Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AgentConfig ¶
type AgentConfig struct {
ID string `yaml:"id"`
StateDir string `yaml:"state_dir"`
LogLevel string `yaml:"log_level"`
}
AgentConfig contains agent-level settings
type Config ¶
type Config struct {
Agent AgentConfig `yaml:"agent"`
Santa SantaConfig `yaml:"santa"`
Rules RulesConfig `yaml:"rules"`
State StateConfig `yaml:"state"`
Shipper ShipperConfig `yaml:"shipper"`
}
Config represents the complete santamon configuration
func LoadForReadOnly ¶
LoadForReadOnly loads config without validating shipper (for status/db commands)
func LoadWithOptions ¶
LoadWithOptions reads configuration with optional validation skips
func (*Config) ValidateWithOptions ¶
ValidateWithOptions checks configuration with optional validation skips
type FirstSeenConfig ¶
type FirstSeenConfig struct {
MaxEntries int `yaml:"max_entries"`
Eviction string `yaml:"eviction"`
}
FirstSeenConfig defines first-seen tracking settings
type HeartbeatConfig ¶
type HeartbeatConfig struct {
Enabled bool `yaml:"enabled"`
Interval time.Duration `yaml:"interval"`
}
HeartbeatConfig defines agent heartbeat settings
type RetryConfig ¶
type RetryConfig struct {
MaxAttempts int `yaml:"max_attempts"`
Backoff string `yaml:"backoff"`
Initial time.Duration `yaml:"initial"`
Max time.Duration `yaml:"max"`
}
RetryConfig defines retry behavior
type RulesConfig ¶
RulesConfig defines detection rules settings
type SantaConfig ¶
type SantaConfig struct {
Mode string `yaml:"mode"`
SpoolDir string `yaml:"spool_dir"`
ArchiveDir string `yaml:"archive_dir"`
StabilityWait time.Duration `yaml:"stability_wait"`
}
SantaConfig defines Santa spool settings
type ShipperConfig ¶
type ShipperConfig struct {
Endpoint string `yaml:"endpoint"`
APIKey string `yaml:"api_key"`
BatchSize int `yaml:"batch_size"`
FlushInterval time.Duration `yaml:"flush_interval"`
Timeout time.Duration `yaml:"timeout"`
Retry RetryConfig `yaml:"retry"`
FlushOnEnqueue *bool `yaml:"flush_on_enqueue"`
TLSSkipVerify bool `yaml:"tls_skip_verify"`
Heartbeat HeartbeatConfig `yaml:"heartbeat"`
}
ShipperConfig defines signal shipping settings
type StateConfig ¶
type StateConfig struct {
DBPath string `yaml:"db_path"`
SyncWrites bool `yaml:"sync_writes"`
CompactInterval time.Duration `yaml:"compact_interval"`
FirstSeen FirstSeenConfig `yaml:"first_seen"`
Windows WindowsConfig `yaml:"windows"`
}
StateConfig defines database settings
type WindowsConfig ¶
type WindowsConfig struct {
GCInterval time.Duration `yaml:"gc_interval"`
MaxEvents int `yaml:"max_events"`
}
WindowsConfig defines correlation window settings