diff --git a/internal/agent/monitor/monitor.go b/internal/agent/monitor/monitor.go index 1aafe6d..161ae29 100644 --- a/internal/agent/monitor/monitor.go +++ b/internal/agent/monitor/monitor.go @@ -155,12 +155,13 @@ func (s *Scout) Add(file string) error { Model: gorm.Model{ CreatedAt: fi.ModTime(), }, - Name: filepath.Base(file), - Path: file, - FileType: filepath.Ext(file)[1:], // Skip the leading '.' - FileSize: uint(fi.Size()), - Source: s.Agent.ID, - Hash: fileHash(file), + Name: filepath.Base(file), + Path: file, + FileType: filepath.Ext(file)[1:], // Skip the leading '.' + FileSize: uint(fi.Size()), + Source: s.Agent.ID, + Hash: fileHash(file), + UploadTime: fi.ModTime(), } return conn.Add(sample) } diff --git a/internal/commands/samples/samples.go b/internal/commands/samples/samples.go index 52402bd..f1bd094 100644 --- a/internal/commands/samples/samples.go +++ b/internal/commands/samples/samples.go @@ -7,6 +7,7 @@ import ( "github.com/pygrum/siphon/internal/logger" "strconv" "strings" + "time" ) const ( @@ -71,7 +72,7 @@ func RenderTable(samples []db.Sample, v bool) { s.Hash, s.FileSize, s.Source, - s.UploadTime.String(), + s.UploadTime.Format(time.DateTime), } t.AppendRow(row) } diff --git a/internal/integrations/agent/agent.go b/internal/integrations/agent/agent.go index e11c3d1..2189034 100644 --- a/internal/integrations/agent/agent.go +++ b/internal/integrations/agent/agent.go @@ -92,6 +92,10 @@ func (f *Fetcher) BasicRequest(a *db.Agent, endpoint, query, form string) (*http func (f *Fetcher) mTLSClient(agent *db.Agent) (*http.Client, error) { serverCertFile := agent.CertPath + // Refresh viper configuration + if err := viper.ReadInConfig(); err != nil { + return nil, err + } certFile, keyFile := viper.GetString("cert_file"), viper.GetString("key_file") // Read server certificate file and add it to trusted certificate store (certPool). Right now I'm reading my cert instead of the servers caCert, err := os.ReadFile(serverCertFile) @@ -149,7 +153,8 @@ func (f *Fetcher) Download(agent *db.Agent, sha256Hash string) (io.ReadCloser, e if err != nil { return nil, err } - if resp.Header.Get("Content-Type") == "application/json" { + // if not application/zip, then its json, meaning request failed + if !strings.EqualFold(resp.Header.Get("content-type"), "application/zip") { body, err := io.ReadAll(resp.Body) if err != nil { return nil, err diff --git a/internal/integrations/integrations.go b/internal/integrations/integrations.go index 26fb857..8ed8986 100644 --- a/internal/integrations/integrations.go +++ b/internal/integrations/integrations.go @@ -14,12 +14,12 @@ func Refresh() { logger.Silentf("invalid configuration: refresh rate must be 1 minute or more") } ticker := time.NewTicker(time.Duration(r) * time.Minute) - mbFetcher := malwarebazaar.NewFetcher() - agFetcher := agent.NewFetcher() for range ticker.C { + mbFetcher := malwarebazaar.NewFetcher() if mbFetcher != nil { go mbFetcher.GetRecent() } + agFetcher := agent.NewFetcher() go agFetcher.GetRecent() } }