crowdsec/pkg/exprhelpers
Thibault "bui" Koechlin 8cca4346a5
Application Security Engine Support (#2273)
Add a new datasource that:
- Receives HTTP requests from remediation components
- Apply rules on them to determine whether they are malicious or not
- Rules can be evaluated in-band (the remediation component will block the request directly) or out-band (the RC will let the request through, but crowdsec can still process the rule matches with scenarios)

The PR also adds support for 2 new hub items:
- appsec-configs: Configure the Application Security Engine (which rules to load, in which phase)
- appsec-rules: a rule that is added in the Application Security Engine (can use either our own format, or seclang)

---------

Co-authored-by: alteredCoder <kevin@crowdsec.net>
Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
Co-authored-by: mmetc <92726601+mmetc@users.noreply.github.com>
Co-authored-by: Marco Mariani <marco@crowdsec.net>
2023-12-07 12:21:04 +01:00
..
tests skip empty lines to avoid issue of #630 (#631) 2021-02-25 09:57:24 +01:00
crowdsec_cti.go fix null deref in cti calls if key is empty (#2540) 2023-10-17 09:34:53 +01:00
crowdsec_cti_test.go fix null deref in cti calls if key is empty (#2540) 2023-10-17 09:34:53 +01:00
debugger.go Improved expr debugger (#2495) 2023-11-24 11:10:54 +01:00
debugger_test.go Improved expr debugger (#2495) 2023-11-24 11:10:54 +01:00
expr_lib.go Application Security Engine Support (#2273) 2023-12-07 12:21:04 +01:00
exprlib_test.go Improved expr debugger (#2495) 2023-11-24 11:10:54 +01:00
helpers.go Application Security Engine Support (#2273) 2023-12-07 12:21:04 +01:00
jsonextract.go Unmarshal Json (#2414) 2023-08-09 09:42:08 +01:00
jsonextract_test.go Add ParseKV helper and rework UnmarshalJSON as a proper helper (#2184) 2023-05-12 09:43:01 +02:00
strings.go add a LogInfo expr helper (#2179) 2023-05-03 10:07:11 +02:00
xml.go use expr.Function for custom functions instead of passing them in the env (#2133) 2023-03-28 10:49:01 +02:00
xml_test.go use expr.Function for custom functions instead of passing them in the env (#2133) 2023-03-28 10:49:01 +02:00