Documentation
¶
Overview ¶
Package responseobserver provides endpoint-side observation infrastructure.
Index ¶
- type BindingResolver
- func (r *BindingResolver) BindTelemetryAsset(ctx context.Context, binding ports.TelemetryAssetBinding) error
- func (r *BindingResolver) ResolveResponseObservationAsset(ctx context.Context, agentID shared.ID) (shared.ID, error)
- func (r *BindingResolver) ResolveTelemetryAsset(ctx context.Context, agentID shared.ID) (shared.ID, error)
- func (r *BindingResolver) ResolveTelemetryReferences(ctx context.Context, agentID, assetID shared.ID, redactionPolicyDigest string, ...) (ports.TelemetryReferenceStatus, error)
- type ProcessTracker
- func (t *ProcessTracker) ObservationFor(request fleetagent.ResponseObservationRequest) (fleetagent.ResponseObservation, bool)
- func (t *ProcessTracker) ObserveProcess(assetID, bootID shared.ID, event detection.ProcessEvent)
- func (t *ProcessTracker) ObserveProcessAt(assetID, bootID shared.ID, observedAt time.Time, event detection.ProcessEvent)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BindingResolver ¶
type BindingResolver struct {
// contains filtered or unexported fields
}
BindingResolver resolves an agent's immutable primary host ownership and independently authorizes a response observer's secondary target. The secondary binding never changes general telemetry ownership; response-observation telemetry must additionally name a live observation work order and is authorized through ObservationTelemetryAuthorizer.
func NewBindingResolver ¶
func NewBindingResolver(primary bindingReferenceStore, observers ports.ResponseObserverBindingStore, clock ports.Clock) (*BindingResolver, error)
func (*BindingResolver) BindTelemetryAsset ¶
func (r *BindingResolver) BindTelemetryAsset(ctx context.Context, binding ports.TelemetryAssetBinding) error
func (*BindingResolver) ResolveResponseObservationAsset ¶
func (r *BindingResolver) ResolveResponseObservationAsset(ctx context.Context, agentID shared.ID) (shared.ID, error)
ResolveResponseObservationAsset authorizes an independently enrolled observer to report on a target asset. It first requires the observer's own primary binding, then checks the operator-owned target assignment against the tenant and its live lifetime.
func (*BindingResolver) ResolveTelemetryAsset ¶
func (*BindingResolver) ResolveTelemetryReferences ¶
func (r *BindingResolver) ResolveTelemetryReferences(ctx context.Context, agentID, assetID shared.ID, redactionPolicyDigest string, refs []fleetagent.TelemetryReference) (ports.TelemetryReferenceStatus, error)
type ProcessTracker ¶
type ProcessTracker struct {
// contains filtered or unexported fields
}
ProcessTracker retains bounded, actually observed lifecycle facts from the local sensor. It never treats a command result as a process observation.
func NewProcessTracker ¶
func NewProcessTracker() *ProcessTracker
func (*ProcessTracker) ObservationFor ¶
func (t *ProcessTracker) ObservationFor(request fleetagent.ResponseObservationRequest) (fleetagent.ResponseObservation, bool)
ObservationFor returns only target-asset evidence observed by an authenticated target-asset sensor. It never rebinds local or primary-host observations to a different asset: sourceAssetID is the authoritative asset boundary. Missing facts or competing replacements fail closed by returning no observation.
func (*ProcessTracker) ObserveProcess ¶
func (t *ProcessTracker) ObserveProcess(assetID, bootID shared.ID, event detection.ProcessEvent)
ObserveProcess is retained for lifecycle-observer compatibility. Callers that have a sensor timestamp must use ObserveProcessAt.
func (*ProcessTracker) ObserveProcessAt ¶
func (t *ProcessTracker) ObserveProcessAt(assetID, bootID shared.ID, observedAt time.Time, event detection.ProcessEvent)
ObserveProcessAt records one actual process lifecycle event after its matching canonical telemetry event reached the local WAL.
Source Files