Documentation
¶
Index ¶
- func CompileExpression(expression string, recordType types.Type) (*vm.Program, error)
- func Contains(slice any, value any) bool
- func ContainsAny(str string, substrs []string) bool
- func CreateEnvironment(record types.AuditRecord) map[string]any
- func DurationSince(ts int64) int64
- func EvaluateExpression(program *vm.Program, record types.AuditRecord) (bool, error)
- func FormatTime(ts int64, format string) string
- func HasKey(m any, key string) bool
- func InSubnet(ip, cidr string) bool
- func IsPrivateIP(ip string) bool
- func IsPublicIP(ip string) bool
- func MatchesPattern(str, pattern string) bool
- func MustCompileExpression(expression string, recordType types.Type) *vm.Program
- func ParsePort(port string) int
- func PortInRange(port, start, end int) bool
- func TimeInRange(ts, start, end int64) bool
- type CompiledFilter
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CompileExpression ¶
CompileExpression compiles an expr-lang expression for a specific audit record type. The expression has access to all fields of the audit record and helper functions.
func Contains ¶
Contains checks if a slice contains a specific value. Supports []string, []int, and []int32 (common in protobuf).
func ContainsAny ¶
ContainsAny checks if a string contains any of the provided substrings.
func CreateEnvironment ¶
func CreateEnvironment(record types.AuditRecord) map[string]any
CreateEnvironment creates an expression environment from an audit record. This makes all fields of the record accessible in expressions. Note: Helper functions are declared via expr.Function() in CompileExpression() with explicit type signatures.
func DurationSince ¶
DurationSince returns the duration in nanoseconds since a given timestamp.
func EvaluateExpression ¶
EvaluateExpression evaluates a compiled expression against an audit record. Returns true if the record matches the filter, false otherwise.
func FormatTime ¶
FormatTime formats a timestamp (nanoseconds) according to the provided format string. Uses Go's time format layout (e.g., "2006-01-02 15:04:05").
func HasKey ¶
HasKey checks if a map contains a specific key. Supports map[string]string and map[string]interface{}.
func IsPrivateIP ¶
IsPrivateIP checks if an IP address is in a private range.
func IsPublicIP ¶
IsPublicIP checks if an IP address is a public (non-private) address.
func MatchesPattern ¶
MatchesPattern checks if a string matches a regular expression pattern.
func MustCompileExpression ¶
MustCompileExpression compiles an expression and panics on error. Useful for static expressions that are known to be valid.
func ParsePort ¶
ParsePort converts a port string to an integer. Returns 0 if the string cannot be parsed.
func PortInRange ¶
PortInRange checks if a port is within a given range (inclusive).
func TimeInRange ¶
TimeInRange checks if a timestamp (nanoseconds) is within a given range.
Source Files