chore: import upstream snapshot with attribution
This commit is contained in:
wehub-resource-sync
@@ -0,0 +1,34 @@
|
||||
[@redeye/parser-core](../index.md) / ServerDelineationTypes
|
||||
|
||||
# Enumeration: ServerDelineationTypes
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Enumeration Members
|
||||
|
||||
- [Database](ServerDelineationTypes.md#database)
|
||||
- [Folder](ServerDelineationTypes.md#folder)
|
||||
|
||||
## Enumeration Members
|
||||
|
||||
### Database
|
||||
|
||||
• **Database** = `"Database"`
|
||||
|
||||
server data not in any particular file/folder structure
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:54](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L54)
|
||||
|
||||
---
|
||||
|
||||
### Folder
|
||||
|
||||
• **Folder** = `"Folder"`
|
||||
|
||||
server data seperated into distinct folders
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:52](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L52)
|
||||
@@ -0,0 +1,35 @@
|
||||
[@redeye/parser-core](../index.md) / UploadType
|
||||
|
||||
# Enumeration: UploadType
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Enumeration Members
|
||||
|
||||
- [Directory](UploadType.md#directory)
|
||||
- [File](UploadType.md#file)
|
||||
|
||||
## Enumeration Members
|
||||
|
||||
### Directory
|
||||
|
||||
• **Directory** = `"Directory"`
|
||||
|
||||
upload a directory
|
||||
|
||||
#### Defined in
|
||||
|
||||
[file-upload.ts:30](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/file-upload.ts#L30)
|
||||
|
||||
---
|
||||
|
||||
### File
|
||||
|
||||
• **File** = `"File"`
|
||||
|
||||
upload a single file or a selection of multiple files
|
||||
Use this if data is in a single file like a json or csv or a selection of files like .pcap files
|
||||
|
||||
#### Defined in
|
||||
|
||||
[file-upload.ts:28](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/file-upload.ts#L28)
|
||||
@@ -0,0 +1,47 @@
|
||||
[@redeye/parser-core](../index.md) / ValidationMode
|
||||
|
||||
# Enumeration: ValidationMode
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Enumeration Members
|
||||
|
||||
- [FileExtensions](ValidationMode.md#fileextensions)
|
||||
- [None](ValidationMode.md#none)
|
||||
- [Parser](ValidationMode.md#parser)
|
||||
|
||||
## Enumeration Members
|
||||
|
||||
### FileExtensions
|
||||
|
||||
• **FileExtensions** = `"FileExtensions"`
|
||||
|
||||
validate uploaded files in client by file extensions
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:61](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L61)
|
||||
|
||||
---
|
||||
|
||||
### None
|
||||
|
||||
• **None** = `"None"`
|
||||
|
||||
no validation
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:59](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L59)
|
||||
|
||||
---
|
||||
|
||||
### Parser
|
||||
|
||||
• **Parser** = `"Parser"`
|
||||
|
||||
validate uploaded files in server with parser, parser must implement "validate-files" command
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:63](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L63)
|
||||
@@ -0,0 +1,45 @@
|
||||
@redeye/parser-core
|
||||
|
||||
# @redeye/parser-core
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Enumerations
|
||||
|
||||
- [ServerDelineationTypes](enums/ServerDelineationTypes.md)
|
||||
- [UploadType](enums/UploadType.md)
|
||||
- [ValidationMode](enums/ValidationMode.md)
|
||||
|
||||
### Interfaces
|
||||
|
||||
- [FileDisplay](interfaces/FileDisplay.md)
|
||||
- [FileUpload](interfaces/FileUpload.md)
|
||||
- [ParserInfo](interfaces/ParserInfo.md)
|
||||
- [UploadForm](interfaces/UploadForm.md)
|
||||
|
||||
### Type Aliases
|
||||
|
||||
- [UploadValidation](index.md#uploadvalidation)
|
||||
|
||||
## Type Aliases
|
||||
|
||||
### UploadValidation
|
||||
|
||||
Ƭ **UploadValidation**: { `validate`: [`None`](enums/ValidationMode.md#none) \| [`Parser`](enums/ValidationMode.md#parser) } \| { `acceptedExtensions`: `string`[] ; `validate`: [`FileExtensions`](enums/ValidationMode.md#fileextensions) }
|
||||
|
||||
The validation mode for the upload form
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// No validation, allow uploading any folder or files
|
||||
validate = { validate: ValidationMode.None };
|
||||
// Only allow files with specific file extensions
|
||||
validate = { validate: ValidationMode.FileExtensions, acceptedExtensions: ['txt', 'png', 'jpg'] };
|
||||
// The parser has implemented the 'validate-files' command and will validate the folder of files
|
||||
validate = { validate: ValidationMode.Parser };
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:76](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L76)
|
||||
@@ -0,0 +1,22 @@
|
||||
[@redeye/parser-core](../index.md) / FileDisplay
|
||||
|
||||
# Interface: FileDisplay
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [editable](FileDisplay.md#editable)
|
||||
|
||||
## Properties
|
||||
|
||||
### editable
|
||||
|
||||
• **editable**: `boolean`
|
||||
|
||||
Whether the names of the servers inferred from the uploaded files are editable
|
||||
A user may want to change the name of a server to something more descriptive
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:85](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L85)
|
||||
@@ -0,0 +1,70 @@
|
||||
[@redeye/parser-core](../index.md) / FileUpload
|
||||
|
||||
# Interface: FileUpload
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [description](FileUpload.md#description)
|
||||
- [example](FileUpload.md#example)
|
||||
- [type](FileUpload.md#type)
|
||||
|
||||
## Properties
|
||||
|
||||
### description
|
||||
|
||||
• **description**: `string`
|
||||
|
||||
Describes what should be uploaded for the selected parser
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
description =
|
||||
'Upload a directory of files that are organized by server name and date in the format: <FOLDER_TO_UPLOAD>/<SERVER_NAME>/<YYYYMMDD>/';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[file-upload.ts:9](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/file-upload.ts#L9)
|
||||
|
||||
---
|
||||
|
||||
### example
|
||||
|
||||
• `Optional` **example**: `string`
|
||||
|
||||
A string that will be displayed in the upload form as an example of the type of file or shape of directory to upload
|
||||
|
||||
**`Default`**
|
||||
|
||||
```ts
|
||||
undefined;
|
||||
```
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
`Campaign_Folder
|
||||
- Server_Folder_1
|
||||
- 200101
|
||||
- 200102
|
||||
- 200103`;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[file-upload.ts:20](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/file-upload.ts#L20)
|
||||
|
||||
---
|
||||
|
||||
### type
|
||||
|
||||
• **type**: `"File"` \| `"Directory"`
|
||||
|
||||
The type of upload, a selection of files or a directory
|
||||
|
||||
#### Defined in
|
||||
|
||||
[file-upload.ts:3](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/file-upload.ts#L3)
|
||||
@@ -0,0 +1,122 @@
|
||||
[@redeye/parser-core](../index.md) / ParserInfo
|
||||
|
||||
# Interface: ParserInfo
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [description](ParserInfo.md#description)
|
||||
- [id](ParserInfo.md#id)
|
||||
- [name](ParserInfo.md#name)
|
||||
- [uploadForm](ParserInfo.md#uploadform)
|
||||
- [version](ParserInfo.md#version)
|
||||
|
||||
## Properties
|
||||
|
||||
### description
|
||||
|
||||
• `Optional` **description**: `string`
|
||||
|
||||
An optional description of the parser
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
description = 'This parser is super cool and does all the things';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:32](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/index.ts#L32)
|
||||
|
||||
---
|
||||
|
||||
### id
|
||||
|
||||
• **id**: `string`
|
||||
|
||||
ID for parser, should match the standard name of the binary file or command
|
||||
// The parser binary is named 'my-parser'
|
||||
id = 'my-parser'
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:19](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/index.ts#L19)
|
||||
|
||||
---
|
||||
|
||||
### name
|
||||
|
||||
• **name**: `string`
|
||||
|
||||
The display name of the parser
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// The parser binary is named 'my-parser'
|
||||
name = 'My Super Cool Parser';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:26](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/index.ts#L26)
|
||||
|
||||
---
|
||||
|
||||
### uploadForm
|
||||
|
||||
• **uploadForm**: [`UploadForm`](UploadForm.md)
|
||||
|
||||
An object that configures the upload form in RedEye's UI
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// upload a directory of files that are organized by server name and date in the format: <FOLDER_TO_UPLOAD>/<SERVER_NAME>/<YYYYMMDD>/
|
||||
uploadForm = {
|
||||
tabTitle: '<C2_NAME>',
|
||||
enabledInBlueTeam: false,
|
||||
serverDelineation: ServerDelineationTypes.Folder,
|
||||
fileUpload: {
|
||||
type: UploadType.Directory,
|
||||
description:
|
||||
'Upload a directory of files that are organized by server name and date in the format: <FOLDER_TO_UPLOAD>/<SERVER_NAME>/<YYYYMMDD>/',
|
||||
example: `Campaign_Folder
|
||||
- Server_Folder_1
|
||||
- 200101
|
||||
- 200102
|
||||
- 200103`,
|
||||
validate: ValidationMode.Parser,
|
||||
},
|
||||
fileDisplay: {
|
||||
editable: true,
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:56](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/index.ts#L56)
|
||||
|
||||
---
|
||||
|
||||
### version
|
||||
|
||||
• **version**: `number`
|
||||
|
||||
The version of the RedEye parser config that the parser is compatible with
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// RedEye parser schema was updated with new fields and commands, bumping from version 1 to 2
|
||||
version = 2;
|
||||
// If you haven't updated your parser to use the new fields and commands, you can still use the old version
|
||||
version = 1;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:13](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/index.ts#L13)
|
||||
@@ -0,0 +1,114 @@
|
||||
[@redeye/parser-core](../index.md) / UploadForm
|
||||
|
||||
# Interface: UploadForm
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [enabledInBlueTeam](UploadForm.md#enabledinblueteam)
|
||||
- [fileDisplay](UploadForm.md#filedisplay)
|
||||
- [fileUpload](UploadForm.md#fileupload)
|
||||
- [serverDelineation](UploadForm.md#serverdelineation)
|
||||
- [tabTitle](UploadForm.md#tabtitle)
|
||||
|
||||
## Properties
|
||||
|
||||
### enabledInBlueTeam
|
||||
|
||||
• **enabledInBlueTeam**: `boolean`
|
||||
|
||||
Whether the parser is enabled in blue team mode
|
||||
This should be false unless the parser is intended to be used by a blue team
|
||||
The Blue team mode is intended to be a read only mode
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:15](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L15)
|
||||
|
||||
---
|
||||
|
||||
### fileDisplay
|
||||
|
||||
• **fileDisplay**: [`FileDisplay`](FileDisplay.md)
|
||||
|
||||
An object that configures the list of servers/files after upload
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// server names are editable
|
||||
fileDisplay = { editable: true };
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:47](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L47)
|
||||
|
||||
---
|
||||
|
||||
### fileUpload
|
||||
|
||||
• **fileUpload**: `Object`
|
||||
|
||||
An object that configures the file upload portion of the upload form
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// upload a directory of files that are organized by server name and date in the format: <FOLDER_TO_UPLOAD>/<SERVER_NAME>/<YYYYMMDD>/
|
||||
fileUpload = {
|
||||
type: UploadType.Directory,
|
||||
description:
|
||||
'Upload a directory of files that are organized by server name and date in the format: <FOLDER_TO_UPLOAD>/<SERVER_NAME>/<YYYYMMDD>/',
|
||||
example: `Campaign_Folder
|
||||
- Server_Folder_1
|
||||
- 200101
|
||||
- 200102
|
||||
- 200103`,
|
||||
validate: ValidationMode.Parser,
|
||||
};
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:40](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L40)
|
||||
|
||||
---
|
||||
|
||||
### serverDelineation
|
||||
|
||||
• **serverDelineation**: `"Folder"` \| `"Database"`
|
||||
|
||||
The type of server delineation used by the parser
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// server data is seperated into distinct folders like 'CAMPAIGN_FOLDER/SERVER_FOLDER/DATE_FOLDER'
|
||||
serverDelineation = ServerDelineationTypes.Folder;
|
||||
// server data is not in any particular file/folder structure
|
||||
serverDelineation = ServerDelineationTypes.Database;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:24](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L24)
|
||||
|
||||
---
|
||||
|
||||
### tabTitle
|
||||
|
||||
• **tabTitle**: `string`
|
||||
|
||||
The title of the tab in the upload form
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
tabTitle = '<C2_NAME>';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[upload-form.ts:9](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-info/upload-form.ts#L9)
|
||||
@@ -0,0 +1,18 @@
|
||||
@redeye/parser-core
|
||||
|
||||
# @redeye/parser-core
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Interfaces
|
||||
|
||||
- [ParserBeacon](interfaces/ParserBeacon.md)
|
||||
- [ParserCommand](interfaces/ParserCommand.md)
|
||||
- [ParserFile](interfaces/ParserFile.md)
|
||||
- [ParserHost](interfaces/ParserHost.md)
|
||||
- [ParserImage](interfaces/ParserImage.md)
|
||||
- [ParserLink](interfaces/ParserLink.md)
|
||||
- [ParserLogEntry](interfaces/ParserLogEntry.md)
|
||||
- [ParserOperator](interfaces/ParserOperator.md)
|
||||
- [ParserOutput](interfaces/ParserOutput.md)
|
||||
- [ParserServer](interfaces/ParserServer.md)
|
||||
@@ -0,0 +1,246 @@
|
||||
[@redeye/parser-core](../index.md) / ParserBeacon
|
||||
|
||||
# Interface: ParserBeacon
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [endTime](ParserBeacon.md#endtime)
|
||||
- [files](ParserBeacon.md#files)
|
||||
- [host](ParserBeacon.md#host)
|
||||
- [images](ParserBeacon.md#images)
|
||||
- [ip](ParserBeacon.md#ip)
|
||||
- [name](ParserBeacon.md#name)
|
||||
- [port](ParserBeacon.md#port)
|
||||
- [process](ParserBeacon.md#process)
|
||||
- [processId](ParserBeacon.md#processid)
|
||||
- [server](ParserBeacon.md#server)
|
||||
- [startTime](ParserBeacon.md#starttime)
|
||||
- [type](ParserBeacon.md#type)
|
||||
|
||||
## Properties
|
||||
|
||||
### endTime
|
||||
|
||||
• `Optional` **endTime**: `Date`
|
||||
|
||||
The date time the beacon ran it's last command or was terminated
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
endTime = new Date('2021-01-01T00:00:00.000Z');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:66](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L66)
|
||||
|
||||
---
|
||||
|
||||
### files
|
||||
|
||||
• `Optional` **files**: [`ParserFile`](ParserFile.md)[]
|
||||
|
||||
A list of files that the beacon has uploaded or downloaded
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
files = [
|
||||
{
|
||||
filePath: 'local/path/to/file.txt',
|
||||
fileName: 'admin-list.txt',
|
||||
dateTime: new Date("2021-01-01T00:00:00.000Z"),
|
||||
md5: '1234567890abcdef1234567890abcdef',
|
||||
fileFlag: 'UPLOAD'
|
||||
// or
|
||||
fileFlag: 'DOWNLOAD'
|
||||
}
|
||||
]
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:94](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L94)
|
||||
|
||||
---
|
||||
|
||||
### host
|
||||
|
||||
• **host**: `string`
|
||||
|
||||
The name of the host that this beacon is running on
|
||||
This should match the name of a host in the hosts object
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
host = 'DESKTOP-12345';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:19](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L19)
|
||||
|
||||
---
|
||||
|
||||
### images
|
||||
|
||||
• `Optional` **images**: [`ParserImage`](ParserImage.md)[]
|
||||
|
||||
A list of images that the beacon has downloaded
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
images = [
|
||||
{
|
||||
fileType: 'png',
|
||||
filePath: 'local/path/to/image.png',
|
||||
fileName: 'host-desktop-screenshot.png',
|
||||
},
|
||||
];
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:78](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L78)
|
||||
|
||||
---
|
||||
|
||||
### ip
|
||||
|
||||
• `Optional` **ip**: `string`
|
||||
|
||||
The IP address of the host as reported by the beacon
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
ip = '192.168.23.3';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:25](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L25)
|
||||
|
||||
---
|
||||
|
||||
### name
|
||||
|
||||
• **name**: `string`
|
||||
|
||||
The name of the beacon
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:7](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L7)
|
||||
|
||||
---
|
||||
|
||||
### port
|
||||
|
||||
• `Optional` **port**: `number`
|
||||
|
||||
The port that the beacon is communicating over
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// http
|
||||
port = 80;
|
||||
// https
|
||||
port = 443;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:42](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L42)
|
||||
|
||||
---
|
||||
|
||||
### process
|
||||
|
||||
• `Optional` **process**: `string`
|
||||
|
||||
The process name of the beacon
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
process = 'explorer.exe';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:48](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L48)
|
||||
|
||||
---
|
||||
|
||||
### processId
|
||||
|
||||
• `Optional` **processId**: `number`
|
||||
|
||||
The process identifier of the beacon
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
pid = 1234;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:54](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L54)
|
||||
|
||||
---
|
||||
|
||||
### server
|
||||
|
||||
• **server**: `string`
|
||||
|
||||
The name of the server that spawned this beacon
|
||||
This should match the name of a server in the servers object
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:12](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L12)
|
||||
|
||||
---
|
||||
|
||||
### startTime
|
||||
|
||||
• `Optional` **startTime**: `Date`
|
||||
|
||||
The date time the beacon was initialized or ran it's first command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
startTime = new Date('2021-01-01T00:00:00.000Z');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:60](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L60)
|
||||
|
||||
---
|
||||
|
||||
### type
|
||||
|
||||
• `Optional` **type**: `"http"` \| `"https"` \| `"smb"` \| `"dns"`
|
||||
|
||||
The type of beacon
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
possible values: 'http' | 'https' | 'smb' | 'dns'
|
||||
type = 'http'
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:33](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L33)
|
||||
@@ -0,0 +1,160 @@
|
||||
[@redeye/parser-core](../index.md) / ParserCommand
|
||||
|
||||
# Interface: ParserCommand
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [attackIds](ParserCommand.md#attackids)
|
||||
- [beacon](ParserCommand.md#beacon)
|
||||
- [commandFailed](ParserCommand.md#commandfailed)
|
||||
- [input](ParserCommand.md#input)
|
||||
- [operator](ParserCommand.md#operator)
|
||||
- [output](ParserCommand.md#output)
|
||||
|
||||
## Properties
|
||||
|
||||
### attackIds
|
||||
|
||||
• `Optional` **attackIds**: `string`[]
|
||||
|
||||
A list of the MITRE ATT&CK techniques used by the command
|
||||
|
||||
**`Default`**
|
||||
|
||||
```ts
|
||||
[];
|
||||
```
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
attackIds = ['T1059', 'T1059.001'];
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:68](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L68)
|
||||
|
||||
---
|
||||
|
||||
### beacon
|
||||
|
||||
• **beacon**: `string`
|
||||
|
||||
Name of the beacon that the command was run from
|
||||
Should match the name of a beacon in the beacons object
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
beacon = 'beacon1';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:17](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L17)
|
||||
|
||||
---
|
||||
|
||||
### commandFailed
|
||||
|
||||
• `Optional` **commandFailed**: `boolean`
|
||||
|
||||
Whether the command was successful
|
||||
|
||||
**`Default`**
|
||||
|
||||
```ts
|
||||
false;
|
||||
```
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// The command output was not found in the logs or the command failed
|
||||
commandFailed = true;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:38](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L38)
|
||||
|
||||
---
|
||||
|
||||
### input
|
||||
|
||||
• **input**: [`ParserLogEntry`](ParserLogEntry.md)
|
||||
|
||||
The input that initialized the command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
input = {
|
||||
blob: 'ls',
|
||||
filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
|
||||
lineNumber: 123,
|
||||
logType: 'INPUT',
|
||||
dateTime: new Date('2021-01-01T00:00:00.000Z'),
|
||||
};
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:30](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L30)
|
||||
|
||||
---
|
||||
|
||||
### operator
|
||||
|
||||
• `Optional` **operator**: `string`
|
||||
|
||||
Name of the operator that sent the command
|
||||
Should match the name of an operator in the operators object
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
operator = 'admin';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:10](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L10)
|
||||
|
||||
---
|
||||
|
||||
### output
|
||||
|
||||
• `Optional` **output**: [`ParserLogEntry`](ParserLogEntry.md)
|
||||
|
||||
The output of the command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the command was successful
|
||||
output = {
|
||||
blob: '[System Process]\nsmss.exe\n...etc',
|
||||
filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
|
||||
lineNumber: 123,
|
||||
logType: 'OUTPUT',
|
||||
dateTime: new Date('2021-01-01T00:00:00.000Z'),
|
||||
};
|
||||
// If the command failed
|
||||
output = undefined;
|
||||
// or
|
||||
output = {
|
||||
blob: 'Unknown command: pwd',
|
||||
filepath: '<directory-of-parser>/logs/2023-02-01/log-1.txt',
|
||||
lineNumber: 123,
|
||||
logType: 'ERROR',
|
||||
dateTime: new Date('2021-01-01T00:00:00.000Z'),
|
||||
};
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-command.ts:61](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-command.ts#L61)
|
||||
@@ -0,0 +1,91 @@
|
||||
[@redeye/parser-core](../index.md) / ParserFile
|
||||
|
||||
# Interface: ParserFile
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [dateTime](ParserFile.md#datetime)
|
||||
- [fileFlag](ParserFile.md#fileflag)
|
||||
- [fileName](ParserFile.md#filename)
|
||||
- [filePath](ParserFile.md#filepath)
|
||||
- [md5](ParserFile.md#md5)
|
||||
|
||||
## Properties
|
||||
|
||||
### dateTime
|
||||
|
||||
• **dateTime**: `Date`
|
||||
|
||||
The date time the file was created or modified
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
dateTime = new Date('2021-01-01T00:00:00.000Z');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:137](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L137)
|
||||
|
||||
---
|
||||
|
||||
### fileFlag
|
||||
|
||||
• **fileFlag**: `"DOWNLOAD"` \| `"UPLOAD"`
|
||||
|
||||
Was this file uploaded to the host or downloaded from the host
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:146](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L146)
|
||||
|
||||
---
|
||||
|
||||
### fileName
|
||||
|
||||
• `Optional` **fileName**: `string`
|
||||
|
||||
The name of the file if the local file name is different from the name of the file
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
name = 'admin-list.txt';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:125](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L125)
|
||||
|
||||
---
|
||||
|
||||
### filePath
|
||||
|
||||
• **filePath**: `string`
|
||||
|
||||
Path to the file that RedEye can access
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
filePath = '<directory-of-parser>/files/file.txt';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:131](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L131)
|
||||
|
||||
---
|
||||
|
||||
### md5
|
||||
|
||||
• `Optional` **md5**: `string`
|
||||
|
||||
The MD5 hash of the file
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:141](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L141)
|
||||
@@ -0,0 +1,114 @@
|
||||
[@redeye/parser-core](../index.md) / ParserHost
|
||||
|
||||
# Interface: ParserHost
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [ip](ParserHost.md#ip)
|
||||
- [name](ParserHost.md#name)
|
||||
- [os](ParserHost.md#os)
|
||||
- [osVersion](ParserHost.md#osversion)
|
||||
- [server](ParserHost.md#server)
|
||||
- [type](ParserHost.md#type)
|
||||
|
||||
## Properties
|
||||
|
||||
### ip
|
||||
|
||||
• `Optional` **ip**: `string`
|
||||
|
||||
The IP address of the host
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
ip = '192.168.23.0';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:28](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L28)
|
||||
|
||||
---
|
||||
|
||||
### name
|
||||
|
||||
• **name**: `string`
|
||||
|
||||
The name of the host
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:5](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L5)
|
||||
|
||||
---
|
||||
|
||||
### os
|
||||
|
||||
• `Optional` **os**: `string`
|
||||
|
||||
The operating system of the host
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
os = 'Windows';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:16](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L16)
|
||||
|
||||
---
|
||||
|
||||
### osVersion
|
||||
|
||||
• `Optional` **osVersion**: `string`
|
||||
|
||||
The version of the operating system of the host
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
osVersion = '10.0.19041';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L22)
|
||||
|
||||
---
|
||||
|
||||
### server
|
||||
|
||||
• **server**: `string`
|
||||
|
||||
The name of the server that first ran a command or spawned a beacon on the host
|
||||
This should match the name of a server in the servers object
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:10](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L10)
|
||||
|
||||
---
|
||||
|
||||
### type
|
||||
|
||||
• `Optional` **type**: `string`
|
||||
|
||||
The type of host
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
type = 'workstation';
|
||||
type = 'server';
|
||||
type = 'laptop';
|
||||
type = 'virtual machine';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-host.ts:37](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-host.ts#L37)
|
||||
@@ -0,0 +1,65 @@
|
||||
[@redeye/parser-core](../index.md) / ParserImage
|
||||
|
||||
# Interface: ParserImage
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [fileName](ParserImage.md#filename)
|
||||
- [filePath](ParserImage.md#filepath)
|
||||
- [fileType](ParserImage.md#filetype)
|
||||
|
||||
## Properties
|
||||
|
||||
### fileName
|
||||
|
||||
• `Optional` **fileName**: `string`
|
||||
|
||||
The name of the image if the local file name is different from the name of the image
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
name = 'host-desktop-screenshot.png';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:116](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L116)
|
||||
|
||||
---
|
||||
|
||||
### filePath
|
||||
|
||||
• **filePath**: `string`
|
||||
|
||||
Path to the image that RedEye can access
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
filePath = '<directory-of-parser>/images/image.png';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:110](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L110)
|
||||
|
||||
---
|
||||
|
||||
### fileType
|
||||
|
||||
• **fileType**: `string`
|
||||
|
||||
The type of image
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
type = 'png';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-beacon.ts:104](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-beacon.ts#L104)
|
||||
@@ -0,0 +1,47 @@
|
||||
[@redeye/parser-core](../index.md) / ParserLink
|
||||
|
||||
# Interface: ParserLink
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [from](ParserLink.md#from)
|
||||
- [to](ParserLink.md#to)
|
||||
|
||||
## Properties
|
||||
|
||||
### from
|
||||
|
||||
• **from**: `string`
|
||||
|
||||
The origin of the link, can be a beacon or server
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
from = 'beacon1';
|
||||
from = 'server1';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-link.ts:8](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-link.ts#L8)
|
||||
|
||||
---
|
||||
|
||||
### to
|
||||
|
||||
• **to**: `string`
|
||||
|
||||
The destination of the link, can be a beacon
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
to = 'beacon2';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-link.ts:14](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-link.ts#L14)
|
||||
@@ -0,0 +1,147 @@
|
||||
[@redeye/parser-core](../index.md) / ParserLogEntry
|
||||
|
||||
# Interface: ParserLogEntry
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [blob](ParserLogEntry.md#blob)
|
||||
- [dateTime](ParserLogEntry.md#datetime)
|
||||
- [filepath](ParserLogEntry.md#filepath)
|
||||
- [lineNumber](ParserLogEntry.md#linenumber)
|
||||
- [lineType](ParserLogEntry.md#linetype)
|
||||
- [logType](ParserLogEntry.md#logtype)
|
||||
|
||||
## Properties
|
||||
|
||||
### blob
|
||||
|
||||
• **blob**: `string`
|
||||
|
||||
The text of the log entry, can be a command input or output
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
blob = 'ls';
|
||||
blob = 'cd C:\\Users\\admin\\Desktop';
|
||||
blob = 'dir';
|
||||
blob = '[System Process]\nsmss.exe\n...etc';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:12](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L12)
|
||||
|
||||
---
|
||||
|
||||
### dateTime
|
||||
|
||||
• `Optional` **dateTime**: `Date`
|
||||
|
||||
The date and time the log entry was created
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
dateTime = new Date('2021-01-01T00:00:00.000Z');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:66](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L66)
|
||||
|
||||
---
|
||||
|
||||
### filepath
|
||||
|
||||
• `Optional` **filepath**: `string`
|
||||
|
||||
Local path to the file that the log entry was found in
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
filepath = '<directory-of-parser>/logs/2023-02-01/log-1.txt';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:18](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L18)
|
||||
|
||||
---
|
||||
|
||||
### lineNumber
|
||||
|
||||
• `Optional` **lineNumber**: `number`
|
||||
|
||||
The starting line number of the log entry in the file
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
lineNumber = 123;
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:24](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L24)
|
||||
|
||||
---
|
||||
|
||||
### lineType
|
||||
|
||||
• `Optional` **lineType**: `"METADATA"` \| `"INPUT"` \| `"TASK"` \| `"CHECKIN"` \| `"OUTPUT"` \| `"MODE"` \| `"ERROR"` \| `"INDICATOR"`
|
||||
|
||||
The type of log line if the logType is 'BEACON'
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the log entry is a command input
|
||||
logType = 'INPUT';
|
||||
// If the log entry is a command output
|
||||
logType = 'OUTPUT';
|
||||
// If the log entry is a beacon status checkin with the server
|
||||
logType = 'CHECKIN';
|
||||
// If the log entry is the C2 server acknowledging a command
|
||||
logType = 'TASK';
|
||||
// If the log entry is an error of any kind
|
||||
logType = 'ERROR';
|
||||
// If the log entry is miscellaneous metadata tied to a beacon
|
||||
logType = 'METADATA';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:42](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L42)
|
||||
|
||||
---
|
||||
|
||||
### logType
|
||||
|
||||
• **logType**: `"BEACON"` \| `"EVENT"` \| `"DOWNLOAD"` \| `"WEBLOG"` \| `"KEYSTROKES"` \| `"UNKNOWN"`
|
||||
|
||||
The type of log entry
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// A beacon log entry
|
||||
logType = 'BEACON';
|
||||
// Misc events on the C2 server (e.g. operator login)
|
||||
logType = 'EVENT';
|
||||
// A file download from a beacon
|
||||
logType = 'DOWNLOAD';
|
||||
// A web log entry from a beacon
|
||||
logType = 'WEBLOG';
|
||||
// A keystroke log entry from a beacon
|
||||
logType = 'KEYSTROKES';
|
||||
// Any other log entry
|
||||
logType = 'UNKNOWN';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-log-entry.ts:60](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-log-entry.ts#L60)
|
||||
@@ -0,0 +1,64 @@
|
||||
[@redeye/parser-core](../index.md) / ParserOperator
|
||||
|
||||
# Interface: ParserOperator
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [endTime](ParserOperator.md#endtime)
|
||||
- [name](ParserOperator.md#name)
|
||||
- [startTime](ParserOperator.md#starttime)
|
||||
|
||||
## Properties
|
||||
|
||||
### endTime
|
||||
|
||||
• `Optional` **endTime**: `Date`
|
||||
|
||||
The date and time the operator last sent a command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the operator is still active
|
||||
endTime = new Date();
|
||||
// If the operator has never sent a command
|
||||
endTime = undefined;
|
||||
// If the operator is no longer active
|
||||
endTime = new Date('<date of last command>');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-operator.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-operator.ts#L22)
|
||||
|
||||
---
|
||||
|
||||
### name
|
||||
|
||||
• **name**: `string`
|
||||
|
||||
The name of the operator
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-operator.ts:5](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-operator.ts#L5)
|
||||
|
||||
---
|
||||
|
||||
### startTime
|
||||
|
||||
• `Optional` **startTime**: `Date`
|
||||
|
||||
The date and time the operator first sent a command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
startTime = new Date('<date of first command>');
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-operator.ts:11](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-operator.ts#L11)
|
||||
@@ -0,0 +1,206 @@
|
||||
[@redeye/parser-core](../index.md) / ParserOutput
|
||||
|
||||
# Interface: ParserOutput
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [beacons](ParserOutput.md#beacons)
|
||||
- [commands](ParserOutput.md#commands)
|
||||
- [hosts](ParserOutput.md#hosts)
|
||||
- [links](ParserOutput.md#links)
|
||||
- [operators](ParserOutput.md#operators)
|
||||
- [servers](ParserOutput.md#servers)
|
||||
|
||||
## Properties
|
||||
|
||||
### beacons
|
||||
|
||||
• **beacons**: `Object`
|
||||
|
||||
A key-value pair of beacon names and their metadata
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the beacon 'beacon1' was created from server 'server1' on host 'DESKTOP-312' at 2021-01-01T00:00:00 and last checked in at 2021-02-02T00:00:02
|
||||
beacons = {
|
||||
beacon1: {
|
||||
name: 'beacon1',
|
||||
server: 'server1',
|
||||
host: 'DESKTOP-312',
|
||||
ip: '192.168.23.2',
|
||||
process: 'svchost.exe',
|
||||
pid: 1234,
|
||||
startTime: new Date('2021-01-01T00:00:00.000Z'),
|
||||
endTime: new Date('2021-02-02T00:00:02.000Z'),
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [beaconName: `string`]: [`ParserBeacon`](ParserBeacon.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:62](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L62)
|
||||
|
||||
---
|
||||
|
||||
### commands
|
||||
|
||||
• **commands**: `Object`
|
||||
|
||||
A key-value pair of unique command identifiers and commands with inputs and outputs, sent by operators to beacons
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the operator 'admin' sent a command to the beacon 'beacon1' at 2021-01-01T00:00:00
|
||||
commands = {
|
||||
'admin-beacon1-2021-01-01T00:00:00': {
|
||||
operator: 'admin',
|
||||
beacon: 'beacon1',
|
||||
input: {
|
||||
blob: 'shell whoami',
|
||||
filepath: 'C:\\Users\\admin\\Desktop\\command.txt',
|
||||
lineNumber: 1,
|
||||
logType: 'BEACON',
|
||||
},
|
||||
output: {
|
||||
blob: 'admin',
|
||||
filepath: 'C:\\Users\\admin\\Desktop\\command.txt',
|
||||
lineNumber: 2,
|
||||
logType: 'BEACON',
|
||||
},
|
||||
attackIds: ['T1033'],
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [commandName: `string`]: [`ParserCommand`](ParserCommand.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:106](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L106)
|
||||
|
||||
---
|
||||
|
||||
### hosts
|
||||
|
||||
• **hosts**: `Object`
|
||||
|
||||
A key-value pair of host names and their metadata
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the host 'DESKTOP-312' was first discovered or had a beacon spawned by server 'server1' with os 'Windows 10.0.19041'
|
||||
hosts = {
|
||||
'DESKTOP-312': {
|
||||
name: 'DESKTOP-312',
|
||||
server: 'server1',
|
||||
os: 'Windows',
|
||||
osVersion: '10.0.19041',
|
||||
ip: '192.168.23.2',
|
||||
type: 'desktop',
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [hostName: `string`]: [`ParserHost`](ParserHost.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:41](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L41)
|
||||
|
||||
---
|
||||
|
||||
### links
|
||||
|
||||
• **links**: `Object`
|
||||
|
||||
A key-value pair of '<from>-<to>' and links from servers to beacons and beacons to beacons
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the server 'server1' has a beacon named 'beacon1'
|
||||
links = {
|
||||
'server1-beacon1': {
|
||||
from: 'server1',
|
||||
to: 'beacon1',
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [linkName: `string`]: [`ParserLink`](ParserLink.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:120](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L120)
|
||||
|
||||
---
|
||||
|
||||
### operators
|
||||
|
||||
• **operators**: `Object`
|
||||
|
||||
A key-value pair of operator names and the time range of their first and last command
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If the operator 'admin' their first command at 2021-01-01T00:00:00 and last command at 2021-02-02T00:00:02
|
||||
operators = {
|
||||
admin: {
|
||||
name: 'admin',
|
||||
startTime: new Date('2021-01-01T00:00:00.000Z'),
|
||||
endTime: new Date('2021-02-02T00:00:02.000Z'),
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [operatorName: `string`]: [`ParserOperator`](ParserOperator.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:78](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L78)
|
||||
|
||||
---
|
||||
|
||||
### servers
|
||||
|
||||
• **servers**: `Object`
|
||||
|
||||
A key-value pair of server names and their metadata
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
// If a C2 server was create with name 'server1' and will be communicating over https
|
||||
servers = {
|
||||
server1: {
|
||||
name: 'server1',
|
||||
type: 'https',
|
||||
},
|
||||
};
|
||||
```
|
||||
|
||||
#### Index signature
|
||||
|
||||
▪ [serverName: `string`]: [`ParserServer`](ParserServer.md)
|
||||
|
||||
#### Defined in
|
||||
|
||||
[index.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/index.ts#L22)
|
||||
@@ -0,0 +1,46 @@
|
||||
[@redeye/parser-core](../index.md) / ParserServer
|
||||
|
||||
# Interface: ParserServer
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [name](ParserServer.md#name)
|
||||
- [type](ParserServer.md#type)
|
||||
|
||||
## Properties
|
||||
|
||||
### name
|
||||
|
||||
• **name**: `string`
|
||||
|
||||
The name of the server
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-server.ts:7](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-server.ts#L7)
|
||||
|
||||
---
|
||||
|
||||
### type
|
||||
|
||||
• `Optional` **type**: `"http"` \| `"https"` \| `"smb"` \| `"dns"`
|
||||
|
||||
The type of server
|
||||
|
||||
**`Default`**
|
||||
|
||||
```ts
|
||||
'http';
|
||||
```
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
type = 'https';
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-server.ts:15](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-output/parser-server.ts#L15)
|
||||
@@ -0,0 +1,9 @@
|
||||
@redeye/parser-core
|
||||
|
||||
# @redeye/parser-core
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Interfaces
|
||||
|
||||
- [ParserValidateFiles](interfaces/ParserValidateFiles.md)
|
||||
@@ -0,0 +1,68 @@
|
||||
[@redeye/parser-core](../index.md) / ParserValidateFiles
|
||||
|
||||
# Interface: ParserValidateFiles
|
||||
|
||||
## Table of contents
|
||||
|
||||
### Properties
|
||||
|
||||
- [invalid](ParserValidateFiles.md#invalid)
|
||||
- [servers](ParserValidateFiles.md#servers)
|
||||
- [valid](ParserValidateFiles.md#valid)
|
||||
|
||||
## Properties
|
||||
|
||||
### invalid
|
||||
|
||||
• **invalid**: `string`[]
|
||||
|
||||
An array of invalid file paths relative to the campaign root directory
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
invalid = ['/campaign/server-1/file3.jpg', '/campaign/server-1/file4.xml'];
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-validate-files.ts:22](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-validate-files.ts#L22)
|
||||
|
||||
---
|
||||
|
||||
### servers
|
||||
|
||||
• **servers**: { `fileCount?`: `number` ; `name`: `string` }[]
|
||||
|
||||
A list of servers and the number of files associated with each server
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
servers = [
|
||||
{ name: 'server1', fileCount: 2 },
|
||||
{ name: 'server2', fileCount: 1 },
|
||||
];
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-validate-files.ts:10](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-validate-files.ts#L10)
|
||||
|
||||
---
|
||||
|
||||
### valid
|
||||
|
||||
• **valid**: `string`[]
|
||||
|
||||
An array of valid file paths relative to the campaign root directory
|
||||
|
||||
**`Example`**
|
||||
|
||||
```ts
|
||||
valid = ['/campaign/server-1/file1.json', '/campaign/server-1/file2.json'];
|
||||
```
|
||||
|
||||
#### Defined in
|
||||
|
||||
[parser-validate-files.ts:16](https://github.com/cisagov/RedEye/blob/bd5dfc45/parsers/parser-core/src/parser-validate-files.ts#L16)
|
||||
Reference in New Issue
Block a user