Documentation
¶
Overview ¶
Package elastic matches expected Elastic Security detection alerts.
Index ¶
- func BuildExploreQuery(since time.Time) string
- func CloseAlerts(api ElasticSecurityDetectionAlertsAPI, alertIDs []string, logger *logrus.Entry) error
- type ElasticSecurityAlertFilter
- type ElasticSecurityAlertMatcher
- func (m *ElasticSecurityAlertMatcher) AlertName() string
- func (m *ElasticSecurityAlertMatcher) Cleanup(indicators []string, logger *logrus.Entry) error
- func (m *ElasticSecurityAlertMatcher) HasExpectedAlert(indicators []string, logger *logrus.Entry) (bool, error)
- func (m *ElasticSecurityAlertMatcher) MatcherName() string
- func (m *ElasticSecurityAlertMatcher) SetSince(t time.Time)
- func (m *ElasticSecurityAlertMatcher) String() string
- func (m *ElasticSecurityAlertMatcher) WithSeverity(severity string) *ElasticSecurityAlertMatcher
- type ElasticSecurityDetectionAlert
- type ElasticSecurityDetectionAlertsAPI
- type ElasticSecurityDetectionAlertsAPIImpl
- type ElasticSecurityDetectionEngineSearchResponse
- type ExploreResult
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BuildExploreQuery ¶
BuildExploreQuery builds the Elasticsearch query for explore mode (all open alerts, no rule name filter). Only alerts created after `since` are included so previous runs don't add noise.
func CloseAlerts ¶
func CloseAlerts(api ElasticSecurityDetectionAlertsAPI, alertIDs []string, logger *logrus.Entry) error
CloseAlerts closes the specified alerts by ID.
Types ¶
type ElasticSecurityAlertFilter ¶
ElasticAlertFilter holds filtering criteria for elastic alerts
type ElasticSecurityAlertMatcher ¶ added in v0.4.0
type ElasticSecurityAlertMatcher struct {
AlertsAPI ElasticSecurityDetectionAlertsAPI
AlertFilter ElasticSecurityAlertFilter
// contains filtered or unexported fields
}
ElasticSecurityAlertMatcher implements the AlertGeneratedMatcher interface
func ElasticSecurityAlert ¶
func ElasticSecurityAlert(name string, envVars map[string]string) (*ElasticSecurityAlertMatcher, error)
ElasticSecurityAlert creates a new elastic security alert matcher. The API client is lazily initialized when first used (in HasExpectedAlert or Cleanup), allowing lint to validate scenario files without requiring API credentials. envVars provides run-specific env vars; pass nil to read from process env (CLI path).
func (*ElasticSecurityAlertMatcher) AlertName ¶ added in v0.4.0
func (m *ElasticSecurityAlertMatcher) AlertName() string
func (*ElasticSecurityAlertMatcher) Cleanup ¶ added in v0.4.0
func (m *ElasticSecurityAlertMatcher) Cleanup(indicators []string, logger *logrus.Entry) error
func (*ElasticSecurityAlertMatcher) HasExpectedAlert ¶ added in v0.4.0
func (*ElasticSecurityAlertMatcher) MatcherName ¶ added in v0.4.0
func (m *ElasticSecurityAlertMatcher) MatcherName() string
func (*ElasticSecurityAlertMatcher) SetSince ¶ added in v0.4.0
func (m *ElasticSecurityAlertMatcher) SetSince(t time.Time)
SetSince restricts the query to alerts created after the given time.
func (*ElasticSecurityAlertMatcher) String ¶ added in v0.4.0
func (m *ElasticSecurityAlertMatcher) String() string
func (*ElasticSecurityAlertMatcher) WithSeverity ¶ added in v0.4.0
func (m *ElasticSecurityAlertMatcher) WithSeverity(severity string) *ElasticSecurityAlertMatcher
WithSeverity adds severity filtering to the matcher Returns self for method chaining
type ElasticSecurityDetectionAlert ¶
type ElasticSecurityDetectionAlert struct {
ID string `json:"_id"`
Index string `json:"_index"`
Source map[string]interface{} `json:"_source"`
Timestamp time.Time `json:"@timestamp"`
}
ElasticSecurityDetectionAlert represents a security detection alert document in Elastic Security
type ElasticSecurityDetectionAlertsAPI ¶
type ElasticSecurityDetectionAlertsAPI interface {
SearchAlerts(query string) ([]ElasticSecurityDetectionAlert, error)
CloseAlert(id string) error
}
func CreateAPIFromEnvVars ¶
func CreateAPIFromEnvVars(envVars map[string]string) (ElasticSecurityDetectionAlertsAPI, error)
CreateAPIFromEnvVars creates an API client from run-specific environment variables. The returned client should be reused across multiple calls to avoid repeated allocations.
type ElasticSecurityDetectionAlertsAPIImpl ¶
type ElasticSecurityDetectionAlertsAPIImpl struct {
// contains filtered or unexported fields
}
func (*ElasticSecurityDetectionAlertsAPIImpl) CloseAlert ¶
func (m *ElasticSecurityDetectionAlertsAPIImpl) CloseAlert(id string) error
func (*ElasticSecurityDetectionAlertsAPIImpl) SearchAlerts ¶
func (m *ElasticSecurityDetectionAlertsAPIImpl) SearchAlerts(query string) ([]ElasticSecurityDetectionAlert, error)
type ElasticSecurityDetectionEngineSearchResponse ¶
type ElasticSecurityDetectionEngineSearchResponse struct {
Took int `json:"took"`
Hits struct {
Total struct {
Value int `json:"value"`
} `json:"total"`
Hits []ElasticSecurityDetectionAlert `json:"hits"`
} `json:"hits"`
}
ElasticSecurityDetectionEngineSearchResponse represents the response from Kibana Detection Engine search API
type ExploreResult ¶
ExploreResult represents a single alert discovered during explore mode.
func ExploreAlerts ¶
func ExploreAlerts(api ElasticSecurityDetectionAlertsAPI, query string, indicators []string, logger *logrus.Entry) ([]ExploreResult, error)
ExploreAlerts queries all open Elastic Security alerts and returns those that match any of the provided indicators.
Source Files
Directories