Documentation
¶
Overview ¶
Package threat implements functionality for handling threat data and analyzing requests for threats.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var (
DbURL = repoURL + "/raw/master/db/" + dbFile
)
Functions ¶
func Get ¶
func Get() error
Get retrieves all the teler threat datasets.
It returns an error if there was an issue when retrieving the datasets.
func IsUpdated ¶
IsUpdated checks if the threat datasets are up-to-date. It returns a boolean value indicating whether the datasets are updated or not, and an error if there was an issue when checking the datasets' last modified date.
func Location ¶ added in v1.2.0
Location returns the location of the teler cache directory. It returns an error if there was an issue when getting the user cache directory.
func TmpLocation ¶ added in v1.2.5
tmpLocation generates a temporary directory path based on the current date and creates the directory if it doesn't already exist. It returns the path of the temporary directory or an error if the creation fails.
func Verify ¶ added in v1.2.5
Verify checks the integrity of files by comparing their checksums with the MD5 sums obtained from a teler-resources repository.
It fetches the MD5 sums, verifies that the fetched data is correct, and then checks the checksums of the local files against the obtained MD5 sums. It returns true if all checksums match, otherwise returns false along with an error if any issues occur during the verification process.
Types ¶
type Threat ¶
type Threat int8
Threat represents the different types of threats that can be excluded from analysis.
The Threat type is used to specify which types of threats should be excluded when analyzing a request for threats. It can be one of the following values:
- CommonWebAttack: covers common web-based attacks such as cross-site scripting (XSS) and SQL injection.
- CVE: covers known vulnerabilities and exploits, as specified by the Common Vulnerabilities and Exposures (CVE) database.
- BadIPAddress: covers requests from known bad IP addresses, such as those associated with known malicious actors or botnets.
- BadReferrer: covers requests with a bad HTTP referrer, such as those that are not expected based on the application's URL structure or are known to be associated with malicious actors.
- BadCrawler: covers requests from known bad crawlers or scrapers, such as those that are known to cause performance issues or attempt to extract sensitive information from the application.
- DirectoryBruteforce: covers requests that attempt to brute-force access to directories on the server, such as by trying common directory names or using dictionary attacks.
const ( // Undefined threat type didn't covers anything Undefined Threat = iota - 1 // Custom threat type is a custom threat that doesn't fit into any of the other defined categories. Custom // CommonWebAttack threat type covers common web-based attacks such as cross-site scripting (XSS) and SQL injection. CommonWebAttack // CVE threat type covers known vulnerabilities and exploits, as specified by the Common Vulnerabilities and Exposures (CVE) database. CVE // BadIPAddress threat type covers requests from known bad IP addresses, such as those associated with known malicious actors or botnets. BadIPAddress // BadReferrer threat type covers requests with a bad HTTP referrer, such as those that are not expected based on the application's URL structure or are known to be associated with malicious actors. BadReferrer // BadCrawler threat type covers requests from known bad crawlers or scrapers, such as those that are known to cause performance issues or attempt to extract sensitive information from the application. BadCrawler // DirectoryBruteforce threat type covers requests that attempt to brute-force access to directories on the server, such as by trying common directory names or using dictionary attacks. DirectoryBruteforce )
func (Threat) Filename ¶ added in v0.4.0
Filename returns the file name representation of a Threat value
If `full` is true, it returns the `full` file path by calling the location function and joining it with the corresponding file name. If `full` is false, it returns only the file name without the path. It returns an error if `full` is true but the location function returns an error or if the corresponding file name cannot be found for the Threat value.
Source Files