Documentation
¶
Index ¶
- Constants
- func GetAlertDegraded() bool
- func GetEnabled() bool
- func GetMaxInflight() int64
- func GetOnSaturation() string
- func GetOnTimeout() string
- func GetTimeoutSecs() int64
- func Inflight() int64
- func SetAlertDegraded(v bool)
- func SetEnabled(v bool)
- func SetMaxInflight(n int64)
- func SetOnSaturation(v string)
- func SetOnTimeout(v string)
- func SetTimeoutSecs(n int64)
- func ValidateSource(src string) (names []string, warnings []string, err error)
- type RuleSet
- func (y *RuleSet) Count() int
- func (y *RuleSet) DeleteRule(name string) error
- func (y *RuleSet) Dir() string
- func (y *RuleSet) Enabled() bool
- func (y *RuleSet) FileRules() map[string][]string
- func (y *RuleSet) Files() []string
- func (y *RuleSet) LoadDir(dir string) error
- func (y *RuleSet) LoadSource(src string) ([]string, error)
- func (y *RuleSet) Match(data []byte) []string
- func (y *RuleSet) Names() []string
- func (y *RuleSet) ReadRule(name string) (string, error)
- func (y *RuleSet) SetDir(dir string)
- func (y *RuleSet) Warnings() []string
- func (y *RuleSet) WriteRule(name, src string) ([]string, error)
Constants ¶
const ( FailClosed = "fail_closed" FailOpenWithAlert = "fail_open_with_alert" )
FailClosed / FailOpenWithAlert are the two posture strings for the on_timeout and on_saturation policies.
Variables ¶
This section is empty.
Functions ¶
func GetAlertDegraded ¶
func GetAlertDegraded() bool
GetAlertDegraded reports whether degraded-mode alerts are enabled.
func GetMaxInflight ¶
func GetMaxInflight() int64
GetMaxInflight returns the in-flight regex-goroutine cap.
func GetOnSaturation ¶
func GetOnSaturation() string
GetOnSaturation returns the on-saturation posture (FailClosed | FailOpenWithAlert).
func GetOnTimeout ¶
func GetOnTimeout() string
GetOnTimeout returns the on-timeout posture (FailClosed | FailOpenWithAlert).
func GetTimeoutSecs ¶
func GetTimeoutSecs() int64
GetTimeoutSecs returns the per-regex match timeout in seconds.
func Inflight ¶
func Inflight() int64
Inflight returns the current count of in-flight regex-match goroutines (observability; surfaced in the security-scan stats map).
func SetAlertDegraded ¶
func SetAlertDegraded(v bool)
SetAlertDegraded toggles degraded-mode alerting.
func SetMaxInflight ¶
func SetMaxInflight(n int64)
SetMaxInflight sets the in-flight regex-goroutine cap.
func SetOnSaturation ¶
func SetOnSaturation(v string)
SetOnSaturation sets the on-saturation posture (FailClosed | FailOpenWithAlert).
func SetOnTimeout ¶
func SetOnTimeout(v string)
SetOnTimeout sets the on-timeout posture (FailClosed | FailOpenWithAlert).
func SetTimeoutSecs ¶
func SetTimeoutSecs(n int64)
SetTimeoutSecs sets the per-regex match timeout in seconds.
func ValidateSource ¶
ValidateSource parses a YARA rule source string without loading it into the global rule set. Used by the admin UI's "validate" feature so operators can check a rule before persisting it. Tier 3.1.
Returns the list of rule names successfully parsed and any parser warnings. Returns an error only when the source contains no valid rules at all; a non-empty warnings slice with a non-empty names slice indicates a source that loaded some rules but skipped others.
Types ¶
type RuleSet ¶
type RuleSet struct {
// contains filtered or unexported fields
}
RuleSet holds compiled YARA rules loaded from a directory. All methods are safe for concurrent use.
func (*RuleSet) DeleteRule ¶
DeleteRule removes the named rule file from disk and reloads. Tier 3.2.
func (*RuleSet) FileRules ¶
FileRules returns a map from file stem to the list of rule names defined in that file. Tier 3.2: lets the GUI show "sample_rules.yar → [EICAR_Test_File, WebShell_…]" without a second round trip. File stems with no parsable rules (parse failures, empty files) map to an empty slice.
func (*RuleSet) Files ¶
Files returns the basenames (without extension) of every *.yar / *.yara file in the configured rules directory. Tier 3.2: the GUI rule editor lists *files*, not the rule names inside them — otherwise ReadRule fails whenever a single file bundles multiple rules (the common case for starter kits). The returned list is sorted and de-duplicated across the two extensions.
func (*RuleSet) LoadDir ¶
LoadDir loads all *.yar and *.yara files from dir, replacing current rules atomically. Errors in individual rule files are logged and captured in y.warnings so admins can see which files failed to parse; the remaining rules are still loaded.
func (*RuleSet) LoadSource ¶
LoadSource compiles rules from a literal source string and installs them, replacing the current rule set; it returns any parser warnings. It is the directory-free counterpart to LoadDir, used for programmatic/test rule loading (the package-main test suite builds rule sets this way).
func (*RuleSet) Names ¶
Names returns the names of all currently loaded rules. Tier 2.1: exposes the rule set so admins can verify which rules are active.
func (*RuleSet) SetDir ¶
SetDir updates the rules directory without loading. Used on first-time startup when /data/yara/ does not yet exist and the admin wants to create rules via the API. Tier 3.2.
func (*RuleSet) Warnings ¶
Warnings returns a copy of any parse/load warnings from the most recent LoadDir call. Empty when all rule files loaded cleanly. Tier 2.1: lets admins surface silently-skipped rules in the UI.
Source Files