mirrors/crowdsec
1
0
Fork 0
mirror of https://github.com/crowdsecurity/crowdsec.git synced 2025-05-11 12:25:53 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
1230 commits 88 branches 214 tags 262 MiB
Commit graph

43 commits

Author SHA1 Message Date
blotus
1095f6c875
use expr.Function for custom functions instead of passing them in the env (#2133) 2023-03-28 10:49:01 +02:00
Thibault "bui" Koechlin
d87f088b8f
match expr helper (#2126) 
* match expr helper
 2023-03-21 10:39:17 +01:00
blotus
94c7efdb5b
add ToString() helper (#2100) 2023-03-16 15:20:31 +01:00
Thibault "bui" Koechlin
d95b7afe61
Distance support : Impossible travel (#2108) 
* add distance helpers
 2023-03-08 18:29:42 +01:00
Thibault "bui" Koechlin
5b0fe4b7f1
support for regexps result cache (#2104) 
* support for regexps result cache : gcache + xxhash

Co-authored-by: Marco Mariani <marco@crowdsec.net>
 2023-03-08 16:07:49 +01:00
blotus
812b87ab48
Add IsIPV4() and IsIP() helpers (#2050) 2023-02-10 14:44:42 +01:00
Thibault "bui" Koechlin
0f5560b62a
more strings helpers (#2040) 
* more strings helpers
 2023-02-09 15:23:21 +01:00
Thibault "bui" Koechlin
4f29ce2ee7
CTI API Helpers in expr (#1851) 
* Add CTI API helpers in expr
* Allow profiles to have an `on_error` option to profiles

Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
 2023-01-19 08:45:50 +01:00
Thibault "bui" Koechlin
6fb962a941
Allow parsers to capture data for future enrichment (#1969) 
* Allow parsers to capture data in a cache, that can be later accessed via expr helpers (fake multi-line support)
 2023-01-11 15:01:02 +01:00
mmetc
033082a31e
ParseUnix() test fix: force UTC (#1970) 2023-01-04 16:22:17 +01:00
Laurence Jones
401739b036
Add unix expr helper (#1952) 
* Add unix expr helper

* Add original value not parsed error

* return early if cannot parse

* Add tests

* Fix negative value
 2022-12-29 14:53:06 +00:00
Laurence Jones
668627f890
Add error checking to lookup host (#1847) 2022-10-31 18:38:01 +00:00
ThinkChaos
22479a289d
Add LookupHost expr lib func (#1775) 2022-10-26 10:17:48 +01:00
he2ss
3d6f015211
Add duration expr to add duration formula (#1556) 
* add duration expr to add duration formula
 2022-06-22 11:29:52 +02:00
blotus
4b311684ab
Add more JSON expr helpers (#1576) 2022-06-08 12:15:29 +02:00
AlteredCoder
1e1741aa45
Allow to set static to a pointer and add IsIPV6 helper (#1540) 
* Allow to set static to a pointer and add IsIPV6 helper
 2022-05-19 16:28:25 +02:00
blotus
64369b5c2b
add expr XML helpers (#1493) 2022-04-29 13:52:23 +02:00
AlteredCoder
526a4dbd08
Reduce the query unescape helper verbosity (#1447) 2022-04-19 12:31:29 +02:00
AlteredCoder
5a0843852a
add IpToRange helpers and allows to have an expression with scope Range (#1260) 
* add IpToRange helpers and allows to have an expression with scope Range
 2022-02-14 16:50:52 +01:00
Thibault "bui" Koechlin
cc1ab8c50d
switch to utc time everywhere (#1167) 
* switch to utc time everywhere


Co-authored-by: alteredCoder <kevin@crowdsec.net>
 2022-01-19 14:56:05 +01:00
AlteredCoder
458dcd1979
add more helpers (#1091) 
* add more exprhelpers
 2021-12-14 11:07:40 +01:00
blotus
2bc9f33e12
add ParseUri() expr helper (#994) 2021-10-08 16:50:31 +02:00
Thibault "bui" Koechlin
af4bb350c0
hubtests revamp + cscli explain (#988) 
* New hubtest CI for scenarios/parsers from the hub
 * New `cscli explain` command to visualize parsers/scenarios pipeline

Co-authored-by: alteredCoder <kevin@crowdsec.net>
Co-authored-by: Sebastien Blot <sebastien@crowdsec.net>
Co-authored-by: he2ss <hamza.essahely@gmail.com>
Co-authored-by: Cristian Nitescu <cristian@crowdsec.net>
 2021-10-04 17:14:52 +02:00
he2ss
e651379964
add jsonExtractUnescape Helper (#962) 
* add jsonExtractUnescape Helper
 2021-09-10 12:43:11 +02:00
registergoofy
7e9ce901a4
add TimeNow in the exprlib helpers (#756) 
* add TimeNow in the exprlib helpers
* add a default date when none is detected: when no date is recognised by ParseDate, then use time.Now()
 2021-04-16 19:13:48 +02:00
Thibault "bui" Koechlin
a3d00fe130
skip empty lines to avoid issue of #630 (#631) 
* skip empty lines to avoid issue of #630

* add tests on empty lines and comms
 2021-02-25 09:57:24 +01:00
Thibault "bui" Koechlin
dbb420f79e
local api (#482) 
Co-authored-by: AlteredCoder
Co-authored-by: erenJag
 2020-11-30 10:37:17 +01:00
erenJag
25dfcebf4c
improve fileInit func by not loading unspecified data (#189) 
* improve fileInit func by not loading unsepcified data
 2020-08-21 14:20:44 +02:00
AlteredCoder
b7096be6e6
fix message to verbose in expr helper (#166) 
Co-authored-by: AlteredCoder <AlteredCoder>
 2020-07-30 17:12:47 +02:00
AlteredCoder
d0ac43b00f
Allow comments with # in expr wordlists 
Co-authored-by: AlteredCoder <AlteredCoder>
 2020-07-07 16:26:00 +02:00
Thibault "bui" Koechlin
a62bac0ca0
verbosity (#121) 2020-07-03 18:26:23 +02:00
Thibault "bui" Koechlin
7691e5b663
re-enable postoverflows (#117) 
* re-enable postoverflows

* debug

* yoloooo

* remove debug

* remove error print

* fix test

* fix leakybucket test

* fix

Co-authored-by: AlteredCoder <AlteredCoder>
 2020-07-02 17:56:39 +02:00
erenJag
f6826c7e47
add expr helper to check if IP is in ipRange (#113) 
* add expr helper to check if IP is in ipRange

* update helper name

Co-authored-by: erenJag <erenJag>
 2020-07-02 11:09:40 +02:00
Thibault "bui" Koechlin
b9ae94b874
Sqlite : Support automatic db flushing (#91) 
* add support for sqlite retention : max_records, max_records_age

* reduce verbosity of cwhub
 2020-07-01 17:04:29 +02:00
Thibault "bui" Koechlin
430b7cd90d
add a 'Upper' expr helper (#50) 
* add a 'Upper' expr helper

* remove redundant startsWith and endsWith
 2020-06-01 16:12:48 +02:00
AlteredCoder
82d6e6938a
Fix expr helpers "StartsWith" and "EndsWith" (#48) 
* fix

* fix typo

Co-authored-by: AlteredCoder <AlteredCoder>
 2020-05-29 17:25:09 +02:00
AlteredCoder
ea4e4153af fix review 2020-05-28 11:32:00 +02:00
AlteredCoder
fd6ecd25df fix review 2020-05-28 11:28:49 +02:00
Thibault "bui" Koechlin
1abdfc9b10 make message better 2020-05-28 11:28:49 +02:00
erenJag
c020ff8c64
Merge pull request #22 from crowdsecurity/add_expr_helpers 
add new expr helpers
 2020-05-25 12:12:49 +02:00
Thibault bui Koechlin
32f32b41c7 add json support via expr helpers 2020-05-22 18:12:33 +02:00
AlteredCoder
62daa98bf3 add new helpers 2020-05-22 13:55:48 +02:00
Thibault bui Koechlin
2016167654 initial import 2020-05-15 11:39:16 +02:00