Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type WindowManager ¶
type WindowManager struct {
// contains filtered or unexported fields
}
WindowManager manages correlation windows
func NewWindowManager ¶
NewWindowManager creates a new correlation window manager
func (*WindowManager) Process ¶
func (wm *WindowManager) Process(msg *santapb.SantaMessage, correlationRules []*rules.CompiledCorrelation) ([]*WindowMatch, error)
Process evaluates an event against correlation rules.
type WindowMatch ¶
type WindowMatch struct {
RuleID string
Title string
Severity string
Tags []string
Description string
Count int
Events []map[string]any
GroupKey string
Rule *rules.CorrelationRule // Keep reference to rule for signal generation
}
WindowMatch represents a correlation window that exceeded threshold
Source Files
Click to show internal directories.
Click to hide internal directories.