assemblyline_models/datastore/
safelist.rs

1use chrono::{DateTime, Utc};
2use serde::{Deserialize, Serialize};
3use serde_with::{DeserializeFromStr, SerializeDisplay};
4use struct_metadata::Described;
5
6use crate::{ElasticMeta, Readable};
7use crate::types::{ClassificationString, ExpandingClassification, Sha1, Sha256, MD5};
8
9use super::badlist::SourceTypes;
10
11#[derive(SerializeDisplay, DeserializeFromStr, strum::Display, strum::EnumString, Described, Debug, Clone, Copy, PartialEq, Eq)]
12#[metadata_type(ElasticMeta)]
13#[strum(serialize_all = "lowercase")]
14pub enum SafehashTypes {
15    File, 
16    Tag, 
17    Signature
18}
19
20/// Hashes of a safelisted file
21#[derive(Debug, Serialize, Deserialize, Described, Default, PartialEq, Eq)]
22#[serde(default)]
23#[metadata_type(ElasticMeta)]
24#[metadata(index=true, store=true)]
25pub struct Hashes {
26    /// MD5
27    #[metadata(copyto="__text__")]
28    pub md5: Option<MD5>,
29    /// SHA1
30    #[metadata(copyto="__text__")]
31    pub sha1: Option<Sha1>,
32    /// SHA256
33    #[metadata(copyto="__text__")]
34    pub sha256: Option<Sha256>,
35}
36
37/// File Details
38#[derive(Debug, Serialize, Deserialize, Described, Default, PartialEq, Eq)]
39#[serde(default)]
40#[metadata_type(ElasticMeta)]
41#[metadata(index=true, store=false)]
42pub struct File {
43    /// List of names seen for that file
44    #[metadata(store=true, copyto="__text__")]    
45    pub name: Vec<String>,
46    /// Size of the file in bytes
47    #[metadata(mapping="long")]
48    pub size: Option<u64>,
49    /// Type of file as identified by Assemblyline
50    #[serde(rename="type")]
51    pub type_: Option<String>,
52}
53
54/// Safelist source
55#[derive(Debug, Serialize, Deserialize, Described, PartialEq, Eq)]
56#[metadata_type(ElasticMeta)]
57#[metadata(index=true, store=false)]
58pub struct Source {
59    /// Classification of the source
60    pub classification: ClassificationString,
61    /// Name of the source
62    #[metadata(store=true)]
63    pub name: String,
64    /// Reason for why file was safelisted
65    pub reason: Vec<String>,
66    /// Type of safelisting source
67    #[serde(rename="type")]
68    pub type_: SourceTypes
69}
70
71/// Tag associated to file
72#[derive(Debug, Serialize, Deserialize, Described, PartialEq, Eq)]
73#[metadata_type(ElasticMeta)]
74#[metadata(index=true, store=true)]
75pub struct Tag {
76    /// Tag type
77    #[serde(rename="type")]
78    pub type_: String,
79    /// Tag value
80    #[metadata(copyto="__text__")]
81    pub value: String,
82}
83
84/// Signature
85#[derive(Debug, Serialize, Deserialize, Described, PartialEq, Eq)]
86#[metadata_type(ElasticMeta)]
87#[metadata(index=true, store=true)]
88pub struct Signature {
89    /// Name of the signature
90    #[metadata(copyto="__text__")]
91    pub name: String,
92}
93
94/// Safelist Model
95#[derive(Debug, Serialize, Deserialize, Described, PartialEq, Eq)]
96#[metadata_type(ElasticMeta)]
97#[metadata(index=true, store=true)]
98pub struct Safelist {
99    /// Date when the safelisted hash was added
100    pub added: DateTime<Utc>,
101    /// Computed max classification for the safe hash
102    #[serde(flatten)]
103    pub classification: ExpandingClassification,
104    /// Is safe hash enabled or not?
105    #[serde(default="default_enabled")]
106    pub enabled: bool,
107    /// When does this item expire from the list?
108    pub expiry_ts: Option<DateTime<Utc>>,
109    /// List of hashes related to the safe hash
110    #[serde(default)]
111    pub hashes: Hashes,
112    /// Information about the file
113    pub file: Option<File>,
114    /// List of reasons why hash is safelisted
115    pub sources: Vec<Source>,
116    /// Information about the tag
117    pub tag: Option<Tag>,
118    /// Information about the signature
119    pub signature: Option<Signature>,
120    /// Type of safe hash
121    #[serde(rename="type")]
122    pub type_: SafehashTypes,
123    /// Last date when sources were added to the safe hash
124    pub updated: DateTime<Utc>,
125}
126
127fn default_enabled() -> bool { true }
128
129impl Readable for Safelist {
130    fn set_from_archive(&mut self, _from_archive: bool) {}
131}
assemblyline_models/datastore/safelist.rs

assemblyline_models/datastore/
safelist.rs
