Documentation
¶
Index ¶
- type DB
- func (db *DB) CleanWindowEvents(ruleID, groupKey string, keepCount int) error
- func (db *DB) Compact() error
- func (db *DB) DequeueSignals(limit int) ([]*Signal, error)
- func (db *DB) EnqueueSignal(sig *Signal) error
- func (db *DB) EnqueueSignalIfNotShipped(sig *Signal) (bool, error)
- func (db *DB) GetJournalEntry(filename string) (*JournalEntry, error)
- func (db *DB) GetMeta(key string) (string, error)
- func (db *DB) GetWindowEvents(ruleID, groupKey string) ([]map[string]any, error)
- func (db *DB) IsFirstSeen(kind, id string) (bool, error)
- func (db *DB) IsShipped(signalID string) (bool, error)
- func (db *DB) MarkShipped(signalID string) error
- func (db *DB) ReplaceWindowEvents(ruleID, groupKey string, events []map[string]any) error
- func (db *DB) SetMeta(key, value string) error
- func (db *DB) Stats() (map[string]any, error)
- func (db *DB) StoreWindowEvent(ruleID, groupKey string, event map[string]any) error
- func (db *DB) UpdateJournal(filename string, offset int64) error
- type FirstSeenEntry
- type JournalEntry
- type Signal
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type DB ¶
DB wraps BoltDB with santamon-specific operations
func (*DB) CleanWindowEvents ¶
CleanWindowEvents removes old events from correlation windows
func (*DB) DequeueSignals ¶
DequeueSignals retrieves and removes up to limit signals from the queue
func (*DB) EnqueueSignal ¶
EnqueueSignal adds a signal to the outbox queue
func (*DB) EnqueueSignalIfNotShipped ¶
EnqueueSignalIfNotShipped atomically checks if a signal was already shipped and enqueues it only if not. Returns true if the signal was enqueued. This prevents the race condition where two goroutines could both enqueue the same signal by doing the check and enqueue in a single transaction.
func (*DB) GetJournalEntry ¶
func (db *DB) GetJournalEntry(filename string) (*JournalEntry, error)
GetJournalEntry retrieves the processing progress for a spool file
func (*DB) GetWindowEvents ¶
GetWindowEvents retrieves events for a correlation window
func (*DB) IsFirstSeen ¶
IsFirstSeen checks if an artifact is being seen for the first time Returns true if first seen, false if already tracked
func (*DB) MarkShipped ¶
MarkShipped records that a signal was successfully shipped
func (*DB) ReplaceWindowEvents ¶
ReplaceWindowEvents overwrites a correlation window with the provided events. If events is empty or nil, the entry is removed.
func (*DB) StoreWindowEvent ¶
StoreWindowEvent stores an event for correlation window processing
type FirstSeenEntry ¶
type FirstSeenEntry struct {
First time.Time `json:"first"`
Count int `json:"count"`
Last time.Time `json:"last"`
}
FirstSeenEntry tracks when an artifact was first observed
type JournalEntry ¶
type JournalEntry struct {
Offset int64 `json:"offset"`
ProcessedTS time.Time `json:"processed_ts"`
}
JournalEntry tracks spool file processing progress
type Signal ¶
type Signal struct {
ID string `json:"signal_id"`
TS time.Time `json:"ts"`
HostID string `json:"host_id"`
RuleID string `json:"rule_id"`
RuleDescription string `json:"rule_description,omitempty"`
Status string `json:"status"`
Severity string `json:"severity"`
Title string `json:"title"`
Tags []string `json:"tags"`
Context map[string]any `json:"context"`
}
Signal represents a detection signal
Source Files