leakybucket

type BayesianEvent struct {
	// contains filtered or unexported fields
}

type BayesianProcessor struct {
	DumbProcessor
	// contains filtered or unexported fields
}

type BayesianType struct{}

type BlackholeProcessor struct {
	DumbProcessor
	// contains filtered or unexported fields
}

type BucketFactory struct {
	Spec BucketSpec

	BucketName     string
	Filename       string
	RunTimeFilter  *vm.Program `json:"-"`
	RunTimeGroupBy *vm.Program `json:"-"`
	DataDir        string

	Simulated bool // Set to true if the scenario instantiating the bucket was in the exclusion list
	// contains filtered or unexported fields
}

type BucketSpec struct {
	FormatVersion       string                     `yaml:"format"`
	Description         string                     `yaml:"description"`
	References          []string                   `yaml:"references"`
	Type                string                     `yaml:"type"`                // Type can be : leaky, counter, trigger. It determines the main bucket characteristics
	Name                string                     `yaml:"name"`                // Name of the bucket, used later in log and user-messages. Should be unique
	Capacity            int                        `yaml:"capacity"`            // Capacity is applicable to leaky buckets and determines the "burst" capacity
	LeakSpeed           string                     `yaml:"leakspeed"`           // Leakspeed is a float representing how many events per second leak out of the bucket
	Filter              string                     `yaml:"filter"`              // Filter is an expr that determines if an event is elligible for said bucket. Filter is evaluated against the Event struct
	GroupBy             string                     `yaml:"groupby,omitempty"`   // groupy is an expr that allows to determine the partitions of the bucket. A common example is the source_ip
	Distinct            string                     `yaml:"distinct"`            // Distinct, when present, adds a `Pour()` processor that will only pour uniq items (based on distinct expr result)
	Debug               bool                       `yaml:"debug"`               // Debug, when set to true, will enable debugging for _this_ scenario specifically
	Labels              map[string]any             `yaml:"labels"`              // Labels is K:V list aiming at providing context the overflow
	Blackhole           string                     `yaml:"blackhole,omitempty"` // Blackhole is a duration that, if present, will prevent same bucket partition to overflow more often than $duration
	ScopeType           ScopeType                  `yaml:"scope,omitempty"`     // to enforce a different remediation than blocking an IP. Will default this to IP
	Reprocess           bool                       `yaml:"reprocess"`           // Reprocess, if true, will for the bucket to be re-injected into processing chain
	Data                []*enrichment.DataProvider `yaml:"data,omitempty"`
	ConditionalOverflow string                     `yaml:"condition"`           // condition if present, is an expression that must return true for the bucket to overflow
	CacheSize           int                        `yaml:"cache_size"`          // CacheSize, if > 0, limits the size of in-memory cache of the bucket
	CancelOnFilter      string                     `yaml:"cancel_on,omitempty"` // a filter that, if matched, kills the bucket
	BayesianPrior       float32                    `yaml:"bayesian_prior"`
	BayesianThreshold   float32                    `yaml:"bayesian_threshold"`
	BayesianConditions  []RawBayesianCondition     `yaml:"bayesian_conditions"` // conditions for the bayesian bucket
	OverflowFilter      string                     `yaml:"overflow_filter"`     // OverflowFilter if present, is a filter that must return true for the overflow to go through
	Duration            string                     `yaml:"duration"`            // Duration allows 'counter' buckets to have a fixed life-time
	ScenarioVersion     string                     `yaml:"version,omitempty"`
}

type BucketStore struct {
	// contains filtered or unexported fields
}

type BucketType interface {
	Validate(f *BucketFactory) error
	BuildProcessors(f *BucketFactory) []Processor
}

type CancelProcessor struct {
	CancelOnFilter *vm.Program
	Debug          bool
}

type ConditionalProcessor struct {
	ConditionalFilter        string
	ConditionalFilterRuntime *vm.Program
	DumbProcessor
}

type ConditionalType struct{}

type CounterType struct{}

type DumbProcessor struct{}

type Leaky struct {
	Mode int // LIVE or TIMEMACHINE
	// the limiter is what holds the proper "leaky aspect", it determines when/if we can pour objects
	Limiter         rate.RateLimiter `json:"-"`
	SerializedState rate.Lstate
	// Queue is used to hold the cache of objects in the bucket, it is used to know 'how many' objects we have in buffer.
	Queue *pipeline.Queue
	// Leaky buckets are receiving message through a chan
	In chan *pipeline.Event `json:"-"`
	// Leaky buckets are pushing their overflows through a chan
	Out chan *pipeline.Queue `json:"-"`
	// shared for all buckets (the idea is to kill this afterward)
	AllOut chan pipeline.Event `json:"-"`
	// the unique identifier of the bucket (a hash)
	Mapkey string

	Suicide     chan bool `json:"-"`
	Uuid        string
	First_ts    time.Time
	Last_ts     time.Time
	Ovflw_ts    time.Time
	Total_count int
	Factory     *BucketFactory
	Duration    time.Duration
	Pour        func(*Leaky, pourGate, pipeline.Event) `json:"-"`
	// contains filtered or unexported fields
}

type LeakyType struct{}

type OverflowProcessor struct {
	Filter        string
	FilterRuntime *vm.Program
	DumbProcessor
}

type PourCollector struct {
	// contains filtered or unexported fields
}

type Processor interface {
	OnBucketInit(f *BucketFactory) error
	OnBucketPour(f *BucketFactory, msg pipeline.Event, leaky *Leaky) *pipeline.Event
	OnBucketOverflow(f *BucketFactory, leaky *Leaky, alert pipeline.RuntimeAlert, queue *pipeline.Queue) (pipeline.RuntimeAlert, *pipeline.Queue)

	AfterBucketPour(f *BucketFactory, msg pipeline.Event, leaky *Leaky) *pipeline.Event
}

type RawBayesianCondition struct {
	ConditionalFilterName string  `yaml:"condition"`
	ProbGivenEvil         float32 `yaml:"prob_given_evil"`
	ProbGivenBenign       float32 `yaml:"prob_given_benign"`
	Guillotine            bool    `yaml:"guillotine,omitempty"`
}

type ScopeType struct {
	Scope         string `yaml:"type"`
	Filter        string `yaml:"expression"`
	RunTimeFilter *vm.Program
}

type SimulationChecker interface {
	IsSimulated(scenario string) bool
}

type TriggerProcessor struct {
	DumbProcessor
}

type TriggerType struct{}

type UniqProcessor struct {
	DistinctCompiled *vm.Program
	KeyCache         map[string]bool
	CacheMutex       sync.Mutex
}