コード例 #1
0
func main() {
	esmap, _ := ioutil.ReadFile("/opt/nighthawk/lib/elastic/ElasticMapping.json")

	nightHawk.LoadConfigFile("/opt/nighthawk/etc/nighthawk.json")

	var esIndexUrl string = ""
	esIndexUrl = GetElasticUrl(nightHawk.ELASTIC_INDEX)

	resp, err := nightHawk.HttpOperation("GET", esIndexUrl, nightHawk.ELASTIC_AUTHCODE, nightHawk.ELASTIC_SSL, nil)
	if err != nil {
		panic(err.Error())
	}

	if resp.StatusCode == 200 || resp.StatusCode == 201 {
		reader := bufio.NewReader(os.Stdin)

		fmt.Printf("Index Already exists. Do you want to recreate [y/n]: ")
		user_input, _ := reader.ReadString('\n')

		if strings.ToLower(user_input[:1]) == "y" {
			esIndexUrl = GetElasticUrl("investigation1")
			// Delete current index
			resp, err := nightHawk.HttpOperation("DELETE", esIndexUrl, nightHawk.ELASTIC_AUTHCODE, nightHawk.ELASTIC_SSL, nil)
			if err != nil {
				panic(err.Error())
			}

			if resp.StatusCode != 200 && resp.StatusCode != 201 {
				body, _ := ioutil.ReadAll(resp.Body)
				fmt.Println(string(body))

				os.Exit(1)
			}
			os.Remove("/opt/nighthawk/var/run/elasticsearch/elastic.init")
			CreateElasticIndex(esIndexUrl, esmap)
		}
	} else {
		esIndexUrl = GetElasticUrl("investigation1")
		CreateElasticIndex(esIndexUrl, esmap)
	}
}
コード例 #2
0
func main() {
	runtime.GOMAXPROCS(nightHawk.MAXPROCS)

	// Setting commandline argument parser
	var runopt RuntimeOptions

	flag.StringVar(&runopt.CaseName, "N", "", "Case name collected triage. If this value is not supplied system generated case name is used.")
	flag.StringVar(&runopt.ComputerName, "C", "", "Computer name")
	flag.StringVar(&runopt.ConfigFile, "c", nightHawk.CONFIG, "nightHawk configuration file")
	flag.StringVar(&runopt.CaseDate, "D", "", "Case date for collected triage. If this value is not supplied current date is used.")
	flag.StringVar(&runopt.CaseAnalyst, "a", "", "Case analyst working with collected triage")
	flag.StringVar(&runopt.Filename, "f", "", "File containing triage file")
	flag.StringVar(&runopt.Debug, "d", "none", "Specify debug generator to be debugged. For list of available generator use \"-d list\" ")
	flag.BoolVar(&runopt.Version, "V", false, "Display version information")
	flag.BoolVar(&runopt.Verbose, "v", false, "Show verbose message on console")

	flag.Parse()

	if runopt.Version {
		nightHawk.ShowVersion()
		os.Exit(0)
	}

	if runopt.Debug == "list" {
		nightHawk.ShowAuditGenerators()
		os.Exit(0)
	}

	if !nightHawk.LoadConfigFile(runopt.ConfigFile) {
		ExitOnError("Error encounter reading configuration file", nightHawk.ERROR_CONFIG_FILE_READ)
	}

	if runopt.Verbose {
		nightHawk.VERBOSE = true
	}

	if runopt.CaseName == "" {
		runopt.CaseName = nightHawk.GenerateCaseName()
	}

	if runopt.CaseDate == "" {
		runopt.CaseDate = fmt.Sprintf("%s", time.Now().UTC().Format(nightHawk.Layout))
	}

	if runopt.Filename == "" {
		ExitOnError("Triage file must be supplied", nightHawk.ERROR_NO_TRIAGE_FILE)
	}
	// __end_of_commandline_parsing

	var caseinfo = nightHawk.CaseInformation{CaseName: runopt.CaseName, CaseDate: runopt.CaseDate, CaseAnalyst: runopt.CaseAnalyst}

	sourcetype := nightHawk.SourceDataFileType(runopt.Filename)

	if sourcetype == nightHawk.MOD_XML {
		if runopt.ComputerName == "" {
			ExitOnError("Computer Name is requried while processing single audit file", nightHawk.ERROR_AUDIT_COMPUTERNAME_REQUIRED)
		}
		errno := LoadSingleAuditFile(caseinfo, runopt.ComputerName, runopt.Filename)

		if errno > 0 {
			ExitOnError("Error occured processing single file", errno)
		}

	} else if sourcetype == nightHawk.MOD_MANS {
		errno := LoadHxAuditFile(caseinfo, runopt.Filename, runopt.Debug)

		if errno > 0 {
			ExitOnError("Error occured processing Hx triage file", errno)
		}

	} else if sourcetype == nightHawk.MOD_ZIP {
		errno := LoadRedlineAuditFile(caseinfo, runopt.Filename, runopt.Debug)

		if errno > 0 {
			ExitOnError("Error occured processing Redline triage file", errno)
		}

	} else if sourcetype == nightHawk.MOD_REDDIR {
		errno := LoadRedlineAuditDirectory(caseinfo, runopt.Filename, runopt.Debug)
		if errno > 0 {
			ExitOnError("Unsupported source file", errno)
		}
	}

} // __end_main__