Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

analysis

package

Go to main page

Versions in this module

v5

v5.1.2

Apr 2, 2026

v5.1.1

Jan 21, 2026

v5.1.0

Sep 22, 2025

Changes in this version

type AnalysisResult

+ HasC2OverDNSDirectConnectionsModifier bool

type ThreatMixtape

+ NetworkSize uint64

v5.0.8

Aug 14, 2024

v5.0.7

Aug 1, 2024

v5.0.6

Jul 17, 2024

v5.0.5

Jul 17, 2024

v5.0.4

Jul 10, 2024

v5.0.3

Jul 3, 2024

v5.0.2

Jul 3, 2024

Changes in this version

+ var ErrInputSliceEmpty = errors.New("input slice must not be empty")

+ var ErrInvalidDatasetTimeRange = errors.New("invalid dataset timerange: min ts is greater than or equal to max ts")

+ type AnalysisResult struct

+ BeaconType string

+ BytesList []float64

+ Count uint64

+ DirectConns []net.IP

+ Dst net.IP

+ DstNUID uuid.UUID

+ FQDN string

+ FirstSeenHistorical time.Time

+ Hash util.FixedString

+ LastSeen time.Time

+ MissingHostCount uint64

+ OnThreatIntel bool

+ OpenCount uint64

+ OpenTotalDuration float64

+ PortProtoService []string

+ Prevalence float32

+ PrevalenceTotal uint64

+ ProxyCount uint64

+ ProxyIPs []net.IP

+ QueriedBy []net.IP

+ ServerIPs []net.IP

+ Src net.IP

+ SrcNUID uuid.UUID

+ SubdomainCount uint64

+ TLD string

+ TSList []uint32

+ TSUnique uint64

+ TotalBytes int64

+ TotalDuration float64

+ type Analyzer struct

+ AnalysisWorkers int

+ Config *config.Config

+ Database *database.DB

+ ImportID util.FixedString

+ UconnChan chan AnalysisResult

+ WriterWorkers int

+ func NewAnalyzer(db *database.DB, cfg *config.Config, importID util.FixedString, ...) (*Analyzer, error)

+ func (analyzer *Analyzer) Analyze() error

+ func (analyzer *Analyzer) ScoopDNS(ctx context.Context, progress *tea.Program) error

+ func (analyzer *Analyzer) ScoopIPConns(ctx context.Context, progress *tea.Program) error

+ func (analyzer *Analyzer) ScoopSNIConns(ctx context.Context, progress *tea.Program) error

+ func (analyzer *Analyzer) Spagoop(ctx context.Context) error

+ type Beacon struct

+ BeaconType string

+ DSCounts []int64

+ DSSizes []int64

+ DataSizeScore float32

+ DurationScore float32

+ HistogramScore float32

+ Score float32

+ TSIntervalCounts []int64

+ TSIntervals []int64

+ TimestampScore float32

+ type ThreatMixtape struct

+ AnalyzedAt time.Time

+ BeaconThreatScore float32

+ BeaconType string

+ C2OverDNSDirectConnScore float32

+ C2OverDNSScore float32

+ FinalScore float32

+ FirstSeenScore float32

+ ImportID util.FixedString

+ LongConnScore float32

+ MissingHostHeaderScore float32

+ ModifierName string

+ ModifierScore float32

+ ModifierValue string

+ PrevalenceScore float32

+ Strobe bool

+ StrobeScore float32

+ ThreatIntel bool

+ ThreatIntelDataSizeScore float32

+ ThreatIntelScore float32

+ func (i ThreatMixtape) Description() string

+ func (i ThreatMixtape) Title() string

+ func (r ThreatMixtape) FilterValue() string

Other modules containing this package

github.com/activecm/rita