Elixir library for interacting with the Guardsix API.

Build a client, then pass it to any domain module.

Setup

client = Guardsix.client("https://guardsix.company.com", "admin", "secret")

Search

query = Guardsix.search_params("user=*", "Last 24 hours", 100, ["127.0.0.1"])

# Block until final results (polls automatically)
{:ok, result} = Guardsix.run_search(client, query)

# Low-level primitives are still available
alias Guardsix.Core.Search

{:ok, %{"search_id" => id}} = Search.get_id(client, query)
{:ok, result}               = Search.get_result(client, id)
{:ok, prefs}                = Search.user_preference(client)
{:ok, repos}                = Search.repos(client)

Incidents

alias Guardsix.Core.Incident

{:ok, incidents} = Incident.list(client, start_time, end_time)
{:ok, states}    = Incident.list_states(client, start_time, end_time)
{:ok, _}         = Incident.resolve(client, ["id1"])
{:ok, _}         = Incident.close(client, ["id2"])
{:ok, _}         = Incident.reopen(client, ["id3"])
{:ok, _}         = Incident.assign(client, ["id1"], "user_id")
{:ok, _}         = Incident.add_comments(client, [Guardsix.comment("id1", "note")])
{:ok, users}     = Incident.get_users(client)

Alert Rules

alias Guardsix.Data.Rule
alias Guardsix.Core.AlertRule

{:ok, rules} = AlertRule.list(client)
{:ok, rule}  = AlertRule.get(client, "rule-id")
{:ok, _}     = AlertRule.activate(client, ["id1", "id2"])
{:ok, _}     = AlertRule.deactivate(client, ["id1"])
{:ok, _}     = AlertRule.delete(client, ["id1"])

# Builder-style alert rule creation
rule =
  Guardsix.rule("Brute Force Detection")
  |> Rule.description("Detects brute force login attempts")
  |> Rule.query("error_code=4625")
  |> Rule.time_range(1, :day)
  |> Rule.repos(["10.0.0.1"])
  |> Rule.limit(100)
  |> Rule.threshold(:greaterthan, 5)
  |> Rule.risk_level("high")
  |> Rule.aggregation_type("max")
  |> Rule.assignee("admin")

{:ok, _} = AlertRule.create(client, rule)

# Email notification
alias Guardsix.Data.EmailNotification

notif =
  Guardsix.email_notification(["rule-1"], "admin@example.com")
  |> EmailNotification.subject("Alert: {{ rule_name }}")
  |> EmailNotification.template("<p>Details</p>")

{:ok, _} = AlertRule.create_email_notification(client, notif)

# HTTP notification
alias Guardsix.Data.HttpNotification

webhook =
  Guardsix.http_notification(["rule-1"], "https://hooks.slack.com/abc", :post)
  |> HttpNotification.body(~s({"text": "{{ rule_name }}"}))
  |> HttpNotification.bearer_auth("my-token")

{:ok, _} = AlertRule.create_http_notification(client, webhook)

Guardsix Repos & User-Defined Lists

alias Guardsix.Core.GuardsixRepo
alias Guardsix.Core.UserDefinedList
alias Guardsix.Core.UserDefinedListBySession

{:ok, repos} = GuardsixRepo.list(client)
{:ok, lists} = UserDefinedList.list(client)

# Session-based operations (unstable)
{:ok, session} = Guardsix.session("https://guardsix.example.com", "admin", "password")
{:ok, data} = UserDefinedListBySession.extract(session, "list-id")
{:ok, _} = UserDefinedListBySession.update_static_by_name(session, "MY_LIST", ["val1"])
{:ok, _} = UserDefinedListBySession.delete_by_name(session, "MY_LIST")

SSL

client = Guardsix.client("https://192.168.1.100", "admin", "secret", ssl_verify: false)