Documentation
¶
Overview ¶
Package runner is the scenario execution engine: it detonates or injects, polls for the expected alerts, and optionally collects related logs.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type DiscoveredAlert ¶
type DiscoveredAlert struct {
RuleName string `json:"ruleName"`
AlertID string `json:"alertId"`
Severity string `json:"severity,omitempty"`
}
DiscoveredAlert represents an alert found during explore mode.
type Indicators ¶
type Runner ¶
func (*Runner) CleanupScenario ¶
func (*Runner) Run ¶
func (m *Runner) Run() ([]ScenarioResult, error)
type Scenario ¶
type Scenario struct {
Name string
RunID string
EnvVars map[string]string // run-specific env vars (nil = use process env)
Detonator detonators.Detonator
Injector injectors.Injector
Collector collectors.Collector
Timeout time.Duration
Assertions []matchers.AlertGeneratedMatcher
Indicators *Indicators
Metadata *Metadata
StatusCallback func(scenarioName, phase string)
ExploreMode bool // when true, discover all matching alerts instead of asserting specific rules
CleanupAlerts bool // when true in explore mode, close discovered alerts after run
// Populated by runner after assertion matching completes
FailedAssertions []matchers.AlertGeneratedMatcher
// Populated by runner after explore mode completes
DiscoveredAlerts []DiscoveredAlert
// Populated by runner after collection completes
CollectedLogPath string
CollectedDocCount int
}
type ScenarioResult ¶
type ScenarioResult struct {
Name string `json:"name"`
Success bool `json:"success"`
ExecutionId string `json:"executionId"`
Error string `json:"error,omitempty"`
MatchingDurationSeconds float64 `json:"matchingDurationSeconds,omitempty"`
CollectedLogPath string `json:"collectedLogPath,omitempty"`
CollectedDocCount int `json:"collectedDocCount,omitempty"`
}
Click to show internal directories.
Click to hide internal directories.