feat(rules_engine): Populate approver predicates

At rule compilation time, the compiler traverses the
AST tree and attempts to find event types for which
approver predicates can be derived.
Most notably, file and registry paths, file extensions, file base names and process executable paths are all candidates for approver predicates.

Author: rabbitstack

pkg/config/filters.go

@@ -202,11 +202,59 @@ type RulesCompileResult struct {
 	HasThreadpoolEvents bool
 	UsedEvents          []event.Type
 	NumberRules         int
+	Approvers           Approvers
 }
 
-func (r RulesCompileResult) ContainsEvent(Type event.Type) bool {
-	for _, ktyp := range r.UsedEvents {
-		if ktyp == Type {
+type Approvers struct {
+	Keys        map[string][]string
+	Paths       map[string][]string
+	Extensions  map[string][]string
+	Bases       map[string][]string
+	Executables map[string][]string
+}
+
+func (p *Approvers) AppendKey(op, path string) {
+	if slices.Contains(p.Keys[op], path) {
+		return
+	}
+	p.Keys[op] = append(p.Keys[op], path)
+}
+
+func (p *Approvers) AppendPath(op, path string) {
+	if slices.Contains(p.Paths[op], path) {
+		return
+	}
+	p.Paths[op] = append(p.Paths[op], path)
+}
+
+func (p *Approvers) AppendExtension(op, ext string) {
+	if slices.Contains(p.Extensions[op], ext) {
+		return
+	}
+	p.Extensions[op] = append(p.Extensions[op], ext)
+}
+
+func (p *Approvers) AppendBase(op, base string) {
+	if slices.Contains(p.Bases[op], base) {
+		return
+	}
+	p.Bases[op] = append(p.Bases[op], base)
+}
+
+func (p *Approvers) AppendExecutable(op, exe string) {
+	if slices.Contains(p.Executables[op], exe) {
+		return
+	}
+	p.Executables[op] = append(p.Executables[op], exe)
+}
+
+func (p Approvers) String() string {
+	return fmt.Sprintf("Keys: %v, Paths: %v, Extensions: %v, Bases: %v, Executables: %v", p.Keys, p.Paths, p.Extensions, p.Bases, p.Executables)
+}
+
+func (r RulesCompileResult) ContainsEvent(e event.Type) bool {
+	for _, typ := range r.UsedEvents {
+		if typ == e {
 			return true
 		}
 	}
@@ -237,7 +285,8 @@ func (r RulesCompileResult) String() string {
 		HasAuditAPIEvents: %t
 		HasDNSEvents: %t
 		HasThreadpoolEvents: %t
-		Events: %s`,
+		Events: %s
+		Approvers: %s`,
 		r.HasProcEvents,
 		r.HasThreadEvents,
 		r.HasModuleEvents,
@@ -251,6 +300,7 @@ func (r RulesCompileResult) String() string {
 		r.HasDNSEvents,
 		r.HasThreadpoolEvents,
 		strings.Join(events, ", "),
+		r.Approvers,
 	)
 }
 

pkg/filter/filter.go

@@ -69,6 +69,8 @@ type Filter interface {
 	GetSequence() *ql.Sequence
 	// IsSequence determines if this filter is a sequence.
 	IsSequence() bool
+	// Expr returns the raw AST expression.
+	Expr() ql.Expr
 }
 
 // Field contains field meta attributes all accessors need to extract the value.
@@ -263,6 +265,10 @@ func (f *filter) EvalWithValuer(e *event.Event, cache *ValuerCache) bool {
 	return ql.Eval(f.expr, f.mapValuer(e, cache), f.hasFunctions)
 }
 
+func (f *filter) Expr() ql.Expr {
+	return f.expr
+}
+
 // evalBoundSequence evaluates the sequence with bound fields
 // and returns true if the sequence expression matches or false
 // otherwise.

pkg/filter/ql/expr.go

@@ -49,7 +49,7 @@ func (e *ParenExpr) String() string {
 
 // BinaryExpr represents an operation between two expressions.
 type BinaryExpr struct {
-	Op  token
+	Op  Token
 	LHS Expr
 	RHS Expr
 }

pkg/filter/ql/lexer.go

@@ -43,7 +43,7 @@ func newScanner(r io.Reader) *scanner {
 // scan returns the next token and position from the underlying reader.
 // Also returns the literal text read for strings, numbers, and duration tokens
 // since these token types can have different literal representations.
-func (s *scanner) scan() (tok token, pos int, lit string) {
+func (s *scanner) scan() (tok Token, pos int, lit string) {
 	// Read next code point.
 	ch0, pos := s.r.read()
 
@@ -124,7 +124,7 @@ func (s *scanner) scan() (tok token, pos int, lit string) {
 }
 
 // scanWhitespace consumes the current rune and all contiguous whitespace.
-func (s *scanner) scanWhitespace() (tok token, pos int, lit string) {
+func (s *scanner) scanWhitespace() (tok Token, pos int, lit string) {
 	// Create a buffer and read the current character into it.
 	var buf bytes.Buffer
 	ch, pos := s.r.curr()
@@ -147,7 +147,7 @@ func (s *scanner) scanWhitespace() (tok token, pos int, lit string) {
 	return WS, pos, buf.String()
 }
 
-func (s *scanner) scanIdent() (tok token, pos int, lit string) {
+func (s *scanner) scanIdent() (tok Token, pos int, lit string) {
 	// Save the starting position of the identifier.
 	_, pos = s.r.read()
 	s.r.unread()
@@ -180,7 +180,7 @@ func (s *scanner) scanIdent() (tok token, pos int, lit string) {
 }
 
 // scanNumber consumes anything that looks like the start of a number.
-func (s *scanner) scanNumber() (tok token, pos int, lit string) {
+func (s *scanner) scanNumber() (tok Token, pos int, lit string) {
 	var buf bytes.Buffer
 
 	// Check if the initial rune is a ".".
@@ -322,7 +322,7 @@ func scanBareIdent(r io.RuneScanner) string {
 
 // scanString consumes a contiguous string of non-quote characters.
 // Quote characters can be consumed if they're first escaped with a backslash.
-func (s *scanner) scanString() (tok token, pos int, lit string) {
+func (s *scanner) scanString() (tok Token, pos int, lit string) {
 	s.r.unread()
 	_, pos = s.r.curr()
 
@@ -384,7 +384,7 @@ type bufScanner struct {
 	i   int // buffer index
 	n   int // buffer size
 	buf [3]struct {
-		tok token
+		tok Token
 		pos int
 		lit string
 	}
@@ -396,12 +396,12 @@ func newBufScanner(r io.Reader) *bufScanner {
 }
 
 // scan reads the next token from the scanner.
-func (s *bufScanner) scan() (tok token, pos int, lit string) {
+func (s *bufScanner) scan() (tok Token, pos int, lit string) {
 	return s.scanFunc(s.s.scan)
 }
 
 // scanFunc uses the provided function to scan the next token.
-func (s *bufScanner) scanFunc(scan func() (token, int, string)) (tok token, pos int, lit string) {
+func (s *bufScanner) scanFunc(scan func() (Token, int, string)) (tok Token, pos int, lit string) {
 	// If we have unread tokens then read them off the buffer first.
 	if s.n > 0 {
 		s.n--
@@ -420,7 +420,7 @@ func (s *bufScanner) scanFunc(scan func() (token, int, string)) (tok token, pos
 func (s *bufScanner) unscan() { s.n++ }
 
 // curr returns the last read token.
-func (s *bufScanner) curr() (tok token, pos int, lit string) {
+func (s *bufScanner) curr() (tok Token, pos int, lit string) {
 	buf := &s.buf[(s.i-s.n+len(s.buf))%len(s.buf)]
 	return buf.tok, buf.pos, buf.lit
 }

pkg/filter/ql/lexer_test.go

@@ -26,7 +26,7 @@ import (
 func TestScanner(t *testing.T) {
 	var tests = []struct {
 		s   string
-		tok token
+		tok Token
 		lit string
 		pos int
 	}{

pkg/filter/ql/parser.go

@@ -650,10 +650,10 @@ func parseDuration(s string) (time.Duration, error) {
 }
 
 // scan returns the next token from the underlying scanner.
-func (p *Parser) scan() (tok token, pos int, lit string) { return p.s.scan() }
+func (p *Parser) scan() (tok Token, pos int, lit string) { return p.s.scan() }
 
 // scanIgnoreWhitespace scans the next non-whitespace.
-func (p *Parser) scanIgnoreWhitespace() (tok token, pos int, lit string) {
+func (p *Parser) scanIgnoreWhitespace() (tok Token, pos int, lit string) {
 	for {
 		tok, pos, lit = p.scan()
 		if tok == WS {

pkg/filter/ql/token.go

@@ -23,10 +23,10 @@ import (
 )
 
 // token represents the lexical token of the filter expression
-type token int
+type Token int
 
 const (
-	Illegal token = iota
+	Illegal Token = iota
 	WS
 	EOF
 
@@ -86,11 +86,11 @@ const (
 	As      // AS
 )
 
-var keywords map[string]token
+var keywords map[string]Token
 
 func init() {
-	keywords = make(map[string]token)
-	for _, tok := range []token{And, Or, Contains, IContains, In,
+	keywords = make(map[string]Token)
+	for _, tok := range []Token{And, Or, Contains, IContains, In,
 		IIn, Not, Startswith, IStartswith, Endswith, IEndswith,
 		Matches, IMatches, Fuzzy, IFuzzy, Fuzzynorm, IFuzzynorm,
 		Intersects, IIntersects, Seq, MaxSpan, By, As} {
@@ -161,18 +161,18 @@ var tokens = [...]string{
 }
 
 // isOperator determines whether the current token is an operator.
-func (tok token) isOperator() bool { return tok > opBeg && tok < opEnd }
+func (tok Token) isOperator() bool { return tok > opBeg && tok < opEnd }
 
 // String returns the string representation of the token.
-func (tok token) String() string {
-	if tok >= 0 && tok < token(len(tokens)) {
+func (tok Token) String() string {
+	if tok >= 0 && tok < Token(len(tokens)) {
 		return tokens[tok]
 	}
 	return ""
 }
 
 // precedence returns the operator precedence of the binary operator token.
-func (tok token) precedence() int {
+func (tok Token) precedence() int {
 	switch tok {
 	case Or:
 		return 1
@@ -189,15 +189,15 @@ func (tok token) precedence() int {
 	return 0
 }
 
-func tokstr(tok token, lit string) string {
+func tokstr(tok Token, lit string) string {
 	if lit != "" {
 		return lit
 	}
 	return tok.String()
 }
 
 // lookup returns the token associated with a given string.
-func lookup(id string) (token, string) {
+func lookup(id string) (Token, string) {
 	if tok, ok := keywords[strings.ToLower(id)]; ok {
 		return tok, ""
 	}