Configuration Class Reference

#include <Configuration.hpp>

Public Types
enum	ContainerType : int { CONTAINER_TYPE_NONE = 0 , CONTAINER_TYPE_AMSI = 10 , CONTAINER_TYPE_PE = 20 , CONTAINER_TYPE_YARA = 30 }
	The type of container that the extensibility is running in. More...

Public Member Functions
	Configuration (std::string configurationPath)
	Constructor for the Configuration class.
void	Parse ()
	Parse the configuration file.
void	IsValidJson ()
	Check if the configuration file is valid.
std::vector< std::string >	GetJsonKeys ()
	Get the keys from the configuration file.

Public Attributes
std::vector< std::string >	m_exclusions
	The exclusions from the configuration file.
std::vector< Configuration::ContainerType >	m_extensibility
	The extensibility selected from the configuration file.
std::vector< std::string >	m_extensibilityListName
	The list of extensibility names from the configuration file.
std::vector< std::tuple< std::string, unsigned long, unsigned long > >	m_eventProviders
	The event providers from the configuration file.
bool	m_ignoreDriver = false
	The ignore driver from the configuration file.
bool	m_quartine = false
	The quarantine malicious files from the configuration file.

Protected Member Functions
void	GetExtensibilitySelected ()
	Get the extensibility selected from the configuration file.
void	GetScannerExclusions ()
	Get the scanner exclusions from the configuration file.
void	GetIgnoreDriver ()
	Get the ignore driver from the configuration file.
void	GetQuarantineMaliciousFiles ()
	Get the quarantine malicious files from the configuration file.
void	GetEventProviders ()
	Get the event providers from the configuration file.

Protected Attributes
nlohmann::json	m_data
std::ifstream	m_fileStream

Detailed Description

Definition at line 7 of file Configuration.hpp.

Member Enumeration Documentation

ContainerType

enum Configuration::ContainerType : int

The type of container that the extensibility is running in.

Enumerator
CONTAINER_TYPE_NONE
CONTAINER_TYPE_AMSI
CONTAINER_TYPE_PE
CONTAINER_TYPE_YARA

Definition at line 29 of file Configuration.hpp.

                       : int {
      CONTAINER_TYPE_NONE = 0,
      CONTAINER_TYPE_AMSI = 10,
      CONTAINER_TYPE_PE = 20,
      CONTAINER_TYPE_YARA = 30
    };

Constructor & Destructor Documentation

Configuration()

Configuration::Configuration

(

std::string

configurationPath

)

Constructor for the Configuration class.

Parameters

configurationPath

The path to the configuration file

Definition at line 55 of file Configuration.cpp.

{
    m_fileStream = std::ifstream(configurationPath);
}

References m_fileStream.

Member Function Documentation

GetEventProviders()

void Configuration::GetEventProviders ( )

protected

Get the event providers from the configuration file.

Definition at line 78 of file Configuration.cpp.

                                      {
    if (m_data["EventProviders"].is_array()) {
 
        std::vector<std::string> selectedExtensibility = m_data["EventProviders"].template get<std::vector<std::string>>();
 
        for (std::string containerTypeStr : selectedExtensibility) {
            auto splitStr = SplitString(containerTypeStr, ',');
            if (splitStr.size() != 3) {
                throw std::runtime_error("Invalid Event Provider format");
            }
 
            std::string providerName = splitStr[0];
            unsigned long providerMatchAnyKeyword = StringToDWORD(splitStr[1]);
            unsigned long providerMatchAllKeyword = StringToDWORD(splitStr[2]);
 
            auto eventProviderInfo = std::make_tuple(providerName, providerMatchAnyKeyword, providerMatchAllKeyword);
            m_eventProviders.push_back(eventProviderInfo);
        }
    }
    else {
        throw std::runtime_error("EventProviders was not set in the the configuration");
    }
}

References m_data, m_eventProviders, SplitString(), and StringToDWORD().

Referenced by Parse().

GetExtensibilitySelected()

void Configuration::GetExtensibilitySelected ( )

protected

Get the extensibility selected from the configuration file.

Definition at line 103 of file Configuration.cpp.

{
    if (m_data["ExtensibilitySelected"].is_array()) {
        std::vector<std::string> selectedExtensibility = m_data["ExtensibilitySelected"].template get<std::vector<std::string>>();
 
        for (std::string containerTypeStr : selectedExtensibility) {
            ContainerType containerType;
 
 
            if (StrToLower(containerTypeStr) == "amsi") {
                containerType = CONTAINER_TYPE_AMSI;
            }
            else if (StrToLower(containerTypeStr) == "pe") {
                containerType = CONTAINER_TYPE_PE;
            }
            else if (StrToLower(containerTypeStr) == "yara") {
                containerType = CONTAINER_TYPE_YARA;
            }
            else {
                throw std::runtime_error("Invalid Container Type");
            }
 
            m_extensibility.push_back(containerType);
        }
    }
    else {
        throw std::runtime_error("ExtensibilitySelected was not set in the the configuration");
    }
}

References CONTAINER_TYPE_AMSI, CONTAINER_TYPE_PE, CONTAINER_TYPE_YARA, m_data, m_extensibility, and StrToLower().

Referenced by Parse().

GetIgnoreDriver()

void Configuration::GetIgnoreDriver ( )

protected

Get the ignore driver from the configuration file.

Definition at line 145 of file Configuration.cpp.

                                    {
    if (m_data["IgnoreDriver"].is_boolean()) {
        m_ignoreDriver = m_data["IgnoreDriver"].template get<bool>();
    }
    else {
        throw std::runtime_error("IgnoreDriver was not set in the the configuration");
    }
}

References m_data, and m_ignoreDriver.

Referenced by Parse().

GetJsonKeys()

std::vector< std::string > Configuration::GetJsonKeys

(

)

Get the keys from the configuration file.

Returns

A vector of strings containing the keys

Definition at line 166 of file Configuration.cpp.

                                                {
    std::vector<std::string> keys;
    if (m_data.is_object()) {
        for (nlohmann::json::const_iterator it = m_data.begin(); it != m_data.end(); ++it) {
            keys.push_back(it.key());
        }
    }
    else {
        throw std::runtime_error("The json data object was not set");
    }
 
    return keys;
}

References m_data.

Referenced by main().

GetQuarantineMaliciousFiles()

void Configuration::GetQuarantineMaliciousFiles ( )

protected

Get the quarantine malicious files from the configuration file.

Definition at line 155 of file Configuration.cpp.

                                                {
    if (m_data["QuarantineMaliciousFiles"].is_boolean()) {
        m_quartine = m_data["QuarantineMaliciousFiles"].template get<bool>();
    }
    else {
        throw std::runtime_error("QuarantineMaliciousFiles was not set in the the configuration");
    }
}

References m_data, and m_quartine.

Referenced by Parse().

GetScannerExclusions()

void Configuration::GetScannerExclusions ( )

protected

Get the scanner exclusions from the configuration file.

Definition at line 134 of file Configuration.cpp.

{
    if (m_data["Exclusions"].is_array()) {
        m_exclusions = m_data["Exclusions"].template get<std::vector<std::string>>();
    }
    else {
        throw std::runtime_error("Exclusions was not set in the the configuration");
    }
}

References m_data, and m_exclusions.

Referenced by Parse().

IsValidJson()

void Configuration::IsValidJson

(

)

Check if the configuration file is valid.

Definition at line 72 of file Configuration.cpp.

{
    m_data = nlohmann::json::parse(m_fileStream);
}

References m_data, and m_fileStream.

Referenced by main().

Parse()

void Configuration::Parse

(

)

Parse the configuration file.

Definition at line 61 of file Configuration.cpp.

{
    m_data = nlohmann::json::parse(m_fileStream);
    GetExtensibilitySelected();
    GetScannerExclusions();
    GetIgnoreDriver();
    GetQuarantineMaliciousFiles();
    GetEventProviders();
}

References GetEventProviders(), GetExtensibilitySelected(), GetIgnoreDriver(), GetQuarantineMaliciousFiles(), GetScannerExclusions(), m_data, and m_fileStream.

Referenced by WinMain().

Member Data Documentation

m_data

nlohmann::json Configuration::m_data

protected

Definition at line 9 of file Configuration.hpp.

Referenced by GetEventProviders(), GetExtensibilitySelected(), GetIgnoreDriver(), GetJsonKeys(), GetQuarantineMaliciousFiles(), GetScannerExclusions(), IsValidJson(), and Parse().

m_eventProviders

std::vector<std::tuple<std::string, unsigned long, unsigned long> > Configuration::m_eventProviders

The event providers from the configuration file.

Definition at line 46 of file Configuration.hpp.

Referenced by GetEventProviders(), and StartPanoptesTrace().

m_exclusions

std::vector<std::string> Configuration::m_exclusions

The exclusions from the configuration file.

Definition at line 37 of file Configuration.hpp.

Referenced by GetScannerExclusions().

m_extensibility

std::vector<Configuration::ContainerType> Configuration::m_extensibility

The extensibility selected from the configuration file.

Definition at line 40 of file Configuration.hpp.

Referenced by GetExtensibilitySelected(), and WinMain().

m_extensibilityListName

std::vector<std::string> Configuration::m_extensibilityListName

The list of extensibility names from the configuration file.

Definition at line 43 of file Configuration.hpp.

m_fileStream

std::ifstream Configuration::m_fileStream

protected

Definition at line 10 of file Configuration.hpp.

Referenced by Configuration(), IsValidJson(), and Parse().

m_ignoreDriver

bool Configuration::m_ignoreDriver = false

The ignore driver from the configuration file.

Definition at line 49 of file Configuration.hpp.

Referenced by GetIgnoreDriver(), and WinMain().

m_quartine

bool Configuration::m_quartine = false

The quarantine malicious files from the configuration file.

Definition at line 52 of file Configuration.hpp.

Referenced by GetQuarantineMaliciousFiles().

---

The documentation for this class was generated from the following files:

• /home/runner/work/Panoptes/Panoptes/src/libraries/Configuration/include/Configuration.hpp
• /home/runner/work/Panoptes/Panoptes/src/libraries/Configuration/src/Configuration.cpp