5353
// osquery version to display tables
54-
osqueryTablesVersion string = "3.3.2"
54+
osqueryTablesVersion string = "4.0.1"
5555
// JSON file with osquery tables data
5656
osqueryTablesFile string = "data/" + osqueryTablesVersion + ".json"
5757
// Static files folder
@@ -104,7 +104,8 @@ var validAuth = map[string]bool{
104104
settings.AuthJSON: true,
105105
}
106106
var validLogging = map[string]bool{
107-
settings.LoggingDB: true,
107+
settings.LoggingDB: true,
108+
settings.LoggingSplunk: true,
108109
}
109110

110111
// Function to load the configuration file

‎cmd/admin/settings.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,28 @@ func loadingMetrics() {
3333
}
3434
}
3535

36+
// Function to load the logging settings
37+
func loadingLogging() {
38+
// Check if logging settings for query results link is ready
39+
if !settingsmgr.IsValue(settings.ServiceAdmin, settings.QueryResultLink) {
40+
if err := settingsmgr.NewStringValue(settings.ServiceAdmin, settings.QueryResultLink, settings.QueryLink); err != nil {
41+
log.Fatalf("Failed to add %s to settings: %v", settings.QueryResultLink, err)
42+
}
43+
}
44+
// Check if logging settings for status logs link is ready
45+
if !settingsmgr.IsValue(settings.ServiceAdmin, settings.StatusLogsLink) {
46+
if err := settingsmgr.NewStringValue(settings.ServiceAdmin, settings.StatusLogsLink, settings.StatusLink); err != nil {
47+
log.Fatalf("Failed to add %s to settings: %v", settings.DebugHTTP, err)
48+
}
49+
}
50+
// Check if logging settings for result logs link is ready
51+
if !settingsmgr.IsValue(settings.ServiceAdmin, settings.ResultLogsLink) {
52+
if err := settingsmgr.NewStringValue(settings.ServiceAdmin, settings.ResultLogsLink, settings.ResultsLink); err != nil {
53+
log.Fatalf("Failed to add %s to settings: %v", settings.DebugHTTP, err)
54+
}
55+
}
56+
}
57+
3658
// Function to load all settings for the service
3759
func loadingSettings() {
3860
// Check if service settings for debug service is ready
@@ -71,6 +93,8 @@ func loadingSettings() {
7193
}
7294
// Metrics
7395
loadingMetrics()
96+
// Logging
97+
loadingLogging()
7498
// Write JSON config to settings
7599
if err := settingsmgr.SetAllJSON(settings.ServiceAdmin, adminConfig.Listener, adminConfig.Port, adminConfig.Host, adminConfig.Auth, adminConfig.Logging); err != nil {
76100
log.Fatalf("Failed to add JSON values to configuration: %v", err)

‎cmd/admin/templates/carves-details.html‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,11 @@
2222
{{ with .Query }}
2323
<div class="card mt-2">
2424
<div class="card-header">
25-
<i class="fa fas fa-server"></i> Carved files for {{ .Name }}
25+
{{ if .Completed }}
26+
<i class="fas fa-flag-checkered"></i> [ <b>COMPLETED</b> ] - Carved files for {{ .Name }}
27+
{{ else }}
28+
<i class="fas fa-hourglass-half"></i> [ <b>ACTIVE</b> ] - Carved files for {{ .Name }}
29+
{{ end }}
2630
<div class="card-header-actions">
2731
<button class="btn btn-sm btn-outline-primary" data-tooltip="true"
2832
data-placement="bottom" title="Refresh details" onclick="refreshCarveDetails();">
@@ -35,8 +39,8 @@
3539
<thead>
3640
<tr>
3741
<th width="45%">Path to Carve</th>
38-
<th width="45%">Target</th>
39-
<th width="10%">Expected</th>
42+
<th width="40%">Target</th>
43+
<th width="15%">Expected / Status</th>
4044
</tr>
4145
</thead>
4246
<tbody>
@@ -56,7 +60,11 @@
5660
{{ end }}
5761
</table>
5862
</td>
59-
<td style="text-align: center;vertical-align: middle;">{{ .Expected }}</td>
63+
<td style="text-align: center;vertical-align: middle;">
64+
<span style="color:black;">{{ .Expected }}</span>/
65+
<b><span style="color:green;">{{ .Executions }}</span></b>/
66+
<b><span style="color:red;">{{ .Errors }}</span></b>
67+
</td>
6068
</tr>
6169
<tr>
6270
<td colspan="4" style="font-size: 1.5em; font-family: monospace;">{{ .Query }}</td>

‎cmd/admin/templates/carves.html‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -150,8 +150,9 @@
150150
data: 'progress',
151151
render: function (data, type, row, meta) {
152152
if (type === 'display') {
153-
return '<b>'+data.total+'</b>/' +
154-
'<b><span style="color:green;">'+data.completed+'</span></b>';
153+
return '<b>'+data.expected+'</b>/' +
154+
'<b><span style="color:green;">'+data.executions+'</span></b>/' +
155+
'<b><span style="color:red;">'+data.errors+'</span></b>';
155156
} else {
156157
return data;
157158
}

‎cmd/admin/templates/components/page-sidebar.html‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,9 @@
9292
{{if eq $e "opensuse"}}
9393
<i class="nav-icon fa fl-opensuse"></i>
9494
{{end}}
95+
{{if eq $e "arch"}}
96+
<i class="nav-icon fa fl-archlinux"></i>
97+
{{end}}
9598
{{if eq $e "unknown"}}
9699
<i class="nav-icon fa fa-question-circle"></i>
97100
{{end}}
@@ -128,6 +131,9 @@
128131
{{if eq $e "opensuse"}}
129132
<i class="nav-icon fa fl-opensuse"></i>
130133
{{end}}
134+
{{if eq $e "arch"}}
135+
<i class="nav-icon fa fl-archlinux"></i>
136+
{{end}}
131137
{{if eq $e "unknown"}}
132138
<i class="nav-icon fa fa-question-circle"></i>
133139
{{end}}
@@ -161,6 +167,9 @@
161167
{{if eq $e "freebsd"}}
162168
<i class="nav-icon fa fl-freebsd"></i>
163169
{{end}}
170+
{{if eq $e "arch"}}
171+
<i class="nav-icon fa fl-archlinux"></i>
172+
{{end}}
164173
{{if eq $e "opensuse"}}
165174
<i class="nav-icon fa fl-opensuse"></i>
166175
{{end}}
@@ -197,6 +206,9 @@
197206
{{if eq $e "freebsd"}}
198207
<i class="nav-icon fa fl-freebsd"></i>
199208
{{end}}
209+
{{if eq $e "arch"}}
210+
<i class="nav-icon fa fl-archlinux"></i>
211+
{{end}}
200212
{{if eq $e "opensuse"}}
201213
<i class="nav-icon fa fl-opensuse"></i>
202214
{{end}}

‎cmd/admin/templates/node.html‎

Lines changed: 32 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -59,14 +59,12 @@
5959
<li class="nav-item">
6060
<a class="nav-link" data-toggle="tab" href="#metadata" role="tab" aria-controls="metadata">Metadata</a>
6161
</li>
62-
{{ if eq $template.Logs "db" }}
6362
<li class="nav-item">
6463
<a class="nav-link" data-toggle="tab" href="#status-logs" role="tab" aria-controls="status-logs">Status Logs</a>
6564
</li>
6665
<li class="nav-item">
6766
<a class="nav-link" data-toggle="tab" href="#result-logs" role="tab" aria-controls="result-logs">Result Logs</a>
6867
</li>
69-
{{ end }}
7068
</ul>
7169

7270
<div class="tab-content">
@@ -122,6 +120,7 @@
122120
{{if eq .Platform "windows"}}<i class='fab fa-windows'></i> windows{{end}}
123121
{{if eq .Platform "freebsd"}}<i class='fl-freebsd'></i> freebsd{{end}}
124122
{{if eq .Platform "opensuse"}}<i class='fl-opensuse'></i> opensuse{{end}}
123+
{{if eq .Platform "arch"}}<i class='fl-archlinux'></i> arch{{end}}
125124
{{if eq .Platform "unknown"}}<i class='fa fa-question-circle'></i> unknown{{end}}
126125
- {{ .PlatformVersion }}</p>
127126
</div>
@@ -315,6 +314,19 @@
315314
</div>
316315
</div>
317316
</div>
317+
{{ else }}
318+
<div class="tab-pane fade" id="status-logs" role="tabpanel">
319+
<div class="card mt-2">
320+
<div id="result-card-header" class="card-header">
321+
<i class="fas fa-stream"></i> See status logs for node {{ .UUID }}
322+
</div>
323+
<div id="status-table" class="card-body">
324+
<a href="{{ statusLogsLink .UUID }}" target="_blank">
325+
See status logs in {{ $template.Logs }}
326+
</a>
327+
</div>
328+
</div>
329+
</div>
318330
{{ end }}
319331

320332
{{ if eq $template.Logs "db" }}
@@ -348,6 +360,19 @@
348360
</div>
349361
</div>
350362
</div>
363+
{{ else }}
364+
<div class="tab-pane fade" id="result-logs" role="tabpanel">
365+
<div class="card mt-2">
366+
<div id="result-card-header" class="card-header">
367+
<i class="fas fa-stream"></i> See result logs for node {{ .UUID }}
368+
</div>
369+
<div id="results-table" class="card-body">
370+
<a href="{{ resultLogsLink .UUID }}" target="_blank">
371+
See result logs in {{ $template.Logs }}
372+
</a>
373+
</div>
374+
</div>
375+
</div>
351376
{{ end }}
352377

353378
</div>
@@ -377,7 +402,6 @@
377402
<!-- custom JS -->
378403
<script src="/static/js/nodeactions.js"></script>
379404
<script src="/static/js/tables.js"></script>
380-
{{ if eq .Logs "db" }}
381405
{{ with .Node }}
382406
<script type="text/javascript">
383407
// Highlight.js code element initialization
@@ -392,6 +416,7 @@
392416
hljs.highlightBlock(block);
393417
});
394418

419+
{{ if eq $template.Logs "db" }}
395420
// Handle datatable ajax error
396421
$.fn.dataTable.ext.errMode = function(settings, helpPage, message) {
397422
console.log(message);
@@ -480,8 +505,6 @@
480505
{ width: '80%', targets: 2 }
481506
]
482507
});
483-
// Enable all tooltips
484-
$('[data-tooltip="true"]').tooltip({trigger : 'hover'});
485508

486509
// Display the number of seconds left and refresh for result logs
487510
var refreshSecondsResult = 60;
@@ -499,6 +522,7 @@
499522
tableResultLogs.ajax.reload();
500523
}
501524
},1000);
525+
{{ end }}
502526

503527
// Refresh sidebar stats
504528
beginStats();
@@ -514,10 +538,12 @@
514538
$("#carveModal").on('shown.bs.modal', function(){
515539
$(this).find('#carve').focus();
516540
});
541+
542+
// Enable all tooltips
543+
$('[data-tooltip="true"]').tooltip({trigger : 'hover'});
517544
});
518545
</script>
519546
{{ end }}
520-
{{ end }}
521547

522548
</body>
523549
</html>

‎cmd/admin/templates/queries-logs.html‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,11 @@
2020
{{ with .Query }}
2121
<div class="card mt-2">
2222
<div class="card-header">
23-
<i class="fa fas fa-server"></i> Results for {{ .Name }}
23+
{{ if .Completed }}
24+
<i class="fas fa-flag-checkered"></i> [ <b>COMPLETED</b> ] - Results for {{ .Name }}
25+
{{ else }}
26+
<i class="fas fa-hourglass-half"></i> [ <b>ACTIVE</b> ] - Results for {{ .Name }}
27+
{{ end }}
2428
<div class="card-header-actions">
2529
<button class="btn btn-sm btn-outline-primary" data-tooltip="true"
2630
data-placement="bottom" title="Refresh table" onclick="refreshTableNow('tableQueryLogs');">
@@ -34,7 +38,7 @@
3438
<tr>
3539
<th width="60%">Query</th>
3640
<th width="25%">Target</th>
37-
<th width="15%">Expected</th>
41+
<th width="15%">Expected / Status</th>
3842
</tr>
3943
</thead>
4044
<tbody>
@@ -54,7 +58,11 @@
5458
{{ end }}
5559
</table>
5660
</td>
57-
<td style="text-align: center;vertical-align: middle;">{{ .Expected }}</td>
61+
<td style="text-align: center;vertical-align: middle;">
62+
<span style="color:black;">{{ .Expected }}</span>/
63+
<b><span style="color:green;">{{ .Executions }}</span></b>/
64+
<b><span style="color:red;">{{ .Errors }}</span></b>
65+
</td>
5866
</tr>
5967
</tbody>
6068
</table>

0 commit comments

Comments
 (0)