Versions in this module Expand all Collapse all v0 v0.0.7 Aug 18, 2026 Changes in this version + func ExportQuick(ctx context.Context, filter QueryFilter, format ExportFormat, writer io.Writer) error + func Init(config Config) error + func IsTorExitNode(ip string) bool + func RecordQuick(event *Event) error + func SetDefault(auditor *Auditor) + type ActionInfo struct + Category string + Description string + Endpoint string + Method string + Path string + Type string + type ActorInfo struct + Email string + ID string + Role string + SessionID string + Type string + Username string + type AnomalyDetector struct + type Auditor struct + func GetDefault() *Auditor + func NewAuditor(config Config) (*Auditor, error) + func (a *Auditor) Close() error + func (a *Auditor) Count(ctx context.Context, filter QueryFilter) (int64, error) + func (a *Auditor) Export(ctx context.Context, filter QueryFilter, format ExportFormat, writer io.Writer) error + func (a *Auditor) GetByID(ctx context.Context, id string) (*Event, error) + func (a *Auditor) GetStats() Stats + func (a *Auditor) Query(ctx context.Context, filter QueryFilter) ([]*Event, error) + func (a *Auditor) Record(event *Event) error + func (a *Auditor) RecordAsync(event *Event) error + type BehaviorProfile struct + ActiveHours []int + ActorID string + AverageRequestsPerMinute float64 + AverageSessionDuration time.Duration + CommonIPs []string + CommonLocations []string + Devices []string + LastUpdated time.Time + RiskBaseline float64 + TypicalActions []string + type ClientInfo struct + Browser string + BrowserVer string + Device string + DeviceType string + IsBot bool + IsMobile bool + IsTablet bool + OS string + OSVer string + type Config struct + AsyncBufferSize int + EnableAsync bool + EnableEncryption bool + EnableIA bool + EncryptionKey string + IAMinRiskThreshold float64 + IncludePayload bool + LogLevel string + MaxPayloadSize int64 + Retention RetentionPolicy + SanitizePII bool + StorageConfig interface{} + StorageType string + type ContextInfo struct + ClientInfo ClientInfo + ForwardedFor string + Headers map[string]string + IPAddress string + IPGeoLocation GeoLocation + PayloadHash string + PayloadSize int64 + Referer string + RequestID string + ServerPort int + SpanID string + TLSVersion string + TraceID string + UserAgent string + type DetectionRule struct + Action func(event *Event) *ThreatDetection + Condition func(event *Event) bool + Description string + Enabled bool + Hits int64 + ID string + LastHit time.Time + Name string + Pattern *regexp.Regexp + Severity string + type Event struct + Action ActionInfo + Actor ActorInfo + Context ContextInfo + DigitalFingerprint string + ID string + Metadata map[string]interface{} + Resource ResourceInfo + Result ResultInfo + RiskScore float64 + Threats []ThreatDetection + Timestamp time.Time + func QueryQuick(ctx context.Context, filter QueryFilter) ([]*Event, error) + type EventQuerier func(ctx context.Context, filter QueryFilter) ([]*Event, error) + type ExportFormat string + const ExportFormatCSV + const ExportFormatJSON + const ExportFormatNDJSON + type GeoLocation struct + AS string + City string + Country string + CountryCode string + ISP string + Latitude float64 + Longitude float64 + Org string + Region string + Timezone string + func LookupGeoIP(ip string) GeoLocation + type IAEngine struct + func NewIAEngine(minRiskThreshold float64, history EventQuerier) *IAEngine + func (e *IAEngine) AddRule(rule DetectionRule) + func (e *IAEngine) Analyze(event *Event) ([]ThreatDetection, float64) + func (e *IAEngine) Disable() + func (e *IAEngine) Enable() + func (e *IAEngine) GetStats() IAStats + func (e *IAEngine) LoadDefaultRules() + func (e *IAEngine) RemoveRule(ruleID string) + type IAStats struct + AverageConfidence float64 + DetectionByType map[string]int64 + FalsePositives int64 + LastEvaluationTime time.Time + ThreatsDetected int64 + TotalEvaluations int64 + TruePositives int64 + type IPReputation struct + AbuseReports int + Blacklisted bool + Categories []string + FirstSeen time.Time + IPAddress string + IsHosting bool + IsMalicious bool + IsProxy bool + IsTor bool + IsVPN bool + LastSeen time.Time + RiskScore float64 + type IPReputationDB struct + func (db *IPReputationDB) Get(ip string) *IPReputation + func (db *IPReputationDB) MarkAsMalicious(ip string, reason string) + func (db *IPReputationDB) Update(rep *IPReputation) + type MemoryStorage struct + func NewMemoryStorage() *MemoryStorage + func (s *MemoryStorage) Close() error + func (s *MemoryStorage) Count(ctx context.Context, filter QueryFilter) (int64, error) + func (s *MemoryStorage) DeleteOlderThan(ctx context.Context, timestamp time.Time) (int64, error) + func (s *MemoryStorage) Export(ctx context.Context, filter QueryFilter, format ExportFormat, writer io.Writer) error + func (s *MemoryStorage) GetByID(ctx context.Context, id string) (*Event, error) + func (s *MemoryStorage) Query(ctx context.Context, filter QueryFilter) ([]*Event, error) + func (s *MemoryStorage) Save(ctx context.Context, event *Event) error + func (s *MemoryStorage) SaveBatch(ctx context.Context, events []*Event) error + type PostgresConfig struct + DSN string + Database string + Host string + MaxIdleConns int + MaxLifetime int + MaxOpenConns int + Password string + Port int + SSLMode string + User string + type PostgresStorage struct + func NewPostgresStorage(config PostgresConfig) (*PostgresStorage, error) + func (s *PostgresStorage) Close() error + func (s *PostgresStorage) Count(ctx context.Context, filter QueryFilter) (int64, error) + func (s *PostgresStorage) DeleteOlderThan(ctx context.Context, timestamp time.Time) (int64, error) + func (s *PostgresStorage) Export(ctx context.Context, filter QueryFilter, format ExportFormat, writer io.Writer) error + func (s *PostgresStorage) GetByID(ctx context.Context, id string) (*Event, error) + func (s *PostgresStorage) Query(ctx context.Context, filter QueryFilter) ([]*Event, error) + func (s *PostgresStorage) Save(ctx context.Context, event *Event) error + func (s *PostgresStorage) SaveBatch(ctx context.Context, events []*Event) error + type QueryFilter struct + ActionCategories []string + ActionTypes []string + ActorIDs []string + ActorTypes []string + EndTime time.Time + EventIDs []string + IPAddresses []string + Limit int + MinRiskScore float64 + Offset int + ResourceIDs []string + ResourceTypes []string + SearchQuery string + SessionIDs []string + SortBy string + SortOrder string + StartTime time.Time + Statuses []string + ThreatTypes []string + type ResourceInfo struct + Collection string + ID string + Name string + Tenant string + Type string + type ResultInfo struct + ChangesCount int + Duration int64 + Error string + Message string + Status string + StatusCode int + type RetentionPolicy struct + ArchiveAfterDays int + CompressAfterDays int + EnableAutoDelete bool + MaxAgeDays int + MaxEvents int64 + type SQLiteConfig struct + DSN string + MaxIdleConns int + MaxLifetime int + MaxOpenConns int + type SQLiteStorage struct + func NewSQLiteStorage(config SQLiteConfig) (*SQLiteStorage, error) + func (s *SQLiteStorage) Close() error + func (s *SQLiteStorage) Count(ctx context.Context, filter QueryFilter) (int64, error) + func (s *SQLiteStorage) DeleteOlderThan(ctx context.Context, timestamp time.Time) (int64, error) + func (s *SQLiteStorage) Export(ctx context.Context, filter QueryFilter, format ExportFormat, writer io.Writer) error + func (s *SQLiteStorage) GetByID(ctx context.Context, id string) (*Event, error) + func (s *SQLiteStorage) Query(ctx context.Context, filter QueryFilter) ([]*Event, error) + func (s *SQLiteStorage) Save(ctx context.Context, event *Event) error + func (s *SQLiteStorage) SaveBatch(ctx context.Context, events []*Event) error + type Stats struct + AverageRiskScore float64 + EventsLastDay int64 + EventsLastHour int64 + LastEventTime time.Time + ThreatsDetected int64 + TotalEvents int64 + Uptime time.Duration + type Storage interface + Close func() error + Count func(ctx context.Context, filter QueryFilter) (int64, error) + DeleteOlderThan func(ctx context.Context, timestamp time.Time) (int64, error) + Export func(ctx context.Context, filter QueryFilter, format ExportFormat, writer io.Writer) error + GetByID func(ctx context.Context, id string) (*Event, error) + Query func(ctx context.Context, filter QueryFilter) ([]*Event, error) + Save func(ctx context.Context, event *Event) error + SaveBatch func(ctx context.Context, events []*Event) error + type ThreatDetection struct + Confidence float64 + Description string + Evidence []string + Pattern string + Recommendation string + RuleID string + Severity string + Type string
Go to main page