elastic

package
v0.6.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 14, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Documentation

Overview

Package elastic is a minimal client for the Elastic Security detection-engine API, used to validate Elastic connectors.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client provides Elastic Security API operations.

func NewClient

func NewClient(config ClientConfig) *Client

NewClient creates a new Elastic integration client.

func (*Client) GetRule

func (c *Client) GetRule(ctx context.Context, ruleID string) (*RuleSummary, error)

GetRule retrieves a single detection rule by ID.

func (*Client) ListRules

func (c *Client) ListRules(ctx context.Context, page, perPage int, enabledOnly bool) (*ListRulesResponse, error)

ListRules retrieves detection rules from Elastic Security. If enabledOnly is true, only enabled rules are returned.

func (*Client) TestConnection

func (c *Client) TestConnection(ctx context.Context) error

TestConnection verifies the API key and Kibana URL are valid.

type ClientConfig

type ClientConfig struct {
	KibanaURL string
	APIKey    string
}

ClientConfig holds Elastic connection configuration.

type ListRulesResponse

type ListRulesResponse struct {
	Page    int           `json:"page"`
	PerPage int           `json:"perPage"`
	Total   int           `json:"total"`
	Data    []RuleSummary `json:"data"`
}

ListRulesResponse is the response from the Kibana Detection Engine _find API.

type RuleSummary

type RuleSummary struct {
	ID          string   `json:"id"`
	RuleID      string   `json:"rule_id"`
	Name        string   `json:"name"`
	Description string   `json:"description"`
	Enabled     bool     `json:"enabled"`
	Tags        []string `json:"tags"`
	Severity    string   `json:"severity"`
	RiskScore   int      `json:"risk_score"`
	Type        string   `json:"type"`
	CreatedAt   string   `json:"created_at"`
	UpdatedAt   string   `json:"updated_at"`
}

RuleSummary represents a detection rule from Elastic Security.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL