siem

type ArcSightClient struct {
	// contains filtered or unexported fields
}

type ArcSightConfig struct {
	CEFDestination     string
	DeviceVendor       string
	DeviceProduct      string
	DeviceVersion      string
	SmartConnectorHost string
	SmartConnectorPort int
}

type AuthConfig struct {
	// Authentication type: api_key, oauth2, basic, certificate
	Type string `json:"type"`
	// API key (for api_key auth)
	APIKey string `json:"api_key,omitempty"`
	// API key header name
	APIKeyHeader string `json:"api_key_header,omitempty"`
	// Username (for basic auth)
	Username string `json:"username,omitempty"`
	// Password (for basic auth)
	Password string `json:"password,omitempty"`
	// OAuth2 token URL
	TokenURL string `json:"token_url,omitempty"`
	// OAuth2 client ID
	ClientID string `json:"client_id,omitempty"`
	// OAuth2 client secret
	ClientSecret string `json:"client_secret,omitempty"`
	// OAuth2 scopes
	Scopes []string `json:"scopes,omitempty"`
	// Certificate file path (for certificate auth)
	CertFile string `json:"cert_file,omitempty"`
	// Key file path (for certificate auth)
	KeyFile string `json:"key_file,omitempty"`
}

type BatchConfig struct {
	// Enable batching
	Enabled bool `json:"enabled"`
	// Maximum batch size (events)
	MaxSize int `json:"max_size"`
	// Maximum batch wait time
	MaxWait time.Duration `json:"max_wait"`
	// Maximum batch size in bytes
	MaxBytes int `json:"max_bytes,omitempty"`
}

type BufferConfig struct {
	// Enable buffering
	Enabled bool `json:"enabled"`
	// Maximum buffer size (events)
	MaxSize int `json:"max_size"`
	// Buffer flush interval
	FlushInterval time.Duration `json:"flush_interval"`
	// Persist buffer to disk
	Persist bool `json:"persist"`
	// Persist directory
	PersistDir string `json:"persist_dir,omitempty"`
}

type CEFFormatter struct {
	// contains filtered or unexported fields
}

type CEFOptions struct {
	Vendor  string
	Product string
	Version string
}

type CSVFormatter struct {
	// contains filtered or unexported fields
}

type Client interface {
	Send(ctx context.Context, event *Event) error
	SendBatch(ctx context.Context, events []*Event) error
	Start()
	Stop()
	Events() chan<- *Event
	Errors() <-chan error
}

type ComplianceMapping struct {
	Framework string `json:"framework"` // SOC2, PCI-DSS, HIPAA, NIST, etc.
	Control   string `json:"control"`
	Section   string `json:"section,omitempty"`
}

type Config struct {
	// Enabled platforms
	Platforms []PlatformConfig `json:"platforms"`
	// Global settings
	Global GlobalConfig `json:"global"`
	// Event filtering
	Filter FilterConfig `json:"filter"`
	// Buffering settings
	Buffer BufferConfig `json:"buffer"`
}

type ElasticsearchClient struct {
	// contains filtered or unexported fields
}

type ElasticsearchConfig struct {
	// Index name (supports date patterns)
	Index string `json:"index"`
	// Pipeline name
	Pipeline string `json:"pipeline,omitempty"`
	// Use data stream
	DataStream bool `json:"data_stream"`
	// Data stream type
	DataStreamType string `json:"data_stream_type"`
}

type Entity struct {
	Type  string `json:"type"` // user, host, ip, application, etc.
	ID    string `json:"id"`
	Name  string `json:"name,omitempty"`
	Value string `json:"value,omitempty"`
}

type Error struct {
	Platform  Platform
	Operation string
	Message   string
	Retryable bool
	Cause     error
}

type Event struct {
	// Unique identifier for this event
	ID string `json:"id"`
	// Timestamp when the event occurred
	Timestamp time.Time `json:"timestamp"`
	// Platform that generated the event
	Source string `json:"source"`
	// Event category
	Category EventCategory `json:"category"`
	// Event type (e.g., "blocked_request", "authentication_failure")
	Type string `json:"type"`
	// Action taken (block, allow, drop, throttle, etc.) - for RFC 5424
	Action string `json:"action,omitempty"`
	// Severity level
	Severity Severity `json:"severity"`
	// Human-readable message
	Message string `json:"message"`
	// Source IP address - for RFC 5424
	SourceIP string `json:"sourceIP,omitempty"`
	// Destination address - for RFC 5424
	Destination string `json:"destination,omitempty"`
	// User identifier - for RFC 5424
	User string `json:"user,omitempty"`
	// Client ID - for RFC 5424
	ClientID string `json:"clientID,omitempty"`
	// Threat type - for RFC 5424
	ThreatType string `json:"threatType,omitempty"`
	// Threat level - for RFC 5424
	ThreatLevel string `json:"threatLevel,omitempty"`
	// Pattern matched - for RFC 5424
	Pattern string `json:"pattern,omitempty"`
	// Raw event data
	Raw map[string]interface{} `json:"raw,omitempty"`
	// Additional attributes
	Attributes map[string]string `json:"attributes,omitempty"`
	// Related entities (users, IPs, hosts)
	Entities []Entity `json:"entities,omitempty"`
	// MITRE ATT&CK mapping
	MITRE *MITREMapping `json:"mitre,omitempty"`
	// Compliance framework mapping
	Compliance []ComplianceMapping `json:"compliance,omitempty"`
	// Compliance framework name - for RFC 5424
	ComplianceFramework string `json:"complianceFramework,omitempty"`
	// Compliance control ID - for RFC 5424
	ComplianceControl string `json:"complianceControl,omitempty"`
}

type EventBuffer struct {
	// contains filtered or unexported fields
}

type EventBuilder struct {
	// contains filtered or unexported fields
}

type EventCategory string

type EventFilter struct {
	// contains filtered or unexported fields
}

type FilterConfig struct {
	// Minimum severity to forward
	MinSeverity Severity `json:"min_severity"`
	// Include these categories only
	IncludeCategories []EventCategory `json:"include_categories,omitempty"`
	// Exclude these categories
	ExcludeCategories []EventCategory `json:"exclude_categories,omitempty"`
	// Include these event types only
	IncludeTypes []string `json:"include_types,omitempty"`
	// Exclude these event types
	ExcludeTypes []string `json:"exclude_types,omitempty"`
	// Custom filter expression
	CustomFilter string `json:"custom_filter,omitempty"`
}

type Format string

type Formatter interface {
	// Format formats a single event
	Format(event *Event) ([]byte, error)
	// FormatBatch formats multiple events
	FormatBatch(events []*Event) ([]byte, error)
	// ContentType returns the content type for the format
	ContentType() string
	// FileExtension returns the file extension for the format
	FileExtension() string
}

type GlobalConfig struct {
	// Application name/identifier
	AppName string `json:"app_name"`
	// Environment (production, staging, development)
	Environment string `json:"environment"`
	// Default severity for unmapped events
	DefaultSeverity Severity `json:"default_severity"`
	// Include raw event data
	IncludeRaw bool `json:"include_raw"`
	// Add hostname to events
	AddHostname bool `json:"add_hostname"`
	// Hostname override
	Hostname string `json:"hostname,omitempty"`
}

type HTTPClient struct {
	*http.Client
	// contains filtered or unexported fields
}

type HealthStatus string

type JSONFormatter struct {
	// contains filtered or unexported fields
}

type LEEFFormatter struct {
	// contains filtered or unexported fields
}

type LEEFOptions struct {
	Vendor  string
	Product string
	Version string
}

type LogRhythmClient struct {
	// contains filtered or unexported fields
}

type LogRhythmConfig struct {
	SyslogHost          string
	SyslogPort          int
	UseTLS              bool
	APIEndpoint         string
	LogSourceIdentifier string
}

type MITREMapping struct {
	Tactic       string   `json:"tactic,omitempty"`
	Technique    string   `json:"technique,omitempty"`
	SubTechnique string   `json:"sub_technique,omitempty"`
	Tactics      []string `json:"tactics,omitempty"`
	Techniques   []string `json:"techniques,omitempty"`
}

type Manager struct {
	// contains filtered or unexported fields
}

type ManagerStats struct {
	EventsReceived int64
	EventsSent     int64
	EventsDropped  int64
	EventsFiltered int64
	Errors         int64
	LastSendTime   time.Time
	PlatformStats  map[Platform]*PlatformStats
	// contains filtered or unexported fields
}

type MetricsHook struct {
	// contains filtered or unexported fields
}

type Platform string

type PlatformConfig struct {
	// Platform type
	Platform Platform `json:"platform"`
	// Enable/disable this platform
	Enabled bool `json:"enabled"`
	// Output format
	Format Format `json:"format"`
	// Endpoint URL (for HTTP-based platforms)
	Endpoint string `json:"endpoint,omitempty"`
	// Authentication configuration
	Auth AuthConfig `json:"auth"`
	// TLS configuration
	TLS TLSConfig `json:"tls"`
	// Platform-specific settings
	Settings map[string]interface{} `json:"settings,omitempty"`
	// Retry configuration
	Retry RetryConfig `json:"retry"`
	// Batch configuration
	Batch BatchConfig `json:"batch"`
}

type PlatformMetricsSnapshot struct {
	EventsSent     int64
	EventsFailed   int64
	EventsFiltered int64
	EventsDropped  int64
	AvgLatency     time.Duration
	MaxLatency     time.Duration
	BufferSize     int
	BufferCapacity int
	Retries        int64
	HealthStatus   HealthStatus
	LastSendTime   time.Time
	LastErrorTime  time.Time
	LastError      string
}

type PlatformStats struct {
	EventsSent    int64
	EventsDropped int64
	Errors        int64
	LastSendTime  time.Time
	LastError     string
}

type PlatformSummary struct {
	EventsSent     int64     `json:"events_sent"`
	EventsFailed   int64     `json:"events_failed"`
	EventsFiltered int64     `json:"events_filtered"`
	EventsDropped  int64     `json:"events_dropped"`
	AvgLatencyMs   int64     `json:"avg_latency_ms"`
	MaxLatencyMs   int64     `json:"max_latency_ms"`
	HealthStatus   string    `json:"health_status"`
	LastSendTime   time.Time `json:"last_send_time"`
}

type QRadarClient struct {
	// contains filtered or unexported fields
}

type QRadarConfig struct {
	LogSourceID        string
	LogSourceName      string
	UseLEEF            bool
	LEEFVersion        string
	EventCollectorHost string
	EventCollectorPort int
}

type RFC5424Message struct {
	Priority       int                      // PRI (facility * 8 + severity)
	Version        int                      // VERSION (always 1)
	Timestamp      time.Time                // TIMESTAMP (RFC3339 or NILVALUE)
	Hostname       string                   // HOSTNAME or NILVALUE
	AppName        string                   // APP-NAME or NILVALUE
	ProcID         string                   // PROCID or NILVALUE
	MsgID          RFC5424MsgID             // MSGID or NILVALUE
	StructuredData []*RFC5424StructuredData // STRUCTURED-DATA
	Message        string                   // MSG
}

type RFC5424MsgID string

type RFC5424StructuredData struct {
	ID     RFC5424StructuredDataID
	Params []RFC5424StructuredDataParam
}

type RFC5424StructuredDataID string

type RFC5424StructuredDataParam struct {
	Name  string
	Value string
}

type ReadCloser struct {
	io.Reader
	CloseFunc func() error
}

type RetryConfig struct {
	// Enable retries
	Enabled bool `json:"enabled"`
	// Maximum retry attempts
	MaxAttempts int `json:"max_attempts"`
	// Initial backoff duration
	InitialBackoff time.Duration `json:"initial_backoff"`
	// Maximum backoff duration
	MaxBackoff time.Duration `json:"max_backoff"`
	// Backoff multiplier
	BackoffMultiplier float64 `json:"backoff_multiplier"`
	// Retry on these HTTP status codes
	RetryOnStatusCodes []int `json:"retry_on_status_codes,omitempty"`
}

type SIEMMetrics struct {

	// Event counters by platform
	EventsSent     map[Platform]int64
	EventsFailed   map[Platform]int64
	EventsFiltered map[Platform]int64
	EventsDropped  map[Platform]int64

	// Latency tracking
	LatencyTotal map[Platform]time.Duration
	LatencyCount map[Platform]int64
	LatencyMax   map[Platform]time.Duration

	// Error tracking
	ErrorsByType map[Platform]map[string]int64

	// Buffer tracking
	BufferSize     map[Platform]int
	BufferCapacity map[Platform]int

	// Retry tracking
	Retries map[Platform]int64

	// Platform health status
	PlatformHealth map[Platform]HealthStatus

	// Last activity timestamps
	LastSendTime  map[Platform]time.Time
	LastErrorTime map[Platform]time.Time
	LastError     map[Platform]string
	// contains filtered or unexported fields
}

type SIEMReportGenerator struct {
	// contains filtered or unexported fields
}

type SIEMSummaryReport struct {
	StartTime     time.Time                    `json:"start_time"`
	EndTime       time.Time                    `json:"end_time"`
	Generated     time.Time                    `json:"generated"`
	TotalEvents   int64                        `json:"total_events"`
	EventsSent    int64                        `json:"events_sent"`
	EventsFailed  int64                        `json:"events_failed"`
	EventsDropped int64                        `json:"events_dropped"`
	SuccessRate   float64                      `json:"success_rate"`
	AvgLatencyMs  int64                        `json:"avg_latency_ms"`
	Platforms     map[Platform]PlatformSummary `json:"platforms"`
}

type SentinelClient struct {
	// contains filtered or unexported fields
}

type SentinelConfig struct {
	WorkspaceID string
	SharedKey   string
	LogType     string
	ARMEndpoint string
}

type Severity string

type SplunkClient struct {
	// contains filtered or unexported fields
}

type SplunkConfig struct {
	// HEC endpoint URL
	HECURL string `json:"hec_url"`
	// HEC token
	HECToken string `json:"hec_token"`
	// Index name
	Index string `json:"index"`
	// Source type
	SourceType string `json:"source_type"`
	// Source name
	Source string `json:"source"`
	// Use batch API
	UseBatchAPI bool `json:"use_batch_api"`
}

type SplunkEvent struct {
	Time       int64                  `json:"time"`
	Host       string                 `json:"host"`
	Source     string                 `json:"source"`
	SourceType string                 `json:"sourcetype"`
	Index      string                 `json:"index"`
	Data       interface{}            `json:"event"`
	Fields     map[string]interface{} `json:"fields,omitempty"`
}

type SumoLogicClient struct {
	// contains filtered or unexported fields
}

type SumoLogicConfig struct {
	HTTPSourceURL  string
	SourceCategory string
	SourceName     string
	SourceHost     string
	UseGzip        bool
}

type SyslogClient struct {
	// contains filtered or unexported fields
}

type SyslogConfig struct {
	Host            string
	Port            int
	Protocol        string
	RFC5424         bool
	Facility        int
	AppName         string
	MessageIDPrefix string
}

type SyslogFormatter struct {
	// contains filtered or unexported fields
}

type SyslogOptions struct {
	Facility int
	AppName  string
	Hostname string
}

type TLSConfig struct {
	// Enable TLS
	Enabled bool `json:"enabled"`
	// Skip certificate verification (insecure)
	InsecureSkipVerify bool `json:"insecure_skip_verify"`
	// CA certificate file
	CAFile string `json:"ca_file,omitempty"`
	// Server name for SNI
	ServerName string `json:"server_name,omitempty"`
	// Minimum TLS version
	MinVersion string `json:"min_version,omitempty"`
}