auditexport

type Event = statedb.AuditEvent

type Format string

type Options struct {
	// Format selects the serialisation. Zero value is FormatJSONL.
	Format Format

	// ProductVersion is stamped into the CEF header so a SIEM can attribute
	// a record to the binary that produced it. Ignored by the other formats.
	// Defaults to "dev" when empty.
	ProductVersion string

	// MaxPayloadBytes truncates the payload field in CEF output. CEF has no
	// formal size cap but collectors routinely drop records past a few
	// kilobytes, and a step payload can be large. 0 selects the default;
	// negative disables truncation.
	MaxPayloadBytes int

	// JSONPayloadLimit bounds the payload of a JSONL record, for a transport
	// with a message size limit (the audit forwarder's syslog sink, Task
	// 20426). Zero, the default, never cuts: an export is lossless. A
	// payload over the limit is left out of the record, which says so —
	// payload_truncated, the payload's length and SHA-256, and an excerpt —
	// rather than arriving cut and looking whole.
	JSONPayloadLimit int

	// Provenance labels each record with the chain it came from and the hub
	// that sent it, for a stream that mixes chains (Task 20426). Nil leaves
	// the records as a single-chain export writes them.
	Provenance *Provenance
}

type Provenance struct {
	// Source is the chain's role: control-plane or project.
	Source string
	// Dir is the directory whose .cloop/state.db holds the chain.
	Dir string
	// Hub names the hub that sent the row. Empty leaves it out.
	Hub string
}

type Summary struct {
	Format     Format
	Events     int
	FirstID    int64
	LastID     int64
	Actors     []string
	EventTypes []string
}