Skip to content
This repository was archived by the owner on Feb 19, 2020. It is now read-only.

Commit ee33f07

Browse files
canyaracanyara
committed
Add tag to alarm and policy
1 parent cdd89a2 commit ee33f07

File tree

7 files changed

+64
-25
lines changed

7 files changed

+64
-25
lines changed

‎alarm/Alarm.js

+7-7
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ class NewDeviceAlarm extends Alarm {
242242
}
243243

244244
keysToCompareForDedup() {
245-
return ["p.device.mac", "p.intf.id", "p.tags"];
245+
return ["p.device.mac", "p.intf.id", "p.tag.ids"];
246246
}
247247

248248
localizedNotificationContentArray() {
@@ -256,7 +256,7 @@ class DeviceBackOnlineAlarm extends Alarm {
256256
}
257257

258258
keysToCompareForDedup() {
259-
return ["p.device.mac", "p.intf.id", "p.tags"];
259+
return ["p.device.mac", "p.intf.id", "p.tag.ids"];
260260
}
261261

262262
localizedNotificationContentArray() {
@@ -273,7 +273,7 @@ class DeviceOfflineAlarm extends Alarm {
273273
}
274274

275275
keysToCompareForDedup() {
276-
return ["p.device.mac", "p.intf.id", "p.tags"];
276+
return ["p.device.mac", "p.intf.id", "p.tag.ids"];
277277
}
278278

279279
localizedNotificationContentArray() {
@@ -287,7 +287,7 @@ class SpoofingDeviceAlarm extends Alarm {
287287
}
288288

289289
keysToCompareForDedup() {
290-
return ["p.device.mac", "p.device.name", "p.device.ip", "p.intf.id", "p.tags"];
290+
return ["p.device.mac", "p.device.name", "p.device.ip", "p.intf.id", "p.tag.ids"];
291291
}
292292

293293
localizedNotificationContentArray() {
@@ -570,9 +570,9 @@ class IntelAlarm extends Alarm {
570570
keysToCompareForDedup() {
571571
const url = this["p.dest.url"];
572572
if (url) {
573-
return ["p.device.mac", "p.dest.name", "p.dest.url", "p.dest.port", "p.intf.id", "p.tags"];
573+
return ["p.device.mac", "p.dest.name", "p.dest.url", "p.dest.port", "p.intf.id", "p.tag.ids"];
574574
}
575-
return ["p.device.mac", "p.dest.name", "p.dest.port", "p.intf.id", "p.tags"];
575+
return ["p.device.mac", "p.dest.name", "p.dest.port", "p.intf.id", "p.tag.ids"];
576576
}
577577

578578
localizedNotificationContentKey() {
@@ -647,7 +647,7 @@ class OutboundAlarm extends Alarm {
647647
}
648648

649649
keysToCompareForDedup() {
650-
return ["p.device.mac", "p.dest.id", "p.intf.id", "p.tags"];
650+
return ["p.device.mac", "p.dest.id", "p.intf.id", "p.tag.ids"];
651651
}
652652

653653
isDup(alarm) {

‎alarm/AlarmManager2.js

+15-2
Original file line numberDiff line numberDiff line change
@@ -1149,8 +1149,14 @@ module.exports = class {
11491149
p.scope = [info.device];
11501150
}
11511151

1152+
p.tag = [];
11521153
if (info.intf) {
1153-
p.tag = [Policy.INTF_PREFIX + info.intf]; // or use tag array
1154+
p.tag.push(Policy.INTF_PREFIX + info.intf); // or use tag array
1155+
}
1156+
1157+
//@TODO need support array?
1158+
if (info.tag) {
1159+
p.tag.push(Policy.TAG_PREFIX + info.tag);
11541160
}
11551161

11561162
if (info.category) {
@@ -1624,7 +1630,14 @@ module.exports = class {
16241630
e["p.device.mac"] = userInput.device; // limit exception to a single device
16251631
}
16261632
if (userInput && userInput.intf) {
1627-
e["intf.id"] = userInput.intf;
1633+
e["p.intf.id"] = userInput.intf;
1634+
}
1635+
if (userInput && userInput.tag) {
1636+
if (_.isArray(userInput.tag)) {
1637+
e["p.tag.ids"] = userInput.tag;
1638+
} else if (_.isString(userInput.tag)) {
1639+
e["p.tag.ids"] = [userInput.tag];
1640+
}
16281641
}
16291642
log.info("Exception object:", e);
16301643
return e;

‎alarm/Exception.js

+8
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,14 @@ module.exports = class {
146146
}
147147
}
148148

149+
if (key === "p.tag.ids") {
150+
const intersect = _.intersection(val, val2);
151+
if (_.difference(intersect, val2).length == 0) {
152+
matched = true;
153+
continue;
154+
}
155+
}
156+
149157
if(val.startsWith("*.")) {
150158
// use glob matching
151159
if(!minimatch(val2, val) && // NOT glob match

‎alarm/Policy.js

+17
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,22 @@ class Policy {
194194
return false; // tag not match
195195
}
196196

197+
if (
198+
this.tag &&
199+
_.isArray(this.tag) &&
200+
!_.isEmpty(this.tag) &&
201+
_.has(alarm, 'p.tag.ids') &&
202+
!_.isEmpty(alarm['p.tag.ids'])
203+
)
204+
) {
205+
for (let index = 0; index < alarm['p.tag.ids'].length; index++) {
206+
const tag = alarm['p.tag.ids'][index];
207+
if (this.tag.includes(Policy.TAG_PREFIX + tag)) {
208+
return false;
209+
}
210+
}
211+
}
212+
197213
// for each policy type
198214
switch (this.type) {
199215
case "ip":
@@ -295,5 +311,6 @@ class Policy {
295311
}
296312

297313
Policy.INTF_PREFIX = "intf:";
314+
Policy.TAG_PREFIX = "tag:";
298315

299316
module.exports = Policy

‎hook/DeviceHook.js

+4-4
Original file line numberDiff line numberDiff line change
@@ -633,7 +633,7 @@ class DeviceHook extends Hook {
633633
"p.device.mac": host.mac,
634634
"p.device.vendor": host.macVendor,
635635
"p.intf.id": host.intf ? host.intf : "",
636-
"p.tags": _.isEmpty(host.tags) ? [] : host.tags
636+
"p.tag.ids": _.isEmpty(host.tags) ? [] : host.tags
637637
});
638638
am2.enqueueAlarm(alarm);
639639
break;
@@ -647,7 +647,7 @@ class DeviceHook extends Hook {
647647
"p.device.mac": host.mac,
648648
"p.device.vendor": host.macVendor,
649649
"p.intf.id": host.intf ? host.intf : "",
650-
"p.tags": _.isEmpty(host.tags) ? [] : host.tags
650+
"p.tag.ids": _.isEmpty(host.tags) ? [] : host.tags
651651
});
652652
am2.enqueueAlarm(alarm);
653653
break;
@@ -662,7 +662,7 @@ class DeviceHook extends Hook {
662662
"p.device.vendor": host.macVendor,
663663
"p.device.lastSeen": host.lastActiveTimestamp,
664664
"p.intf.id": host.intf ? host.intf : "",
665-
"p.tags": _.isEmpty(host.tags) ? [] : host.tags
665+
"p.tag.ids": _.isEmpty(host.tags) ? [] : host.tags
666666
});
667667
am2.enqueueAlarm(alarm);
668668
break;
@@ -676,7 +676,7 @@ class DeviceHook extends Hook {
676676
"p.device.mac": host.mac,
677677
"p.device.vendor": host.macVendor,
678678
"p.intf.id": host.intf ? host.intf : "",
679-
"p.tags": _.isEmpty(host.tags) ? [] : host.tags
679+
"p.tag.ids": _.isEmpty(host.tags) ? [] : host.tags
680680
});
681681
am2.enqueueAlarm(alarm);
682682
break;

‎intel/TagsInfoIntel.js

+9-8
Original file line numberDiff line numberDiff line change
@@ -22,22 +22,23 @@ const tagManager = require('../net2/TagManager.js');
2222

2323
class TagsInfoIntel extends Intel {
2424
async enrichAlarm(alarm) {
25-
if (_.has(alarm, 'p.tags')) {
26-
let tags = [];
27-
for (let index = 0; index < alarm['p.tags'].length; index++) {
28-
const tagUid = alarm['p.tags'][index];
25+
if (_.has(alarm, 'p.tag.ids')) {
26+
let names = [];
27+
for (let index = 0; index < alarm['p.tag.ids'].length; index++) {
28+
const tagUid = alarm['p.tag.ids'][index];
2929
const tagInfo = tagManager.getTagByUid(tagUid);
30-
if (condition) {
31-
tags.push({ uid: tagUid, name: tagInfo.getTagName() });
30+
if (tagInfo) {
31+
names.push({ uid: tagUid, name: tagInfo.getTagName() });
3232
}
3333
}
3434

35-
alarm['p.tags'] = tags;
35+
Object.assign(alarm, {
36+
'p.tag.names': names
37+
});
3638
}
3739

3840
return alarm;
3941
}
40-
4142
}
4243

4344
module.exports = IntfInfoIntel

‎monitor/FlowMonitor.js

+4-4
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ function alarmBootstrap(flow) {
7474
"p.dest.ip": flow.dh,
7575
"p.dest.port": flow.dp,
7676
"p.intf.id": flow.intf,
77-
"p.tags": flow.tags
77+
"p.tag.ids": flow.tags
7878
}
7979
}
8080

@@ -749,7 +749,7 @@ module.exports = class FlowMonitor {
749749
"p.local_is_client": direction == 'in' ? "1" : "0", // connection is initiated from local
750750
"p.flow": JSON.stringify(flow),
751751
"p.intf.id": flow.intf,
752-
"p.tags": flow.tags
752+
"p.tag.ids": flow.tags
753753
});
754754

755755
// ideally each destination should have a unique ID, now just use hostname as a workaround
@@ -965,7 +965,7 @@ module.exports = class FlowMonitor {
965965
"e.dest.ports": this.getRemotePorts(flowObj),
966966
"p.from": intelObj.from,
967967
"p.intf.id": flowObj.intf,
968-
"p.tags": flowObj.tags
968+
"p.tag.ids": flowObj.tags
969969
};
970970

971971
this.updateURLPart(alarmPayload, flowObj);
@@ -1046,7 +1046,7 @@ module.exports = class FlowMonitor {
10461046
"e.device.ports": this.getDevicePorts(flowObj),
10471047
"e.dest.ports": this.getRemotePorts(flowObj),
10481048
"p.intf.id": flowObj.intf,
1049-
"p.tags": flowObj.tags
1049+
"p.tag.ids": flowObj.tags
10501050
};
10511051

10521052
this.updateURLPart(alarmPayload, flowObj);

0 commit comments

Comments
 (0)