agent

type ActionHandler struct {
	// contains filtered or unexported fields
}

type ActivityTracker struct {
	sync.RWMutex

	// driver loaded
	Drivers []DriverInfo
	// contains filtered or unexported fields
}

type Agent struct {
	sync.RWMutex // Mutex to lock the IDS when updating rules

	Engine   *engine.Engine
	DryRun   bool
	PrintAll bool
	// contains filtered or unexported fields
}

type ConStat struct {
	FirstSeen string          `json:"first-seen"`
	LastSeen  string          `json:"last-seen"`
	Resolved  map[string]uint `json:"resolved"`
	Ports     map[uint16]uint `json:"ports"`
	Count     int             `json:"count"`
}

type DriverInfo struct {

	/* Public */
	Image           string            `json:"image"`
	HashesMap       map[string]string `json:"hashes"`
	Signed          bool              `json:"signed"`
	Signature       string            `json:"signature"`
	SignatureStatus string            `json:"signature-status"`
	// contains filtered or unexported fields
}

type EventStats struct {
	// contains filtered or unexported fields
}

type FileInfo struct {
	Dir     string            `json:"dir"`
	Name    string            `json:"name"`
	Size    int64             `json:"size"`
	ModTime time.Time         `json:"modtime"`
	Type    string            `json:"type"`
	Hashes  map[string]string `json:"hashes,omitempty"`
	Err     error             `json:"error"`
}

type FileStats struct {
	LastAccessed           *datastructs.RingSet `json:"last-accessed"`
	CountFilesCreated      int64                `json:"file-create-count"`
	CountFilesCreatedByExt map[string]int64     `json:"file-create-count-by-ext"`
	TimeFirstFileCreated   time.Time            `json:"first-file-create"`
	TimeLastFileCreated    time.Time            `json:"last-file-create"`
	CountFilesDeleted      int64                `json:"file-delete-count"`
	CountFilesDeletedByExt map[string]int64     `json:"file-delete-count-by-ext"`
	TimeFirstFileDeleted   time.Time            `json:"first-file-delete"`
	TimeLastFileDeleted    time.Time            `json:"last-file-delete"`
}

type Filter struct {
	EventIDs *datastructs.SyncedSet
	Channel  string
}

type Hook func(*Agent, *event.EdrEvent)

type HookManager struct {
	sync.RWMutex
	Filters []*Filter
	Hooks   []Hook
	// contains filtered or unexported fields
}

type KernelFile struct {
	FileName   string
	FileObject uint64
	EventCount map[int64]uint64
}

type ModuleInfo struct {
	Image            string            `json:"image"`
	FileVersion      string            `json:"file-version"`
	Description      string            `json:"description"`
	Product          string            `json:"product"`
	Company          string            `json:"company"`
	OriginalFileName string            `json:"orginal-filename"`
	Hashes           map[string]string `json:"hashes"`
	Signature        string            `json:"signature"`
	SignatureStatus  string            `json:"signature-status"`
	Signed           bool              `json:"signed"`
	// Statistics
	LoadCount int64     `json:"load-count"`
	FirstLoad time.Time `json:"first-load"`
	LastLoad  time.Time `json:"last-load"`
	// contains filtered or unexported fields
}

type ProcStats struct {
	CreateProcessCount int64               `json:"create-process-count"`
	Connections        map[string]*ConStat `json:"connections"`
	Files              FileStats           `json:"files"`
}

type ProcessTrack struct {

	/* Public */
	Image                  string            `json:"image"`
	ParentImage            string            `json:"parent-image"`
	PID                    int64             `json:"pid"`
	CommandLine            string            `json:"command-line"`
	ParentCommandLine      string            `json:"parent-command-line"`
	CurrentDirectory       string            `json:"cwd"`
	ParentCurrentDirectory string            `json:"parent-cwd"`
	ProcessGUID            string            `json:"process-guid"`
	User                   string            `json:"user"`
	ParentUser             string            `json:"parent-user"`
	IntegrityLevel         string            `json:"integrity-lvl"`
	ParentIntegrityLevel   string            `json:"parent-integrity-lvl"`
	ParentProcessGUID      string            `json:"parent-process-guid"`
	Services               string            `json:"services"`
	ParentServices         string            `json:"parent-services"`
	ProtectionLevel        uint32            `json:"protection-lvl"`
	ParentProtectionLevel  uint32            `json:"parent-protection-lvl"`
	HashesMap              map[string]string `json:"hashes"`
	Signature              string            `json:"signature"`
	SignatureStatus        string            `json:"signature-status"`
	Signed                 bool              `json:"signed"`
	Ancestors              []string          `json:"ancestors"`
	Modules                []*ModuleInfo     `json:"modules"`
	Integrity              float64           `json:"integrity"`
	IntegrityTimeout       bool              `json:"integrity-timeout"`
	MemDumped              bool              `json:"memory-dumped"`
	DumpCount              int               `json:"dump-count"`
	ChildCount             int               `json:"child-count"` // number of currently running child proceses
	Stats                  ProcStats         `json:"statistics"`
	ThreatScore            ThreatScore       `json:"threat-score"`
	Terminated             bool              `json:"terminated"`
	TimeTerminated         time.Time         `json:"time-terminated"`
	// contains filtered or unexported fields
}

type Report struct {
	Processes map[string]ProcessTrack `json:"processes"`
	Modules   []ModuleInfo            `json:"modules"`
	Drivers   []DriverInfo            `json:"drivers"`
	Commands  []config.ReportCommand  `json:"commands"`
	StartTime time.Time               `json:"start-timestamp"` // time at which report generation started
	StopTime  time.Time               `json:"stop-timestamp"`  // time at which report generation stopped
}

type ThreatScore struct {
	Signatures map[string]uint `json:"signatures"`
	Score      int64           `json:"score"`
}

type WalkItem struct {
	Dirs  []FileInfo `json:"dirs"`
	Files []FileInfo `json:"files"`
	Err   string     `json:"err"`
}