Add New Channel and Events API about honeytrap HOT 4 CLOSED

We need to implement a new Event API which will be called appropriately in different areas of code to deliver event details which will be send to pushers for delivery to their respective channels, this Event types must also have a textual representation suitable for logging.

We have the following events:

• honeytrap global events, like starting and stopping, starting containers, stopping containers
• specific session events, like ssh session start, login etc
• data (like files, packet logs, etc)

I think 1+2 can be fit within the event API.

from honeytrap.

All events will be sent as part of the Data field of the PushMessage type, as PushMessage will be the defactor means by which all messages are delivered and pushed by channels.

We will also be removing the RecordPush and the Record API, has this has been superseded by the PushMessage and Pusher API.

from honeytrap.

To allow more flexibility in how we filter messages to specific channels, we will need to allow duplicate channels based on giving keyed values. This will allow us for example, to have multiple slack backends that deliver messages to different channels of same or different slack groups.

Backends with no key in value will have the default name of the backend use (no duplicates will be allowed and panic will occur for this, if found).

[[backend.honeytrap]]
host = "http://api.honeytrap.io/"
token = "b0b6e462-ef0b-11e6-abc7-0fb6247f5820"

[[backend.slack]]
key = "slack.1"
host = "https://hooks.slack.com/services/"
token = "blabla"

[[backend.slack]]
key = "slack.2"
host = "https://hooks.slack.com/services/"
token = "boooosd43433oa"

[[channel]]
backend = ['honeytrap', 'slack.2']
events = ['*']
categories = ['ping']
sensors = ['ssh', 'http']

[[channel]]
backend = ['slack.1', 'honeytrap', 'elasticsearch']
events = ['reads*']
categories = ['ping']
sensors = ['http']

from honeytrap.

Currently the last PR adjusted the details we needed in for the new channel and event API. If we feel we need to have more changes added or the criteria of this PR were not met, then we will reopen the issue.

from honeytrap.