brexhq / substation

Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
https://substation.readme.io
MIT License
330 stars 21 forks source link

feat: add bitmath inspector #128

Closed shellcromancer closed 1 year ago

shellcromancer commented 1 year ago

Description

This adds a new bitmath inspector similar to the strings inspector focused on comparison operations with numbers. The supported operations are and, or, xor, and not and compare the resulting value with 0.

Motivation and Context

Some datasets have field which are bitfield constants where the meaning is best unpacked with bitwise masking to check values and then inserting the meaning into a new field. I don't believe this is possible to check with the other inspectors today.

How Has This Been Tested?

New test cases have been added to cover the new existing operations and it solves for the target use case internally.

Types of changes

Checklist:

shellcromancer commented 1 year ago

Overall looks good, added some comments for small improvements and requests for more unit testing.

Thanks for the quick review! :) Made some changes including the additional unit tests πŸ‘

Would this ever need to support floats?

Today this inspector would handle floats in a loss-y way by truncating values into integers. There might be a use case for float handling considering that the JSON spec supports decimal notation (specifically arbitrary-precision decimal), but it's implementation should live separately b/c the key operation of bitwise-and masking isn't defined on floats in Go.

jshlbrd commented 1 year ago

Today this inspector would handle floats in a loss-y way by truncating values into integers. There might be a use case for float handling considering that the JSON spec supports decimal notation (specifically arbitrary-precision decimal), but it's implementation should live separately b/c the key operation of bitwise-and masking isn't defined on floats in Go.

It sounds like two different inspectors (number and bitwise) or this one inspector handles the value differently depending on the type.

shellcromancer commented 1 year ago

It sounds like two different inspectors (number and bitwise) or this one inspector handles the value differently depending on the type.

With that in mind I've focused this on doing bitmath and then comparing for a non-zero result instead and removed non-bitwise types πŸ‘