compliance

package
v0.7.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 9, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Documentation

Index

Constants

View Source 
const RuleMappingSchemaVersion = "agentprovenance.compliance_rule_mapping/v1"

Variables

This section is empty.

Functions

This section is empty.

Types

type Control 

type Control struct {
	ID          string   `json:"id" yaml:"id"`
	Title       string   `json:"title" yaml:"title"`
	Description string   `json:"description" yaml:"description"`
	Evidence    []string `json:"evidence" yaml:"evidence"`
	Partial     []string `json:"partial,omitempty" yaml:"partial"`
	NotApplies  []string `json:"not_applicable,omitempty" yaml:"not_applicable"`
	Gap         string   `json:"gap" yaml:"gap"`
	NextStep    string   `json:"recommended_next_step" yaml:"recommended_next_step"`
}

type EvidenceRef 

type EvidenceRef struct {
	Ref     string `json:"ref"`
	Kind    string `json:"kind"`
	ID      string `json:"id"`
	Summary string `json:"summary,omitempty"`
}

EvidenceRef is one entity-backed piece of evidence for a control (e.g. a policy_decision or risk_signal). Its "kind/id" resolves to a graph-lens node, so the dashboard cross-links it back to the graph.

type Framework 

type Framework struct {
	ID          string    `json:"id" yaml:"id"`
	Title       string    `json:"title" yaml:"title"`
	Description string    `json:"description" yaml:"description"`
	Disclaimer  string    `json:"disclaimer" yaml:"disclaimer"`
	Controls    []Control `json:"controls" yaml:"controls"`
}

func Frameworks 

func Frameworks(ruleSets ...RuleSet) []Framework

func GetFramework 

func GetFramework(id string, ruleSets ...RuleSet) (Framework, bool)

type Mapping 

type Mapping struct {
	Framework       string   `json:"framework" yaml:"framework"`
	Rules           []string `json:"rules" yaml:"rules"`
	BuiltinControls []string `json:"builtin_controls" yaml:"builtin_controls"`
}

type Rule 

type Rule struct {
	ID          string   `json:"id" yaml:"id"`
	Title       string   `json:"title" yaml:"title"`
	Description string   `json:"description" yaml:"description"`
	Evidence    []string `json:"evidence" yaml:"evidence"`
	Partial     []string `json:"partial,omitempty" yaml:"partial"`
	NotApplies  []string `json:"not_applicable,omitempty" yaml:"not_applicable"`
	Gap         string   `json:"gap" yaml:"gap"`
	NextStep    string   `json:"recommended_next_step" yaml:"recommended_next_step"`
}

type RuleControlResult added in v0.4.0 

type RuleControlResult struct {
	ControlID    string        `json:"control_id"`
	Title        string        `json:"title"`
	Description  string        `json:"description"`
	Status       RuleStatus    `json:"status"`
	Rules        []RuleView    `json:"rules"`
	EvidenceRefs []EvidenceRef `json:"evidence_refs"`
	Gap          string        `json:"gap"`
	NextStep     string        `json:"recommended_next_step"`
	Reason       string        `json:"reason"`
}

func FindRuleItem added in v0.4.1 

func FindRuleItem(report RuleMappingReport, controlID string) (RuleControlResult, bool)

FindRuleItem returns the mapping result for one control id.

type RuleHit added in v0.4.1 

type RuleHit struct {
	Ref          string `json:"ref"` // policy_decision/<id>
	Decision     string `json:"decision"`
	Reason       string `json:"reason"`
	EventID      string `json:"event_id,omitempty"`
	RiskSignalID string `json:"risk_signal_id,omitempty"`
	CreatedAt    string `json:"created_at,omitempty"`
	Enforced     bool   `json:"enforced"` // this firing blocked (vs detect/audit)
}

RuleHit is one individual firing of a rule in this run -- one policy_decision row. The UI lists every hit under its rule when a control is expanded, so a reviewer sees each occurrence (time, decision, reason) rather than only a count. Ref is clickable and focuses the decision's node in the graph.

type RuleMappingOptions added in v0.4.0 

type RuleMappingOptions struct {
	Framework string
	RunID     string
	// Rules is the detection rule set to map from. When nil it defaults to
	// security.DefaultRules(). A deployment running a custom YAML engine should
	// pass that engine's rules so custom rules (with their own controls: tags)
	// participate in the mapping.
	Rules []security.Rule
	// RuleSets adds custom framework catalogs (extra frameworks/controls) the
	// same way the CLI's --ruleset does, so a control set beyond the built-ins
	// can be mapped.
	RuleSets []RuleSet
	// Only / Exclude filter which control ids are evaluated.
	Only    []string
	Exclude []string
}

type RuleMappingReport added in v0.4.0 

type RuleMappingReport struct {
	SchemaVersion string              `json:"schema_version"`
	Framework     string              `json:"framework"`
	FrameworkName string              `json:"framework_name"`
	RunID         string              `json:"run_id"`
	Disclaimer    string              `json:"disclaimer"`
	Summary       RuleMappingSummary  `json:"summary"`
	Items         []RuleControlResult `json:"items"`
}

func MapRunRules added in v0.4.0 

func MapRunRules(db *sql.DB, opts RuleMappingOptions) (RuleMappingReport, error)

MapRunRules maps the configured detection rules onto a framework's controls for one run and reports the four-state coverage above.

func RuleGaps added in v0.4.1 

func RuleGaps(report RuleMappingReport, noRuleOnly bool, limit int) RuleMappingReport

RuleGaps narrows a report to the controls that need attention: "detected" (a rule fired but did not block) and "no_rule" (no detector maps here). When noRuleOnly is set, only uncovered controls are returned. Enforced and not_triggered controls are not gaps and are dropped.

type RuleMappingSummary added in v0.4.0 

type RuleMappingSummary struct {
	Enforced     int `json:"enforced"`
	Detected     int `json:"detected"`
	NotTriggered int `json:"not_triggered"`
	NoRule       int `json:"no_rule"`
	Total        int `json:"total"`
}

type RuleSet 

type RuleSet struct {
	SchemaVersion string      `json:"schema_version" yaml:"schema_version"`
	ID            string      `json:"id" yaml:"id"`
	Title         string      `json:"title" yaml:"title"`
	Description   string      `json:"description" yaml:"description"`
	Disclaimer    string      `json:"disclaimer" yaml:"disclaimer"`
	Frameworks    []Framework `json:"frameworks" yaml:"frameworks"`
	Rules         []Rule      `json:"rules" yaml:"rules"`
	Mappings      []Mapping   `json:"mappings" yaml:"mappings"`
}

func LoadRuleSet 

func LoadRuleSet(path string) (RuleSet, error)

func (RuleSet) Validate 

func (r RuleSet) Validate() error

type RuleStatus added in v0.4.0 

type RuleStatus string
const (
	RuleStatusEnforced     RuleStatus = "enforced"
	RuleStatusDetected     RuleStatus = "detected"
	RuleStatusNotTriggered RuleStatus = "not_triggered"
	RuleStatusNoRule       RuleStatus = "no_rule"
)

type RuleView added in v0.4.0 

type RuleView struct {
	ID       string    `json:"id"`
	Reason   string    `json:"reason"`
	Mode     string    `json:"mode"`              // enforce | detect
	Intended string    `json:"intended_decision"` // deny | quarantine | kill
	Fired    int       `json:"fired"`
	Enforced bool      `json:"enforced"`
	Hits     []RuleHit `json:"hits,omitempty"`
}

RuleView is one detection rule mapped to a control, plus how it behaved this run. Mode/Intended come from the rule definition; Fired/Enforced/Hits from the run's policy_decisions.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.