PanoptesServiceClient Class Reference

Panoptes Service Client that is used to communicate with the Panoptes Service via. More...

#include <container_ipc.hpp>

Public Member Functions
	PanoptesServiceClient ()
	The PanoptesServiceClient class is a class that implements the PanoptesServiceClient class.
bool	Hello (ExtensibilityType extensibilityType, std::string port)
	The Hello function sends a Hello message to the Panoptes main service from the container.
bool	SendResults_Yara (std::string PePath, std::string FileHash, DWORD ProcessId, std::string YaraRulesPath, INT MatchRules, std::vector< std::string > DetectedRules)
bool	SendResults_PE (std::string PePath, bool IsPeSigned, std::string PeSignerSubject, std::vector< std::string > PeImports)
bool	SendResults_AMSI (std::string PePath, DWORD AmsiResult)
	PanoptesServiceClient ()
bool	Hello (ExtensibilityType extensibilityType, int ContainerPort)
	Send a hello message to the Panoptes Service to bind to the service.
bool	SendResults_AMSI (std::string PePath, std::string FileHash, DWORD AmsiResult)
	Send the results of the AMSI scan to the Panoptes Service.
	PanoptesServiceClient ()
bool	Hello (ExtensibilityType extensibilityType, int ContainerPort)
bool	SendResults_PE (std::string PePath, PortableExecutable::PEScanData data)
	PanoptesServiceClient ()
bool	Hello (ExtensibilityType extensibilityType, int ContainerPort)
bool	SendResults_Yara (std::string PePath, std::string FileHash, std::vector< std::string > DetectedRules)
	Send the results of the YARA scan to the Panoptes Service.
	PanoptesServiceClient ()
bool	QueuePeScan (std::string PePath, std::string FileHash, std::string &message)
	Send a request to the Panoptes Service to scan a PE file.
	PanoptesServiceClient ()
bool	QueuePeScan (std::string PePath, std::string FileHash, std::string &message)

Detailed Description

Panoptes Service Client that is used to communicate with the Panoptes Service via.

The Panoptes Service Client that used to communicate via gRPC.

Definition at line 36 of file container_ipc.hpp.

Constructor & Destructor Documentation

PanoptesServiceClient() [1/6]

PanoptesServiceClient::PanoptesServiceClient

(

)

The PanoptesServiceClient class is a class that implements the PanoptesServiceClient class.

Constructor for the Panoptes Service Client.

Constructor for the Panoptes Service Client to set up the connection to the.

Constructor for the Panoptes Service Client to set up the connection to the Panoptes Service.

Returns

The PanoptesServiceClient class.

Definition at line 15 of file service_client.cpp.

                                            {
    std::string server_url = "localhost:" + std::to_string(SERVICE_PORT);
    std::shared_ptr<grpc::Channel> channel = grpc::CreateChannel(server_url, grpc::InsecureChannelCredentials());
    stub_ = PanoptesService::NewStub(channel);
}

References SERVICE_PORT, and stub_.

PanoptesServiceClient() [2/6]

PanoptesServiceClient::PanoptesServiceClient

(

)

PanoptesServiceClient() [3/6]

PanoptesServiceClient::PanoptesServiceClient

(

)

PanoptesServiceClient() [4/6]

PanoptesServiceClient::PanoptesServiceClient

(

)

PanoptesServiceClient() [5/6]

PanoptesServiceClient::PanoptesServiceClient

(

)

PanoptesServiceClient() [6/6]

PanoptesServiceClient::PanoptesServiceClient

(

)

Member Function Documentation

Hello() [1/4]

bool PanoptesServiceClient::Hello	(	ExtensibilityType	extensibilityType,
		int	ContainerPort
	)

Send a hello message to the Panoptes Service to bind to the service.

Send a hello message to the Panoptes Service to bind to the service containing the type of extensibility and the port of the container that the extensibility is running in.

Parameters

extensibilityType	The type of extensibility, in this case AMSI
ContainerPort	The port of the container that the extensibility is running in

Returns

True if the hello message was sent successfully, false otherwise

Parameters

extensibilityType	The type of extensibility, in this case YARA
ContainerPort	The port of the container that the extensibility is running in

Returns

True if the hello message was sent successfully, false otherwise

Definition at line 74 of file service_client_amsi.cpp.

                                                                                       {
    AckMessage reply;
    ContainerInfo request;
    ClientContext g_context;
 
    request.set_container_type((ContainerType)extensibilityType);
    request.set_grpc_port(ContainerPort);
 
    Status status = stub_->Hello(&g_context, request, &reply);
 
    if (!status.ok()) {
        std::cout << status.error_code() << ": " << status.error_message() << std::endl;
        exit(1);
    }
 
    return reply.ack_type();
}

References stub_.

Hello() [2/4]

bool PanoptesServiceClient::Hello	(	ExtensibilityType	extensibilityType,
		int	ContainerPort
	)

Hello() [3/4]

bool PanoptesServiceClient::Hello	(	ExtensibilityType	extensibilityType,
		int	ContainerPort
	)

Hello() [4/4]

bool PanoptesServiceClient::Hello	(	ExtensibilityType	extensibilityType,
		std::string	port
	)

The Hello function sends a Hello message to the Panoptes main service from the container.

Parameters

extensibilityType	The type of extensibility.
port	The port of the Panoptes main service.

Returns

True if the Hello message is sent successfully, false otherwise.

Definition at line 25 of file service_client.cpp.

                                                                                     {
    AckMessage reply;
    ContainerInfo request;
    ClientContext g_context;
 
    int grpc_port = std::stoi(port);
    request.set_container_type((ContainerType)extensibilityType);
    request.set_grpc_port(grpc_port);
 
    Status status = stub_->Hello(&g_context, request, &reply);
 
    if (!status.ok()) {
        std::cout << status.error_code() << ": " << status.error_message() << std::endl;
        return !reply.ack_type();
    }
    
    return !reply.ack_type();
}

References stub_.

Referenced by PanoBind().

QueuePeScan() [1/2]

bool PanoptesServiceClient::QueuePeScan	(	std::string	PePath,
		std::string	FileHash,
		std::string &	message
	)

Send a request to the Panoptes Service to scan a PE file.

Parameters

PePath	The path to the PE file
FileHash	The hash of the PE file
message	The message to send to the Panoptes Service

Returns

True if the request was sent successfully, false otherwise

Definition at line 72 of file scanner_ipc.cpp.

                                                                                                {
    AckMessage reply;
    ClientContext context;
    std::chrono::system_clock::time_point deadline = std::chrono::system_clock::now() + std::chrono::milliseconds(8000); // 8 second timeout
    context.set_deadline(deadline);
    PeScanInfo request;
    request.set_file_hash(FileHash);
    request.set_portable_executable_path(PePath);
 
    Status status = stub_->QueuePeScan(&context, request, &reply);
    if (!status.ok()) {
        if (status.error_code() != grpc::StatusCode::UNKNOWN || status.error_code() != grpc::StatusCode::DEADLINE_EXCEEDED) {
            message = status.error_message();
            return false;
        }
    }
 
    return true;
}

References stub_.

Referenced by main(), and WinMain().

QueuePeScan() [2/2]

bool PanoptesServiceClient::QueuePeScan	(	std::string	PePath,
		std::string	FileHash,
		std::string &	message
	)

SendResults_AMSI() [1/2]

bool PanoptesServiceClient::SendResults_AMSI	(	std::string	PePath,
		DWORD	AmsiResult
	)

Referenced by PanoEntry().

SendResults_AMSI() [2/2]

bool PanoptesServiceClient::SendResults_AMSI	(	std::string	PePath,
		std::string	FileHash,
		DWORD	AmsiResult
	)

Send the results of the AMSI scan to the Panoptes Service.

Parameters

PePath	The path of the file that was scanned
FileHash	The hash of the file that was scanned
AmsiResult	The result of the AMSI scan

Returns

True if the results were sent successfully, false otherwise

Definition at line 97 of file service_client_amsi.cpp.

{
    AckMessage reply;
    ContainerReply request;
    ClientContext g_context;
 
    ScanAMSI results;
    request.set_portable_executable_path(PePath);
    request.set_file_hash(FileHash);
    results.set_amsi_result(AmsiResult);
 
    request.mutable_amsi_scan()->CopyFrom(results);
 
    Status status = stub_->ScanResults(&g_context, request, &reply);
 
    if (!status.ok()) {
        std::cout << status.error_code() << ": " << status.error_message() << std::endl;
        exit(1);
    }
 
    return !reply.ack_type();
}

References stub_.

SendResults_PE() [1/2]

bool PanoptesServiceClient::SendResults_PE	(	std::string	PePath,
		bool	IsPeSigned,
		std::string	PeSignerSubject,
		std::vector< std::string >	PeImports
	)

Referenced by PanoEntry().

SendResults_PE() [2/2]

bool PanoptesServiceClient::SendResults_PE	(	std::string	PePath,
		PortableExecutable::PEScanData	data
	)

Definition at line 83 of file service_client_pe.cpp.

                                                                                              {
    AckMessage reply;
    ContainerReply request;
    ClientContext g_context;
 
    ScanPE results;
    request.set_portable_executable_path(PePath);
    request.set_file_hash(PePath);
    results.set_signed_(data.isSigned);
    for (int i = 0; i < data.imports.size(); i++) {
        results.add_imports(data.imports[i]);
    }
 
    for (int i = 0; i < data.sections.size(); i++) {
        results.add_sections(data.sections[i]);
    }
 
    for (int i = 0; i < data.section_entropy.size(); i++) {
        results.add_section_entropy(data.section_entropy[i]);
    }
 
    request.mutable_pe_scan()->CopyFrom(results);
 
    Status status = stub_->ScanResults(&g_context, request, &reply);
 
    if (!status.ok()) {
        //std::cout << status.error_code() << ": " << status.error_message() << std::endl;
        exit(1);
    }
 
    return reply.ack_type();
}

References PortableExecutable::PEScanData::imports, PortableExecutable::PEScanData::isSigned, PortableExecutable::PEScanData::section_entropy, PortableExecutable::PEScanData::sections, and stub_.

SendResults_Yara() [1/2]

bool PanoptesServiceClient::SendResults_Yara	(	std::string	PePath,
		std::string	FileHash,
		DWORD	ProcessId,
		std::string	YaraRulesPath,
		INT	MatchRules,
		std::vector< std::string >	DetectedRules
	)

Referenced by PanoEntry().

SendResults_Yara() [2/2]

bool PanoptesServiceClient::SendResults_Yara	(	std::string	pePath,
		std::string	fileHash,
		std::vector< std::string >	detectedRules
	)

Send the results of the YARA scan to the Panoptes Service.

Parameters

pePath	The path of the file that was scanned
fileHash	The hash of the file that was scanned
detectedRules	The rules that were detected

Returns

True if the results were sent successfully, false otherwise

Definition at line 97 of file service_client_yara.cpp.

                                                                                                                     {
    ClientContext context;
    AckMessage reply;
    ContainerReply request;
 
    ScanYara results;
    request.set_portable_executable_path(pePath);
    request.set_file_hash(fileHash);
 
    for (auto rule : detectedRules) {
        results.add_detected_rules(rule);
    }
 
    request.mutable_yara_scan()->CopyFrom(results);
 
    Status status = stub_->ScanResults(&context, request, &reply);
 
    if (!status.ok()) {
        std::cout << status.error_code() << ": " << status.error_message() << std::endl;
        exit(1);
    }
 
    return reply.ack_type();
}

References stub_.

---

The documentation for this class was generated from the following files:

• /home/runner/work/Panoptes/Panoptes/src/container/include/container_ipc.hpp
• /home/runner/work/Panoptes/Panoptes/src/extensibility/PanoptesAMSI/include/PanoptesAMSI.h
• /home/runner/work/Panoptes/Panoptes/src/extensibility/PanoptesPE/include/PanoptesPE.h
• /home/runner/work/Panoptes/Panoptes/src/extensibility/PanoptesYara/include/PanoptesYara.h
• /home/runner/work/Panoptes/Panoptes/src/scanner/PanoptesScan/include/scanner_ipc.hpp
• /home/runner/work/Panoptes/Panoptes/src/scanner/PanoptesScanCLI/include/scanner_ipc.hpp
• /home/runner/work/Panoptes/Panoptes/src/container/src/service_client.cpp
• /home/runner/work/Panoptes/Panoptes/src/extensibility/PanoptesAMSI/src/service_client_amsi.cpp
• /home/runner/work/Panoptes/Panoptes/src/extensibility/PanoptesPE/src/service_client_pe.cpp
• /home/runner/work/Panoptes/Panoptes/src/extensibility/PanoptesYara/src/service_client_yara.cpp
• /home/runner/work/Panoptes/Panoptes/src/scanner/PanoptesScan/src/scanner_ipc.cpp
• /home/runner/work/Panoptes/Panoptes/src/scanner/PanoptesScanCLI/src/scanner_ipc.cpp