Skip to main content

FQL generation engine for Caracara

Project description

CrowdStrike Falcon Twitter URL

Caracara Filters

PyPI OSS Lifecycle

A new filter system for Caracara.

Caracara's previous filter system was inflexible, and tailored too heavily toward the Hosts API module. This project aims to provide an FQL generator that is dialect-aware (i.e., contextual, based on the API module that the request will be sent to).

Basic Concepts

Instead of declaring each filter as a class, we now have them defined in a dictionary which is significantly easier to work with. Dynamic functionality is provided by storing (partial) functions into each filter.

Each filter derives from the 'default' / base filter, which is configured with identity transforms and validators that return the input value and True, respectively, and expects a string input. These settings can be overridden per-filter, and are enforced when a filter is added to the FQLGenerator object. We call this process rebasing, as each filter is rebased from a smaller dictionary over the top of the default filter, thus ensuring that all expected values will be present.

When a filter is created, the input goes through these processing stages:

  • Validation: the filter's input is passed into a validation function that always returns a bool. True means that the input is valid, and False will raise a ValueError exception. At this stage, we also validate the input type; incorrect input types will result in a TypeError.
  • Transformation: each filter value can be transformed from a human-defined input into something machine-readable, expected by the API. For example, relative timestamps (such as -30m) are transformed to a UTC ISO8601 timestamp ready for the Falcon API, and Containment Pending is rewritten to containment_pending as expected by the Hosts API.
  • Storage: the validated, transformed input is stored alongside the FQL property name and the operator (e.g., equality, >=, etc.), ready for FQL generation.

When FQL is generated, each of the filters are iterated over and converted to FQL individually, and then chained together with + to form an AND condition.

Limitations

We currently only support a limited subset of FQL. For example:

  • We can generate a condition like "all systems that run Windows or Linux, AND have an IP address in the range 192.168.0.0/16 OR 10.0.0.0/8".
  • We cannot generate a condition like "all systems that run Windows AND have an IP address in the 192.168.0.0/16 range, as well as all Linux systems in the 10.0.0.0/8 range".

The latter is out of scope as it requires chaining together multiple filters. You can effectively create this functionality for yourself by creating two FQL generators, wrapping their outputs in parentheses, and chaining them together with a '+'.join().

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

caracara_filters-0.2.0.tar.gz (13.3 kB view details)

Uploaded Source

Built Distribution

caracara_filters-0.2.0-py3-none-any.whl (18.4 kB view details)

Uploaded Python 3

File details

Details for the file caracara_filters-0.2.0.tar.gz.

File metadata

  • Download URL: caracara_filters-0.2.0.tar.gz
  • Upload date:
  • Size: 13.3 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: poetry/1.6.1 CPython/3.9.18 Linux/6.2.0-1011-azure

File hashes

Hashes for caracara_filters-0.2.0.tar.gz
Algorithm Hash digest
SHA256 cc0813a7e0cf64b5e9c20cee289610cd25f7a03b2d84988e5fa21333a2485d5e
MD5 0a460019e95d17db0fa4e16b700b0884
BLAKE2b-256 3d63b839350b407ec2bae1aca9ab533daf69a0edb0410d5ce060d2dbe6d6074d

See more details on using hashes here.

File details

Details for the file caracara_filters-0.2.0-py3-none-any.whl.

File metadata

  • Download URL: caracara_filters-0.2.0-py3-none-any.whl
  • Upload date:
  • Size: 18.4 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: poetry/1.6.1 CPython/3.9.18 Linux/6.2.0-1011-azure

File hashes

Hashes for caracara_filters-0.2.0-py3-none-any.whl
Algorithm Hash digest
SHA256 853bb9ebf754dc6d707c17b4489dc5c3cf79756071736921b14f60a33cab2b77
MD5 01e2a27f6056af5ac1f6e62dd57228bd
BLAKE2b-256 8abdbbb21926c0345f382da34b06c983b2ffe52b0fdff62a133ed56d147f383b

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page