Manuel Sabban
1f06f242cc
fix https://github.com/crowdsecurity/crowdsec/issues/1746 ( #1749 )
...
Co-authored-by: sabban <15465465+sabban@users.noreply.github.com>
2022-09-14 15:26:26 +02:00
blotus
9b3ff82542
add WAL support for sqlite ( #1752 )
2022-09-14 15:09:54 +02:00
AlteredCoder
7d97729eea
Add config option to enable or not local API and agent ( #1730 )
...
* Add flag to enable or not local API and agent
2022-09-12 14:38:29 +02:00
AlteredCoder
b06167a3fa
Allow plugins to load environment variable ( #1727 )
...
* Allow plugins to load environment variable
2022-09-08 11:41:28 +02:00
Manuel Sabban
b2130b1593
Fix 1737 ( #1738 )
...
* add GetMeta to *types.Event
Co-authored-by: sabban <15465465+sabban@users.noreply.github.com>
2022-09-07 10:11:39 +02:00
Thibault "bui" Koechlin
9d199fd4a9
fix #1733 : add support for exclusion regexps ( #1735 )
...
* allow to specify a list of regular expressions to skip some specific files
2022-09-06 14:58:37 +02:00
mmetc
414282a2c9
golangci-lint 1.49 and related fixes ( #1736 )
2022-09-06 13:55:03 +02:00
Laurence Jones
e674537d0b
Update sprig to v3 ( #1722 )
...
* Update sprig to v3
2022-09-05 09:05:50 +02:00
he2ss
ea40ffd655
Datasource/kafka ( #1698 )
...
* add Kafka datasource
2022-08-30 17:03:45 +02:00
Manuel Sabban
7d0f89df29
Implement reinject command to send notifications of alerts ( #1638 )
...
* implement reinject command to send notifications of alerts using a profile
Co-authored-by: sabban <15465465+sabban@users.noreply.github.com>
2022-08-30 15:45:52 +02:00
Thibault "bui" Koechlin
bacea50485
allow user to disable decision deduplication ( #1687 )
...
* allow user to disable decision deduplication
2022-08-26 14:17:46 +02:00
blotus
1f5224b74b
switch to go 1.19 ( #1709 )
2022-08-26 13:31:49 +02:00
mmetc
eea07b7a1a
golangci-lint v1.48 and fixes for "usestdlibvars" ( #1711 )
2022-08-16 09:46:10 +02:00
AlteredCoder
1002affc16
cscli machines delete: return an error if machines doesn't exist ( #1689 )
...
* cscli machines delete: return an error if machines doesn't exist
2022-07-28 17:32:12 +02:00
Thibault "bui" Koechlin
866c200c31
Generic dateparse approach ( #1669 )
...
* Allow any parser to suggest a format string for the date to be parsed.
* allow the enricher functions to get the parser's logger so they can inherit the level
2022-07-28 16:41:41 +02:00
Thibault "bui" Koechlin
0eea20fa7c
revert decision dedup behavior to 1.3.4 ( #1675 )
...
* revert decision dedup behavior to 1.3.4
2022-07-22 11:20:10 +02:00
Thibault "bui" Koechlin
bd91ddaf52
logging consistency for .local files ( #1655 )
2022-07-13 10:56:03 +02:00
blotus
7b8cd63b04
do not set the UDP read buffer size in syslog datasource ( #1657 )
2022-07-13 10:18:03 +02:00
AlteredCoder
39da36361c
Get geoip Country from other objects if not present ( #1659 )
2022-07-12 15:26:34 +02:00
Thibault "bui" Koechlin
73f336363a
bump log level when overloading config file with .local ( #1646 )
...
* bump log level
Co-authored-by: Marco Mariani <marco@crowdsec.net>
2022-07-08 09:29:23 +02:00
blotus
5c1c941851
close response body in heartbeat ( #1637 )
2022-07-06 14:50:54 +02:00
AlteredCoder
5f62d738fc
Add no-capi flag and review some logs ( #1628 )
...
* Add no-capi flag and review some logs
2022-07-01 16:56:13 +02:00
Thibault "bui" Koechlin
ca4cd6d559
attempt to fix ticker leak ( #1620 )
2022-06-30 17:36:01 +02:00
AlteredCoder
02e0f3c095
Fix event.timestamp pointer usage ( #1621 )
...
* Fix event.timestamp pointer usage
* avoid returning an error when creating alerts if something goes wrong during the parsing
Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
2022-06-30 17:35:42 +02:00
blotus
863facaa33
Properly handle expired decisions with different scopes ( #1616 )
2022-06-29 16:13:04 +02:00
Thibault "bui" Koechlin
15902dcba6
fix #1615 : cleanup based on heartbeat instead ( #1617 )
2022-06-29 13:21:58 +02:00
mmetc
8e7e799304
[wip] serve metrics only after agent and/or lapi are ready; fixed some func tests ( #1613 )
2022-06-24 15:55:21 +02:00
he2ss
7fafb483ad
Pkg/database/fix count decisions since by value ( #1606 )
...
* fix CountDecisionsSinceByValue to have also expired decisions
2022-06-23 12:04:07 +02:00
AlteredCoder
a4f4eabf0a
support yml file ( #1605 )
2022-06-22 17:01:27 +02:00
mmetc
628d7be1d8
simplify err.Error() to err when used in printf context ( #1603 )
2022-06-22 15:53:53 +02:00
he2ss
3d6f015211
Add duration expr to add duration formula ( #1556 )
...
* add duration expr to add duration formula
2022-06-22 11:29:52 +02:00
Thibault "bui" Koechlin
a6ed08b239
Add alerts and decisions metrics, LAPI and agent timing prom metrics ( #1546 )
2022-06-22 11:14:34 +02:00
AlteredCoder
0a39066f9d
Fix #1552 ( #1569 )
2022-06-22 10:29:02 +02:00
mmetc
d71279f023
added flag crowdsec --warning ( #1461 )
2022-06-22 09:38:23 +02:00
mmetc
c78c833400
CI: colored test output, colored crowdsec and crowdsec-api logs, full final db dump for mysql and sqlite ( #1596 )
...
* github-ci: color unit test output and logs
* new config option: force_color_logs (useful in CI)
* bats: show sqlite/mysql dump at the end
* removed "-v" (print package names) from "go build"
* general workflow cleanup
2022-06-17 16:12:49 +02:00
mmetc
10585bfecc
enabled linters and fixes for: misspell, predeclared, unconvert, ineffassign, gosimple, govet ( #1595 )
2022-06-16 14:41:54 +02:00
Thibault "bui" Koechlin
ff72a3c1c7
avoid create a new name generator at each bucket instanciation, it's not that cheap ( #1591 )
2022-06-15 10:02:00 +02:00
blotus
9c1b78395a
reduce verbosity of TLS auth and FlushAgentsAndBouncers ( #1588 )
2022-06-13 16:08:00 +02:00
Thibault "bui" Koechlin
581ddf78fc
Performance improvements ( #1583 )
...
* fix concurrent map write on distinct cache
* cache compiled expressions for groupby and cancel_on filters
* limit objects copy when it's going to lock a shared goroutine
2022-06-13 14:41:05 +02:00
Thibault "bui" Koechlin
567e0ab7d1
fix concurrent map write on distinct cache ( #1582 )
2022-06-10 09:39:23 +02:00
Thibault "bui" Koechlin
1c0fe09576
Add support for certificate authentication for agents and bouncers ( #1428 )
2022-06-08 16:05:52 +02:00
blotus
bdda8691ff
New syslog parser for syslog datasource ( #1554 )
2022-06-08 15:16:58 +02:00
blotus
4b311684ab
Add more JSON expr helpers ( #1576 )
2022-06-08 12:15:29 +02:00
mmetc
799cc82bb5
functional tests, minor refactoring and lint/cleanup ( #1570 )
...
* cmd/crowdsec: removed log.Fatal()s, added tests and print error for unrecognized argument
* updated golangci-lint to v1.46
* lint/deadcode: fix existing issues
* tests: cscli config backup/restore
* tests: cscli completion powershell/fish
* err check: pflags MarkHidden()
* empty .dockerignore (and explain the reason)
* tests, errors.Wrap
* test for CS_LAPI_SECRET and minor refactoring
* minor style changes
* log cleanup
2022-06-06 15:24:48 +02:00
mmetc
88a4801d6a
allow run-tests with -f "<test-name>" ( #1564 )
2022-05-28 22:10:27 +02:00
he2ss
e88e9946f9
Crowdsec/decisions_stream bug fix ( #1517 )
...
* Fix bug when stream interval is greater or equal to 60s
Co-authored-by: alteredCoder <kevin@crowdsec.net>
2022-05-27 15:23:59 +02:00
mmetc
1fc9587919
fix #1283 : update and enable error reports from golangci ( #1523 )
2022-05-25 22:27:50 +02:00
mmetc
1a293a2a27
cwhub: export SetHubBranch ( #1559 )
2022-05-24 15:46:48 +02:00
mmetc
357899b83e
fixed uid/gid bound check regression ( #1555 )
2022-05-23 09:46:39 +02:00
Thibault "bui" Koechlin
0483b9c641
do not spew.Sdump() the invalid node on error. It leads to huge memory usage, especially if the parsers refers ie. datafile ( #1550 )
2022-05-20 13:29:47 +02:00
AlteredCoder
1e1741aa45
Allow to set static to a pointer and add IsIPV6 helper ( #1540 )
...
* Allow to set static to a pointer and add IsIPV6 helper
2022-05-19 16:28:25 +02:00
Thibault "bui" Koechlin
fe09737d80
Add support for machine heartbeat ( #1541 )
...
* add the last_heartbeat field
* add heartbeat controller
* add endpoint of heartbeat
* heartbeat integration
* add last_heartbeat to cscli machines list
2022-05-19 15:47:27 +02:00
mmetc
131ed1b0a7
error reporting ( #1501 )
...
* unified error reporting, removed redundancy, tests
2022-05-19 10:48:08 +02:00
Manuel Sabban
18030e6c58
add notifications command ( #1537 )
...
* add notifications command
Co-authored-by: sabban <15465465+sabban@users.noreply.github.com>
2022-05-18 16:13:33 +02:00
Shivam Sandbhor
220bbe5862
Document LAPI filters ( #1535 )
...
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-05-18 11:45:12 +02:00
mmetc
98f2ac5e7c
fix #1385 : .yaml.local ( #1497 )
...
Added support for .yaml.local files to override values in .yaml
2022-05-18 10:08:37 +02:00
blotus
39f7e38444
retry to send alert to plugin channel if it fails ( #1530 )
2022-05-17 16:57:15 +02:00
Thibault "bui" Koechlin
fbcb2ed7fd
Improve distinct/uniq behaviour ( #1478 )
...
* make uniq/distinct use a cache that is independant of the bucket's cache_size
* add testing specifically for cache_size
2022-05-17 12:45:53 +02:00
blotus
0449ec1868
Windows Support ( #1159 )
2022-05-17 12:14:59 +02:00
Cristian Nitescu
a49b023a28
GetExprEnv usage optimization ( #1515 )
...
* avoid multiples calls to GetExprEnv
* cache ExprEnv in node process
* use global expression env
* remove block profile rate
2022-05-17 10:50:37 +02:00
blotus
8f111680bf
Allow to override statics in hubtest. ( #1495 )
2022-04-29 14:24:41 +02:00
blotus
64369b5c2b
add expr XML helpers ( #1493 )
2022-04-29 13:52:23 +02:00
blotus
392708a804
Fix docker flaky test ( #1494 )
2022-04-29 12:16:49 +02:00
AlteredCoder
f22e4eb24e
Improve MySQL performance ( #1477 )
...
* Improve MySQL performance
2022-04-28 12:53:14 +02:00
AlteredCoder
be977d1cc4
Fix cwhub collections uninstall dependencies ( #1486 )
...
* Fix cwhub collections uninstall dependencies
2022-04-27 18:28:03 +02:00
AlteredCoder
a645c928d4
Fix decisions list with --no-simu flag ( #1482 )
...
* Fix decisions list with --no-simu flag
2022-04-27 11:05:40 +02:00
Greg Myers
0f4ab71f01
Fix typos in docs, comments, code ( #1483 )
2022-04-27 11:04:12 +02:00
AlteredCoder
44b11c2e5b
Fix hub items installation ( #1481 )
2022-04-26 17:37:07 +02:00
blotus
1bd8cc79c8
Kill the whole docker acquis in tests ( #1475 )
2022-04-22 16:56:22 +02:00
blotus
8909fbdb22
cleanup container state if the reader tomb dies by itself ( #1470 )
2022-04-22 10:52:44 +02:00
Thibault "bui" Koechlin
242706a475
fix journalctl deadlock on shutdown ( #1468 )
...
* avoid being locked sending termination error while the reading routine - on the chan - died
2022-04-21 14:02:25 +02:00
AlteredCoder
4273a0f243
cscli: add autocompletions for hubitems ( #1465 )
...
* Add autocompletion for hub items in cscli
2022-04-20 15:44:48 +02:00
he2ss
615895da9d
cscli: add force enroll feature ( #1430 )
...
* cscli: add force enroll feature
2022-04-20 13:34:17 +02:00
Thibault "bui" Koechlin
e6a35e8714
Improve plugins grouping (alternative to #1424 ) ( #1437 )
...
* Fix races in test (#1446 )
Co-authored-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
Co-authored-by: alteredCoder <kevin@crowdsec.net>
Co-authored-by: AlteredCoder <64792091+AlteredCoder@users.noreply.github.com>
2022-04-19 19:12:23 +02:00
AlteredCoder
526a4dbd08
Reduce the query unescape helper verbosity ( #1447 )
2022-04-19 12:31:29 +02:00
Shivam Sandbhor
8060f54f27
Cwhub testing ( #1438 )
...
* Add tests in cwhub and fix collection upgrade(#1431 )
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com
Co-authored-by: bui <thibault@crowdsec.net>
Co-authored-by: Thibault "bui" Koechlin <orixxx@gmail.com>
2022-04-19 12:07:35 +02:00
mmetc
4b9a0c4ef7
typos ( #1453 )
2022-04-19 11:25:27 +02:00
Shivam Sandbhor
4a3ec85686
Update bouncer pull in rupture mode ( #1445 )
...
* Update bouncer pull in rupture mode
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-04-15 12:24:01 +02:00
AlteredCoder
71165bcd30
Send all installed scenario to LAPI ( #1277 )
2022-04-13 17:48:29 +02:00
AlteredCoder
099469c5d2
Fix hub loader to support '.yml' files ( #1433 )
2022-04-11 16:13:20 +02:00
Shivam Sandbhor
a8089c8ddb
Add origins param in decision stream service ( #1429 )
...
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-04-07 12:40:27 +02:00
blotus
9cf2d5ab5c
handle containers with TTY in docker acquis ( #1422 )
2022-04-05 10:31:36 +02:00
Thibault "bui" Koechlin
ba7f4fcec0
make this info level ( #1409 )
...
* make this info level
2022-04-01 15:31:33 +02:00
Thibault "bui" Koechlin
d8dc01cd94
Revamp unit tests ( #1368 )
...
* Revamp unit tests
* Increase coverage
* Use go-acc to get cross packages coverage
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-03-29 14:20:26 +02:00
Håvard Moen
42ff269bc8
add back dialect to handle pgx correctly ( #1376 )
2022-03-23 09:29:22 +01:00
AlteredCoder
411baa4dcf
Improve cscli metrics units ( #1374 )
...
* Improve cscli metrics units
2022-03-21 12:13:36 +01:00
Shivam Sandbhor
c5566e92f3
Fix 1262 pgsql conflict resolve ( #1363 )
...
* Fix api for all dbs (#1310 )
* DB agnostic lapi sanitize
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
* Update ent
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
* Fix go dep mess.
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-03-17 14:12:13 +01:00
Shivam Sandbhor
023ac9e138
Add trusted IPs which have admin API access ( #1352 )
...
* Add trusted IPs which have admin API access
2022-03-16 17:28:34 +01:00
Shivam Sandbhor
42a1bc0260
Add query param to filter decisions by scenarios and origin ( #1294 )
...
* Add query param to filter decisions by scenarios
2022-03-16 14:37:42 +01:00
Shivam Sandbhor
bb30a3f966
Don't omit fields of bouncer in json ( #1354 )
...
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-03-16 09:40:34 +01:00
Thibault "bui" Koechlin
a74a41dac5
fix #1357 ( #1358 )
2022-03-16 09:40:00 +01:00
Shivam Sandbhor
76e97303a5
Deprecate pid_file config ( #1346 )
...
* Deprecate pid_file config
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
* Fix unit test
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
* Impl review suggestions.
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-03-16 09:23:49 +01:00
j-k
2cd3248431
refactor: use runtime rather than ldflags for go details ( #1302 )
2022-03-14 11:29:34 +01:00
mmetc
4e6b9597f8
fix for https://staticcheck.io/docs/checks#SA2002 ( #1334 )
2022-03-10 13:53:33 +01:00
mmetc
7c0593c659
noop code removal, typos and lint fixes ( #1329 )
2022-03-09 16:15:18 +01:00
mmetc
10ce45c054
allow notification plugins to work on freebsd and non-root functional tests ( #1253 )
...
* random uuid for all platforms
* check group writable and setgid; don't check group ownership
* allow user to run plugins without changing desired user/group (set them to "")
2022-03-09 12:09:50 +01:00
Thibault "bui" Koechlin
5a15f9b39b
bailout on incompatible duration format ( #1326 )
2022-03-08 18:18:36 +01:00
mmetc
e35efc5b2d
fix check uid, gid values ( #1309 )
2022-03-07 10:16:34 +01:00
Thibault "bui" Koechlin
b66366c28c
Revert "Handle decisions with varying expiry for same IP ( #1262 )" ( #1308 )
...
This reverts commit e4f6cdfc14
2022-03-04 10:17:31 +01:00
mmetc
c5dda0ffba
fix: deny copy folder to itself or subpath ( #1299 )
2022-03-02 11:30:04 +01:00
Shivam Sandbhor
c3dbe0080c
Exit syslog acquis only after server is dead ( #1288 )
2022-03-01 11:32:28 +01:00
blotus
fb74b2fda7
Improve LAPI performance when under high load ( #1273 )
2022-02-17 17:52:04 +01:00
Shivam Sandbhor
e4f6cdfc14
Handle decisions with varying expiry for same IP ( #1262 )
...
* Upgrade ent and add sql/modifier in codegen
* update db wrappers to sanitize LAPI
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-02-16 15:19:14 +01:00
mmetc
9bc7e6ffcf
Refactor unit tests to reduce line count ( #1264 )
2022-02-15 12:50:33 +01:00
Shivam Sandbhor
43d5690432
Detect missing plugin binary wrt profiles ( #1252 )
...
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-02-14 17:45:03 +01:00
AlteredCoder
8b90f4b2b2
Upgrade download datafiles if doesn't exist ( #1254 )
2022-02-14 16:51:06 +01:00
AlteredCoder
5a0843852a
add IpToRange helpers and allows to have an expression with scope Range ( #1260 )
...
* add IpToRange helpers and allows to have an expression with scope Range
2022-02-14 16:50:52 +01:00
mmetc
40ab8fa738
Atoi() -> ParseInt() ( #1256 )
2022-02-14 14:00:42 +01:00
Shivam Sandbhor
76e3612088
Check log level before dumping resp ( #1243 )
...
* Check log level before dumping resp
* Sleep longer in func tests
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-02-08 15:40:01 +01:00
mmetc
5c7c12c62d
define cwversion.System (Platform) in "make static" too; show it with --version ( #1238 )
2022-02-04 13:02:45 +01:00
Thibault "bui" Koechlin
dd53d19777
Make whitelist by expr debug level ( #1236 )
...
* fix #616 : simply make it at debug level, so that the user can set his node to debug level if he really wants to see this. Otherwise it can be too spammy
2022-02-03 17:04:18 +01:00
mmetc
ad28a979e9
local control flow cleanup ( #1215 )
...
removed redundant/unreachable returns, else branches, type declarations, unused variables
2022-02-01 22:08:06 +01:00
mmetc
35eea39db7
allow Makefile to override /etc/crowdsec and /var/lib/crowdsec/data ( #1221 )
2022-02-01 10:34:53 +01:00
mmetc
8310c10ce3
console_config.yaml -> console.yaml ( #1195 )
2022-01-21 11:52:23 +01:00
mmetc
240e5ad3ab
remove trailing carriage return ( #1194 )
2022-01-21 11:35:21 +01:00
blotus
19323ba4aa
fix crash on upgrade with nil last push field ( #1191 )
2022-01-20 18:10:40 +01:00
AlteredCoder
b93b8d9a2e
Support PGX ( #1186 )
...
* Support PGX
* support sslmode
2022-01-20 11:17:21 +01:00
Shivam Sandbhor
59a537514f
Check for errors before modifying proc attrs ( #1181 )
...
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-01-19 15:34:09 +01:00
Thibault "bui" Koechlin
cc1ab8c50d
switch to utc time everywhere ( #1167 )
...
* switch to utc time everywhere
Co-authored-by: alteredCoder <kevin@crowdsec.net>
2022-01-19 14:56:05 +01:00
AlteredCoder
b1a7ffb92f
fix postgreSQL count fail ( #1184 )
2022-01-19 14:50:53 +01:00
Thibault "bui" Koechlin
c81fc87d4e
fix #1168 ( #1179 )
...
* fix #1168
2022-01-19 11:34:40 +01:00
Thibault "bui" Koechlin
a88848009a
fix default perms for log file ( #1177 )
...
* fix default perms
2022-01-18 16:54:02 +01:00
Thibault "bui" Koechlin
a17f150e5d
fix #1170 : display full message in debug mode when syslog cannot parse ( #1176 )
...
* fix #1170 : display full message in debug mode when syslog cannot parse
2022-01-18 09:54:01 +01:00
Thibault "bui" Koechlin
40ed810c0b
Gin upgrade ( #1174 )
...
* upgrade gin / gin-jwt, and add a new 'trusted_proxies' option to provide trusted CIDRs
2022-01-17 17:18:12 +01:00
Thibault "bui" Koechlin
6e92da76ad
lapi to capi : allow push of tainted/custom/manual decisions ( #1154 )
...
* add console command to control signal sharing
* modify metrics endpoint to add lastpush
Co-authored-by: alteredCoder <kevin@crowdsec.net>
2022-01-13 16:46:16 +01:00
blotus
cc72800f50
Update LAPI swagger ( #1155 )
2022-01-11 16:45:34 +01:00
Thibault "bui" Koechlin
3bca25fd6d
lists support from central api ( #1074 )
...
* lists support from central api
Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
2022-01-11 14:31:51 +01:00
blotus
4a11060930
Kinesis datasource ( #1147 )
2022-01-11 14:19:43 +01:00
Thibault "bui" Koechlin
6c676c4869
fix #1131 : complain when validating unknown machine ( #1146 )
2022-01-05 13:50:04 +01:00
Shivam Sandbhor
ba71c55492
Fix cscli inpsect json output ( #1145 )
...
* Fix cscli inpsect json output
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-01-05 10:42:27 +01:00
Thibault "bui" Koechlin
8e3004ebb3
fix race condition on repetitive trigger buckets creation ( #1144 )
2022-01-04 14:02:07 +01:00
Shivam Sandbhor
6c4ec64ca9
Fix json output of cscli hub list ( #1143 )
...
* Fix json output of cscli hub list
* Fix functional tests.
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2022-01-04 11:49:23 +01:00
blotus
f86ec1c389
Docker api version negotiation ( #1135 )
2021-12-30 12:21:49 +01:00
blotus
3105897f37
Allow to configure log rotation ( #1130 )
2021-12-28 11:59:03 +01:00
mmetc
7126f8f0ff
replaced ( #1129 )
2021-12-28 10:32:46 +01:00
AlteredCoder
f86e0c0a5a
don't send decisions with negative duration to bouncers ( #1117 )
2021-12-21 10:23:30 +01:00
Sykursen
6a3adcff0e
Upgrade metabase to v41.5 ( #1109 )
2021-12-17 10:29:48 +01:00
Thibault "bui" Koechlin
106254f020
support for cancel_on ( #1105 )
...
* cancel_on filter
* tests
2021-12-17 09:56:02 +01:00
AlteredCoder
d913ac160e
fix create alert bulk for decisions insertion ( #1107 )
...
* fix create alert bulk for decisions insertion
2021-12-16 18:26:19 +01:00
AlteredCoder
88d06260d7
add cscli decisions import ( #1038 )
...
* add cscli decisions import
Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
Co-authored-by: bui <thibault@crowdsec.net>
2021-12-15 11:39:37 +01:00
AlteredCoder
458dcd1979
add more helpers ( #1091 )
...
* add more exprhelpers
2021-12-14 11:07:40 +01:00
Thibault "bui" Koechlin
e5204bc1b1
fix #1083 : do not update/overwrite 'not installed' collections sub-items on 'cscli XX upgrade' ( #1089 )
...
* fix #1083 : do not update/overwrite 'not installed' collections sub-items on 'cscli XX upgrade'
2021-12-13 19:31:16 +01:00
mmetc
c7fb6a1428
enabled -> enabling ( #1090 )
2021-12-13 13:14:29 +01:00
Manuel Sabban
4e6f6fe3a2
log4j vuln fix for metabase ( #1082 )
...
Co-authored-by: sabban <15465465+sabban@users.noreply.github.com>
2021-12-13 10:19:20 +01:00
mmetc
7dee103b6e
typos of various nature ( #1072 )
2021-12-06 17:29:23 +01:00
AlteredCoder
4917aa23c9
Docker datasource ( #1064 )
...
* add docker datasource
2021-12-02 15:55:50 +01:00
blotus
dd03d07355
optimize the flush function by deleting alerts based on their id ( #1054 )
2021-11-17 10:15:38 +01:00
he2ss
0652e9ed08
feature cscli|crowdsec add additional labels on crowdsec dsn run ( #1053 )
...
* feature cscli|crowdsec add additional labels on crowdsec dsn run
2021-11-17 10:08:46 +01:00
Thibault "bui" Koechlin
3c768490ba
fix #873 without breaking backward ( #1052 )
2021-11-15 14:16:18 +01:00
Kerma Gérald
37c2a10e21
Use math.MaxInt32 instead of math.MaxUint32 ( #980 )
...
To fix 32 bits compilation in v1.2.0
https://github.com/crowdsecurity/crowdsec/issues/979
Signed-off-by: Kerma Gérald <gandalf@gk2.net>
2021-11-15 12:14:04 +01:00
Thibault "bui" Koechlin
7362828a3b
add --failures to explain feature : only display failed lines ( #1048 )
...
* add --failures to explain feature : only display failed lines
* no error no problem
2021-11-08 18:01:43 +01:00
Thibault "bui" Koechlin
8b0527bf9d
add evt. ( #1045 )
2021-11-03 15:17:48 +01:00
AlteredCoder
fb54388e93
Fix issue 1033 ( #1034 )
...
* Fix issue 1033
2021-11-02 12:16:33 +01:00
Thibault "bui" Koechlin
d1ce543440
Improve explain ( #1039 )
...
* improve explain feature
* nicer display for details, --verbose in favor of --debug for details
2021-11-02 12:06:01 +01:00
Shivam Sandbhor
cbada3d435
Allow using cloudwatch using iam role instead of hardcoded tokens ( #1035 )
2021-11-02 10:25:35 +01:00
mmetc
f10187bd6d
typos ( #1036 )
2021-11-02 09:19:22 +01:00
Thibault "bui" Koechlin
2b2a11fec7
Extra syslog debug ( #1030 )
...
* extra logging
2021-11-01 20:55:03 +01:00
AlteredCoder
cf57c89177
add name and alias in cscli console enroll ( #950 )
...
* add name and alias in cscli console enroll
2021-10-26 15:33:17 +02:00
blotus
25a2d528b0
Alerts flush: Optimization of the flush mechanism (batch and limit to one job) + add cscli alerts flush command ( #1024 )
...
- Don't allow running more than one alert flush job at a time to prevent runaway CPU usage in some case. (fix High CPU after Upgrade to 1.2.0 #1022 )
- Add a cscli alerts flush command to manually flush the alerts in the database (fixes Improvement/Manual flush mechanism #1023 ).
- Enable cascading deletion on alerts as we upgraded ent: Deleting an alert in the database will automatically delete all related decisions, events and meta
- Add an index on alerts.id to try to improve flush performance with very big sqlite database.
- Flush alert now operates in batch
2021-10-26 13:33:45 +02:00
Thibault "bui" Koechlin
3f99330b3d
Entgo 0.9 ( #1018 )
...
* update entgo & sqlite to latest version
* schema update
2021-10-22 16:15:57 +02:00
Shivam Sandbhor
a7b1c02bd5
Fix bugs in cloudwatch acq ( #991 )
...
* Fix bugs in cloudwatch acq
- Fix concurrent writes to map streamIndexes
- Fix multiple cases of modifying while iterating on slice.
- Fix order of fetching cloudwatch events.
- Remove `startup` hack.
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
* Fix cloudwatch tests
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2021-10-22 10:35:05 +02:00
Thibault "bui" Koechlin
3bb2128bf4
fix sort :/ ( #1007 )
2021-10-12 19:16:24 +02:00
Thibault "bui" Koechlin
1bd6b8f7b9
Multiple fixes ( #1006 )
...
* fix #1005 : timestamp in trigger timemachine buckets
* attempt at consistent bucket order for hubtest
2021-10-12 14:09:17 +02:00
Thibault "bui" Koechlin
2961a0ed02
ensure machineID is included early enough into the alert ( #1004 )
2021-10-11 15:02:16 +02:00
blotus
2bc9f33e12
add ParseUri() expr helper ( #994 )
2021-10-08 16:50:31 +02:00
AlteredCoder
0ccc69696b
Break on success when alert already has decision ( #997 ) ( #999 )
...
* Break on success when alert already has decision (#997 )
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2021-10-05 11:30:34 +02:00
Thibault "bui" Koechlin
af4bb350c0
hubtests revamp + cscli explain ( #988 )
...
* New hubtest CI for scenarios/parsers from the hub
* New `cscli explain` command to visualize parsers/scenarios pipeline
Co-authored-by: alteredCoder <kevin@crowdsec.net>
Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
Co-authored-by: he2ss <hamza.essahely@gmail.com>
Co-authored-by: Cristian Nitescu <cristian@crowdsec.net>
2021-10-04 17:14:52 +02:00
Thibault "bui" Koechlin
c2fd173d1e
fix node success logic ( #993 )
...
* fix node success logic : only fail node on child failure if mother node has no successfull grok
2021-09-28 17:58:07 +02:00
he2ss
fb308d5596
fix plugins logging in right level ( #990 )
2021-09-28 14:44:21 +02:00
he2ss
db5ffb0040
Update test env ( #987 )
...
* update test_env
2021-09-24 18:06:30 +02:00
blotus
f0db3742de
fix usage of regex.Match in cloudwatch module ( #986 )
2021-09-23 13:52:05 +02:00
Shivam Sandbhor
cca76da2d6
Fix crash if plugin config is broken ( #964 )
...
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2021-09-10 14:25:34 +02:00
he2ss
e651379964
add jsonExtractUnescape Helper ( #962 )
...
* add jsonExtractUnescape Helper
2021-09-10 12:43:11 +02:00
AlteredCoder
5ae69aa293
fix stacktrace when mmdb file are not present ( #935 )
...
* fix stacktrace when mmdb file are not present
2021-09-09 16:27:30 +02:00
blotus
7a1b955ad1
use our fork of grokky ( #953 )
2021-09-09 14:46:16 +02:00
Shivam Sandbhor
b8e24a1e0b
Make plugin runner configurable and run only registered plugins ( #944 )
...
* Make plugin runner configurable and run only registered plugins
2021-09-08 11:36:42 +02:00
Thibault "bui" Koechlin
0ad6165ed2
fix release drafter + readme + remove dead readme for acquis ( #933 )
2021-09-03 09:07:24 +02:00
Manuel Sabban
d7d591ff84
update to use cdn for hub ( #920 )
...
* update to use cdn for hub
* add cdn for version
* fix unit tests accodingly with new cdn
Co-authored-by: sabban <15465465+sabban@users.noreply.github.com>
2021-09-02 15:17:37 +02:00
Thibault "bui" Koechlin
bed90a832e
fix #919 : display error message ( #929 )
...
* fix #919
* fix tests
2021-09-02 12:46:32 +02:00
Thibault "bui" Koechlin
589cb72d41
enforce a bit more parsing for resillience ( #928 )
2021-09-02 12:34:20 +02:00
Shivam Sandbhor
b40fd36607
Add plugin interface code in protobufs package ( #921 )
...
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
2021-08-31 14:40:17 +02:00
Thibault "bui" Koechlin
68c11dd827
don't try to send/don't notify if plugin chan is nil ( #923 )
2021-08-31 14:39:32 +02:00
blotus
b5d0d56a11
add support for --since in journalctl DSN ( #917 )
2021-08-31 12:40:22 +02:00
ThinkChaos
448a227079
Minor changes to specific logs ( #900 )
...
- Minor changes to specific logs
- Fix LAPI to not push signals to CAPI when disabled #907
2021-08-25 18:30:05 +02:00
Thibault "bui" Koechlin
c188d401a3
Improve CAPI pull management ( #871 )
...
* prepare for new consensus : thousands of ips
Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
2021-08-25 11:45:29 +02:00
Thibault "bui" Koechlin
950759f6d6
Output plugins ( #878 )
...
* Add plugin system for notifications (#857 )
2021-08-25 11:43:29 +02:00
Manuel Sabban
4dbbd4b3c4
Download datafile ( #895 )
...
* add the ability to download datafile on cscli hub upgrade on files are missing
* fix stuff + lint
* fix error management
Co-authored-by: sabban <15465465+sabban@users.noreply.github.com>
2021-08-19 09:08:20 +02:00
Shivam Sandbhor
f64f20fd53
Document scope parameter for stream API ( #897 )
...
Signed-off-by: Shivam Sandbhor <shivam@crowdsec.net>
2021-08-18 16:05:56 +02:00
Nanik
b0746fbc4d
fix: add /health endpoint ( #881 )
...
* fix: add /health endpoint
2021-08-18 09:06:01 +02:00
Thibault "bui" Koechlin
05ac3ca402
if profile is in debug, log debug even if it matched the profile ( #894 )
2021-08-17 16:50:16 +02:00
Thibault "bui" Koechlin
25ed1c265d
fix #885 : remove dead dependencies for plugin ( #891 )
2021-08-17 10:32:15 +02:00
Thibault "bui" Koechlin
fc7369c4ea
Fix big serialized entries ( #877 )
...
* bump serialized to 8k
* handle oversized serialized entry : progressively strip its size down
2021-08-03 15:46:10 +02:00
Thibault "bui" Koechlin
01028d0a09
Goroutine leak hunt ( #874 )
...
* close the writers of gin loggers + kill the tomb of httpServer
* body close defer
2021-07-30 11:41:17 +02:00
blotus
cedfca07c2
don't wait for acquis tomb if we have no sources ( #868 )
2021-07-28 08:58:44 +02:00
Thibault "bui" Koechlin
b6ee006078
ensure decisions from CAPI have proper case ( #848 )
2021-07-02 11:23:46 +02:00
Thibault "bui" Koechlin
033c8e17e8
fix #842 #837 ( #845 )
...
* fix #842 and move preflight checks tgth
* handle new container name
Co-authored-by: AlteredCoder <AlteredCoder>
2021-07-01 18:15:22 +02:00
blotus
3994aec7fe
add console enroll command to cscli ( #828 )
2021-06-28 17:34:19 +02:00
Thibault "bui" Koechlin
7f0cac8ee6
add support for 'expression' ( fix #822 ) in grok patterns ( #830 )
...
* add support for 'expression' (fix #822 ) in grok patterns
* add tests
2021-06-21 09:07:33 +02:00
Thibault "bui" Koechlin
ce6a61df1c
Refactor Acquisition Interface ( #773 )
...
* Add new acquisition interface + new modules (cloudwatch, syslog)
Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
2021-06-11 09:53:53 +02:00
Thibault "bui" Koechlin
71c1d9431f
fix #823 : lower JsonExtract debug ( #824 )
...
* lower key not found log level, fix #823
2021-06-02 14:27:34 +02:00
