rapid7

package module
v0.0.13 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Apr 15, 2024 License: BSD-3-Clause-Clear Imports: 9 Imported by: 0

README



Rapid7 Go Client


Go Reference GitHub tag (latest SemVer)

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type APIError

type APIError struct {
	Message       string `json:"message"`
	CorrelationID string `json:"correlation_id"`
}

type Assignee

type Assignee struct {
	Email string `json:"email"`
	Name  string `json:"name"`
}

type Client

type Client struct {
	IDR *IDR
	VM  *VM
}

func New

func New(region, apiKey string) (client *Client, err error)

type CommentAttachment added in v0.0.3

type CommentAttachment struct {
	CreatedTime time.Time `json:"created_time"`
	Creator     Creator   `json:"creator"`
	FileName    string    `json:"file_name"`
	MimeType    string    `json:"mime_type"`
	RRN         string    `json:"rrn"`
	ScanStatus  string    `json:"scan_status"`
	Size        int64     `json:"size"`
}

type Creator added in v0.0.3

type Creator struct {
	Name string `json:"name"`
	Type string `json:"type"`
}

type IDR

type IDR struct {
	BaseURL *url.URL
	// contains filtered or unexported fields
}

func (*IDR) AssetSearch added in v0.0.13

func (idr *IDR) AssetSearch(index int32, search ...IDRAssetSearchQuery) (*Rapid7PagedResponse[IDRAsset], error)

func (*IDR) Assets added in v0.0.13

func (idr *IDR) Assets(search ...IDRAssetSearchQuery) ([]*IDRAsset, error)

func (*IDR) Investigation

func (idr *IDR) Investigation(id string) (investigation *Investigation, err error)

func (*IDR) InvestigationComments added in v0.0.3

func (idr *IDR) InvestigationComments(inv *Investigation) (comments *InvestigationComments, err error)

func (*IDR) Investigations

func (idr *IDR) Investigations(q ...*InvestigationsQuery) ([]*Investigation, error)

func (*IDR) InvestigationsAll added in v0.0.11

func (idr *IDR) InvestigationsAll(q ...*InvestigationsQuery) ([]*Investigation, error)

func (*IDR) InvestigationsResponse added in v0.0.11

func (idr *IDR) InvestigationsResponse(q ...*InvestigationsQuery) (*InvestigationsResponse, error)

func (*IDR) URL

func (idr *IDR) URL(paths ...string) string

func (*IDR) UpdateInvestigation added in v0.0.8

func (idr *IDR) UpdateInvestigation(id string, update *InvestigationUpdateRequest) (*Investigation, error)

type IDRAsset added in v0.0.13

type IDRAsset struct {
	RRN  string `json:"rrn"`
	Name string `json:"name"`
}

type IDRAssetQueryParams added in v0.0.13

type IDRAssetQueryParams struct {
	Index *int32 `json:"index"`
	// Size field is not used here, but it is included to reflect the data structure.
	// Set ASSET_SEARCH_PAGE_SIZE instead.
	Size *int32 `json:"size"`
}

type IDRAssetRequest added in v0.0.13

type IDRAssetRequest struct {
	Search []IDRAssetSearchQuery `json:"search"`
	Sort   []IDRAssetSortQuery   `json:"sort,omitempty"`
}

type IDRAssetSearchPageSize added in v0.0.13

type IDRAssetSearchPageSize int32
var IDR_ASSET_SEARCH_PAGE_SIZE IDRAssetSearchPageSize = 100

func (IDRAssetSearchPageSize) String added in v0.0.13

func (s IDRAssetSearchPageSize) String() string

type IDRAssetSearchQuery added in v0.0.13

type IDRAssetSearchQuery struct {
	Field    string         `json:"field"`
	Operator SearchOperator `json:"operator"`
	Value    string         `json:"value"`
}

type IDRAssetSortQuery added in v0.0.13

type IDRAssetSortQuery struct {
	Field string        `json:"field"`
	Order SortDirection `json:"order"`
}

type Investigation

type Investigation struct {
	Assignee        *Assignee                `json:"assignee"`
	CreatedTime     time.Time                `json:"created_time"`
	Disposition     InvestigationDisposition `json:"disposition"`
	FirstAlertTime  *time.Time               `json:"first_alert_time"`
	LastAccessed    time.Time                `json:"last_accessed"`
	LatestAlertTime *time.Time               `json:"latest_alert_time"`
	OrganizationID  string                   `json:"organization_id"`
	Priority        InvestigationPriority    `json:"priority"`
	Responsibility  string                   `json:"responsibility"`
	RRN             string                   `json:"rrn"`
	Source          InvestigationSource      `json:"source"`
	Status          InvestigationStatus      `json:"status"`
	Tags            []string                 `json:"tags"`
	Title           string                   `json:"title"`
}

type InvestigationAssignee added in v0.0.8

type InvestigationAssignee struct {
	Email string `json:"email"`
}

type InvestigationCommentData added in v0.0.3

type InvestigationCommentData struct {
	Body        string              `json:"body"`
	CreatedTime time.Time           `json:"created_time"`
	Creator     Creator             `json:"creator"`
	RRN         string              `json:"rrn"`
	Target      string              `json:"target"`
	Visibility  string              `json:"visibility"`
	Attachments []CommentAttachment `json:"attachments"`
}

type InvestigationComments added in v0.0.3

type InvestigationComments struct {
	Data     []InvestigationCommentData `json:"data"`
	Metadata Metadata                   `json:"metadata"`
}

type InvestigationDisposition added in v0.0.2

type InvestigationDisposition string

BENIGN, MALICIOUS, NOT_APPLICABLE, UNDECIDED

const BENIGN InvestigationDisposition = "BENIGN"
const MALICIOUS InvestigationDisposition = "MALICIOUS"
const NOT_APPLICABLE InvestigationDisposition = "NOT_APPLICABLE"
const UNDECIDED InvestigationDisposition = "UNDECIDED"

func (InvestigationDisposition) String added in v0.0.6

func (i InvestigationDisposition) String() string

type InvestigationPriority added in v0.0.2

type InvestigationPriority string

CRITICAL, HIGH, MEDIUM, LOW, UNSPECIFIED

const CRITICAL InvestigationPriority = "CRITICAL"
const HIGH InvestigationPriority = "HIGH"
const LOW InvestigationPriority = "LOW"
const MEDIUM InvestigationPriority = "MEDIUM"
const UNSPECIFIED InvestigationPriority = "UNSPECIFIED"

func (InvestigationPriority) String added in v0.0.6

func (i InvestigationPriority) String() string

type InvestigationSource added in v0.0.2

type InvestigationSource string

MANUAL, HUNT, ALERT

const ALERT InvestigationSource = "ALERT"
const HUNT InvestigationSource = "HUNT"
const MANUAL InvestigationSource = "MANUAL"

func (InvestigationSource) String added in v0.0.6

func (i InvestigationSource) String() string

type InvestigationStatus added in v0.0.2

type InvestigationStatus string

OPEN, WAITING, INVESTIGATING, CLOSED

const CLOSED InvestigationStatus = "CLOSED"
const INVESTIGATING InvestigationStatus = "INVESTIGATING"
const OPEN InvestigationStatus = "OPEN"
const WAITING InvestigationStatus = "WAITING"

func (InvestigationStatus) String added in v0.0.6

func (i InvestigationStatus) String() string

type InvestigationUpdateRequest added in v0.0.8

type InvestigationUpdateRequest struct {
	Assignee    *InvestigationAssignee   `json:"assignee,omitempty"`
	Disposition InvestigationDisposition `json:"disposition,omitempty"`
	Priority    InvestigationPriority    `json:"priority,omitempty"`
	Status      InvestigationStatus      `json:"status,omitempty"`
	Title       string                   `json:"title,omitempty"`
}

type InvestigationsQuery

type InvestigationsQuery struct {
	// A user's email address. Only investigations assigned to that user will be included.
	AssigneeEmail string `url:"assignee.email,omitempty"`
	// The time an investigation is closed. Only investigations whose created_time is before this
	// date will be returned by the API. Must be an ISO-formatted timestamp.
	EndTime time.Time `url:"end_time,omitempty"`
	// The 0-based index of the first page to retrieve. Must be an integer greater than 0.
	//
	// Default: 0
	Index int32 `url:"index,omitempty"`
	// Indicates whether the requester has multi-customer access. If set to true, a user API key
	// must be provided. Investigations will be returned from all organizations the calling user
	// has access to.
	//
	// Default: false
	MultiCustomer bool `url:"multi-customer,omitempty"`
	// A comma-separated list of investigation priorities to include in the result.
	Priorities []InvestigationPriority `url:"priorities,omitempty,comma"`
	// The maximum number of investigations to retrieve. Must be an integer greater than 0, or less
	// than or equal to 100.
	//
	// Default: 20
	Size int32 `url:"size,omitempty"`
	// Sort investigations by field and direction,  separated by a comma. Sortable fields are
	// `created_time`, `priority`, `rrn`, `alerts_most_recent_created_time`, and
	// `alerts_most_recent_detection_created_time`.
	//
	// Default: "priority,DESC"
	Sort string `url:"sort,omitempty"`
	// A comma-separated list of investigation sources to include in the result.
	Sources []string `url:"sources,omitempty,comma"`
	// The time an investigation is opened. Only investigations whose created_time is after this
	// date will be returned by the API. Must be an ISO-formatted timestamp.
	//
	// Default: 28 days prior to current time.
	StartTime time.Time `url:"start_time,omitempty,comma"`
	// A comma-separated list of investigation statuses to include in the result.
	Statuses []InvestigationStatus `url:"statuses,omitempty,comma"`
	// A comma-separated list of tags to include in the result. Only investigations who have all
	// specified tags will be included.
	Tags []string `url:"tags,omitempty,comma"`
}

func (*InvestigationsQuery) SortBy added in v0.0.11

func (q *InvestigationsQuery) SortBy(field SortField, direction SortDirection)

type InvestigationsResponse

type InvestigationsResponse = Rapid7PagedResponse[Investigation]

type Metadata added in v0.0.3

type Metadata struct {
	// The current page, starting from 0. This value will always be provided.
	Index int32 `json:"index"`
	// The number of data items in the current page. This value will always be provided.
	Size int32 `json:"size"`
	// The attributes used to sort the complete response. This will be provided if the response is sorted.
	Sort string `json:"sort,omitempty"`
	// The total number of data items that make up the complete response. This will be provided if possible.
	TotalData int64 `json:"total_data,omitempty"`
	// The total number of pages that make up the complete response. This will be provided if possible.
	TotalPages int32 `json:"total_pages,omitempty"`
}

type RRN added in v0.0.3

type RRN struct {
	OrganizationID string   `json:"organizationId"`
	Partition      string   `json:"partition"`
	RegionCode     string   `json:"regionCode"`
	Resource       string   `json:"resource"`
	ResourceTypes  []string `json:"resourceTypes"`
	Service        string   `json:"service"`
}

type Rapid7PagedResponse added in v0.0.2

type Rapid7PagedResponse[T any] struct {
	Data     []*T     `json:"data"`
	Metadata Metadata `json:"metadata"`
}

type SearchOperator added in v0.0.13

type SearchOperator string

EQUALS, CONTAINS, IN

const CONTAINS SearchOperator = "CONTAINS"
const EQUALS SearchOperator = "EQUALS"
const IN SearchOperator = "IN"

func (SearchOperator) String added in v0.0.13

func (s SearchOperator) String() string

type SortDirection added in v0.0.11

type SortDirection string

ASC, DESC

const SORT_ASCENDING SortDirection = "ASC"
const SORT_DESCENDING SortDirection = "DESC"

func (SortDirection) String added in v0.0.11

func (s SortDirection) String() string

type SortField added in v0.0.11

type SortField string

`created_time`, `priority`, `rrn`, `alerts_most_recent_created_time`, or `alerts_most_recent_detection_created_time`.

const SORT_CREATED_TIME SortField = "created_time"
const SORT_MOST_RECENT_CREATED_TIME SortField = "alerts_most_recent_created_time"
const SORT_MOST_RECENT_DETECTION_TIME SortField = "alerts_most_recent_detection_created_time"
const SORT_PRIORITY SortField = "priority"
const SORT_RRN SortField = "rrn"

func (SortField) String added in v0.0.11

func (s SortField) String() string

type VM added in v0.0.13

type VM struct {
	BaseURL *url.URL
	// contains filtered or unexported fields
}

func (*VM) AssetSearch added in v0.0.13

func (vm *VM) AssetSearch(search ...VMAssetSearchQuery) (*Rapid7PagedResponse[VMAsset], error)

func (*VM) Assets added in v0.0.13

func (vm *VM) Assets(search ...VMAssetSearchQuery) ([]*VMAsset, error)

func (*VM) URL added in v0.0.13

func (vm *VM) URL(paths ...string) string

type VMAsset added in v0.0.13

type VMAsset struct {
	AssessedForPolicies            bool                     `json:"assessed_for_policies"`
	AssessedForVulnerabilities     bool                     `json:"assessed_for_vulnerabilities"`
	CredentialAssessments          []VMCredentialAssessment `json:"credential_assessments"`
	CriticalVulnerabilities        int32                    `json:"critical_vulnerabilities"`
	Exploits                       int32                    `json:"exploits"`
	HostName                       string                   `json:"host_name"`
	ID                             string                   `json:"id"`
	IP                             string                   `json:"ip"`
	LastAssessedForVulnerabilities time.Time                `json:"last_assessed_for_vulnerabilities"`
	LastScanEnd                    time.Time                `json:"last_scan_end"`
	LastScanStart                  time.Time                `json:"last_scan_start"`
	MAC                            string                   `json:"mac"`
	MalwareKits                    int32                    `json:"malware_kits"`
	ModerateVulnerabilities        int32                    `json:"moderate_vulnerabilities"`
	New                            []VMVulnerability        `json:"new"`
	OSArchitecture                 string                   `json:"os_architecture"`
	OSDescription                  string                   `json:"os_description"`
	OSFamily                       string                   `json:"os_family"`
	OSName                         string                   `json:"os_name"`
	OSSystemName                   string                   `json:"os_system_name"`
	OSType                         string                   `json:"os_type"`
	OSVendor                       string                   `json:"os_vendor"`
	OSVersion                      string                   `json:"os_version"`
	Remediated                     []VMVulnerability        `json:"remediated"`
	RiskScore                      float32                  `json:"risk_score"`
	Same                           []VMVulnerability        `json:"same"`
	SevereVulnerabilities          int32                    `json:"severe_vulnerabilities"`
	Tags                           []VMAssetTag             `json:"tags"`
	TotalVulnerabilities           int32                    `json:"total_vulnerabilities"`
	Type                           VMType                   `json:"type"`
	UniqueIdentifiers              []VMUniqueIdentifier     `json:"unique_identifiers"`
}

type VMAssetSearchPageSize added in v0.0.13

type VMAssetSearchPageSize int
var VM_ASSET_SEARCH_PAGE_SIZE VMAssetSearchPageSize = 100

func (VMAssetSearchPageSize) String added in v0.0.13

func (s VMAssetSearchPageSize) String() string

type VMAssetSearchQuery added in v0.0.13

type VMAssetSearchQuery struct {
	Cursor                   string        `json:"cursor,omitempty"`
	CurrentTime              time.Time     `json:"currentTime,omitempty"`
	ComparisonTime           time.Time     `json:"comparisonTime,omitempty"`
	IncludeSame              bool          `json:"includeSame,omitempty"`
	IncludeUniqueIdentifiers bool          `json:"includeUniqueIdentifiers,omitempty"`
	Page                     int           `json:"page,omitempty"`
	Size                     int           `json:"size,omitempty"`
	Sort                     SortDirection `json:"sort,omitempty"`
}

func (VMAssetSearchQuery) Map added in v0.0.13

func (q VMAssetSearchQuery) Map() map[string]string

type VMAssetSearchRequest added in v0.0.13

type VMAssetSearchRequest struct {
	Asset         string `json:"asset,omitempty"`
	Vulnerability string `json:"vulnerability,omitempty"`
}

type VMAssetTag added in v0.0.13

type VMAssetTag struct {
	Name string `json:"name"`
	Type string `json:"type"`
}

type VMCredentialAssessment added in v0.0.13

type VMCredentialAssessment struct {
	Port     int64  `json:"port"`
	Protocol string `json:"protocol"`
	Status   string `json:"status"`
}

type VMType added in v0.0.13

type VMType string
const (
	VMHypervisor VMType = "hypervisor"
	VMMobile     VMType = "mobile"
	VMGuest      VMType = "guest"
	VMPhysical   VMType = "physical"
	VMUnknown    VMType = "unknown"
)

func (VMType) String added in v0.0.13

func (v VMType) String() string

type VMUniqueIdentifier added in v0.0.13

type VMUniqueIdentifier struct {
	ID     string `json:"id"`
	Source string `json:"source"`
}

type VMVulnerability added in v0.0.13

type VMVulnerability struct {
	CheckID         string                `json:"check_id"`
	FirstFound      time.Time             `json:"first_found"`
	Key             string                `json:"key"`
	LastFound       time.Time             `json:"last_found"`
	NIC             string                `json:"nic"`
	Port            int32                 `json:"port"`
	Proof           string                `json:"proof"`
	Protocol        string                `json:"protocol"`
	SolutionFix     string                `json:"solution_fix"`
	SolutionID      string                `json:"solution_id"`
	SolutionSummary string                `json:"solution_summary"`
	SolutionType    string                `json:"solution_type"`
	Status          VMVulnerabilityStatus `json:"status"`
	VulnerabilityID string                `json:"vulnerability_id"`
}

type VMVulnerabilityStatus added in v0.0.13

type VMVulnerabilityStatus string
const (
	VMExceptionVulnExpl   VMVulnerabilityStatus = "EXCEPTION_VULN_EXPL"
	VMUnexpectedErr       VMVulnerabilityStatus = "UNEXPECTED_ERR"
	VMNotVulnDontStore    VMVulnerabilityStatus = "NOT_VULN_DONT_STORE"
	VMSuperseded          VMVulnerabilityStatus = "SUPERSEDED"
	VMExceptionVulnPotl   VMVulnerabilityStatus = "EXCEPTION_VULN_POTL"
	VMVulnerableExpl      VMVulnerabilityStatus = "VULNERABLE_EXPL"
	VMOverriddenVulnVers  VMVulnerabilityStatus = "OVERRIDDEN_VULN_VERS"
	VMSkippedDisabled     VMVulnerabilityStatus = "SKIPPED_DISABLED"
	VMVulnerableVers      VMVulnerabilityStatus = "VULNERABLE_VERS"
	VMVulnerablePotential VMVulnerabilityStatus = "VULNERABLE_POTENTIAL"
	VMSkippedVers         VMVulnerabilityStatus = "SKIPPED_VERS"
	VMExceptionVulnVers   VMVulnerabilityStatus = "EXCEPTION_VULN_VERS"
	VMNotVulnerable       VMVulnerabilityStatus = "NOT_VULNERABLE"
	VMUnknownStatus       VMVulnerabilityStatus = "UNKNOWN"
	VMSkippedDOS          VMVulnerabilityStatus = "SKIPPED_DOS"
)

func (VMVulnerabilityStatus) String added in v0.0.13

func (v VMVulnerabilityStatus) String() string

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL