Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ Slack overview message for the security user:

1. Tag your Falcon hosts with `email/user/company/com` if their email is `[email protected]`.
2. Assign compliance policies to your devices in Workspace ONE.
3. Fetch a binary release or Docker image from [Releases](https://github.com/hazcod/crowdstrike-spotlight-slacker/releases).
3. Fetch a binary release or Docker image from [Releases](https://github.com/hazcod/security-slacker/releases).
4. Create a Falcon API token to use in `API Clients and Keys` with `Read` permission to `Hosts` and `Spotlight`.
5. Create Workspace ONE oauth2 API credentials with a read-only role.
6. Create a configuration file:
Expand Down
48 changes: 16 additions & 32 deletions cmd/main.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,26 +3,20 @@ package main
import (
"context"
"flag"
"github.com/hazcod/crowdstrike-spotlight-slacker/pkg/overview/security"
"github.com/hazcod/crowdstrike-spotlight-slacker/pkg/overview/user"
"github.com/hazcod/crowdstrike-spotlight-slacker/pkg/ws1"
"github.com/hazcod/security-slacker/pkg/overview/security"
"github.com/hazcod/security-slacker/pkg/overview/user"
slackPkg "github.com/hazcod/security-slacker/pkg/slack"
"github.com/hazcod/security-slacker/pkg/ws1"
"gopkg.in/errgo.v2/fmt/errors"
"os"
"strings"

config2 "github.com/hazcod/crowdstrike-spotlight-slacker/config"
"github.com/hazcod/crowdstrike-spotlight-slacker/pkg/falcon"
config2 "github.com/hazcod/security-slacker/config"
"github.com/hazcod/security-slacker/pkg/falcon"
"github.com/sirupsen/logrus"
"github.com/slack-go/slack"
)

var (
slackStatusHolidays = []string{
"vacationing",
"absent",
}
)

func main() {
ctx := context.Background()

Expand Down Expand Up @@ -153,27 +147,16 @@ func main() {

logrus.WithField("email", slackUser.Profile.Email).Debug("looking at Slack user")

if config.Slack.SkipOnHoliday {
isOnHoliday := false
slackStatus := strings.ToLower(slackUser.Profile.StatusText)

for _, statusPrefix := range slackStatusHolidays {
if strings.HasPrefix(slackStatus, statusPrefix) {
isOnHoliday = true
break
}
}

if isOnHoliday {
logrus.WithField("slack_name", slackUser.Name).Warn("skipping user since he/she is on holiday")
continue
}
if config.Slack.SkipOnHoliday && slackPkg.IsOnHoliday(slackUser) {
logrus.WithField("slack_name", slackUser.Name).Warn("skipping user since he/she is on holiday")
continue
}

logrus.WithField("falcon", len(userFalconMsg.Devices)).WithField("ws1", len(userWS1Msg.Devices)).WithField("email", userEmail).
Debug("found messages")
logrus.WithField("falcon", len(userFalconMsg.Devices)).WithField("ws1", len(userWS1Msg.Devices)).
WithField("email", userEmail).Debug("found messages")

slackMessage, err := user.BuildUserOverviewMessage(logrus.StandardLogger(), config, slackUser, falconMessages[userEmail], ws1Messages[userEmail])
slackMessage, err := user.BuildUserOverviewMessage(
logrus.StandardLogger(), config, slackUser, falconMessages[userEmail], ws1Messages[userEmail])
if err != nil {
logrus.WithError(err).WithField("user", slackUser.Profile.Email).Error("could not generate user message")
continue
Expand Down Expand Up @@ -221,7 +204,7 @@ func main() {
for _, userWithSensor := range usersWithSensors {
if strings.HasPrefix(userWithSensor, "_NOTAG/") {
errorsToReport = append(errorsToReport, errors.Newf(
"%s does not have a user email tag assigned", strings.Split("/", userWithSensor)[1],
"%s does not have a user email tag assigned", strings.Split(userWithSensor, "/")[1],
))
}
}
Expand Down Expand Up @@ -249,7 +232,8 @@ func main() {

// ---

overviewText, err := security.BuildSecurityOverviewMessage(logrus.StandardLogger(), *config, falconMessages, ws1Messages, errorsToReport)
overviewText, err := security.BuildSecurityOverviewMessage(logrus.StandardLogger(),
*config, falconMessages, ws1Messages, errorsToReport)
if err != nil {
logrus.WithError(err).Fatal("could not generate security overview")
}
Expand Down
6 changes: 2 additions & 4 deletions go.mod
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
module github.com/hazcod/crowdstrike-spotlight-slacker
module github.com/hazcod/security-slacker

go 1.22.0

toolchain go1.23.5
go 1.23.5

require (
github.com/crowdstrike/gofalcon v0.11.1
Expand Down
2 changes: 2 additions & 0 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,8 @@ github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
github.com/hazcod/security-slacker v1.23.2 h1:BpIvTOzdJ0B12ti/pRCB2h9U1Qk1hI3Mz13iYJji56I=
github.com/hazcod/security-slacker v1.23.2/go.mod h1:GTAIISObcv8PamF5nPEcAh6+NtlLA/Z5KT4E9PVKSdw=
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
Expand Down
3 changes: 1 addition & 2 deletions pkg/falcon/extractor.go
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ import (

"github.com/crowdstrike/gofalcon/falcon"
"github.com/crowdstrike/gofalcon/falcon/models"
"github.com/hazcod/crowdstrike-spotlight-slacker/config"
"github.com/hazcod/security-slacker/config"
"github.com/sirupsen/logrus"
)

Expand Down Expand Up @@ -215,7 +215,6 @@ func GetMessages(config *config.Config, ctx context.Context) (results map[string
allHostDetails = append(allHostDetails, hostDetail.Payload.Resources...)

sliceStart = sliceEnd
sliceEnd = sliceStart + step
}

securityErrorsMap := make(map[string]struct{})
Expand Down
6 changes: 3 additions & 3 deletions pkg/overview/security/builder.go
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ package security

import (
"bytes"
"github.com/hazcod/crowdstrike-spotlight-slacker/config"
"github.com/hazcod/crowdstrike-spotlight-slacker/pkg/falcon"
"github.com/hazcod/crowdstrike-spotlight-slacker/pkg/ws1"
"github.com/hazcod/security-slacker/config"
"github.com/hazcod/security-slacker/pkg/falcon"
"github.com/hazcod/security-slacker/pkg/ws1"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"html/template"
Expand Down
14 changes: 7 additions & 7 deletions pkg/overview/user/builder.go
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ package user

import (
"bytes"
"github.com/hazcod/crowdstrike-spotlight-slacker/config"
"github.com/hazcod/crowdstrike-spotlight-slacker/pkg/falcon"
"github.com/hazcod/crowdstrike-spotlight-slacker/pkg/ws1"
"github.com/hazcod/security-slacker/config"
"github.com/hazcod/security-slacker/pkg/falcon"
"github.com/hazcod/security-slacker/pkg/ws1"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"github.com/slack-go/slack"
Expand All @@ -26,13 +26,13 @@ func BuildUserOverviewMessage(logger *logrus.Logger, config *config.Config, slac
}

variables := struct {
Slack slack.User
Slack slack.User
Falcon falcon.FalconResult
WS1 ws1.WS1Result
WS1 ws1.WS1Result
}{
Slack: slackUser,
Slack: slackUser,
Falcon: falconResult,
WS1: ws1Result,
WS1: ws1Result,
}

var buffer bytes.Buffer
Expand Down
25 changes: 25 additions & 0 deletions pkg/slack/holiday.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
package slack

import (
"github.com/slack-go/slack"
"strings"
)

var (
slackStatusHolidays = []string{
"vacationing",
"absent",
}
)

func IsOnHoliday(user slack.User) bool {
slackStatus := strings.ToLower(user.Profile.StatusText)

for _, statusPrefix := range slackStatusHolidays {
if strings.HasPrefix(slackStatus, statusPrefix) {
return true
}
}

return false
}
6 changes: 0 additions & 6 deletions pkg/slack/message.go

This file was deleted.

2 changes: 1 addition & 1 deletion pkg/ws1/extractor.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ import (
"context"
"encoding/json"
"fmt"
"github.com/hazcod/crowdstrike-spotlight-slacker/config"
"github.com/hazcod/security-slacker/config"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"golang.org/x/oauth2/clientcredentials"
Expand Down
Loading