chore: import upstream snapshot with attribution
This commit is contained in:
wehub-resource-sync
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"$ref": "#/definitions/LoggerOptions",
|
||||
"definitions": {
|
||||
"LoggerOptions": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"message": {
|
||||
"type": "string"
|
||||
},
|
||||
"tags": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"level": {
|
||||
"enum": ["debug", "error", "warn"],
|
||||
"type": "string"
|
||||
},
|
||||
"error": {},
|
||||
"payload": {}
|
||||
},
|
||||
"required": ["message"]
|
||||
}
|
||||
},
|
||||
"$schema": "http://json-schema.org/draft-07/schema#"
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
{
|
||||
"$ref": "#/definitions/ParserInfo",
|
||||
"definitions": {
|
||||
"ParserInfo": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"version": {
|
||||
"description": "The version of the RedEye parser config that the parser is compatible with",
|
||||
"type": "number"
|
||||
},
|
||||
"id": {
|
||||
"description": "ID for parser, should match the standard name of the binary file or command\n// The parser binary is named 'my-parser'\nid = 'my-parser'",
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "The display name of the parser",
|
||||
"type": "string"
|
||||
},
|
||||
"description": {
|
||||
"description": "An optional description of the parser",
|
||||
"type": "string"
|
||||
},
|
||||
"uploadForm": {
|
||||
"$ref": "#/definitions/UploadForm",
|
||||
"description": "An object that configures the upload form in RedEye's UI"
|
||||
}
|
||||
},
|
||||
"required": ["id", "name", "uploadForm", "version"]
|
||||
},
|
||||
"UploadForm": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"tabTitle": {
|
||||
"description": "The title of the tab in the upload form",
|
||||
"type": "string"
|
||||
},
|
||||
"enabledInBlueTeam": {
|
||||
"description": "Whether the parser is enabled in blue team mode\nThis should be false unless the parser is intended to be used by a blue team\nThe Blue team mode is intended to be a read only mode",
|
||||
"type": "boolean"
|
||||
},
|
||||
"serverDelineation": {
|
||||
"description": "The type of server delineation used by the parser",
|
||||
"enum": ["Database", "Folder"],
|
||||
"type": "string"
|
||||
},
|
||||
"fileUpload": {
|
||||
"description": "An object that configures the file upload portion of the upload form",
|
||||
"anyOf": [
|
||||
{
|
||||
"allOf": [
|
||||
{
|
||||
"$ref": "#/definitions/FileUpload"
|
||||
},
|
||||
{
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"validate": {
|
||||
"enum": ["None", "Parser"],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["validate"]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"allOf": [
|
||||
{
|
||||
"$ref": "#/definitions/FileUpload"
|
||||
},
|
||||
{
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"validate": {
|
||||
"description": "validate uploaded files in client by file extensions",
|
||||
"type": "string",
|
||||
"const": "FileExtensions"
|
||||
},
|
||||
"acceptedExtensions": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["acceptedExtensions", "validate"]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"fileDisplay": {
|
||||
"$ref": "#/definitions/FileDisplay",
|
||||
"description": "An object that configures the list of servers/files after upload"
|
||||
}
|
||||
},
|
||||
"required": ["enabledInBlueTeam", "fileDisplay", "fileUpload", "serverDelineation", "tabTitle"]
|
||||
},
|
||||
"FileUpload": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"description": "The type of upload, a selection of files or a directory",
|
||||
"enum": ["Directory", "File"],
|
||||
"type": "string"
|
||||
},
|
||||
"description": {
|
||||
"description": "Describes what should be uploaded for the selected parser",
|
||||
"type": "string"
|
||||
},
|
||||
"example": {
|
||||
"description": "A string that will be displayed in the upload form as an example of the type of file or shape of directory to upload",
|
||||
"default": "undefined",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["description", "type"]
|
||||
},
|
||||
"FileDisplay": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"editable": {
|
||||
"description": "Whether the names of the servers inferred from the uploaded files are editable\nA user may want to change the name of a server to something more descriptive",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"required": ["editable"]
|
||||
}
|
||||
},
|
||||
"$schema": "http://json-schema.org/draft-07/schema#"
|
||||
}
|
||||
@@ -0,0 +1,296 @@
|
||||
{
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"definitions": {
|
||||
"ParserLogEntry": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"blob": {
|
||||
"description": "The text of the log entry, can be a command input or output",
|
||||
"type": "string"
|
||||
},
|
||||
"filepath": {
|
||||
"description": "Local path to the file that the log entry was found in",
|
||||
"type": "string"
|
||||
},
|
||||
"lineNumber": {
|
||||
"description": "The starting line number of the log entry in the file",
|
||||
"type": "number"
|
||||
},
|
||||
"lineType": {
|
||||
"description": "The type of log line if the logType is 'BEACON'",
|
||||
"enum": ["CHECKIN", "ERROR", "INDICATOR", "INPUT", "METADATA", "MODE", "OUTPUT", "TASK"],
|
||||
"type": "string"
|
||||
},
|
||||
"logType": {
|
||||
"description": "The type of log entry",
|
||||
"enum": ["BEACON", "DOWNLOAD", "EVENT", "KEYSTROKES", "UNKNOWN", "WEBLOG"],
|
||||
"type": "string"
|
||||
},
|
||||
"dateTime": {
|
||||
"description": "The date and time the log entry was created",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
}
|
||||
},
|
||||
"required": ["blob", "logType"]
|
||||
},
|
||||
"ParserCommand": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"operator": {
|
||||
"description": "Name of the operator that sent the command\nShould match the name of an operator in the operators object",
|
||||
"type": "string"
|
||||
},
|
||||
"beacon": {
|
||||
"description": "Name of the beacon that the command was run from\nShould match the name of a beacon in the beacons object",
|
||||
"type": "string"
|
||||
},
|
||||
"input": {
|
||||
"$ref": "#/definitions/ParserLogEntry",
|
||||
"description": "The input that initialized the command"
|
||||
},
|
||||
"commandFailed": {
|
||||
"description": "Whether the command was successful",
|
||||
"default": false,
|
||||
"type": "boolean"
|
||||
},
|
||||
"output": {
|
||||
"description": "The output of the command",
|
||||
"$ref": "#/definitions/ParserLogEntry"
|
||||
},
|
||||
"attackIds": {
|
||||
"description": "A list of the MITRE ATT&CK techniques used by the command",
|
||||
"default": [],
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["beacon", "input"]
|
||||
},
|
||||
"ParserLink": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"from": {
|
||||
"description": "The origin of the link, can be a beacon or server",
|
||||
"type": "string"
|
||||
},
|
||||
"to": {
|
||||
"description": "The destination of the link, can be a beacon",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["from", "to"]
|
||||
},
|
||||
"ParserOperator": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "The name of the operator",
|
||||
"type": "string"
|
||||
},
|
||||
"startTime": {
|
||||
"description": "The date and time the operator first sent a command",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"endTime": {
|
||||
"description": "The date and time the operator last sent a command",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
}
|
||||
},
|
||||
"required": ["name"]
|
||||
},
|
||||
"ParserServer": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "The name of the server",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "The type of server",
|
||||
"enum": ["dns", "http", "https", "smb"],
|
||||
"default": "'http'",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["name"]
|
||||
},
|
||||
"ParserHost": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "The name of the host",
|
||||
"type": "string"
|
||||
},
|
||||
"server": {
|
||||
"description": "The name of the server that first ran a command or spawned a beacon on the host\nThis should match the name of a server in the servers object",
|
||||
"type": "string"
|
||||
},
|
||||
"os": {
|
||||
"description": "The operating system of the host",
|
||||
"type": "string"
|
||||
},
|
||||
"osVersion": {
|
||||
"description": "The version of the operating system of the host",
|
||||
"type": "string"
|
||||
},
|
||||
"ip": {
|
||||
"description": "The IP address of the host",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "The type of host",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["name", "server"]
|
||||
},
|
||||
"ParserBeacon": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "The name of the beacon",
|
||||
"type": "string"
|
||||
},
|
||||
"server": {
|
||||
"description": "The name of the server that spawned this beacon\nThis should match the name of a server in the servers object",
|
||||
"type": "string"
|
||||
},
|
||||
"host": {
|
||||
"description": "The name of the host that this beacon is running on\nThis should match the name of a host in the hosts object",
|
||||
"type": "string"
|
||||
},
|
||||
"ip": {
|
||||
"description": "The IP address of the host as reported by the beacon",
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"description": "The type of beacon",
|
||||
"enum": ["dns", "http", "https", "smb"],
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"description": "The port that the beacon is communicating over",
|
||||
"type": "number"
|
||||
},
|
||||
"process": {
|
||||
"description": "The process name of the beacon",
|
||||
"type": "string"
|
||||
},
|
||||
"processId": {
|
||||
"description": "The process identifier of the beacon",
|
||||
"type": "number"
|
||||
},
|
||||
"startTime": {
|
||||
"description": "The date time the beacon was initialized or ran it's first command",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"endTime": {
|
||||
"description": "The date time the beacon ran it's last command or was terminated",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"images": {
|
||||
"description": "A list of images that the beacon has downloaded",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/ParserImage"
|
||||
}
|
||||
},
|
||||
"files": {
|
||||
"description": "A list of files that the beacon has uploaded or downloaded",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/ParserFile"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["host", "name", "server"]
|
||||
},
|
||||
"ParserImage": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"fileType": {
|
||||
"description": "The type of image",
|
||||
"enum": "*",
|
||||
"type": "string"
|
||||
},
|
||||
"filePath": {
|
||||
"description": "Path to the image that RedEye can access",
|
||||
"type": "string"
|
||||
},
|
||||
"fileName": {
|
||||
"description": "The name of the image if the local file name is different from the name of the image",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["filePath", "fileType"]
|
||||
},
|
||||
"ParserFile": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"fileName": {
|
||||
"description": "The name of the file if the local file name is different from the name of the file",
|
||||
"type": "string"
|
||||
},
|
||||
"filePath": {
|
||||
"description": "Path to the file that RedEye can access",
|
||||
"type": "string"
|
||||
},
|
||||
"dateTime": {
|
||||
"description": "The date time the file was created or modified",
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"md5": {
|
||||
"description": "The MD5 hash of the file",
|
||||
"type": "string"
|
||||
},
|
||||
"fileFlag": {
|
||||
"description": "Was this file uploaded to the host or downloaded from the host",
|
||||
"enum": ["DOWNLOAD", "UPLOAD"],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["dateTime", "fileFlag", "filePath"]
|
||||
},
|
||||
"ParserOutput": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"servers": {
|
||||
"description": "A key-value pair of server names and their metadata",
|
||||
"type": "{ [serverName: string] : ParserServer }"
|
||||
},
|
||||
"hosts": {
|
||||
"description": "A key-value pair of host names and their metadata",
|
||||
"type": "{ [hostName: string] : ParserHost }"
|
||||
},
|
||||
"beacons": {
|
||||
"description": "A key-value pair of beacon names and their metadata",
|
||||
"type": "{ [beaconName: string] : ParserBeacon }"
|
||||
},
|
||||
"operators": {
|
||||
"description": "A key-value pair of operator names and the time range of their first and last command",
|
||||
"type": "{ [operatorName: string] : ParserOperator }"
|
||||
},
|
||||
"commands": {
|
||||
"description": "A key-value pair of unique command identifiers and commands with inputs and outputs, sent by operators to beacons",
|
||||
"type": "{ [commandName: string] : ParserCommand }"
|
||||
},
|
||||
"links": {
|
||||
"description": "A key-value pair of '<from>-<to>' and links from servers to beacons and beacons to beacons",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"$ref": "#/definitions/ParserLink"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["beacons", "commands", "hosts", "links", "operators", "servers"]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"$ref": "#/definitions/ParserProgress",
|
||||
"definitions": {
|
||||
"ParserProgress": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"percent": {
|
||||
"description": "The percent progress of the parsing process, a number between 0 and 100",
|
||||
"type": "number"
|
||||
},
|
||||
"message": {
|
||||
"description": "The current state of the parsing process",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": ["message", "percent"]
|
||||
}
|
||||
},
|
||||
"$schema": "http://json-schema.org/draft-07/schema#"
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
{
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"definitions": {
|
||||
"ParserValidateFiles": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"servers": {
|
||||
"description": "A list of servers and the number of files associated with each server",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"fileCount": {
|
||||
"type": "number"
|
||||
}
|
||||
},
|
||||
"required": ["name"]
|
||||
}
|
||||
},
|
||||
"valid": {
|
||||
"description": "An array of valid file paths relative to the campaign root directory",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"invalid": {
|
||||
"description": "An array of invalid file paths relative to the campaign root directory",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": ["invalid", "servers", "valid"]
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user