file_integrity

type AnalysisReport struct {
	CorellationId string        `json:"corellationId"`
	RequestId     string        `json:"requestId"`
	JobStatus     JobStatus     `json:"jobStatus"`
	JobId         string        `json:"jobId"`
	Report        Report        `json:"report"`
	AnalysisStats AnalysisStats `json:"analysis_stats"`
}

type AnalysisStats struct {
	TotalSeconds float64     `json:"total_seconds"`
	QueryStats   []QueryStat `json:"query_stats"`
}

type AnalysisType string

type AuthenticationResponse struct {
	AccessToken string `json:"access_token"`
	ExpiresIn   int    `json:"expires_in"`
	TokenType   string `json:"token_type"`
	ExpiresAt   time.Time
}

type Config struct {
	Paths               []string        `config:"paths" validate:"required"`
	HashTypes           []HashType      `config:"hash_types"`
	MaxFileSize         string          `config:"max_file_size"`
	MaxFileSizeBytes    uint64          `config:",ignore"`
	ScanAtStart         bool            `config:"scan_at_start"`
	ScanRatePerSec      string          `config:"scan_rate_per_sec"`
	ScanRateBytesPerSec uint64          `config:",ignore"`
	Recursive           bool            `config:"recursive"` // Recursive enables recursive monitoring of directories.
	ExcludeFiles        []match.Matcher `config:"exclude_files"`
	IncludeFiles        []match.Matcher `config:"include_files"`
	Intelix             IntelixConfig   `config:"intelix" validate:"required"`
}

type Digest []byte

type ErrorResponse struct {
	CorellationId string `json:"corellationId"`
	RequestId     string `json:"requestId"`
	Error         string `json:"error"`
	Message       string `json:"message"`
	CreatedAt     string `json:"createdAt"`
}

type Event struct {
	Timestamp     time.Time              `json:"timestamp"`             // Time of event.
	Path          string                 `json:"path"`                  // The path associated with the event.
	TargetPath    string                 `json:"target_path,omitempty"` // Target path for symlinks.
	Info          *Metadata              `json:"info"`                  // File metadata (if the file exists).
	Source        Source                 `json:"source"`                // Source of the event.
	Action        Action                 `json:"action"`                // Action (like created, updated).
	Hashes        map[HashType]Digest    `json:"hash,omitempty"`        // File hashes.
	LookupResults map[string]interface{} `json:"intelix,omitempty"`     // Intelix lookup results
	// contains filtered or unexported fields
}

type EventProducer interface {
	// Start starts the event producer and writes events to the returned
	// channel. When the producer is finished it will close the returned
	// channel. If the returned event channel is not drained the producer will
	// block (possibly causing data loss). The producer can be stopped
	// prematurely by closing the provided done channel. An error is returned
	// if the producer fails to start.
	Start(done <-chan struct{}) (<-chan Event, error)
}

type FileLookupResponse struct {
	CorellationId   string        `json:"corellationId"`
	RequestId       string        `json:"requestId"`
	ReputationScore int           `json:"reputationScore"`
	DetectionName   string        `json:"detectionName"`
	Ttl             int           `json:"ttl"`
	AnalysisStats   AnalysisStats `json:"analysis_stats"`
}

type HashType string

type Intelix struct {
	// contains filtered or unexported fields
}

type IntelixAnalysisCOnfig struct {
	// TODO: use human friendly units, https://godoc.org/github.com/alecthomas/units
	MinSize            uint64 `config:"min_size" validate:"required"`
	MaxSize            uint64 `config:"max_size" validate:"required"`
	ReportPollInterval int    `config:"report_poll_interval" validate:"required"`
	AnalysisTimeout    int    `config:"analysis_timeout" validate:"required"`
}

type IntelixConfig struct {
	Credentials                       IntelixCredentials    `config:"credentials" validate:"required"`
	Urls                              IntelixUrls           `config:"urls" validate:"required"`
	QueryTimeout                      int                   `config:"query_timeout" validate:"required"`
	StaticAnalysisReputationThreshold int                   `config:"static_analysis_reputation_threshold" validate:"required"`
	DynamicAnalysisScoreThreshold     int                   `config:"dynamic_analysis_score_threshold" validate:"required"`
	StaticAnalysisConig               IntelixAnalysisCOnfig `config:"static_analysis" validate:"required"`
	DynamicAnalysisConfig             IntelixAnalysisCOnfig `config:"dynamic_analysis" validate:"required"`
}

type IntelixCredentials struct {
	ClientId     string `config:"clientId" validate:"required"`
	ClientSecret string `config:"clientSecret" validate:"required"`
}

type IntelixScanner interface {
	MalwareLookup(sha256 Digest) (*FileLookupResponse, error)
	Analysis(analysisType AnalysisType, size uint64, filePath string) (*AnalysisReport, error)
}

type IntelixUrls struct {
	Proxy      string `config:"proxy_url"`
	AuthUrl    string `config:"auth_url" validate:"required"`
	IntelixUrl string `config:"intelix_url" validate:"required"`
}

type JobStatus string

type Metadata struct {
	Inode  uint64      `json:"inode"`
	UID    uint32      `json:"uid"`
	GID    uint32      `json:"gid"`
	SID    string      `json:"sid"`
	Owner  string      `json:"owner"`
	Group  string      `json:"group"`
	Size   uint64      `json:"size"`
	MTime  time.Time   `json:"mtime"`  // Last modification time.
	CTime  time.Time   `json:"ctime"`  // Last metadata change time.
	Type   Type        `json:"type"`   // File type (dir, file, symlink).
	Mode   os.FileMode `json:"mode"`   // Permissions
	SetUID bool        `json:"setuid"` // setuid bit (POSIX only)
	SetGID bool        `json:"setgid"` // setgid bit (POSIX only)
	Origin []string    `json:"origin"` // External origin info for the file (MacOS only)
}

type MetricSet struct {
	mb.BaseMetricSet
	// contains filtered or unexported fields
}

type QueryStat struct {
	QueryType QueryType `json:"query_type"`
	Seconds   float64   `json:"total_seconds"`
}

type QueryType string

type Report struct {
	// Common fields
	Submission      string
	AnalysisType    string
	AnalysisSubject interface{}
	Score           int
	// Static analysis fields
	AnalysisSummary    interface{} `json:"analysis_summary,omitempty"`
	ContainerAnalysis  interface{} `json:"container_analysis,omitempty"`
	Detection          interface{} `json:"detection,omitempty"`
	DocumentAnalysis   interface{} `json:"document_analysis,omitempty"`
	MlAggregateResults interface{} `json:"ml_aggregate_results,omitempty"`
	MlFile             interface{} `json:"ml_file,omitempty"`
	MlFilepath         interface{} `json:"ml_filepath,omitempty"`
	MlInputs           interface{} `json:"ml_inputs,omitempty"`
	PeAnalysis         interface{} `json:"pe_analysis,omitempty"`
	Reputation         interface{} `json:"reputation,omitempty"`
	Target             interface{} `json:"target,omitempty"`
	// Dynamic analysis Fields
	MaliciousActivity        interface{}    `json:"malicious_activity,omitempty"`
	MaliciousClassifications interface{}    `json:"malicious_classifications,omitempty"`
	DetonationInfo           interface{}    `json:"detonation_info,omitempty"`
	Files                    interface{}    `json:"files,omitempty"`
	Processes                interface{}    `json:"processes,omitempty"`
	Registry                 interface{}    `json:"registry,omitempty"`
	Network                  interface{}    `json:"network,omitempty"`
	Screenshots              []string       `json:"screenshots,omitempty"`
	ScreenshotMap            map[int]string `json:"screenshot,omitempty"`
	ActivityTree             interface{}    `json:"activity_tree,omitempty"`
}

type Source uint8

type Type uint8