alerts.go

package alphasoc

import (
	"context"
	"encoding/json"
	"fmt"
	"net/http"

	"github.com/alphasoc/alphasoc-go/models"
)

// Alerts allows for fetching alerts generated by network telemetry submitted to
// the AlphaSOC Analytics Engine (via API or other sources). Each alert includes
// the original (although normalized) event along with the associated threats
// and context.
//
// In every response there is a Follow bookmark attached, which
// should be passed to consecutive requests as a parameter, so only new alerts
// are being returned. Once the last page is returned More property in the
// response is set to false.
func (c *Client) Alerts(ctx context.Context, follow string) (*models.Alerts, error) {
	req, err := c.prepareRequest(ctx, "GET", alertsEndpoint, nil)
	if err != nil {
		return nil, err
	}

	if follow != "" {
		query := req.URL.Query()
		query.Add("follow", follow)
		req.URL.RawQuery = query.Encode()
	}

	resp, err := c.client.Do(req)
	if err != nil {
		return nil, err
	}

	defer resp.Body.Close()
	decoder := json.NewDecoder(resp.Body)

	switch resp.StatusCode {
	case http.StatusOK:
		alerts := &models.Alerts{}
		err := decoder.Decode(alerts)
		if err != nil {
			return nil, APIError{fmt.Sprintf("parsing alerts: %v", err), resp.StatusCode}
		}

		return alerts, nil

	case http.StatusBadRequest:
		errMsg := &models.ErrorMessage{}
		err := decoder.Decode(errMsg)
		if err != nil {
			return nil, APIError{fmt.Sprintf("status bad request, json decode error %v", err), resp.StatusCode}
		}

		if errMsg.Message == nil {
			return nil, APIError{"status bad request", resp.StatusCode}
		}

		return nil, APIError{*errMsg.Message, resp.StatusCode}

	case http.StatusUnauthorized:
		errMsg := &models.ErrorMessage{}
		err := decoder.Decode(errMsg)
		if err != nil {
			return nil, APIError{fmt.Sprintf("status unauthorized, json decode error %v", err), resp.StatusCode}
		}

		if errMsg.Message == nil {
			return nil, APIError{"status unauthorized", resp.StatusCode}
		}

		return nil, APIError{*errMsg.Message, resp.StatusCode}

	case http.StatusForbidden:
		errMsg := &models.ErrorMessage{}
		err := decoder.Decode(errMsg)
		if err != nil {
			return nil, APIError{fmt.Sprintf("status forbidden, json decode error %v", err), resp.StatusCode}
		}

		if errMsg.Message == nil {
			return nil, APIError{"status forbidden", resp.StatusCode}
		}

		return nil, APIError{*errMsg.Message, resp.StatusCode}

	case http.StatusTooManyRequests:
		errMsg := &models.ErrorMessage{}
		err := decoder.Decode(errMsg)
		if err != nil {
			return nil, APIError{fmt.Sprintf("status too many requests, json decode error %v", err), resp.StatusCode}
		}

		if errMsg.Message == nil {
			return nil, APIError{"status too many requests", resp.StatusCode}
		}

		return nil, APIError{*errMsg.Message, resp.StatusCode}

	default:
		return nil, APIError{"unexpected response", resp.StatusCode}
	}
}