forked from lacework/go-sdk
-
Notifications
You must be signed in to change notification settings - Fork 0
/
integration_alert_channels_qradar.go
123 lines (109 loc) · 3.95 KB
/
integration_alert_channels_qradar.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
//
// Author:: Darren Murray(<[email protected]>)
// Copyright:: Copyright 2020, Lacework Inc.
// License:: Apache License, Version 2.0
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
package api
import "github.com/pkg/errors"
// NewQRadarAlertChannel returns an instance of QRadarAlertChannel
// with the provided name and data.
//
// Basic usage: Initialize a new QRadarAlertChannel struct, then
// use the new instance to do CRUD operations
//
// client, err := api.NewClient("account")
// if err != nil {
// return err
// }
//
// qradarChannel := api.NewQRadarAlertChannel("foo",
// api.QRadarChannelData{
// CommunicationType: "HTTPS",
// HostURL: "https://qradar-lacework.com",
// HostPort: 8080,
// },
// )
//
// client.Integrations.CreateQRadarAlertChannel(qradarChannel)
//
func NewQRadarAlertChannel(name string, data QRadarChannelData) QRadarAlertChannel {
return QRadarAlertChannel{
commonIntegrationData: commonIntegrationData{
Name: name,
Type: QRadarChannelIntegration.String(),
Enabled: 1,
},
Data: data,
}
}
// CreateQRadarAlertChannel creates a qradar alert channel integration on the Lacework Server
func (svc *IntegrationsService) CreateQRadarAlertChannel(integration QRadarAlertChannel) (
response QRadarAlertChannelResponse,
err error,
) {
err = svc.create(integration, &response)
return
}
// GetQRadarAlertChannel gets a qradar alert channel integration that matches with
// the provided integration guid on the Lacework Server
func (svc *IntegrationsService) GetQRadarAlertChannel(guid string) (response QRadarAlertChannelResponse,
err error) {
err = svc.get(guid, &response)
return
}
// UpdateQRadarAlertChannel updates a single qradar alert channel integration
func (svc *IntegrationsService) UpdateQRadarAlertChannel(data QRadarAlertChannel) (
response QRadarAlertChannelResponse,
err error,
) {
err = svc.update(data.IntgGuid, data, &response)
return
}
// ListQRadarAlertChannel lists the qradar alert channel integrations available on the Lacework Server
func (svc *IntegrationsService) ListQRadarAlertChannel() (response QRadarAlertChannelResponse, err error) {
err = svc.listByType(QRadarChannelIntegration, &response)
return
}
type QRadarAlertChannelResponse struct {
Data []QRadarAlertChannel `json:"data"`
Ok bool `json:"ok"`
Message string `json:"message"`
}
type QRadarAlertChannel struct {
commonIntegrationData
Data QRadarChannelData `json:"DATA"`
}
type QRadarChannelData struct {
CommunicationType qradarComm `json:"QRADAR_COMM_TYPE,omitempty" mapstructure:"QRADAR_COMM_TYPE"`
HostURL string `json:"QRADAR_HOST_URL" mapstructure:"QRADAR_HOST_URL"`
HostPort int `json:"QRADAR_HOST_PORT,omitempty" mapstructure:"QRADAR_HOST_PORT"`
}
type qradarComm string
const (
// The list of valid inputs for QRadar Communication Type field
QRadarCommHttps qradarComm = "HTTPS"
QRadarCommHttpsSelfSigned qradarComm = "HTTPS Self Signed Cert"
)
var qradarCommTypes = map[string]qradarComm{
string(QRadarCommHttps): QRadarCommHttps,
string(QRadarCommHttpsSelfSigned): QRadarCommHttpsSelfSigned,
}
// QRadarComm returns the qradarComm type for the corresponding string input
func QRadarComm(site string) (qradarComm, error) {
if val, ok := qradarCommTypes[site]; ok {
return val, nil
}
return "", errors.Errorf("%v is not a valid QRadar communication type", site)
}