Documentation
¶
Overview ¶
Package auditexport serialises the tamper-evident audit trail into the formats a compliance pipeline consumes (Task 20167).
Three writers, one interface:
jsonl one JSON object per line — lossless, the format to keep csv a flat table — the format a human opens in a spreadsheet cef ArcSight Common Event Format — the format a SIEM ingests
The package deliberately holds no database handle and no file handle: it writes events from a slice to an io.Writer. That keeps the format rules (which are fiddly, especially CEF's two-level escaping) testable against golden fixtures without a SQLite dependency, and lets the same code serve both the CLI's `--output file` and a future HTTP download.
Hashes are carried through every format. An export that dropped prev_hash and row_hash would be a list of claims about the past with no way to check them; carrying them means a recipient can re-run the chain verification against the export itself.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var AllFormats = []Format{FormatJSONL, FormatCSV, FormatCEF}
AllFormats lists the supported formats in the order help text shows them.
Functions ¶
Types ¶
type Event ¶
type Event = statedb.AuditEvent
Event is the row shape being exported, re-exported so callers need not import pkg/statedb just to name the type.
type Format ¶
type Format string
Format selects the serialisation.
func ParseFormat ¶
ParseFormat resolves a user-supplied format name, case-insensitively. "json" is accepted as an alias for jsonl: it is the name people reach for, and refusing it teaches nothing.
type Options ¶
type Options struct {
// Format selects the serialisation. Zero value is FormatJSONL.
Format Format
// ProductVersion is stamped into the CEF header so a SIEM can attribute
// a record to the binary that produced it. Ignored by the other formats.
// Defaults to "dev" when empty.
ProductVersion string
// MaxPayloadBytes truncates the payload field in CEF output. CEF has no
// formal size cap but collectors routinely drop records past a few
// kilobytes, and a step payload can be large. 0 selects the default;
// negative disables truncation.
MaxPayloadBytes int
}
Options tunes an export run.
Source Files