magneticstain / Inquisition

An advanced and versatile open-source network anomaly detection platform
MIT License
8 stars 4 forks source link

Expose FieldType Data via Celestial API #109

Closed magneticstain closed 5 years ago

magneticstain commented 5 years ago

Part of Issue #101 includes making Field data mutable. As part of that, the type of field should be able to be set by the user.

With the current design, we should load that FieldType data as content set data via the Celestial API. This is also useful for use with the Field API call too when using the API externally.

magneticstain commented 5 years ago

Completed and verified:

[josh@jimmy1 ~]$ curl -v 'https://inquisition.carlso.net/api/v1/tuning/?t=field_type' | python -m json.tool
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 138.197.139.58...
* TCP_NODELAY set
* Connected to inquisition.carlso.net (138.197.139.58) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
  CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [108 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [2750 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [333 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [70 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=inquisition.carlso.net
*  start date: Aug  5 17:30:51 2018 GMT
*  expire date: Nov  3 17:30:51 2018 GMT
*  subjectAltName: host "inquisition.carlso.net" matched cert's "inquisition.carlso.net"
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
} [5 bytes data]
> GET /api/v1/tuning/?t=field_type HTTP/1.1
> Host: inquisition.carlso.net
> User-Agent: curl/7.59.0
> Accept: */*
> 
{ [5 bytes data]
< HTTP/1.1 200 OK
< Date: Tue, 14 Aug 2018 23:53:19 GMT
< Server: Apache/2.4.25 (Debian)
< strict-transport-security: max-age=2592000; includeSubDomains
< X-Frame-Options: sameorigin
< X-XSS-Protection: 1
< X-Content-Type-Options: nosniff
< Content-Security-Policy: default-src 'self'; connect-src https:;
< X-Permitted-Cross-Domain-Policies: none
< Referrer-Policy: no-referrer
< Cache-Control: max-age=0
< Vary: Accept-Encoding
< Content-Length: 234
< Content-Type: application/json
< 
{ [234 bytes data]
100   234  100   234    0     0    720      0 --:--:-- --:--:-- --:--:--   720
* Connection #0 to host inquisition.carlso.net left intact
{
    "data": [
        {
            "type_id": 1,
            "type_key": "hst",
            "type_name": "log_source"
        },
        {
            "type_id": 2,
            "type_key": "src",
            "type_name": "traffic_source"
        },
        {
            "type_id": 3,
            "type_key": "dst",
            "type_name": "traffic_destination"
        }
    ],
    "data_source": "default",
    "status": "success"
}
[josh@jimmy1 ~]$