lineage

package
v0.1.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Dec 3, 2025 License: Apache-2.0 Imports: 3 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Serialize

func Serialize(nodes []*Node) []map[string]any

Serialize converts a lineage chain into a JSON-friendly structure.

Types

type Config

type Config struct {
	MaxEntries int
	TTL        time.Duration
}

Config controls Store behavior.

type Key

type Key struct {
	BootUUID   string
	Pid        int32
	PidVersion int32
}

Key uniquely identifies a process within a boot session.

func FromProcessID

func FromProcessID(bootUUID string, pid *santapb.ProcessID) Key

FromProcessID builds a Key from a Santa ProcessID and boot UUID.

func (Key) IsZero

func (k Key) IsZero() bool

IsZero reports whether the key has no meaningful value.

type Node

type Node struct {
	Key         Key
	Parent      Key
	Responsible Key

	Path      string
	User      string
	UID       int32
	Group     string
	GID       int32
	SessionID int32

	Args      []string
	StartTime time.Time
	CreatedAt time.Time
}

Node captures execution-time information about a process.

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store keeps a bounded, per-boot cache of process nodes for lineage building.

func NewStore

func NewStore(cfg Config) *Store

NewStore creates a new lineage store with sane defaults.

func (*Store) Lineage

func (s *Store) Lineage(key Key, maxDepth int) []*Node

Lineage builds an ancestor chain starting from key, following Parent links. The returned slice is ordered from root (oldest ancestor) to leaf (key).

func (*Store) UpsertFromExecution

func (s *Store) UpsertFromExecution(msg *santapb.SantaMessage, ev *santapb.Execution)

UpsertFromExecution records or updates a node based on an Execution event. It should be called once per execution event.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL