ilyaglow / go-cortex

:crystal_ball: Cortex API client written in Go https://github.com/TheHive-Project/Cortex
GNU Affero General Public License v3.0
11 stars 1 forks source link

Cortexutil package #11

Closed ilyaglow closed 6 years ago

ilyaglow commented 6 years ago

How it can be used:

package main

import (
    "log"
    "strconv"

    "github.com/ilyaglow/go-cortex"
)

// Report is a sample analyzer report
type Report struct {
    Field   string   `json:"field,omitempty"`
    Results []string `json:"results,omitempty"`
    Status  bool     `json:"status,omitempty"`
}

func main() {
    // Grab stdin to JobInput structure
    input, err := cortex.NewInput()
    if err != nil {
        log.Fatal(err)
    }

    // Get url parameter from analyzer config
    url, err := input.Config.GetString("url")
    if err != nil {
        // Report an error if something went wrong
        cortex.SayError(input, err.Error())
    }

    // You get somehow report struct from JobInput.Data
    rep, err := Do(input.Data, url)
    if err != nil {
        cortex.SayError(input, err.Error())
    }

    // Make taxonomies
    var txs []cortex.Taxonomy
    namespace := "AnalyzerName"
    predicate := "Predicate"
    if len(rep.Results) == 0 {
        txs = append(txs, cortex.Taxonomy{
            Namespace: namespace,
            Predicate: predicate,
            Level:     "safe",
            Value:     "0",
        })
    } else {
        txs = append(txs, cortex.Taxonomy{
            Namespace: namespace,
            Predicate: predicate,
            Level:     "suspicious",
            Value:     strconv.FormatInt(int64(len(rep.Results[0])), 10),
        })
    }

    // Report accept marshallable struct and taxonomies
    cortex.SayReport(rep, txs)
}

// Do represents analyzing data
func Do(input string, u string) (*Report, error) {
    return &Report{
        Field:   "some",
        Results: []string{"domain.com", "127.0.0.1", "email@domain.com"},
        Status:  true,
    }, nil
}
coveralls commented 6 years ago

Coverage Status

Coverage decreased (-9.9%) to 70.45% when pulling 0385bdd9a1462ba8cf4040cc693f66ca5f155886 on cortexutil-pr into 580b17a2449a3f86bd0da89722df85cdf3d7a3ff on master.