Documentation
¶
Index ¶
- Constants
- Variables
- func BuildActivation(msg *santapb.SantaMessage) map[string]any
- func ErrDuplicateID(id string) error
- func ErrDuplicateIDConflict(id string) error
- func ErrInvalidField(field string, index int) error
- func ErrInvalidSeverity(severity string) error
- func ErrRequired(field string) error
- type BaselineRule
- type CompiledBaseline
- type CompiledCorrelation
- type CompiledRule
- type CorrelationRule
- type Engine
- func (e *Engine) Evaluate(msg *santapb.SantaMessage) ([]*Match, error)
- func (e *Engine) GetBaselines() []*CompiledBaseline
- func (e *Engine) GetCorrelations() []*CompiledCorrelation
- func (e *Engine) GetEnv() *cel.Env
- func (e *Engine) IsInLearningPeriod(baseline *BaselineRule) bool
- func (e *Engine) LoadRules(rules *RulesConfig) error
- type Match
- type Rule
- type RulesConfig
Constants ¶
const ( SeverityLow = "low" SeverityMedium = "medium" SeverityHigh = "high" SeverityCritical = "critical" )
Severity levels for rules
Variables ¶
var ValidSeverities = map[string]bool{ SeverityLow: true, SeverityMedium: true, SeverityHigh: true, SeverityCritical: true, }
ValidSeverities returns the set of valid severity levels
Functions ¶
func BuildActivation ¶ added in v0.1.1
func BuildActivation(msg *santapb.SantaMessage) map[string]any
BuildActivation creates a CEL activation map from a Santa message with all required variables
func ErrDuplicateID ¶
func ErrDuplicateIDConflict ¶
func ErrInvalidField ¶
func ErrInvalidSeverity ¶
func ErrRequired ¶
Types ¶
type BaselineRule ¶
type BaselineRule struct {
ID string `yaml:"id"`
Title string `yaml:"title"`
Description string `yaml:"description,omitempty"`
Expr string `yaml:"expr"` // Filter expression
Track []string `yaml:"track"` // Fields to track for uniqueness
Severity string `yaml:"severity"`
Tags []string `yaml:"tags,omitempty"`
Enabled bool `yaml:"enabled"`
LearningPeriod time.Duration `yaml:"learning_period,omitempty"` // Suppress alerts during learning
}
BaselineRule detects first-occurrence or deviation from baseline
func (*BaselineRule) Validate ¶
func (br *BaselineRule) Validate() error
Validate checks a baseline rule
type CompiledBaseline ¶
type CompiledBaseline struct {
Rule *BaselineRule
Program cel.Program
}
CompiledBaseline holds a baseline rule plus its compiled CEL program
type CompiledCorrelation ¶
type CompiledCorrelation struct {
Rule *CorrelationRule
Program cel.Program
}
CompiledCorrelation holds a correlation rule plus its compiled CEL program.
type CompiledRule ¶
CompiledRule is a rule ready for evaluation
type CorrelationRule ¶
type CorrelationRule struct {
ID string `yaml:"id"`
Title string `yaml:"title"`
Description string `yaml:"description,omitempty"`
Expr string `yaml:"expr"` // Filter expression
Window time.Duration `yaml:"window"` // Time window
GroupBy []string `yaml:"group_by"` // Fields to group by
CountDistinct string `yaml:"count_distinct"` // Field to count distinct values
Threshold int `yaml:"threshold"` // Count threshold
Severity string `yaml:"severity"`
Tags []string `yaml:"tags,omitempty"`
Enabled bool `yaml:"enabled"`
}
CorrelationRule represents a time-window correlation rule
func (*CorrelationRule) Validate ¶
func (cr *CorrelationRule) Validate() error
Validate checks a correlation rule
type Engine ¶
type Engine struct {
// contains filtered or unexported fields
}
Engine evaluates detection rules against events
func (*Engine) Evaluate ¶
func (e *Engine) Evaluate(msg *santapb.SantaMessage) ([]*Match, error)
Evaluate runs all rules against an event and returns matches.
func (*Engine) GetBaselines ¶
func (e *Engine) GetBaselines() []*CompiledBaseline
GetBaselines returns the compiled baseline rules
func (*Engine) GetCorrelations ¶
func (e *Engine) GetCorrelations() []*CompiledCorrelation
GetCorrelations returns the compiled correlation rules
func (*Engine) IsInLearningPeriod ¶
func (e *Engine) IsInLearningPeriod(baseline *BaselineRule) bool
IsInLearningPeriod checks if a baseline rule is still in its learning period
func (*Engine) LoadRules ¶
func (e *Engine) LoadRules(rules *RulesConfig) error
LoadRules compiles rules from the rules configuration
type Match ¶
type Match struct {
RuleID string
Title string
Severity string
Tags []string
Message *santapb.SantaMessage
Timestamp time.Time
Rule *Rule
}
Match represents a rule match
type Rule ¶
type Rule struct {
ID string `yaml:"id"`
Title string `yaml:"title"`
Description string `yaml:"description,omitempty"`
Expr string `yaml:"expr"`
Severity string `yaml:"severity"`
Tags []string `yaml:"tags,omitempty"`
Enabled bool `yaml:"enabled"`
ExtraContext []string `yaml:"extra_context,omitempty"` // Optional extra fields to include in signal context
IncludeEvent bool `yaml:"include_event,omitempty"` // If true, include full event map in signal context
IncludeProcessTree bool `yaml:"include_process_tree,omitempty"` // If true, include process lineage in signal context
}
Rule represents a single detection rule
type RulesConfig ¶
type RulesConfig struct {
Rules []*Rule `yaml:"rules"`
Correlations []*CorrelationRule `yaml:"correlations"`
Baselines []*BaselineRule `yaml:"baselines,omitempty"`
}
RulesConfig represents the rules.yaml file structure
func Load ¶
func Load(path string) (*RulesConfig, error)
Load loads rules from either a file or directory, auto-detecting the type
func LoadRulesDir ¶
func LoadRulesDir(dirPath string) (*RulesConfig, error)
LoadRulesDir loads and merges all .yaml/.yml files from a directory recursively
func LoadRulesFile ¶
func LoadRulesFile(path string) (*RulesConfig, error)
LoadRulesFile loads and parses the rules YAML file
func (*RulesConfig) Merge ¶
func (rc *RulesConfig) Merge(other *RulesConfig)
Merge combines another RulesConfig into this one
func (*RulesConfig) Validate ¶
func (rc *RulesConfig) Validate() error
Validate checks the rules configuration for errors
Source Files