chore: import upstream snapshot with attribution
This commit is contained in:
wehub-resource-sync
Executable
+554
@@ -0,0 +1,554 @@
|
||||
<!-- TOC -->
|
||||
|
||||
- [Intro](#intro)
|
||||
- [Basic Requirements](#basic-requirements)
|
||||
- [`info`](#info)
|
||||
- [`parse-campaign`](#parse-campaign)
|
||||
- [Parsing a single file](#parsing-a-single-file)
|
||||
- [Line 1](#line-1)
|
||||
- [Line 2](#line-2)
|
||||
- [Line 3 & Output](#line-3--output)
|
||||
- [Line 4](#line-4)
|
||||
- [Parsing the log file](#parsing-the-log-file)
|
||||
- [Make Parser Executable](#make-parser-executable)
|
||||
- [Conclusion](#conclusion)
|
||||
<!-- TOC -->
|
||||
|
||||
# Intro
|
||||
|
||||
This is a guide for creating a parser that processes C2 data into a format that RedEye can integrate. A RedEye parser can be written in any programming language, as long as it can be invoked from the command-line and return messages through stdout. In summary, RedEye parsers are standalone command-line programs, placed in the `parsers` folder, and invoked by RedEye.
|
||||
|
||||
For this guide, we're going to create a simple parser called `custom-redeye-parser` using NodeJS, but the concepts can be applied to any language. We'll walk you through the process of creating a parser and detail each subcommand that can be implemented to use in RedEye.
|
||||
|
||||
# Basic Requirements
|
||||
|
||||
A parser must support a very simple set of commands and arguments that will be invoked by RedEye. Most languages have a built-in method for reading command-line arguments, but you can also use a third-party library.
|
||||
|
||||
Before we start implementing the first command, we should go over what communication between RedEye and your custom parser looks like.
|
||||
Communication to the parser happens through command-line arguments only.
|
||||
The parser communicates back through standard output (stdout) with messages of stringified JSON data.
|
||||
Here's an example of the communication lifecycle between RedEye and our parser:
|
||||
|
||||
Here's a quick overview the communication lifecycle with a parser named `custom-redeye-parser`:
|
||||
|
||||
1. On startup, RedEye requests information about the parser using the `custom-redeye-parser info` command
|
||||
2. A User selects our `custom-redeye-parser` in the RedEye interface and uploads files to be parsed
|
||||
3. RedEye invokes the parser with a path to the user uploaded files: `custom-redeye-parser parser-campaign --folder </path/to/folder>`
|
||||
4. The parser processes the files and returns the JSON object (through stdout) with the parsed data
|
||||
5. RedEye processes the JSON object and stores the data in the database
|
||||
|
||||
Messages sent by the parser must always be formatted as: `[<TYPE>] <JSON>\n`. In our example, we're using the `[DATA]` message type, which tells RedEye this is the return data from the command.
|
||||
You can see more information on all the message types in the [Message Types](#message-types) section.
|
||||
|
||||
Now let's get into the first command RedEye will send to your parser.
|
||||
|
||||
# `info`
|
||||
|
||||
The `info` command _informs_ RedEye on our parsers configuration and customizes our parsers upload form within RedEye's UI. On startup, RedEye will send the `info` command (example: `custom-redeye-parser info`) to each parser it detects (or is configured to use).
|
||||
The info our parser needs to send includes the parser ID, display name, and upload form configuration. Here's the `info` command implemented for the `custom-redeye-parser` with some comments to explain each property:
|
||||
|
||||
```typescript
|
||||
#!/usr/bin/env node
|
||||
function info() {
|
||||
const message =
|
||||
'[DATA] ' + // The start of our message with the DATA message type
|
||||
JSON.stringify({
|
||||
version: 1, // The version of the RedEye parser config that the parser is compatible with
|
||||
id: 'custom-redeye-parser', // ID for parser, should match the name of the binary file or command
|
||||
name: 'Custom RedEye Parser', // The display name of the parser
|
||||
|
||||
// Configures the upload form in the RedEye client for the parser
|
||||
uploadForm: {
|
||||
serverDelineation: 'Database', // How our C2 data is separated, by folders of files or database/config file
|
||||
enabledInBlueTeam: false, // Whether the parser is enabled for Blue Team users
|
||||
tabTitle: 'C2 Framework', // The title of the upload option in the selection menu
|
||||
fileUpload: {
|
||||
type: 'Directory', // The type of upload, is it a single file or a directory
|
||||
validate: 'None', // How to validate the files uploaded, more on this later
|
||||
description: 'Upload a directory of C2 log files', // A description of the upload
|
||||
},
|
||||
fileDisplay: {
|
||||
editable: true, // Whether the user can edit the server names before uploading
|
||||
},
|
||||
},
|
||||
}) +
|
||||
'\n'; // End the message with a newline
|
||||
process.stdout.write(message);
|
||||
}
|
||||
|
||||
if (process.argv[2] === 'info') {
|
||||
// Check if the command is info
|
||||
info();
|
||||
}
|
||||
```
|
||||
|
||||
If you put this code in a file (for the example, we called our file `custom-redeye-parser`), make it executable, and place it in `parsers` folder; You can start RedEye (with "parsers" set to true RedEye's `config.json`) and see our parser available in the "Add Campaign" dialog's Source options.
|
||||
|
||||
|
||||
|
||||
Now that we have our parser configured and recognized by RedEye, we can start implementing the `parse-campaign` command.
|
||||
|
||||
# `parse-campaign`
|
||||
|
||||
The `parse-campaign` command processes the users uploaded files and returns the transformed data to RedEye.
|
||||
It is invoked with the following command: `custom-redeye-parser parse-campaign --folder </path/to/folder>`.
|
||||
The `--folder` argument is the path to a folder containing the files we need to parse.
|
||||
Our parser needs to read those files and transform the data into a network graph that RedEye can ingest.
|
||||
How you implement this largely depends on what your data looks like, we'll walk through each of the properties in the data structure and show an example of transforming the data into the RedEye format.
|
||||
|
||||
Here's an overview of what each property in the data structure represents:
|
||||
|
||||
`Servers` are the C2 servers that `Operators` use to send `Commands` to `Beacons`.
|
||||
`Hosts` are target assets in a network like workstations, laptops, network servers, etc.
|
||||
`Beacons` are the C2 agents that run on `Hosts` and execute `Commands`.
|
||||
`Commands` are the actions that `Operators` execute on `Beacons` through `Servers`.
|
||||
`Links` are the connections from `Servers` to `Beacons` and `Beacons` to `Beacons`.
|
||||
`Operators` are the drivers of action, they initiate `Commands` through `Servers` that `Beacons` run on `Hosts`.
|
||||
|
||||
And this is the relationship between each property:
|
||||
|
||||
- `Operators` are standalone entities referenced by the `Commands` they execute.
|
||||
- `Servers` are the starting point of our network graph.
|
||||
- `Hosts` are assigned to the first `Server` that establishes a connection,
|
||||
- `Beacons` are assigned to `Hosts`,
|
||||
- `Commands` are assigned to `Beacons`.
|
||||
- `Links` connect `Servers` to `Beacons` and `Beacons` to `Beacons`.
|
||||
|
||||
Here is the JSON structure that RedEye expects:
|
||||
|
||||
```typescript
|
||||
interface ParserOutput {
|
||||
servers: { [server: string]: ParserServer };
|
||||
hosts: { [host: string]: ParserHost };
|
||||
beacons: { [beacon: string]: ParserBeacon };
|
||||
operators: { [operator: string]: ParserOperator };
|
||||
commands: { [command: string]: ParserCommand };
|
||||
links: { [link: string]: ParserLink };
|
||||
}
|
||||
```
|
||||
|
||||
For an in-depth explanation of each property, check out the [Commands API Guide](./commands-api/parse-campaign/index.md)
|
||||
|
||||
## Parsing a single file
|
||||
|
||||
To make this easier to understand, we'll start by parsing a single database/json file and transforming it into the RedEye data structure.
|
||||
This example data file is an ideal format for RedEye, not all C2 log files will be this easy to parse, but it's to focus on how RedEye's data structure works rather than understanding a log format.
|
||||
|
||||
Let's start by parsing a single file and transforming it into the RedEye data structure.
|
||||
For this example, we'll fabricate a simplified C2 log file called `c2-log-files.txt`:
|
||||
|
||||
```
|
||||
2023-08-17T19:37:41 [INIT] <thor> server - name: server1; type: https;
|
||||
2023-08-17T19:38:41 [INIT] <thor> beacon - name: beacon1; from: server1; procces: explorer.exe; pid: 1234; port: 443; - on: host1; ip: 192.168.23.1; os: Windows 10.0.19041;
|
||||
2023-08-17T19:39:41 [COMMAND] <thor> beacon1 - mitre: T1057 - ps
|
||||
2023-08-17T19:40:11 [OUTPUT]
|
||||
***
|
||||
[System Process] 0 0
|
||||
System 0 4
|
||||
Registry 4 68
|
||||
smss.exe 4 268
|
||||
***
|
||||
2023-08-17T19:44:23 [INIT] <thor> beacon - name: beacon2; from: beacon1; procces: notepad.exe; pid: 3456; port: 443; - on: host1; ip: 192.168.23.1; os: Windows 10.0.19041;
|
||||
```
|
||||
|
||||
Let break this down into how it maps to the RedEye data structure:
|
||||
|
||||
#### Line 1
|
||||
|
||||
`2023-08-17T19:37:41 [INIT] <thor> server - name: server1; type: https;`
|
||||
|
||||
Here's the information we can extract from this line:
|
||||
|
||||
- The timestamp of the event: `2023-08-17T19:37:41`
|
||||
- This event is initializing a C2 entity: `INIT`
|
||||
- The operator of the event: `thor`
|
||||
- The type of C2 entity: `server`
|
||||
- Finally, the name and type of the server: `server1` & `https`
|
||||
|
||||
And formatted for RedEye:
|
||||
|
||||
```json
|
||||
{
|
||||
"servers": {
|
||||
"server1": {
|
||||
"name": "server1",
|
||||
"type": "https"
|
||||
}
|
||||
},
|
||||
"operators": {
|
||||
"thor": {
|
||||
"name": "thor"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Line 2
|
||||
|
||||
`2023-08-17T19:38:41 [INIT] <thor> beacon - name: beacon1; from: server1; procces: explorer.exe; pid: 1234; port: 443; - on: host1; ip: 192.168.23.1; os: Windows 10.0.19041;`
|
||||
|
||||
Here's the information we can extract from this line:
|
||||
|
||||
- The timestamp of the event: `2023-08-17T19:38:41`
|
||||
- This event is initializing a C2 entity: `INIT`
|
||||
- The operator of the event: `thor`
|
||||
- The type of C2 entity: `beacon`
|
||||
- The name of the beacon: `beacon1`
|
||||
- The server the beacon is connected to: `server1`
|
||||
- The process name and PID of the beacon: `explorer.exe` & `1234`
|
||||
- The port the beacon is connected to: `443`
|
||||
- The host the beacon is running on: `host1`
|
||||
- The IP, OS, and OS version of the host: `192.168.23.1` & `Windows` & `10.0.19041`
|
||||
|
||||
And all the new information formatted for RedEye:
|
||||
|
||||
```json
|
||||
{
|
||||
"hosts": {
|
||||
"host1": {
|
||||
"name": "host1",
|
||||
"ip": "",
|
||||
"os": "Windows",
|
||||
"osVersion": "10.0.19041"
|
||||
}
|
||||
},
|
||||
"beacons": {
|
||||
"beacon1": {
|
||||
"name": "beacon1",
|
||||
"process": "explorer.exe",
|
||||
"pid": "1234",
|
||||
"port": "443",
|
||||
"host": "host1",
|
||||
"server": "server1"
|
||||
}
|
||||
},
|
||||
"links": {
|
||||
"server1-beacon1": {
|
||||
"from": "server1",
|
||||
"to": "beacon1"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Line 3 & Output
|
||||
|
||||
```
|
||||
2023-08-17T19:39:41 [COMMAND] <thor> beacon1 - mitre: T1057 -> ps
|
||||
2023-08-17T19:40:11 [OUTPUT]
|
||||
***
|
||||
[System Process] 0 0
|
||||
System 0 4
|
||||
Registry 4 68
|
||||
smss.exe 4 268
|
||||
***
|
||||
```
|
||||
|
||||
Here's the information we can extract from these lines:
|
||||
COMMAND
|
||||
|
||||
- The timestamp of the command event: `2023-08-17T19:39:41`
|
||||
- This event is a command: `COMMAND`
|
||||
- The operator of the event: `thor`
|
||||
- The beacon the command is being sent to: `beacon1`
|
||||
- The MITRE ATT&CK technique being executed: `T1057`
|
||||
- The command being executed: `ps`
|
||||
OUTPUT
|
||||
- The timestamp of the output event: `2023-08-17T19:40:11`
|
||||
- This event is output from a command: `OUTPUT`
|
||||
- The beacon the output is from: `beacon1`
|
||||
- The output of the command between the `***` delimiters
|
||||
|
||||
And all the new information formatted for RedEye:
|
||||
|
||||
```
|
||||
{
|
||||
"commands": {
|
||||
"ps-beacon1-17-08-23 19:39:41": {
|
||||
"attackIds": ["T1057"],
|
||||
"input": {
|
||||
"blob": "ps",
|
||||
"dateTime": "17-08-23 19:39:41",
|
||||
"logType": "BEACON",
|
||||
"filePath": "<folder-with-log-files>/c2-log-files.txt",
|
||||
"lineNumber": "3"
|
||||
},
|
||||
"output": {
|
||||
"blob": "[System Process] 0 0\nSystem 0 4\nRegistry 4 68\nsmss.exe 4 268\n",
|
||||
"dateTime": "17-08-23 19:40:11",
|
||||
"logType": "BEACON",
|
||||
"filePath": "<folder-with-log-files>/c2-log-files.txt",
|
||||
"lineNumber": "4"
|
||||
},
|
||||
"beacon": "beacon1",
|
||||
"operator": "thor",
|
||||
"timestamp": "17-08-23 19:39:41"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Line 4
|
||||
|
||||
`2023-08-17T19:44:23 [INIT] <thor> beacon - name: beacon2; from: beacon1; procces: notepad.exe; pid: 3456; port: 443; - on: host1; ip: 192.168.23.1; os: Windows 10.0.19041;`
|
||||
|
||||
Here's the information we can extract from this line:
|
||||
|
||||
- The timestamp of the event: `2023-08-17T19:44:23`
|
||||
- This event is initializing a C2 entity: `INIT`
|
||||
- The operator of the event: `thor`
|
||||
- The type of C2 entity: `beacon`
|
||||
- The name of the beacon: `beacon2`
|
||||
- The beacon the beacon is connected to: `beacon1`
|
||||
- The process name and PID of the beacon: `notepad.exe` & `3456`
|
||||
- The port the beacon is connected to: `443`
|
||||
- The host the beacon is running on: `host1`
|
||||
- The IP, OS, and OS version of the host: `192.168.23.1` & `Windows` & `10.0.19041`
|
||||
|
||||
And all the new information formatted for RedEye:
|
||||
|
||||
```json5
|
||||
{
|
||||
beacons: {
|
||||
// ...
|
||||
beacon2: {
|
||||
name: 'beacon2',
|
||||
process: 'notepad.exe',
|
||||
pid: '3456',
|
||||
port: '443',
|
||||
host: 'host1',
|
||||
server: 'server1',
|
||||
},
|
||||
},
|
||||
links: {
|
||||
// ...
|
||||
'beacon1-beacon2': {
|
||||
from: 'beacon1',
|
||||
to: 'beacon2',
|
||||
},
|
||||
},
|
||||
}
|
||||
```
|
||||
|
||||
Here is the final data structure for our example:
|
||||
|
||||
```json5
|
||||
{
|
||||
servers: {
|
||||
server1: {
|
||||
name: 'server1',
|
||||
type: 'https',
|
||||
},
|
||||
},
|
||||
hosts: {
|
||||
host1: {
|
||||
name: 'host1',
|
||||
ip: '192.168.23.1',
|
||||
os: 'Windows',
|
||||
osVersion: '10.0.19041',
|
||||
},
|
||||
},
|
||||
beacons: {
|
||||
beacon1: {
|
||||
name: 'beacon1',
|
||||
process: 'explorer.exe',
|
||||
pid: '1234',
|
||||
port: '443',
|
||||
host: 'host1',
|
||||
server: 'server1',
|
||||
commands: ['ps'],
|
||||
},
|
||||
beacon2: {
|
||||
name: 'beacon2',
|
||||
process: 'notepad.exe',
|
||||
pid: '3456',
|
||||
port: '443',
|
||||
host: 'host1',
|
||||
server: 'server1',
|
||||
},
|
||||
},
|
||||
operators: {
|
||||
thor: {
|
||||
name: 'thor',
|
||||
},
|
||||
},
|
||||
links: {
|
||||
'server1-beacon1': {
|
||||
from: 'server1',
|
||||
to: 'beacon1',
|
||||
},
|
||||
'beacon1-beacon2': {
|
||||
from: 'beacon1',
|
||||
to: 'beacon2',
|
||||
},
|
||||
},
|
||||
commands: {
|
||||
'ps-beacon1-17-08-23 19:39:41': {
|
||||
attackIds: ['T1057'],
|
||||
input: {
|
||||
blob: 'ps',
|
||||
dateTime: '17-08-23 19:39:41',
|
||||
logType: 'BEACON',
|
||||
filePath: '<folder-with-log-files>/c2-log-files.txt',
|
||||
lineNumber: '3',
|
||||
},
|
||||
beacon: 'beacon1',
|
||||
operator: 'thor',
|
||||
timestamp: '17-08-23 19:39:41',
|
||||
},
|
||||
},
|
||||
}
|
||||
```
|
||||
|
||||
### Parsing the log file
|
||||
|
||||
Now that we've gone over how to identify what data to extract and how to format it for RedEye. Let's update the previous file we created and add the following code:
|
||||
|
||||
```typescript
|
||||
#!/usr/bin/env node
|
||||
import fileSystem from 'fs';
|
||||
|
||||
function parseLogFile() {
|
||||
const logPath = process.argv[4].replaceAll('"', ''); // Get the path and remove the quotes around it
|
||||
const logFile = fileSystem.readFileSync(`${logPath}/c2-log-files.txt`, 'utf8'); // Read the log file from the path passed in the command
|
||||
const lines = logFile.split('\n'); // Split the log file into lines
|
||||
const output = {
|
||||
// Create an empty object to store our output
|
||||
servers: {},
|
||||
hosts: {},
|
||||
beacons: {},
|
||||
operators: {},
|
||||
commands: {},
|
||||
links: {},
|
||||
};
|
||||
|
||||
const totalLines = lines.length;
|
||||
while (lines.length > 0) {
|
||||
// Iterate over each line in the log file
|
||||
const line = lines.shift(); // Get the first line in the log file
|
||||
if (!line.length) {
|
||||
break; // If the line is empty, break out of the loop
|
||||
}
|
||||
const [messageInfo, ...message] = line.split(' - '); // Split the line into its parts
|
||||
const [timestamp, type, operatorItem, source] = messageInfo.split(' '); // Split the line into its parts
|
||||
const operator = operatorItem.replace('<', '').replace('>', ''); // Get the operator name
|
||||
if (type === '[INIT]') {
|
||||
// Check if the line is an INIT message
|
||||
const properties = getProperties(message[0]);
|
||||
|
||||
if (source === 'server') {
|
||||
output.servers[properties.name] = {
|
||||
// Create a new server object
|
||||
name: properties.name,
|
||||
type: properties.type,
|
||||
};
|
||||
}
|
||||
|
||||
if (source === 'beacon') {
|
||||
const hostProperties = getProperties(message[1]);
|
||||
output.beacons[properties.name] = {
|
||||
// Create a new beacon object
|
||||
name: properties.name,
|
||||
host: hostProperties.on,
|
||||
process: properties.process,
|
||||
processId: properties.pid,
|
||||
port: properties.port,
|
||||
server: properties.server,
|
||||
};
|
||||
output.links[`${properties.name}-${properties.from}`] = {
|
||||
// Create a new link object
|
||||
source: properties.name,
|
||||
target: properties.from,
|
||||
};
|
||||
if (!output.hosts[hostProperties.on]) {
|
||||
const [os, osVersion] = hostProperties.os.split(' '); // Get the os and os version of the host
|
||||
output.hosts[hostProperties.on] = {
|
||||
name: hostProperties.on,
|
||||
ip: hostProperties.ip,
|
||||
os: os,
|
||||
osVersion: osVersion,
|
||||
};
|
||||
}
|
||||
}
|
||||
}
|
||||
if (type === '[COMMAND]') {
|
||||
// Check if the line is a COMMAND message
|
||||
const [commandProps, command] = message;
|
||||
const properties = getProperties(commandProps);
|
||||
const inputLineNumber = totalLines - lines.length;
|
||||
|
||||
// Get the command output
|
||||
let commandOutput = '';
|
||||
|
||||
const [commandOutputTimestamp] = lines.shift().split(' ');
|
||||
lines.shift(); // Move past starting *** line
|
||||
while (lines[0] !== '***') {
|
||||
commandOutput += lines.shift() + '\n';
|
||||
}
|
||||
lines.shift(); // Move past ending *** line
|
||||
const outputLineNumber = totalLines - lines.length;
|
||||
|
||||
// Create a new command object
|
||||
output.commands[`${command}-${source}-${timestamp}`] = {
|
||||
// Create a new command object
|
||||
attackIds: properties.mitre.split(','),
|
||||
input: {
|
||||
blob: command,
|
||||
dateTime: timestamp,
|
||||
logType: 'BEACON',
|
||||
lineType: 'INPUT',
|
||||
filePath: process.argv[4],
|
||||
lineNumber: inputLineNumber,
|
||||
},
|
||||
output: {
|
||||
blob: commandOutput,
|
||||
dateTime: commandOutputTimestamp,
|
||||
logType: 'BEACON',
|
||||
lineType: 'OUTPUT',
|
||||
filePath: process.argv[4],
|
||||
lineNumber: outputLineNumber,
|
||||
},
|
||||
beacon: source,
|
||||
operator: operator,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
const message =
|
||||
'[DATA] ' + // The start of our message with the DATA message type
|
||||
JSON.stringify(output); // The output object as a JSON string
|
||||
+'\n'; // A new line character to end the message
|
||||
|
||||
process.stdout.write(message); // Write the message to stdout
|
||||
}
|
||||
|
||||
function getProperties(message) {
|
||||
const properties = {};
|
||||
|
||||
for (const property of message.split('; ')) {
|
||||
// Iterate over each property in the message
|
||||
const [key, value] = property.split(': '); // Split the property into its parts
|
||||
properties[key] = value; // Add the property to the properties object
|
||||
}
|
||||
|
||||
return properties;
|
||||
}
|
||||
|
||||
if (process.argv[2] === 'info') {
|
||||
// Check if the command is info
|
||||
info();
|
||||
} else if (process.argv[2] === 'parse-campaign') {
|
||||
// Check if the command is 'parse-campaign'
|
||||
parseLogFile();
|
||||
}
|
||||
```
|
||||
|
||||
You now have a fully functioning parser that can be integrated into RedEye!
|
||||
|
||||
# Make Parser Executable
|
||||
|
||||
The final step is to make your parser executable and add it to the `parsers` folder in the RedEye directory. RedEye will automatically detect the parser if the `parsers` option in `config.json` is set to true.
|
||||
|
||||
# Conclusion
|
||||
|
||||
In this guide, we went over what a custom RedEye parser is, went over how to implement the `info` command, and implemented a log parser for the `parse-campaign` command. We look forward to seeing what you create!
|
||||
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"$ref": "#/definitions/LoggerOptions",
|
||||
"definitions": {
|
||||
"LoggerOptions": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"message": {
|
||||
"type": "string"
|
||||
},
|
||||
"tags": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"level": {
|
||||
"enum": ["debug", "error", "warn"],
|
||||
"type": "string"
|
||||
},
|
||||
"error": {},
|
||||
"payload": {}
|
||||
},
|
||||
"required": ["message"]
|
||||
}
|
||||
},
|
||||
"$schema": "http://json-schema.org/draft-07/schema#"
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
{
|
||||
"$ref": "#/definitions/ParserInfo",
|
||||
"definitions": {
|
||||
"ParserInfo": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"version": {
|
||||
"description": "The version of the RedEye parser config that the parser is compatible with",
|
||||
"type": "number"
|
||||
},
|
||||
"id": {
|
||||
"description": "ID for parser, should match the standard name of the binary file or command\n// The parser binary is named 'my-parser'\nid = 'my-parser'",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "The display name of the parser",
|
||||
"type": "string"
|
||||
},
|
||||
"description": {
|
||||
"description": "An optional description of the parser",
|
||||
"type": "string"
|
||||
},
|
||||
"uploadForm": {
|
||||
"$ref": "#/definitions/UploadForm",
|
||||
"description": "An object that configures the upload form in RedEye's UI"
|
||||
}
|
||||
},
|
||||
"required": ["id", "name", "uploadForm", "version"]
|
||||
},
|
||||
"UploadForm": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"tabTitle": {
|
||||
"description": "The title of the tab in the upload form",
|
||||
"type": "string"
|
||||
},
|
||||
"enabledInBlueTeam": {
|
||||
"description": "Whether the parser is enabled in blue team mode\nThis should be false unless the parser is intended to be used by a blue team\nThe Blue team mode is intended to be a read only mode",
|
||||
"type": "boolean"
|
||||
},
|
||||
"serverDelineation": {
|
||||
"description": "The type of server delineation used by the parser",
|
||||
"enum": ["Database", "Folder"],
|
||||
"type": "string"
|
||||
},
|
||||
"fileUpload": {
|
||||
"description": "An object that configures the file upload portion of the upload form",
|
||||
"anyOf": [
|
||||
{
|
||||
"allOf": [
|
||||
{
|
||||
"$ref": "#/definitions/FileUpload"
|
||||
},
|
||||
{
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"validate": {
|
||||
"enum": ["None", "Parser"],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["validate"]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"allOf": [
|
||||
{
|
||||
"$ref": "#/definitions/FileUpload"
|
||||
},
|
||||
{
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"validate": {
|
||||
"description": "validate uploaded files in client by file extensions",
|
||||
"type": "string",
|
||||
"const": "FileExtensions"
|
||||
},
|
||||
"acceptedExtensions": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["acceptedExtensions", "validate"]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"fileDisplay": {
|
||||
"$ref": "#/definitions/FileDisplay",
|
||||
"description": "An object that configures the list of servers/files after upload"
|
||||
}
|
||||
},
|
||||
"required": ["enabledInBlueTeam", "fileDisplay", "fileUpload", "serverDelineation", "tabTitle"]
|
||||
},
|
||||
"FileUpload": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"description": "The type of upload, a selection of files or a directory",
|
||||
"enum": ["Directory", "File"],
|
||||
"type": "string"
|
||||
},
|
||||
"description": {
|
||||
"description": "Describes what should be uploaded for the selected parser",
|
||||
"type": "string"
|
||||
},
|
||||
"example": {
|
||||
"description": "A string that will be displayed in the upload form as an example of the type of file or shape of directory to upload",
|
||||
"default": "undefined",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["description", "type"]
|
||||
},
|
||||
"FileDisplay": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"editable": {
|
||||
"description": "Whether the names of the servers inferred from the uploaded files are editable\nA user may want to change the name of a server to something more descriptive",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": ["editable"]
|
||||
}
|
||||
},
|
||||
"$schema": "http://json-schema.org/draft-07/schema#"
|
||||
}
|
||||
@@ -0,0 +1,296 @@
|
||||
{
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"definitions": {
|
||||
"ParserLogEntry": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"blob": {
|
||||
"description": "The text of the log entry, can be a command input or output",
|
||||
"type": "string"
|
||||
},
|
||||
"filepath": {
|
||||
"description": "Local path to the file that the log entry was found in",
|
||||
"type": "string"
|
||||
},
|
||||
"lineNumber": {
|
||||
"description": "The starting line number of the log entry in the file",
|
||||
"type": "number"
|
||||
},
|
||||
"lineType": {
|
||||
"description": "The type of log line if the logType is 'BEACON'",
|
||||
"enum": ["CHECKIN", "ERROR", "INDICATOR", "INPUT", "METADATA", "MODE", "OUTPUT", "TASK"],
|
||||
"type": "string"
|
||||
},
|
||||
"logType": {
|
||||
"description": "The type of log entry",
|
||||
"enum": ["BEACON", "DOWNLOAD", "EVENT", "KEYSTROKES", "UNKNOWN", "WEBLOG"],
|
||||
"type": "string"
|
||||
},
|
||||
"dateTime": {
|
||||
"description": "The date and time the log entry was created",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
}
|
||||
},
|
||||
"required": ["blob", "logType"]
|
||||
},
|
||||
"ParserCommand": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"operator": {
|
||||
"description": "Name of the operator that sent the command\nShould match the name of an operator in the operators object",
|
||||
"type": "string"
|
||||
},
|
||||
"beacon": {
|
||||
"description": "Name of the beacon that the command was run from\nShould match the name of a beacon in the beacons object",
|
||||
"type": "string"
|
||||
},
|
||||
"input": {
|
||||
"$ref": "#/definitions/ParserLogEntry",
|
||||
"description": "The input that initialized the command"
|
||||
},
|
||||
"commandFailed": {
|
||||
"description": "Whether the command was successful",
|
||||
"default": false,
|
||||
"type": "boolean"
|
||||
},
|
||||
"output": {
|
||||
"description": "The output of the command",
|
||||
"$ref": "#/definitions/ParserLogEntry"
|
||||
},
|
||||
"attackIds": {
|
||||
"description": "A list of the MITRE ATT&CK techniques used by the command",
|
||||
"default": [],
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["beacon", "input"]
|
||||
},
|
||||
"ParserLink": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"from": {
|
||||
"description": "The origin of the link, can be a beacon or server",
|
||||
"type": "string"
|
||||
},
|
||||
"to": {
|
||||
"description": "The destination of the link, can be a beacon",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["from", "to"]
|
||||
},
|
||||
"ParserOperator": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "The name of the operator",
|
||||
"type": "string"
|
||||
},
|
||||
"startTime": {
|
||||
"description": "The date and time the operator first sent a command",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"endTime": {
|
||||
"description": "The date and time the operator last sent a command",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
}
|
||||
},
|
||||
"required": ["name"]
|
||||
},
|
||||
"ParserServer": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "The name of the server",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "The type of server",
|
||||
"enum": ["dns", "http", "https", "smb"],
|
||||
"default": "'http'",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["name"]
|
||||
},
|
||||
"ParserHost": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "The name of the host",
|
||||
"type": "string"
|
||||
},
|
||||
"server": {
|
||||
"description": "The name of the server that first ran a command or spawned a beacon on the host\nThis should match the name of a server in the servers object",
|
||||
"type": "string"
|
||||
},
|
||||
"os": {
|
||||
"description": "The operating system of the host",
|
||||
"type": "string"
|
||||
},
|
||||
"osVersion": {
|
||||
"description": "The version of the operating system of the host",
|
||||
"type": "string"
|
||||
},
|
||||
"ip": {
|
||||
"description": "The IP address of the host",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "The type of host",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["name", "server"]
|
||||
},
|
||||
"ParserBeacon": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "The name of the beacon",
|
||||
"type": "string"
|
||||
},
|
||||
"server": {
|
||||
"description": "The name of the server that spawned this beacon\nThis should match the name of a server in the servers object",
|
||||
"type": "string"
|
||||
},
|
||||
"host": {
|
||||
"description": "The name of the host that this beacon is running on\nThis should match the name of a host in the hosts object",
|
||||
"type": "string"
|
||||
},
|
||||
"ip": {
|
||||
"description": "The IP address of the host as reported by the beacon",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "The type of beacon",
|
||||
"enum": ["dns", "http", "https", "smb"],
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"description": "The port that the beacon is communicating over",
|
||||
"type": "number"
|
||||
},
|
||||
"process": {
|
||||
"description": "The process name of the beacon",
|
||||
"type": "string"
|
||||
},
|
||||
"processId": {
|
||||
"description": "The process identifier of the beacon",
|
||||
"type": "number"
|
||||
},
|
||||
"startTime": {
|
||||
"description": "The date time the beacon was initialized or ran it's first command",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"endTime": {
|
||||
"description": "The date time the beacon ran it's last command or was terminated",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"images": {
|
||||
"description": "A list of images that the beacon has downloaded",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/ParserImage"
|
||||
}
|
||||
},
|
||||
"files": {
|
||||
"description": "A list of files that the beacon has uploaded or downloaded",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/ParserFile"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["host", "name", "server"]
|
||||
},
|
||||
"ParserImage": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"fileType": {
|
||||
"description": "The type of image",
|
||||
"enum": "*",
|
||||
"type": "string"
|
||||
},
|
||||
"filePath": {
|
||||
"description": "Path to the image that RedEye can access",
|
||||
"type": "string"
|
||||
},
|
||||
"fileName": {
|
||||
"description": "The name of the image if the local file name is different from the name of the image",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["filePath", "fileType"]
|
||||
},
|
||||
"ParserFile": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"fileName": {
|
||||
"description": "The name of the file if the local file name is different from the name of the file",
|
||||
"type": "string"
|
||||
},
|
||||
"filePath": {
|
||||
"description": "Path to the file that RedEye can access",
|
||||
"type": "string"
|
||||
},
|
||||
"dateTime": {
|
||||
"description": "The date time the file was created or modified",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"md5": {
|
||||
"description": "The MD5 hash of the file",
|
||||
"type": "string"
|
||||
},
|
||||
"fileFlag": {
|
||||
"description": "Was this file uploaded to the host or downloaded from the host",
|
||||
"enum": ["DOWNLOAD", "UPLOAD"],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["dateTime", "fileFlag", "filePath"]
|
||||
},
|
||||
"ParserOutput": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"servers": {
|
||||
"description": "A key-value pair of server names and their metadata",
|
||||
"type": "{ [serverName: string] : ParserServer }"
|
||||
},
|
||||
"hosts": {
|
||||
"description": "A key-value pair of host names and their metadata",
|
||||
"type": "{ [hostName: string] : ParserHost }"
|
||||
},
|
||||
"beacons": {
|
||||
"description": "A key-value pair of beacon names and their metadata",
|
||||
"type": "{ [beaconName: string] : ParserBeacon }"
|
||||
},
|
||||
"operators": {
|
||||
"description": "A key-value pair of operator names and the time range of their first and last command",
|
||||
"type": "{ [operatorName: string] : ParserOperator }"
|
||||
},
|
||||
"commands": {
|
||||
"description": "A key-value pair of unique command identifiers and commands with inputs and outputs, sent by operators to beacons",
|
||||
"type": "{ [commandName: string] : ParserCommand }"
|
||||
},
|
||||
"links": {
|
||||
"description": "A key-value pair of '<from>-<to>' and links from servers to beacons and beacons to beacons",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"$ref": "#/definitions/ParserLink"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["beacons", "commands", "hosts", "links", "operators", "servers"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"$ref": "#/definitions/ParserProgress",
|
||||
"definitions": {
|
||||
"ParserProgress": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"percent": {
|
||||
"description": "The percent progress of the parsing process, a number between 0 and 100",
|
||||
"type": "number"
|
||||
},
|
||||
"message": {
|
||||
"description": "The current state of the parsing process",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["message", "percent"]
|
||||
}
|
||||
},
|
||||
"$schema": "http://json-schema.org/draft-07/schema#"
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
{
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"definitions": {
|
||||
"ParserValidateFiles": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"servers": {
|
||||
"description": "A list of servers and the number of files associated with each server",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"fileCount": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"required": ["name"]
|
||||
}
|
||||
},
|
||||
"valid": {
|
||||
"description": "An array of valid file paths relative to the campaign root directory",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"invalid": {
|
||||
"description": "An array of invalid file paths relative to the campaign root directory",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["invalid", "servers", "valid"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
[@redeye/parser-core](../index.md) / ServerDelineationTypes
|
||||
|
||||
# Enumeration: ServerDelineationTypes
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Enumeration Members
|
||||
|
||||
- [Database](ServerDelineationTypes.md#database)
|
||||
- [Folder](ServerDelineationTypes.md#folder)
|
||||
|
||||
## Enumeration Members
|
||||
|
||||
### Database
|
||||
|
||||
• **Database** = `"Database"`
|
||||
|
||||
server data not in any particular file/folder structure
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:54](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L54)
|
||||
|
||||
---
|
||||
|
||||
### Folder
|
||||
|
||||
• **Folder** = `"Folder"`
|
||||
|
||||
server data seperated into distinct folders
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:52](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L52)
|
||||
@@ -0,0 +1,35 @@
|
||||
[@redeye/parser-core](../index.md) / UploadType
|
||||
|
||||
# Enumeration: UploadType
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Enumeration Members
|
||||
|
||||
- [Directory](UploadType.md#directory)
|
||||
- [File](UploadType.md#file)
|
||||
|
||||
## Enumeration Members
|
||||
|
||||
### Directory
|
||||
|
||||
• **Directory** = `"Directory"`
|
||||
|
||||
upload a directory
|
||||
|
||||
#### Defined in
|
||||
|
||||
[file-upload.ts:30](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/file-upload.ts#L30)
|
||||
|
||||
---
|
||||
|
||||
### File
|
||||
|
||||
• **File** = `"File"`
|
||||
|
||||
upload a single file or a selection of multiple files
|
||||
Use this if data is in a single file like a json or csv or a selection of files like .pcap files
|
||||
|
||||
#### Defined in
|
||||
|
||||
[file-upload.ts:28](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/file-upload.ts#L28)
|
||||
@@ -0,0 +1,47 @@
|
||||
[@redeye/parser-core](../index.md) / ValidationMode
|
||||
|
||||
# Enumeration: ValidationMode
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Enumeration Members
|
||||
|
||||
- [FileExtensions](ValidationMode.md#fileextensions)
|
||||
- [None](ValidationMode.md#none)
|
||||
- [Parser](ValidationMode.md#parser)
|
||||
|
||||
## Enumeration Members
|
||||
|
||||
### FileExtensions
|
||||
|
||||
• **FileExtensions** = `"FileExtensions"`
|
||||
|
||||
validate uploaded files in client by file extensions
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:61](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L61)
|
||||
|
||||
---
|
||||
|
||||
### None
|
||||
|
||||
• **None** = `"None"`
|
||||
|
||||
no validation
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:59](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L59)
|
||||
|
||||
---
|
||||
|
||||
### Parser
|
||||
|
||||
• **Parser** = `"Parser"`
|
||||
|
||||
validate uploaded files in server with parser, parser must implement "validate-files" command
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:63](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L63)
|
||||
@@ -0,0 +1,45 @@
|
||||
@redeye/parser-core
|
||||
|
||||
# @redeye/parser-core
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Enumerations
|
||||
|
||||
- [ServerDelineationTypes](enums/ServerDelineationTypes.md)
|
||||
- [UploadType](enums/UploadType.md)
|
||||
- [ValidationMode](enums/ValidationMode.md)
|
||||
|
||||
### Interfaces
|
||||
|
||||
- [FileDisplay](interfaces/FileDisplay.md)
|
||||
- [FileUpload](interfaces/FileUpload.md)
|
||||
- [ParserInfo](interfaces/ParserInfo.md)
|
||||
- [UploadForm](interfaces/UploadForm.md)
|
||||
|
||||
### Type Aliases
|
||||
|
||||
- [UploadValidation](index.md#uploadvalidation)
|
||||
|
||||
## Type Aliases
|
||||
|
||||
### UploadValidation
|
||||
|
||||
Ƭ **UploadValidation**: { `validate`: [`None`](enums/ValidationMode.md#none) \| [`Parser`](enums/ValidationMode.md#parser) } \| { `acceptedExtensions`: `string`[] ; `validate`: [`FileExtensions`](enums/ValidationMode.md#fileextensions) }
|
||||
|
||||
The validation mode for the upload form
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// No validation, allow uploading any folder or files
|
||||
validate = { validate: ValidationMode.None };
|
||||
// Only allow files with specific file extensions
|
||||
validate = { validate: ValidationMode.FileExtensions, acceptedExtensions: ['txt', 'png', 'jpg'] };
|
||||
// The parser has implemented the 'validate-files' command and will validate the folder of files
|
||||
validate = { validate: ValidationMode.Parser };
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:76](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L76)
|
||||
@@ -0,0 +1,22 @@
|
||||
[@redeye/parser-core](../index.md) / FileDisplay
|
||||
|
||||
# Interface: FileDisplay
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [editable](FileDisplay.md#editable)
|
||||
|
||||
## Properties
|
||||
|
||||
### editable
|
||||
|
||||
• **editable**: `boolean`
|
||||
|
||||
Whether the names of the servers inferred from the uploaded files are editable
|
||||
A user may want to change the name of a server to something more descriptive
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:85](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L85)
|
||||
@@ -0,0 +1,70 @@
|
||||
[@redeye/parser-core](../index.md) / FileUpload
|
||||
|
||||
# Interface: FileUpload
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [description](FileUpload.md#description)
|
||||
- [example](FileUpload.md#example)
|
||||
- [type](FileUpload.md#type)
|
||||
|
||||
## Properties
|
||||
|
||||
### description
|
||||
|
||||
• **description**: `string`
|
||||
|
||||
Describes what should be uploaded for the selected parser
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
description =
|
||||
'Upload a directory of files that are organized by server name and date in the format: <FOLDER_TO_UPLOAD>/<SERVER_NAME>/<YYYYMMDD>/';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[file-upload.ts:9](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/file-upload.ts#L9)
|
||||
|
||||
---
|
||||
|
||||
### example
|
||||
|
||||
• `Optional` **example**: `string`
|
||||
|
||||
A string that will be displayed in the upload form as an example of the type of file or shape of directory to upload
|
||||
|
||||
**`Default`**
|
||||
|
||||
```ts
|
||||
undefined;
|
||||
```
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
`Campaign_Folder
|
||||
- Server_Folder_1
|
||||
- 200101
|
||||
- 200102
|
||||
- 200103`;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[file-upload.ts:20](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/file-upload.ts#L20)
|
||||
|
||||
---
|
||||
|
||||
### type
|
||||
|
||||
• **type**: `"File"` \| `"Directory"`
|
||||
|
||||
The type of upload, a selection of files or a directory
|
||||
|
||||
#### Defined in
|
||||
|
||||
[file-upload.ts:3](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/file-upload.ts#L3)
|
||||
@@ -0,0 +1,122 @@
|
||||
[@redeye/parser-core](../index.md) / ParserInfo
|
||||
|
||||
# Interface: ParserInfo
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [description](ParserInfo.md#description)
|
||||
- [id](ParserInfo.md#id)
|
||||
- [name](ParserInfo.md#name)
|
||||
- [uploadForm](ParserInfo.md#uploadform)
|
||||
- [version](ParserInfo.md#version)
|
||||
|
||||
## Properties
|
||||
|
||||
### description
|
||||
|
||||
• `Optional` **description**: `string`
|
||||
|
||||
An optional description of the parser
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
description = 'This parser is super cool and does all the things';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:32](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/index.ts#L32)
|
||||
|
||||
---
|
||||
|
||||
### id
|
||||
|
||||
• **id**: `string`
|
||||
|
||||
ID for parser, should match the standard name of the binary file or command
|
||||
// The parser binary is named 'my-parser'
|
||||
id = 'my-parser'
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:19](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/index.ts#L19)
|
||||
|
||||
---
|
||||
|
||||
### name
|
||||
|
||||
• **name**: `string`
|
||||
|
||||
The display name of the parser
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// The parser binary is named 'my-parser'
|
||||
name = 'My Super Cool Parser';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:26](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/index.ts#L26)
|
||||
|
||||
---
|
||||
|
||||
### uploadForm
|
||||
|
||||
• **uploadForm**: [`UploadForm`](UploadForm.md)
|
||||
|
||||
An object that configures the upload form in RedEye's UI
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// upload a directory of files that are organized by server name and date in the format: <FOLDER_TO_UPLOAD>/<SERVER_NAME>/<YYYYMMDD>/
|
||||
uploadForm = {
|
||||
tabTitle: '<C2_NAME>',
|
||||
enabledInBlueTeam: false,
|
||||
serverDelineation: ServerDelineationTypes.Folder,
|
||||
fileUpload: {
|
||||
type: UploadType.Directory,
|
||||
description:
|
||||
'Upload a directory of files that are organized by server name and date in the format: <FOLDER_TO_UPLOAD>/<SERVER_NAME>/<YYYYMMDD>/',
|
||||
example: `Campaign_Folder
|
||||
- Server_Folder_1
|
||||
- 200101
|
||||
- 200102
|
||||
- 200103`,
|
||||
validate: ValidationMode.Parser,
|
||||
},
|
||||
fileDisplay: {
|
||||
editable: true,
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:56](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/index.ts#L56)
|
||||
|
||||
---
|
||||
|
||||
### version
|
||||
|
||||
• **version**: `number`
|
||||
|
||||
The version of the RedEye parser config that the parser is compatible with
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// RedEye parser schema was updated with new fields and commands, bumping from version 1 to 2
|
||||
version = 2;
|
||||
// If you haven't updated your parser to use the new fields and commands, you can still use the old version
|
||||
version = 1;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:13](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/index.ts#L13)
|
||||
@@ -0,0 +1,114 @@
|
||||
[@redeye/parser-core](../index.md) / UploadForm
|
||||
|
||||
# Interface: UploadForm
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [enabledInBlueTeam](UploadForm.md#enabledinblueteam)
|
||||
- [fileDisplay](UploadForm.md#filedisplay)
|
||||
- [fileUpload](UploadForm.md#fileupload)
|
||||
- [serverDelineation](UploadForm.md#serverdelineation)
|
||||
- [tabTitle](UploadForm.md#tabtitle)
|
||||
|
||||
## Properties
|
||||
|
||||
### enabledInBlueTeam
|
||||
|
||||
• **enabledInBlueTeam**: `boolean`
|
||||
|
||||
Whether the parser is enabled in blue team mode
|
||||
This should be false unless the parser is intended to be used by a blue team
|
||||
The Blue team mode is intended to be a read only mode
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:15](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L15)
|
||||
|
||||
---
|
||||
|
||||
### fileDisplay
|
||||
|
||||
• **fileDisplay**: [`FileDisplay`](FileDisplay.md)
|
||||
|
||||
An object that configures the list of servers/files after upload
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// server names are editable
|
||||
fileDisplay = { editable: true };
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:47](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L47)
|
||||
|
||||
---
|
||||
|
||||
### fileUpload
|
||||
|
||||
• **fileUpload**: `Object`
|
||||
|
||||
An object that configures the file upload portion of the upload form
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// upload a directory of files that are organized by server name and date in the format: <FOLDER_TO_UPLOAD>/<SERVER_NAME>/<YYYYMMDD>/
|
||||
fileUpload = {
|
||||
type: UploadType.Directory,
|
||||
description:
|
||||
'Upload a directory of files that are organized by server name and date in the format: <FOLDER_TO_UPLOAD>/<SERVER_NAME>/<YYYYMMDD>/',
|
||||
example: `Campaign_Folder
|
||||
- Server_Folder_1
|
||||
- 200101
|
||||
- 200102
|
||||
- 200103`,
|
||||
validate: ValidationMode.Parser,
|
||||
};
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:40](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L40)
|
||||
|
||||
---
|
||||
|
||||
### serverDelineation
|
||||
|
||||
• **serverDelineation**: `"Folder"` \| `"Database"`
|
||||
|
||||
The type of server delineation used by the parser
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// server data is seperated into distinct folders like 'CAMPAIGN_FOLDER/SERVER_FOLDER/DATE_FOLDER'
|
||||
serverDelineation = ServerDelineationTypes.Folder;
|
||||
// server data is not in any particular file/folder structure
|
||||
serverDelineation = ServerDelineationTypes.Database;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:24](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L24)
|
||||
|
||||
---
|
||||
|
||||
### tabTitle
|
||||
|
||||
• **tabTitle**: `string`
|
||||
|
||||
The title of the tab in the upload form
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
tabTitle = '<C2_NAME>';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:9](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L9)
|
||||
@@ -0,0 +1,18 @@
|
||||
@redeye/parser-core
|
||||
|
||||
# @redeye/parser-core
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Interfaces
|
||||
|
||||
- [ParserBeacon](interfaces/ParserBeacon.md)
|
||||
- [ParserCommand](interfaces/ParserCommand.md)
|
||||
- [ParserFile](interfaces/ParserFile.md)
|
||||
- [ParserHost](interfaces/ParserHost.md)
|
||||
- [ParserImage](interfaces/ParserImage.md)
|
||||
- [ParserLink](interfaces/ParserLink.md)
|
||||
- [ParserLogEntry](interfaces/ParserLogEntry.md)
|
||||
- [ParserOperator](interfaces/ParserOperator.md)
|
||||
- [ParserOutput](interfaces/ParserOutput.md)
|
||||
- [ParserServer](interfaces/ParserServer.md)
|
||||
@@ -0,0 +1,246 @@
|
||||
[@redeye/parser-core](../index.md) / ParserBeacon
|
||||
|
||||
# Interface: ParserBeacon
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [endTime](ParserBeacon.md#endtime)
|
||||
- [files](ParserBeacon.md#files)
|
||||
- [host](ParserBeacon.md#host)
|
||||
- [images](ParserBeacon.md#images)
|
||||
- [ip](ParserBeacon.md#ip)
|
||||
- [name](ParserBeacon.md#name)
|
||||
- [port](ParserBeacon.md#port)
|
||||
- [process](ParserBeacon.md#process)
|
||||
- [processId](ParserBeacon.md#processid)
|
||||
- [server](ParserBeacon.md#server)
|
||||
- [startTime](ParserBeacon.md#starttime)
|
||||
- [type](ParserBeacon.md#type)
|
||||
|
||||
## Properties
|
||||
|
||||
### endTime
|
||||
|
||||
• `Optional` **endTime**: `Date`
|
||||
|
||||
The date time the beacon ran it's last command or was terminated
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
endTime = new Date('2021-01-01T00:00:00.000Z');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:66](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L66)
|
||||
|
||||
---
|
||||
|
||||
### files
|
||||
|
||||
• `Optional` **files**: [`ParserFile`](ParserFile.md)[]
|
||||
|
||||
A list of files that the beacon has uploaded or downloaded
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
files = [
|
||||
{
|
||||
filePath: 'local/path/to/file.txt',
|
||||
fileName: 'admin-list.txt',
|
||||
dateTime: new Date("2021-01-01T00:00:00.000Z"),
|
||||
md5: '1234567890abcdef1234567890abcdef',
|
||||
fileFlag: 'UPLOAD'
|
||||
// or
|
||||
fileFlag: 'DOWNLOAD'
|
||||
}
|
||||
]
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:94](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L94)
|
||||
|
||||
---
|
||||
|
||||
### host
|
||||
|
||||
• **host**: `string`
|
||||
|
||||
The name of the host that this beacon is running on
|
||||
This should match the name of a host in the hosts object
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
host = 'DESKTOP-12345';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:19](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L19)
|
||||
|
||||
---
|
||||
|
||||
### images
|
||||
|
||||
• `Optional` **images**: [`ParserImage`](ParserImage.md)[]
|
||||
|
||||
A list of images that the beacon has downloaded
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
images = [
|
||||
{
|
||||
fileType: 'png',
|
||||
filePath: 'local/path/to/image.png',
|
||||
fileName: 'host-desktop-screenshot.png',
|
||||
},
|
||||
];
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:78](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L78)
|
||||
|
||||
---
|
||||
|
||||
### ip
|
||||
|
||||
• `Optional` **ip**: `string`
|
||||
|
||||
The IP address of the host as reported by the beacon
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
ip = '192.168.23.3';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:25](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L25)
|
||||
|
||||
---
|
||||
|
||||
### name
|
||||
|
||||
• **name**: `string`
|
||||
|
||||
The name of the beacon
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:7](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L7)
|
||||
|
||||
---
|
||||
|
||||
### port
|
||||
|
||||
• `Optional` **port**: `number`
|
||||
|
||||
The port that the beacon is communicating over
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// http
|
||||
port = 80;
|
||||
// https
|
||||
port = 443;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:42](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L42)
|
||||
|
||||
---
|
||||
|
||||
### process
|
||||
|
||||
• `Optional` **process**: `string`
|
||||
|
||||
The process name of the beacon
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
process = 'explorer.exe';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:48](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L48)
|
||||
|
||||
---
|
||||
|
||||
### processId
|
||||
|
||||
• `Optional` **processId**: `number`
|
||||
|
||||
The process identifier of the beacon
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
pid = 1234;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:54](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L54)
|
||||
|
||||
---
|
||||
|
||||
### server
|
||||
|
||||
• **server**: `string`
|
||||
|
||||
The name of the server that spawned this beacon
|
||||
This should match the name of a server in the servers object
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:12](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L12)
|
||||
|
||||
---
|
||||
|
||||
### startTime
|
||||
|
||||
• `Optional` **startTime**: `Date`
|
||||
|
||||
The date time the beacon was initialized or ran it's first command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
startTime = new Date('2021-01-01T00:00:00.000Z');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:60](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L60)
|
||||
|
||||
---
|
||||
|
||||
### type
|
||||
|
||||
• `Optional` **type**: `"http"` \| `"https"` \| `"smb"` \| `"dns"`
|
||||
|
||||
The type of beacon
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
possible values: 'http' | 'https' | 'smb' | 'dns'
|
||||
type = 'http'
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:33](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L33)
|
||||
@@ -0,0 +1,160 @@
|
||||
[@redeye/parser-core](../index.md) / ParserCommand
|
||||
|
||||
# Interface: ParserCommand
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [attackIds](ParserCommand.md#attackids)
|
||||
- [beacon](ParserCommand.md#beacon)
|
||||
- [commandFailed](ParserCommand.md#commandfailed)
|
||||
- [input](ParserCommand.md#input)
|
||||
- [operator](ParserCommand.md#operator)
|
||||
- [output](ParserCommand.md#output)
|
||||
|
||||
## Properties
|
||||
|
||||
### attackIds
|
||||
|
||||
• `Optional` **attackIds**: `string`[]
|
||||
|
||||
A list of the MITRE ATT&CK techniques used by the command
|
||||
|
||||
**`Default`**
|
||||
|
||||
```ts
|
||||
[];
|
||||
```
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
attackIds = ['T1059', 'T1059.001'];
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:68](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L68)
|
||||
|
||||
---
|
||||
|
||||
### beacon
|
||||
|
||||
• **beacon**: `string`
|
||||
|
||||
Name of the beacon that the command was run from
|
||||
Should match the name of a beacon in the beacons object
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
beacon = 'beacon1';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:17](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L17)
|
||||
|
||||
---
|
||||
|
||||
### commandFailed
|
||||
|
||||
• `Optional` **commandFailed**: `boolean`
|
||||
|
||||
Whether the command was successful
|
||||
|
||||
**`Default`**
|
||||
|
||||
```ts
|
||||
false;
|
||||
```
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// The command output was not found in the logs or the command failed
|
||||
commandFailed = true;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:38](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L38)
|
||||
|
||||
---
|
||||
|
||||
### input
|
||||
|
||||
• **input**: [`ParserLogEntry`](ParserLogEntry.md)
|
||||
|
||||
The input that initialized the command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
input = {
|
||||
blob: 'ls',
|
||||
filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
|
||||
lineNumber: 123,
|
||||
logType: 'INPUT',
|
||||
dateTime: new Date('2021-01-01T00:00:00.000Z'),
|
||||
};
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:30](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L30)
|
||||
|
||||
---
|
||||
|
||||
### operator
|
||||
|
||||
• `Optional` **operator**: `string`
|
||||
|
||||
Name of the operator that sent the command
|
||||
Should match the name of an operator in the operators object
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
operator = 'admin';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:10](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L10)
|
||||
|
||||
---
|
||||
|
||||
### output
|
||||
|
||||
• `Optional` **output**: [`ParserLogEntry`](ParserLogEntry.md)
|
||||
|
||||
The output of the command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the command was successful
|
||||
output = {
|
||||
blob: '[System Process]\nsmss.exe\n...etc',
|
||||
filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
|
||||
lineNumber: 123,
|
||||
logType: 'OUTPUT',
|
||||
dateTime: new Date('2021-01-01T00:00:00.000Z'),
|
||||
};
|
||||
// If the command failed
|
||||
output = undefined;
|
||||
// or
|
||||
output = {
|
||||
blob: 'Unknown command: pwd',
|
||||
filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
|
||||
lineNumber: 123,
|
||||
logType: 'ERROR',
|
||||
dateTime: new Date('2021-01-01T00:00:00.000Z'),
|
||||
};
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:61](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L61)
|
||||
@@ -0,0 +1,91 @@
|
||||
[@redeye/parser-core](../index.md) / ParserFile
|
||||
|
||||
# Interface: ParserFile
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [dateTime](ParserFile.md#datetime)
|
||||
- [fileFlag](ParserFile.md#fileflag)
|
||||
- [fileName](ParserFile.md#filename)
|
||||
- [filePath](ParserFile.md#filepath)
|
||||
- [md5](ParserFile.md#md5)
|
||||
|
||||
## Properties
|
||||
|
||||
### dateTime
|
||||
|
||||
• **dateTime**: `Date`
|
||||
|
||||
The date time the file was created or modified
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
dateTime = new Date('2021-01-01T00:00:00.000Z');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:137](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L137)
|
||||
|
||||
---
|
||||
|
||||
### fileFlag
|
||||
|
||||
• **fileFlag**: `"DOWNLOAD"` \| `"UPLOAD"`
|
||||
|
||||
Was this file uploaded to the host or downloaded from the host
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:146](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L146)
|
||||
|
||||
---
|
||||
|
||||
### fileName
|
||||
|
||||
• `Optional` **fileName**: `string`
|
||||
|
||||
The name of the file if the local file name is different from the name of the file
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
name = 'admin-list.txt';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:125](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L125)
|
||||
|
||||
---
|
||||
|
||||
### filePath
|
||||
|
||||
• **filePath**: `string`
|
||||
|
||||
Path to the file that RedEye can access
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
filePath = '<directory-of-parser>/files/file.txt';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:131](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L131)
|
||||
|
||||
---
|
||||
|
||||
### md5
|
||||
|
||||
• `Optional` **md5**: `string`
|
||||
|
||||
The MD5 hash of the file
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:141](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L141)
|
||||
@@ -0,0 +1,114 @@
|
||||
[@redeye/parser-core](../index.md) / ParserHost
|
||||
|
||||
# Interface: ParserHost
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [ip](ParserHost.md#ip)
|
||||
- [name](ParserHost.md#name)
|
||||
- [os](ParserHost.md#os)
|
||||
- [osVersion](ParserHost.md#osversion)
|
||||
- [server](ParserHost.md#server)
|
||||
- [type](ParserHost.md#type)
|
||||
|
||||
## Properties
|
||||
|
||||
### ip
|
||||
|
||||
• `Optional` **ip**: `string`
|
||||
|
||||
The IP address of the host
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
ip = '192.168.23.0';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:28](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L28)
|
||||
|
||||
---
|
||||
|
||||
### name
|
||||
|
||||
• **name**: `string`
|
||||
|
||||
The name of the host
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:5](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L5)
|
||||
|
||||
---
|
||||
|
||||
### os
|
||||
|
||||
• `Optional` **os**: `string`
|
||||
|
||||
The operating system of the host
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
os = 'Windows';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:16](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L16)
|
||||
|
||||
---
|
||||
|
||||
### osVersion
|
||||
|
||||
• `Optional` **osVersion**: `string`
|
||||
|
||||
The version of the operating system of the host
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
osVersion = '10.0.19041';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L22)
|
||||
|
||||
---
|
||||
|
||||
### server
|
||||
|
||||
• **server**: `string`
|
||||
|
||||
The name of the server that first ran a command or spawned a beacon on the host
|
||||
This should match the name of a server in the servers object
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:10](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L10)
|
||||
|
||||
---
|
||||
|
||||
### type
|
||||
|
||||
• `Optional` **type**: `string`
|
||||
|
||||
The type of host
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
type = 'workstation';
|
||||
type = 'server';
|
||||
type = 'laptop';
|
||||
type = 'virtual machine';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:37](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L37)
|
||||
@@ -0,0 +1,65 @@
|
||||
[@redeye/parser-core](../index.md) / ParserImage
|
||||
|
||||
# Interface: ParserImage
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [fileName](ParserImage.md#filename)
|
||||
- [filePath](ParserImage.md#filepath)
|
||||
- [fileType](ParserImage.md#filetype)
|
||||
|
||||
## Properties
|
||||
|
||||
### fileName
|
||||
|
||||
• `Optional` **fileName**: `string`
|
||||
|
||||
The name of the image if the local file name is different from the name of the image
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
name = 'host-desktop-screenshot.png';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:116](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L116)
|
||||
|
||||
---
|
||||
|
||||
### filePath
|
||||
|
||||
• **filePath**: `string`
|
||||
|
||||
Path to the image that RedEye can access
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
filePath = '<directory-of-parser>/images/image.png';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:110](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L110)
|
||||
|
||||
---
|
||||
|
||||
### fileType
|
||||
|
||||
• **fileType**: `string`
|
||||
|
||||
The type of image
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
type = 'png';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:104](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L104)
|
||||
@@ -0,0 +1,47 @@
|
||||
[@redeye/parser-core](../index.md) / ParserLink
|
||||
|
||||
# Interface: ParserLink
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [from](ParserLink.md#from)
|
||||
- [to](ParserLink.md#to)
|
||||
|
||||
## Properties
|
||||
|
||||
### from
|
||||
|
||||
• **from**: `string`
|
||||
|
||||
The origin of the link, can be a beacon or server
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
from = 'beacon1';
|
||||
from = 'server1';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-link.ts:8](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-link.ts#L8)
|
||||
|
||||
---
|
||||
|
||||
### to
|
||||
|
||||
• **to**: `string`
|
||||
|
||||
The destination of the link, can be a beacon
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
to = 'beacon2';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-link.ts:14](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-link.ts#L14)
|
||||
@@ -0,0 +1,147 @@
|
||||
[@redeye/parser-core](../index.md) / ParserLogEntry
|
||||
|
||||
# Interface: ParserLogEntry
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [blob](ParserLogEntry.md#blob)
|
||||
- [dateTime](ParserLogEntry.md#datetime)
|
||||
- [filepath](ParserLogEntry.md#filepath)
|
||||
- [lineNumber](ParserLogEntry.md#linenumber)
|
||||
- [lineType](ParserLogEntry.md#linetype)
|
||||
- [logType](ParserLogEntry.md#logtype)
|
||||
|
||||
## Properties
|
||||
|
||||
### blob
|
||||
|
||||
• **blob**: `string`
|
||||
|
||||
The text of the log entry, can be a command input or output
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
blob = 'ls';
|
||||
blob = 'cd C:\\Users\\admin\\Desktop';
|
||||
blob = 'dir';
|
||||
blob = '[System Process]\nsmss.exe\n...etc';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:12](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L12)
|
||||
|
||||
---
|
||||
|
||||
### dateTime
|
||||
|
||||
• `Optional` **dateTime**: `Date`
|
||||
|
||||
The date and time the log entry was created
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
dateTime = new Date('2021-01-01T00:00:00.000Z');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:66](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L66)
|
||||
|
||||
---
|
||||
|
||||
### filepath
|
||||
|
||||
• `Optional` **filepath**: `string`
|
||||
|
||||
Local path to the file that the log entry was found in
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
filepath = '<directory-of-parser>/logs/2023-02-01/log-1.txt';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:18](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L18)
|
||||
|
||||
---
|
||||
|
||||
### lineNumber
|
||||
|
||||
• `Optional` **lineNumber**: `number`
|
||||
|
||||
The starting line number of the log entry in the file
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
lineNumber = 123;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:24](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L24)
|
||||
|
||||
---
|
||||
|
||||
### lineType
|
||||
|
||||
• `Optional` **lineType**: `"METADATA"` \| `"INPUT"` \| `"TASK"` \| `"CHECKIN"` \| `"OUTPUT"` \| `"MODE"` \| `"ERROR"` \| `"INDICATOR"`
|
||||
|
||||
The type of log line if the logType is 'BEACON'
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the log entry is a command input
|
||||
logType = 'INPUT';
|
||||
// If the log entry is a command output
|
||||
logType = 'OUTPUT';
|
||||
// If the log entry is a beacon status checkin with the server
|
||||
logType = 'CHECKIN';
|
||||
// If the log entry is the C2 server acknowledging a command
|
||||
logType = 'TASK';
|
||||
// If the log entry is an error of any kind
|
||||
logType = 'ERROR';
|
||||
// If the log entry is miscellaneous metadata tied to a beacon
|
||||
logType = 'METADATA';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:42](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L42)
|
||||
|
||||
---
|
||||
|
||||
### logType
|
||||
|
||||
• **logType**: `"BEACON"` \| `"EVENT"` \| `"DOWNLOAD"` \| `"WEBLOG"` \| `"KEYSTROKES"` \| `"UNKNOWN"`
|
||||
|
||||
The type of log entry
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// A beacon log entry
|
||||
logType = 'BEACON';
|
||||
// Misc events on the C2 server (e.g. operator login)
|
||||
logType = 'EVENT';
|
||||
// A file download from a beacon
|
||||
logType = 'DOWNLOAD';
|
||||
// A web log entry from a beacon
|
||||
logType = 'WEBLOG';
|
||||
// A keystroke log entry from a beacon
|
||||
logType = 'KEYSTROKES';
|
||||
// Any other log entry
|
||||
logType = 'UNKNOWN';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:60](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L60)
|
||||
@@ -0,0 +1,64 @@
|
||||
[@redeye/parser-core](../index.md) / ParserOperator
|
||||
|
||||
# Interface: ParserOperator
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [endTime](ParserOperator.md#endtime)
|
||||
- [name](ParserOperator.md#name)
|
||||
- [startTime](ParserOperator.md#starttime)
|
||||
|
||||
## Properties
|
||||
|
||||
### endTime
|
||||
|
||||
• `Optional` **endTime**: `Date`
|
||||
|
||||
The date and time the operator last sent a command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the operator is still active
|
||||
endTime = new Date();
|
||||
// If the operator has never sent a command
|
||||
endTime = undefined;
|
||||
// If the operator is no longer active
|
||||
endTime = new Date('<date of last command>');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-operator.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-operator.ts#L22)
|
||||
|
||||
---
|
||||
|
||||
### name
|
||||
|
||||
• **name**: `string`
|
||||
|
||||
The name of the operator
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-operator.ts:5](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-operator.ts#L5)
|
||||
|
||||
---
|
||||
|
||||
### startTime
|
||||
|
||||
• `Optional` **startTime**: `Date`
|
||||
|
||||
The date and time the operator first sent a command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
startTime = new Date('<date of first command>');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-operator.ts:11](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-operator.ts#L11)
|
||||
@@ -0,0 +1,206 @@
|
||||
[@redeye/parser-core](../index.md) / ParserOutput
|
||||
|
||||
# Interface: ParserOutput
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [beacons](ParserOutput.md#beacons)
|
||||
- [commands](ParserOutput.md#commands)
|
||||
- [hosts](ParserOutput.md#hosts)
|
||||
- [links](ParserOutput.md#links)
|
||||
- [operators](ParserOutput.md#operators)
|
||||
- [servers](ParserOutput.md#servers)
|
||||
|
||||
## Properties
|
||||
|
||||
### beacons
|
||||
|
||||
• **beacons**: `Object`
|
||||
|
||||
A key-value pair of beacon names and their metadata
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the beacon 'beacon1' was created from server 'server1' on host 'DESKTOP-312' at 2021-01-01T00:00:00 and last checked in at 2021-02-02T00:00:02
|
||||
beacons = {
|
||||
beacon1: {
|
||||
name: 'beacon1',
|
||||
server: 'server1',
|
||||
host: 'DESKTOP-312',
|
||||
ip: '192.168.23.2',
|
||||
process: 'svchost.exe',
|
||||
pid: 1234,
|
||||
startTime: new Date('2021-01-01T00:00:00.000Z'),
|
||||
endTime: new Date('2021-02-02T00:00:02.000Z'),
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [beaconName: `string`]: [`ParserBeacon`](ParserBeacon.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:62](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L62)
|
||||
|
||||
---
|
||||
|
||||
### commands
|
||||
|
||||
• **commands**: `Object`
|
||||
|
||||
A key-value pair of unique command identifiers and commands with inputs and outputs, sent by operators to beacons
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the operator 'admin' sent a command to the beacon 'beacon1' at 2021-01-01T00:00:00
|
||||
commands = {
|
||||
'admin-beacon1-2021-01-01T00:00:00': {
|
||||
operator: 'admin',
|
||||
beacon: 'beacon1',
|
||||
input: {
|
||||
blob: 'shell whoami',
|
||||
filepath: 'C:\\Users\\admin\\Desktop\\command.txt',
|
||||
lineNumber: 1,
|
||||
logType: 'BEACON',
|
||||
},
|
||||
output: {
|
||||
blob: 'admin',
|
||||
filepath: 'C:\\Users\\admin\\Desktop\\command.txt',
|
||||
lineNumber: 2,
|
||||
logType: 'BEACON',
|
||||
},
|
||||
attackIds: ['T1033'],
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [commandName: `string`]: [`ParserCommand`](ParserCommand.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:106](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L106)
|
||||
|
||||
---
|
||||
|
||||
### hosts
|
||||
|
||||
• **hosts**: `Object`
|
||||
|
||||
A key-value pair of host names and their metadata
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the host 'DESKTOP-312' was first discovered or had a beacon spawned by server 'server1' with os 'Windows 10.0.19041'
|
||||
hosts = {
|
||||
'DESKTOP-312': {
|
||||
name: 'DESKTOP-312',
|
||||
server: 'server1',
|
||||
os: 'Windows',
|
||||
osVersion: '10.0.19041',
|
||||
ip: '192.168.23.2',
|
||||
type: 'desktop',
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [hostName: `string`]: [`ParserHost`](ParserHost.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:41](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L41)
|
||||
|
||||
---
|
||||
|
||||
### links
|
||||
|
||||
• **links**: `Object`
|
||||
|
||||
A key-value pair of '<from>-<to>' and links from servers to beacons and beacons to beacons
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the server 'server1' has a beacon named 'beacon1'
|
||||
links = {
|
||||
'server1-beacon1': {
|
||||
from: 'server1',
|
||||
to: 'beacon1',
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [linkName: `string`]: [`ParserLink`](ParserLink.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:120](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L120)
|
||||
|
||||
---
|
||||
|
||||
### operators
|
||||
|
||||
• **operators**: `Object`
|
||||
|
||||
A key-value pair of operator names and the time range of their first and last command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the operator 'admin' their first command at 2021-01-01T00:00:00 and last command at 2021-02-02T00:00:02
|
||||
operators = {
|
||||
admin: {
|
||||
name: 'admin',
|
||||
startTime: new Date('2021-01-01T00:00:00.000Z'),
|
||||
endTime: new Date('2021-02-02T00:00:02.000Z'),
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [operatorName: `string`]: [`ParserOperator`](ParserOperator.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:78](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L78)
|
||||
|
||||
---
|
||||
|
||||
### servers
|
||||
|
||||
• **servers**: `Object`
|
||||
|
||||
A key-value pair of server names and their metadata
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If a C2 server was create with name 'server1' and will be communicating over https
|
||||
servers = {
|
||||
server1: {
|
||||
name: 'server1',
|
||||
type: 'https',
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [serverName: `string`]: [`ParserServer`](ParserServer.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L22)
|
||||
@@ -0,0 +1,46 @@
|
||||
[@redeye/parser-core](../index.md) / ParserServer
|
||||
|
||||
# Interface: ParserServer
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [name](ParserServer.md#name)
|
||||
- [type](ParserServer.md#type)
|
||||
|
||||
## Properties
|
||||
|
||||
### name
|
||||
|
||||
• **name**: `string`
|
||||
|
||||
The name of the server
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-server.ts:7](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-server.ts#L7)
|
||||
|
||||
---
|
||||
|
||||
### type
|
||||
|
||||
• `Optional` **type**: `"http"` \| `"https"` \| `"smb"` \| `"dns"`
|
||||
|
||||
The type of server
|
||||
|
||||
**`Default`**
|
||||
|
||||
```ts
|
||||
'http';
|
||||
```
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
type = 'https';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-server.ts:15](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-server.ts#L15)
|
||||
@@ -0,0 +1,9 @@
|
||||
@redeye/parser-core
|
||||
|
||||
# @redeye/parser-core
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Interfaces
|
||||
|
||||
- [ParserValidateFiles](interfaces/ParserValidateFiles.md)
|
||||
@@ -0,0 +1,68 @@
|
||||
[@redeye/parser-core](../index.md) / ParserValidateFiles
|
||||
|
||||
# Interface: ParserValidateFiles
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [invalid](ParserValidateFiles.md#invalid)
|
||||
- [servers](ParserValidateFiles.md#servers)
|
||||
- [valid](ParserValidateFiles.md#valid)
|
||||
|
||||
## Properties
|
||||
|
||||
### invalid
|
||||
|
||||
• **invalid**: `string`[]
|
||||
|
||||
An array of invalid file paths relative to the campaign root directory
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
invalid = ['/campaign/server-1/file3.jpg', '/campaign/server-1/file4.xml'];
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-validate-files.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-validate-files.ts#L22)
|
||||
|
||||
---
|
||||
|
||||
### servers
|
||||
|
||||
• **servers**: { `fileCount?`: `number` ; `name`: `string` }[]
|
||||
|
||||
A list of servers and the number of files associated with each server
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
servers = [
|
||||
{ name: 'server1', fileCount: 2 },
|
||||
{ name: 'server2', fileCount: 1 },
|
||||
];
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-validate-files.ts:10](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-validate-files.ts#L10)
|
||||
|
||||
---
|
||||
|
||||
### valid
|
||||
|
||||
• **valid**: `string`[]
|
||||
|
||||
An array of valid file paths relative to the campaign root directory
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
valid = ['/campaign/server-1/file1.json', '/campaign/server-1/file2.json'];
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-validate-files.ts:16](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-validate-files.ts#L16)
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 57 KiB |
Reference in New Issue
Block a user