go.mondoo.com/cnquery@v0.0.0-20231005093811-59568235f6ea/providers/os/resources/auditpol.go (about)

     1  // Copyright (c) Mondoo, Inc.
     2  // SPDX-License-Identifier: BUSL-1.1
     3  
     4  package resources
     5  
     6  import (
     7  	"fmt"
     8  	"strings"
     9  
    10  	"go.mondoo.com/cnquery/llx"
    11  	"go.mondoo.com/cnquery/providers/os/resources/windows"
    12  )
    13  
    14  func (p *mqlAuditpol) list() ([]interface{}, error) {
    15  	o, err := CreateResource(p.MqlRuntime, "command", map[string]*llx.RawData{
    16  		"command": llx.StringData("auditpol /get /category:* /r"),
    17  	})
    18  	if err != nil {
    19  		return nil, err
    20  	}
    21  
    22  	cmd := o.(*mqlCommand)
    23  	out := cmd.GetStdout()
    24  	if out.Error != nil {
    25  		return nil, fmt.Errorf("could not run auditpol: " + out.Error.Error())
    26  	}
    27  
    28  	entries, err := windows.ParseAuditpol(strings.NewReader(out.Data))
    29  	if err != nil {
    30  		return nil, err
    31  	}
    32  
    33  	auditPolEntries := make([]interface{}, len(entries))
    34  	for i := range entries {
    35  		entry := entries[i]
    36  		o, err := CreateResource(p.MqlRuntime, "auditpol.entry", map[string]*llx.RawData{
    37  			"machinename":      llx.StringData(entry.MachineName),
    38  			"policytarget":     llx.StringData(entry.PolicyTarget),
    39  			"subcategory":      llx.StringData(entry.Subcategory),
    40  			"subcategoryguid":  llx.StringData(entry.SubcategoryGUID),
    41  			"inclusionsetting": llx.StringData(entry.InclusionSetting),
    42  			"exclusionsetting": llx.StringData(entry.ExclusionSetting),
    43  		})
    44  		if err != nil {
    45  			return nil, err
    46  		}
    47  		auditPolEntries[i] = o.(*mqlAuditpolEntry)
    48  	}
    49  
    50  	return auditPolEntries, nil
    51  }
    52  
    53  func (p *mqlAuditpolEntry) id() (string, error) {
    54  	return p.Subcategoryguid.Data, nil
    55  }