Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Key ¶
Key uniquely identifies a process within a boot session.
func FromProcessID ¶
FromProcessID builds a Key from a Santa ProcessID and boot UUID.
type Node ¶
type Node struct {
Key Key
Parent Key
Responsible Key
Path string
User string
UID int32
Group string
GID int32
SessionID int32
Args []string
StartTime time.Time
CreatedAt time.Time
}
Node captures execution-time information about a process.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store keeps a bounded, per-boot cache of process nodes for lineage building.
func (*Store) Lineage ¶
Lineage builds an ancestor chain starting from key, following Parent links. The returned slice is ordered from root (oldest ancestor) to leaf (key).
func (*Store) UpsertFromExecution ¶
func (s *Store) UpsertFromExecution(msg *santapb.SantaMessage, ev *santapb.Execution)
UpsertFromExecution records or updates a node based on an Execution event. It should be called once per execution event.
Click to show internal directories.
Click to hide internal directories.