Documentation
¶
Index ¶
- Variables
- func ActorIsPlatformBinary(msg *santapb.SantaMessage) bool
- func ActorPath(msg *santapb.SantaMessage) string
- func ActorSigningID(msg *santapb.SantaMessage) string
- func ActorTeam(msg *santapb.SantaMessage) string
- func BuildActivation(msg *santapb.SantaMessage, eventMap map[string]any)
- func Decision(msg *santapb.SantaMessage) string
- func DecodedArgs(msg *santapb.SantaMessage) []string
- func EventTime(msg *santapb.SantaMessage) time.Time
- func ExtractField(event map[string]any, field string) string
- func Kind(msg *santapb.SantaMessage) string
- func KindFromMap(evt map[string]any) string
- func Mode(msg *santapb.SantaMessage) string
- func Reason(msg *santapb.SantaMessage) string
- func TargetPath(msg *santapb.SantaMessage) string
- func TargetSHA256(msg *santapb.SantaMessage) string
- func TargetSigningID(msg *santapb.SantaMessage) string
- func TargetTeam(msg *santapb.SantaMessage) string
- func ToMap(msg *santapb.SantaMessage) (map[string]any, error)
Constants ¶
This section is empty.
Variables ¶
var EventTypes = []string{
"execution",
"fork",
"exit",
"close",
"rename",
"unlink",
"link",
"exchangedata",
"disk",
"bundle",
"allowlist",
"file_access",
"codesigning_invalidated",
"login_window_session",
"login_logout",
"screen_sharing",
"open_ssh",
"authentication",
"clone",
"copyfile",
"gatekeeper_override",
"launch_item",
"tcc_modification",
"xprotect",
}
EventTypes lists all Santa event types NOTE: This must be kept in sync with the protobuf message types
Functions ¶
func ActorIsPlatformBinary ¶
func ActorIsPlatformBinary(msg *santapb.SantaMessage) bool
ActorIsPlatformBinary indicates whether the instigator is a platform binary.
func ActorPath ¶
func ActorPath(msg *santapb.SantaMessage) string
ActorPath extracts the instigator path.
func ActorSigningID ¶
func ActorSigningID(msg *santapb.SantaMessage) string
ActorSigningID extracts the instigator signing identifier. NOTE: Only works for FileAccess events - Execution instigators use ProcessInfoLight which lacks code signature.
func ActorTeam ¶
func ActorTeam(msg *santapb.SantaMessage) string
ActorTeam extracts the instigator team identifier when available. NOTE: Only works for FileAccess events - Execution instigators use ProcessInfoLight which lacks code signature.
func BuildActivation ¶
func BuildActivation(msg *santapb.SantaMessage, eventMap map[string]any)
BuildActivation enriches the eventMap in-place with metadata fields needed for CEL evaluation. This modifies the input map to avoid unnecessary allocations. The eventMap must already contain the protobuf data from ToMap().
func Decision ¶
func Decision(msg *santapb.SantaMessage) string
Decision returns a string representation of the allow/deny outcome for the event.
func DecodedArgs ¶ added in v0.1.1
func DecodedArgs(msg *santapb.SantaMessage) []string
DecodedArgs returns decoded args for execution events, empty list otherwise. Args from Santa are already decoded as [][]byte, so we just convert to []string.
func EventTime ¶
func EventTime(msg *santapb.SantaMessage) time.Time
EventTime returns the event timestamp, or zero if missing.
func ExtractField ¶
ExtractField walks a dotted path within the event map and returns the value as string.
func Kind ¶
func Kind(msg *santapb.SantaMessage) string
Kind returns the lower-case event type name for a Santa message.
func KindFromMap ¶
KindFromMap returns the lower-case event type name for an event map produced by ToMap. It checks for known top-level keys.
func Mode ¶
func Mode(msg *santapb.SantaMessage) string
Mode returns the Santa mode (monitor/lockdown) when available.
func Reason ¶
func Reason(msg *santapb.SantaMessage) string
Reason returns the Santa reason for execution events.
func TargetPath ¶
func TargetPath(msg *santapb.SantaMessage) string
TargetPath extracts a human-readable target path.
func TargetSHA256 ¶
func TargetSHA256(msg *santapb.SantaMessage) string
TargetSHA256 returns the hash identifier for the event target when available.
func TargetSigningID ¶
func TargetSigningID(msg *santapb.SantaMessage) string
TargetSigningID extracts the target signing identifier.
func TargetTeam ¶
func TargetTeam(msg *santapb.SantaMessage) string
TargetTeam extracts the target team identifier.
Types ¶
This section is empty.
Source Files