1037966 - [mig console] search support

Status: RESOLVED FIXED

(Enterprise Information Security Graveyard :: MIG, task)

Description

[Julien Vehent]

The console needs support for advanced search queries, through the API.
Some example:

> select agents where command.id='12345' and commands.results.0.foundanything=true

> select action where name='some action name' and starttime>='2014-07-01'

> select command where agent.name='someserver.example.net' and action.threat.family='compliance'

etc...

As a step 2, it would be useful to have multiple search targets. The default target would be the API, but the result a query could be stored in a local buffer, and further queries ran against that buffer.

> select commands where action.id='123456'
==> results stored in BUF1

> select agents from BUF1 where command.status != 'done'

> select agents from BUF1 where command.results.*.foundanything=true

Comment 1

[Julien Vehent]

Instead of re-implementing complex search support in the console, another idea would be to give investigators unbounded sql access, aka "SQL Injection".
The API would require a strong authentication mechanism and session management. Authentication should use GPG to avoid introducing a second key/password. The API would also need support for ACLs, and a read-only database user.

Some investigators would gain search access by tying their identity to a search role in the API ACLs. That would also let us open us the API without giving full access to its data.

In the console, we would pass whole SQL queries as POST bodies, and return the results in json.

Comment 2

[Julien Vehent]

Migrated to github issues: https://github.com/mozilla/mig/issues