payload

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Apr 8, 2026 License: Apache-2.0 Imports: 2 Imported by: 0

Documentation

Overview

Package payload defines the v1 ingest envelope (mirrors api/ingest.v1.schema.json). Facts live only under components.*; per-port firewall posture is listeners[].firewall_rule.

Index

Constants

View Source
const (
	FirewallRuleFiltered   = "filtered"
	FirewallRuleUnfiltered = "unfiltered"
	FirewallRuleBlocked    = "blocked"
	FirewallRuleUnknown    = "unknown"
)

Variables

This section is empty.

Functions

func AgentUtcRFC3339

func AgentUtcRFC3339(t time.Time) string

Types

type AuditCheck

type AuditCheck struct {
	ID          string `json:"id"`
	Status      string `json:"status"`
	Description string `json:"description"`
}

type AuditSection

type AuditSection struct {
	ID     string       `json:"id"`
	Title  string       `json:"title"`
	Checks []AuditCheck `json:"checks"`
}

type Components added in v0.2.0

type Components struct {
	CoreSystemAndKernel                 CoreSystemAndKernelComponent                 `json:"core_system_and_kernel"`
	IdentityAccessAndAuthentication     IdentityAccessAndAuthenticationComponent     `json:"identity_access_and_authentication"`
	FileSystemAndStorage                FileSystemAndStorageComponent                `json:"file_system_and_storage"`
	NetworkAndHostFirewall              NetworkAndHostFirewallComponent              `json:"network_and_host_firewall"`
	SoftwarePackagesAndApplications     SoftwarePackagesAndApplicationsComponent     `json:"software_packages_and_applications"`
	ContainerAndCloudNativeLinux        ContainerAndCloudNativeLinuxComponent        `json:"container_and_cloud_native_linux"`
	LoggingAndSystemAuditing            LoggingAndSystemAuditingComponent            `json:"logging_and_system_auditing"`
	Cryptography                        CryptographyComponent                        `json:"cryptography"`
	SecurityFrameworksAndMalwareDefense SecurityFrameworksAndMalwareDefenseComponent `json:"security_frameworks_and_malware_defense"`
	Other                               OtherComponent                               `json:"other"`
}

Components groups inventory by competitor-audited sections (RBAC boundary).

type ContainerAndCloudNativeLinuxComponent added in v0.2.0

type ContainerAndCloudNativeLinuxComponent struct {
	HostRuntimes *ContainerNativeHostRuntimes `json:"host_runtimes,omitempty"`
}

type ContainerNativeHostRuntimes added in v0.2.0

type ContainerNativeHostRuntimes struct {
	Docker  *DockerHostFingerprint  `json:"docker,omitempty"`
	Kubelet *KubeletNodeFingerprint `json:"kubelet,omitempty"`
	Error   string                  `json:"error,omitempty"`
}

ContainerNativeHostRuntimes is §6 host_runtimes: Docker daemon and kubelet hints only (no language runtime items).

type CoreSystemAndKernelComponent added in v0.2.0

type CoreSystemAndKernelComponent struct {
	OS              OSInfo                  `json:"os"`
	HostTime        *HostTime               `json:"host_time,omitempty"`
	HostProcess     *HostProcess            `json:"host_process,omitempty"`
	Grub            *GrubSnapshot           `json:"grub,omitempty"`
	FirmwareBoot    *FirmwareBoot           `json:"firmware_boot,omitempty"`
	SystemdHealth   *SystemdHealth          `json:"systemd_health,omitempty"`
	SysctlLive      *SysctlLiveBlock        `json:"sysctl_live,omitempty"`
	SysctlOverlay   *SysctlOverlayBlock     `json:"sysctl_overlay,omitempty"`
	KernelModules   *KernelModulesBlock     `json:"kernel_modules,omitempty"`
	SelinuxApparmor *SelinuxApparmorBlock   `json:"selinux_apparmor,omitempty"`
	HighRiskProcess *HighRiskProcessSurface `json:"high_risk_process,omitempty"`
}

type CronTimersInventory added in v0.2.0

type CronTimersInventory struct {
	SystemCrontabLineCount    int      `json:"system_crontab_line_count"`
	SystemCrontabSample       []string `json:"system_crontab_sample,omitempty"`
	CronDropinFileNamesSample []string `json:"cron_dropin_file_names_sample,omitempty"`
	UserCrontabsPresentCount  int      `json:"user_crontabs_present_count"`
	UserCrontabUsersSample    []string `json:"user_crontab_users_sample,omitempty"`
	UserCrontabLinesSample    []string `json:"user_crontab_lines_sample,omitempty"`
	CronVarSpoolModeOctal     string   `json:"cron_var_spool_mode_octal,omitempty"`
	SystemdTimersCount        int      `json:"systemd_timers_count"`
	SystemdTimerUnitsSample   []string `json:"systemd_timer_units_sample,omitempty"`
	Error                     string   `json:"error,omitempty"`
}

CronTimersInventory summarizes cron files, user crontabs, and systemd timers.

type CryptStorageHint added in v0.2.0

type CryptStorageHint struct {
	CrypttabReadable          bool     `json:"crypttab_readable"`
	CrypttabEntryCount        int      `json:"crypttab_entry_count"`
	CrypttabMapperNamesSample []string `json:"crypttab_mapper_names_sample,omitempty"`
	LsblkCryptVolumeCount     int      `json:"lsblk_crypt_volume_count"`
	LsblkCryptNamesSample     []string `json:"lsblk_crypt_names_sample,omitempty"`
	Error                     string   `json:"error,omitempty"`
}

CryptStorageHint summarizes crypttab and lsblk crypt volumes (no keys).

type CryptographyComponent added in v0.2.0

type CryptographyComponent struct{}

CryptographyComponent is reserved for TLS/cert inventory; time lives under core_system_and_kernel.host_time.

type CupsExposureFingerprint added in v0.2.0

type CupsExposureFingerprint struct {
	UnitActiveState         string   `json:"unit_active_state,omitempty"`
	ListenLinesSample       []string `json:"listen_lines_sample,omitempty"`
	WebInterfaceLinesSample []string `json:"web_interface_lines_sample,omitempty"`
	Error                   string   `json:"error,omitempty"`
}

CupsExposureFingerprint is CUPS unit state and bounded config lines.

type DockerHostFingerprint added in v0.2.0

type DockerHostFingerprint struct {
	DockerCliPath         string `json:"docker_cli_path,omitempty"`
	DaemonJSONPath        string `json:"daemon_json_path,omitempty"`
	LiveRestore           *bool  `json:"live_restore,omitempty"`
	Icc                   *bool  `json:"icc,omitempty"`
	UserlandProxy         *bool  `json:"userland_proxy,omitempty"`
	TlsInDaemonJSON       *bool  `json:"tls_in_daemon_json,omitempty"`
	TlsVerifyInDaemonJSON *bool  `json:"tls_verify_in_daemon_json,omitempty"`
	ContainerCount        *int   `json:"container_count,omitempty"`
	RootlessHint          string `json:"rootless_hint,omitempty"`
	DockerSockPath        string `json:"docker_sock_path,omitempty"`
	DockerSockModeOctal   string `json:"docker_sock_mode_octal,omitempty"`
	DockerSockOwnerUID    *int   `json:"docker_sock_owner_uid,omitempty"`
	DockerSockGroupGID    *int   `json:"docker_sock_group_gid,omitempty"`
	Error                 string `json:"error,omitempty"`
}

DockerHostFingerprint is non-secret Docker daemon posture (CIS-style hints).

type DuplicateIDEntry added in v0.2.0

type DuplicateIDEntry struct {
	ID    int      `json:"id"`
	Names []string `json:"names"`
}

DuplicateIDEntry lists a numeric ID shared by more than one account (names capped for audit).

type DuplicateUidGid added in v0.2.0

type DuplicateUidGid struct {
	DuplicateUidCount int                `json:"duplicate_uid_count"`
	DuplicateGidCount int                `json:"duplicate_gid_count"`
	DuplicateUids     []DuplicateIDEntry `json:"duplicate_uids,omitempty"`
	DuplicateGids     []DuplicateIDEntry `json:"duplicate_gids,omitempty"`
	Error             string             `json:"error,omitempty"`
}

DuplicateUidGid reports passwd/group collisions (bounded names per ID).

type FileIntegrityTooling added in v0.2.0

type FileIntegrityTooling struct {
	AideSuspected      bool     `json:"aide_suspected"`
	TripwireSuspected  bool     `json:"tripwire_suspected"`
	EvidencePaths      []string `json:"evidence_paths,omitempty"`
	SystemdUnitsSample []string `json:"systemd_units_sample,omitempty"`
	LatestDbUtcHint    string   `json:"latest_db_utc_hint,omitempty"`
	Error              string   `json:"error,omitempty"`
}

FileIntegrityTooling detects AIDE/Tripwire-style tooling without uploading databases.

type FileSystemAndStorageComponent added in v0.2.0

type FileSystemAndStorageComponent struct {
	HostDisk              *HostDisk              `json:"host_disk,omitempty"`
	HostPath              *HostPath              `json:"host_path,omitempty"`
	HostSuid              *HostSuid              `json:"host_suid,omitempty"`
	MountOptionsAudit     *MountOptionsAudit     `json:"mount_options_audit,omitempty"`
	PathPermissionsAudit  *PathPermissionsAudit  `json:"path_permissions_audit,omitempty"`
	UsbStoragePosture     *UsbStoragePosture     `json:"usb_storage_posture,omitempty"`
	FileIntegrityTooling  *FileIntegrityTooling  `json:"file_integrity_tooling,omitempty"`
	CryptStorageHint      *CryptStorageHint      `json:"crypt_storage_hint,omitempty"`
	NfsExportsFingerprint *NfsExportsFingerprint `json:"nfs_exports_fingerprint,omitempty"`
}

type FilesystemEntry

type FilesystemEntry struct {
	Mount         string `json:"mount"`
	Fstype        string `json:"fstype"`
	UsedPct       int    `json:"used_pct"`
	AvailGB       int    `json:"avail_gb"`
	InodesUsedPct *int   `json:"inodes_used_pct,omitempty"`
}

type Firewall

type Firewall struct {
	Family                  string   `json:"firewall_family"`
	Active                  bool     `json:"active"`
	DefaultPolicyIn         string   `json:"default_policy_in,omitempty"`
	DefaultPolicyOut        string   `json:"default_policy_out,omitempty"`
	RuleCount               *int     `json:"rule_count,omitempty"`
	HasEstablishedRelated   *bool    `json:"has_established_related,omitempty"`
	FirewalldDefaultZone    string   `json:"firewalld_default_zone,omitempty"`
	FirewalldZoneTarget     string   `json:"firewalld_zone_target,omitempty"`
	UfwStatusVerboseSample  []string `json:"ufw_status_verbose_sample,omitempty"`
	BackendRulesetSha256Hex string   `json:"backend_ruleset_sha256,omitempty"`
	BackendRulesetExcerpt   string   `json:"backend_ruleset_excerpt,omitempty"`
	Error                   string   `json:"error,omitempty"`
}

type FirmwareBoot added in v0.2.0

type FirmwareBoot struct {
	BootMode           string `json:"boot_mode"`
	EfiSysfsPresent    bool   `json:"efi_sysfs_present"`
	EfibootmgrExitZero bool   `json:"efibootmgr_exit_zero,omitempty"`
	Error              string `json:"error,omitempty"`
}

FirmwareBoot hints UEFI vs BIOS without requiring root.

type GrubSnapshot added in v0.2.0

type GrubSnapshot struct {
	DefaultGrubPath          string `json:"default_grub_path,omitempty"`
	GrubCmdlineLinux         string `json:"grub_cmdline_linux,omitempty"`
	GrubTimeout              string `json:"grub_timeout,omitempty"`
	PasswordReferencePresent *bool  `json:"password_reference_present,omitempty"`
	GrubCfgReadablePath      string `json:"grub_cfg_readable_path,omitempty"`
	Error                    string `json:"error,omitempty"`
}

GrubSnapshot is parsed /etc/default/grub (and optional readable grub.cfg path); no secret values.

type HighRiskProcessEntry added in v0.2.0

type HighRiskProcessEntry struct {
	Pid           int32  `json:"pid"`
	User          string `json:"user"`
	ExePath       string `json:"exe_path,omitempty"`
	BinaryDeleted bool   `json:"binary_deleted"`
	CmdlineEmpty  bool   `json:"cmdline_empty"`
	ListenerPorts []int  `json:"listener_ports,omitempty"`
	Reason        string `json:"reason,omitempty"`
}

HighRiskProcessEntry is one bounded process row.

type HighRiskProcessSurface added in v0.2.0

type HighRiskProcessSurface struct {
	Items []HighRiskProcessEntry `json:"items"`
	Error string                 `json:"error,omitempty"`
}

HighRiskProcessSurface samples listeners and root-owned processes with exe/cmdline hints.

type HostBackup

type HostBackup struct {
	BackupStatus    string   `json:"backup_status"`
	LatestBackupUTC string   `json:"latest_backup_utc"`
	ToolsDetected   []string `json:"tools_detected,omitempty"`
	HasPeriodicCron *bool    `json:"has_periodic_cron,omitempty"`
	Error           string   `json:"error,omitempty"`
}

type HostDisk

type HostDisk struct {
	Filesystems []FilesystemEntry `json:"filesystems,omitempty"`
	Error       string            `json:"error,omitempty"`
}

type HostNetwork

type HostNetwork struct {
	DefaultRouteVia         string         `json:"default_route_via,omitempty"`
	HasPublicIPv4           *bool          `json:"has_public_ipv4,omitempty"`
	HasPublicIPv6           *bool          `json:"has_public_ipv6,omitempty"`
	PublicIPCandidates      []string       `json:"public_ip_candidates,omitempty"`
	Interfaces              []NetworkIface `json:"interfaces,omitempty"`
	ResolvConfNameservers   []string       `json:"resolv_conf_nameservers,omitempty"`
	ResolvConfSearchDomains []string       `json:"resolv_conf_search_domains,omitempty"`
	ResolvConfSampleLines   []string       `json:"resolv_conf_sample_lines,omitempty"`
	SystemdResolvedStub     *bool          `json:"systemd_resolved_stub,omitempty"`
	Error                   string         `json:"error,omitempty"`
}

type HostPath

type HostPath struct {
	Entries []PathEntry `json:"entries"`
	Error   string      `json:"error,omitempty"`
}

type HostProcess

type HostProcess struct {
	Top     []ProcessTopEntry `json:"top"`
	Signals *ProcessSignals   `json:"signals,omitempty"`
	Error   string            `json:"error,omitempty"`
}

type HostRuntimes

type HostRuntimes struct {
	Items   []RuntimeEntry          `json:"items"`
	Docker  *DockerHostFingerprint  `json:"docker,omitempty"`
	Kubelet *KubeletNodeFingerprint `json:"kubelet,omitempty"`
	Error   string                  `json:"error,omitempty"`
}

type HostSSH

type HostSSH struct {
	PermitRootLogin            string   `json:"permit_root_login,omitempty"`
	PasswordAuthentication     string   `json:"password_authentication,omitempty"`
	ChallengeResponseAuth      string   `json:"challenge_response_auth,omitempty"`
	KexAlgorithmsSample        []string `json:"kex_algorithms_sample,omitempty"`
	CiphersSample              []string `json:"ciphers_sample,omitempty"`
	ListenAddresses            []string `json:"listen_addresses,omitempty"`
	MaxAuthTries               *int     `json:"max_auth_tries,omitempty"`
	ClientAliveIntervalSeconds *int     `json:"client_alive_interval_seconds,omitempty"`
	ClientAliveCountMax        *int     `json:"client_alive_count_max,omitempty"`
	AllowUsersPresent          *bool    `json:"allow_users_present,omitempty"`
	DenyUsersPresent           *bool    `json:"deny_users_present,omitempty"`
	Subsystem                  string   `json:"subsystem,omitempty"`
	UsePAM                     string   `json:"use_pam,omitempty"`
	X11Forwarding              string   `json:"x11_forwarding,omitempty"`
	Error                      string   `json:"error,omitempty"`
}

type HostSuid

type HostSuid struct {
	Items []SuidItem `json:"items"`
	Error string     `json:"error,omitempty"`
}

type HostTime

type HostTime struct {
	UtcNow              string   `json:"utc_now"`
	RtcInSync           *bool    `json:"rtc_in_sync,omitempty"`
	NtpActive           *bool    `json:"ntp_active,omitempty"`
	TimesyncDaemon      string   `json:"timesync_daemon,omitempty"`
	OffsetMs            *float64 `json:"offset_ms,omitempty"`
	SkewVsServerSeconds *int     `json:"skew_vs_server_seconds,omitempty"`
}

type HostUsersSummary

type HostUsersSummary struct {
	NHuman          int          `json:"n_human,omitempty"`
	NSystem         int          `json:"n_system,omitempty"`
	NWithLoginShell int          `json:"n_with_login_shell,omitempty"`
	NUidZero        int          `json:"n_uid_zero,omitempty"`
	Sample          []UserSample `json:"sample,omitempty"`
	Error           string       `json:"error,omitempty"`
}

type IdentityAccessAndAuthenticationComponent added in v0.2.0

type IdentityAccessAndAuthenticationComponent struct {
	HostUsersSummary          *HostUsersSummary          `json:"host_users_summary,omitempty"`
	HostSSH                   *HostSSH                   `json:"host_ssh,omitempty"`
	ShadowAccountSummary      *ShadowAccountSummary      `json:"shadow_account_summary,omitempty"`
	DuplicateUidGid           *DuplicateUidGid           `json:"duplicate_uid_gid,omitempty"`
	PasswordPolicyFingerprint *PasswordPolicyFingerprint `json:"password_policy_fingerprint,omitempty"`
	SudoersAudit              *SudoersAudit              `json:"sudoers_audit,omitempty"`
}

type IfaceAddress

type IfaceAddress struct {
	IP    string `json:"ip"`
	Scope string `json:"scope"`
}

type KernelModulesBlock added in v0.2.0

type KernelModulesBlock struct {
	Names           []string `json:"names"`
	DenylistMatches []string `json:"denylist_matches,omitempty"`
	Error           string   `json:"error,omitempty"`
}

KernelModulesBlock lists loaded modules (capped) with optional denylist hits.

type KubeletNodeFingerprint added in v0.2.0

type KubeletNodeFingerprint struct {
	KubeletBinaryPath     string   `json:"kubelet_binary_path,omitempty"`
	ConfigSourcePaths     []string `json:"config_source_paths,omitempty"`
	ReadOnlyPort          *int     `json:"read_only_port,omitempty"`
	ProtectKernelDefaults *bool    `json:"protect_kernel_defaults,omitempty"`
	AnonymousAuthEnabled  *bool    `json:"anonymous_auth_enabled,omitempty"`
	DropInExecSampleLines []string `json:"drop_in_exec_sample_lines,omitempty"`
	Error                 string   `json:"error,omitempty"`
}

KubeletNodeFingerprint captures bounded kubelet config hints when the node runs Kubernetes.

type LegacyInsecureServices added in v0.2.0

type LegacyInsecureServices struct {
	TelnetSuspected          bool     `json:"telnet_suspected"`
	RshSuspected             bool     `json:"rsh_suspected"`
	RloginSuspected          bool     `json:"rlogin_suspected"`
	RexecSuspected           bool     `json:"rexec_suspected"`
	VsftpdSuspected          bool     `json:"vsftpd_suspected"`
	ProftpdSuspected         bool     `json:"proftpd_suspected"`
	InetdConfPresent         bool     `json:"inetd_conf_present"`
	InetdConfNonCommentLines int      `json:"inetd_conf_non_comment_lines"`
	SystemdUnitNamesSample   []string `json:"systemd_unit_names_sample,omitempty"`
	Error                    string   `json:"error,omitempty"`
}

LegacyInsecureServices reports presence-only hints for legacy network services.

type Listener

type Listener struct {
	Port               int    `json:"port"`
	Bind               string `json:"bind"`
	Process            string `json:"process"`
	ListenPid          int32  `json:"listen_pid,omitempty"`
	SystemdUnit        string `json:"systemd_unit,omitempty"`
	SystemdUnitMissing bool   `json:"systemd_unit_missing,omitempty"`
	BindScope          string `json:"bind_scope,omitempty"`
	ExposureRisk       string `json:"exposure_risk,omitempty"`
	FirewallRule       string `json:"firewall_rule,omitempty"`
	LanFirewallRule    string `json:"lan_firewall_rule,omitempty"`
	WanFirewallRule    string `json:"wan_firewall_rule,omitempty"`
}

type LoggingAndSystemAuditingComponent added in v0.2.0

type LoggingAndSystemAuditingComponent struct {
	AuditSections []AuditSection `json:"audit_sections,omitempty"`
}

type MountOptionsAudit added in v0.2.0

type MountOptionsAudit struct {
	Paths []MountPathSignals `json:"paths,omitempty"`
	Error string             `json:"error,omitempty"`
}

MountOptionsAudit compares fstab and live mount options for standard hardening paths.

type MountPathSignals added in v0.2.0

type MountPathSignals struct {
	Mountpoint       string `json:"mountpoint"`
	InFstab          bool   `json:"in_fstab"`
	FstabOptions     string `json:"fstab_options,omitempty"`
	LiveMountOptions string `json:"live_mount_options,omitempty"`
	Nodev            bool   `json:"nodev"`
	Nosuid           bool   `json:"nosuid"`
	Noexec           bool   `json:"noexec"`
}

MountPathSignals reports nodev/nosuid/noexec from live mounts (preferred) or fstab.

type MtaFingerprint added in v0.2.0

type MtaFingerprint struct {
	DetectedMta                              string   `json:"detected_mta,omitempty"`
	PostfixInetInterfaces                    string   `json:"postfix_inet_interfaces,omitempty"`
	PostfixMynetworksStyle                   string   `json:"postfix_mynetworks_style,omitempty"`
	PostfixSmtpdRecipientRestrictionsPresent *bool    `json:"postfix_smtpd_recipient_restrictions_present,omitempty"`
	EximConfigPath                           string   `json:"exim_config_path,omitempty"`
	EximRelayDomainsHintSample               []string `json:"exim_relay_domains_hint_sample,omitempty"`
	SendmailCfPathPresent                    *bool    `json:"sendmail_cf_path_present,omitempty"`
	SendmailLinesSample                      []string `json:"sendmail_lines_sample,omitempty"`
	Error                                    string   `json:"error,omitempty"`
}

MtaFingerprint is MTA presence and bounded relay/bind hints (no queue contents).

type NetworkAndHostFirewallComponent added in v0.2.0

type NetworkAndHostFirewallComponent struct {
	Listeners              []Listener              `json:"listeners"`
	HostNetwork            *HostNetwork            `json:"host_network,omitempty"`
	Firewall               *Firewall               `json:"firewall,omitempty"`
	TcpWrappersFingerprint *TcpWrappersFingerprint `json:"tcp_wrappers_fingerprint,omitempty"`
	LegacyInsecureServices *LegacyInsecureServices `json:"legacy_insecure_services,omitempty"`
}

type NetworkIface

type NetworkIface struct {
	Name           string         `json:"name"`
	Type           string         `json:"type"`
	IsDockerBridge *bool          `json:"is_docker_bridge,omitempty"`
	Ipv6Enabled    *bool          `json:"ipv6_enabled,omitempty"`
	Promiscuous    *bool          `json:"promiscuous,omitempty"`
	Addresses      []IfaceAddress `json:"addresses,omitempty"`
}

type NfsExportEntry added in v0.2.0

type NfsExportEntry struct {
	Index                      int    `json:"index"`
	PathHash                   string `json:"path_hash"`
	CombinedOptionsFingerprint string `json:"combined_options_fingerprint"`
	HasNoRootSquash            bool   `json:"has_no_root_squash"`
	HasRootSquash              bool   `json:"has_root_squash"`
	SecModeHint                string `json:"sec_mode_hint,omitempty"`
}

NfsExportEntry is one export line fingerprint (path hashed).

type NfsExportsFingerprint added in v0.2.0

type NfsExportsFingerprint struct {
	ExportsReadable bool             `json:"exports_readable"`
	Entries         []NfsExportEntry `json:"entries,omitempty"`
	Error           string           `json:"error,omitempty"`
}

NfsExportsFingerprint summarizes /etc/exports with hashed paths (no raw export paths).

type OSInfo

type OSInfo struct {
	Pretty             string `json:"pretty"`
	Kernel             string `json:"kernel"`
	KernelArch         string `json:"kernel_arch,omitempty"`
	DistroID           string `json:"distro_id,omitempty"`
	DistroName         string `json:"distro_name,omitempty"`
	DistroVersionID    string `json:"distro_version_id,omitempty"`
	OSReleaseID        string `json:"os_release_id,omitempty"`
	OSReleaseVersionID string `json:"os_release_version_id,omitempty"`
	OSReleaseVersion   string `json:"os_release_version,omitempty"`
	OSReleaseName      string `json:"os_release_name,omitempty"`
	Platform           string `json:"platform,omitempty"`
	PlatformFamily     string `json:"platform_family,omitempty"`
	PlatformVersion    string `json:"platform_version,omitempty"`
}

type OtherComponent added in v0.2.0

type OtherComponent struct{}

OtherComponent is reserved; send {} until extensions are defined.

type PackagesUpdates

type PackagesUpdates struct {
	Manager                    string   `json:"manager,omitempty"`
	LastPackageIndexRefreshUTC string   `json:"last_package_index_refresh_utc,omitempty"`
	InstalledPackageCount      int      `json:"installed_package_count"`
	PendingUpdatesCount        int      `json:"pending_updates_count"`
	SecurityUpdatesCount       int      `json:"security_updates_count"`
	SecurityUpdatesSample      []string `json:"security_updates_sample,omitempty"`
	Error                      string   `json:"error,omitempty"`
}

type PasswordPolicyFingerprint added in v0.2.0

type PasswordPolicyFingerprint struct {
	PwqualityKeys             []PwqualityKV `json:"pwquality_keys,omitempty"`
	PamPasswordRequisiteLines []string      `json:"pam_password_requisite_lines,omitempty"`
	Error                     string        `json:"error,omitempty"`
}

PasswordPolicyFingerprint reads pwquality.conf and PAM password stack lines (no secrets).

type PathEntry

type PathEntry struct {
	Path          string `json:"path"`
	Exists        bool   `json:"exists"`
	WorldWritable bool   `json:"world_writable"`
}

type PathPermissionsAudit added in v0.2.0

type PathPermissionsAudit struct {
	TmpStickyBitPresent     *bool      `json:"tmp_sticky_bit_present,omitempty"`
	WorldWritableDirsSample []string   `json:"world_writable_dirs_sample,omitempty"`
	SgidItemsSample         []SgidItem `json:"sgid_items_sample,omitempty"`
	UnownedFilesSample      []string   `json:"unowned_files_sample,omitempty"`
	Error                   string     `json:"error,omitempty"`
}

PathPermissionsAudit extends path posture: sticky /tmp, WW dirs, SGID, unowned samples.

type ProcessSignals

type ProcessSignals struct {
	InterpreterPython  int `json:"interpreter_python,omitempty"`
	InterpreterNode    int `json:"interpreter_node,omitempty"`
	InterpreterJava    int `json:"interpreter_java,omitempty"`
	UnknownHashWorkers int `json:"unknown_hash_workers,omitempty"`
}

type ProcessTopEntry

type ProcessTopEntry struct {
	Pid    int32   `json:"pid"`
	Name   string  `json:"name"`
	User   string  `json:"user"`
	CpuPct float64 `json:"cpu_pct"`
	RssMb  float64 `json:"rss_mb"`
}

type PwqualityKV added in v0.2.0

type PwqualityKV struct {
	Key   string `json:"key"`
	Value string `json:"value"`
}

PwqualityKV is one non-secret pwquality.conf assignment.

type RedisExposureFingerprint added in v0.2.0

type RedisExposureFingerprint struct {
	UnitActiveState    string `json:"unit_active_state,omitempty"`
	ConfigPathUsed     string `json:"config_path_used,omitempty"`
	Bind               string `json:"bind,omitempty"`
	Port               *int   `json:"port,omitempty"`
	ProtectedMode      string `json:"protected_mode,omitempty"`
	RequirepassPresent *bool  `json:"requirepass_present,omitempty"`
	Error              string `json:"error,omitempty"`
}

RedisExposureFingerprint is non-secret redis.conf exposure hints plus unit state.

type RuntimeEntry

type RuntimeEntry struct {
	Kind       string `json:"kind"`
	Version    string `json:"version"`
	BinaryPath string `json:"binary_path"`
	ManagedBy  string `json:"managed_by"`
}

type SecurityFrameworksAndMalwareDefenseComponent added in v0.2.0

type SecurityFrameworksAndMalwareDefenseComponent struct{}

SecurityFrameworksAndMalwareDefenseComponent is reserved for AV/EDR/fim product signals; process inventory lives under core_system_and_kernel.host_process.

type SelinuxApparmorBlock added in v0.2.0

type SelinuxApparmorBlock struct {
	SelinuxMode     string `json:"selinux_mode,omitempty"`
	ApparmorSummary string `json:"apparmor_summary,omitempty"`
	Error           string `json:"error,omitempty"`
}

SelinuxApparmorBlock reports MAC posture (no policy dump).

type ServiceEntry

type ServiceEntry struct {
	Name          string `json:"name"`
	Manager       string `json:"manager"`
	Enabled       *bool  `json:"enabled,omitempty"`
	ActiveState   string `json:"active_state,omitempty"`
	UnitFileState string `json:"unit_file_state,omitempty"`
}

type ServicesBlock

type ServicesBlock struct {
	Items []ServiceEntry `json:"items"`
	Error string         `json:"error,omitempty"`
}

type SgidItem added in v0.2.0

type SgidItem struct {
	Path  string `json:"path"`
	Owner string `json:"owner"`
	Mode  string `json:"mode"`
}

SgidItem is a bounded setgid file entry (same shape idea as SuidItem).

type ShadowAccountSummary added in v0.2.0

type ShadowAccountSummary struct {
	ShadowReadable                   bool   `json:"shadow_readable"`
	AccountsLockedCount              int    `json:"accounts_locked_count"`
	AccountsNoLoginPasswordCount     int    `json:"accounts_no_login_password_count"`
	AccountsPasswordExpiredHintCount int    `json:"accounts_password_expired_hint_count"`
	AccountsNeverLoggedInHintCount   int    `json:"accounts_never_logged_in_hint_count"`
	Error                            string `json:"error,omitempty"`
}

ShadowAccountSummary is non-secret metadata from /etc/shadow (no hash material).

type SoftwarePackagesAndApplicationsComponent added in v0.2.0

type SoftwarePackagesAndApplicationsComponent struct {
	Services                 ServicesBlock             `json:"services"`
	PackagesUpdates          *PackagesUpdates          `json:"packages_updates,omitempty"`
	HostBackup               *HostBackup               `json:"host_backup,omitempty"`
	HostRuntimes             *HostRuntimes             `json:"host_runtimes,omitempty"`
	WebDbServersFingerprint  *WebDbServersFingerprint  `json:"web_db_servers_fingerprint,omitempty"`
	RedisExposureFingerprint *RedisExposureFingerprint `json:"redis_exposure_fingerprint,omitempty"`
	CronTimersInventory      *CronTimersInventory      `json:"cron_timers_inventory,omitempty"`
	CupsExposureFingerprint  *CupsExposureFingerprint  `json:"cups_exposure_fingerprint,omitempty"`
	MtaFingerprint           *MtaFingerprint           `json:"mta_fingerprint,omitempty"`
}

type SudoersAudit added in v0.2.0

type SudoersAudit struct {
	FilesScanned                     []string `json:"files_scanned,omitempty"`
	NopasswdMentionCount             int      `json:"nopasswd_mention_count"`
	AllAllPatternCount               int      `json:"all_all_pattern_count"`
	WildcardRiskLineCount            int      `json:"wildcard_risk_line_count"`
	IncludedirCount                  int      `json:"includedir_count"`
	DefaultsRequirettyPresent        bool     `json:"defaults_requiretty_present"`
	DefaultsUsePtyPresent            bool     `json:"defaults_use_pty_present"`
	DefaultsVisiblepwInvertedPresent bool     `json:"defaults_visiblepw_inverted_present"`
	Error                            string   `json:"error,omitempty"`
}

SudoersAudit is structural sudoers signal without transmitting full rule bodies. When Error is set, MarshalJSON emits only "error" (no zero-valued counters or flags).

func (SudoersAudit) MarshalJSON added in v0.2.0

func (s SudoersAudit) MarshalJSON() ([]byte, error)

type SuidItem

type SuidItem struct {
	Path  string `json:"path"`
	Owner string `json:"owner"`
	Mode  string `json:"mode"`
}

type SysctlDriftEntry added in v0.2.0

type SysctlDriftEntry struct {
	Key       string `json:"key"`
	FileValue string `json:"file_value,omitempty"`
	LiveValue string `json:"live_value,omitempty"`
}

SysctlDriftEntry compares file-based sysctl vs live kernel.

type SysctlKV added in v0.2.0

type SysctlKV struct {
	Key   string `json:"key"`
	Value string `json:"value"`
}

SysctlKV is one sysctl key (dotted) and live string from /proc/sys.

type SysctlLiveBlock added in v0.2.0

type SysctlLiveBlock struct {
	Items []SysctlKV `json:"items"`
	Error string     `json:"error,omitempty"`
}

SysctlLiveBlock is a bounded CIS/STIG-style allowlist read from /proc/sys.

type SysctlOverlayBlock added in v0.2.0

type SysctlOverlayBlock struct {
	ParsedFiles []string           `json:"parsed_files,omitempty"`
	Drift       []SysctlDriftEntry `json:"drift,omitempty"`
	Error       string             `json:"error,omitempty"`
}

SysctlOverlayBlock parses sysctl.conf / sysctl.d and detects drift vs live.

type SystemdHealth added in v0.2.0

type SystemdHealth struct {
	SystemdPresent   bool   `json:"systemd_present"`
	DefaultTarget    string `json:"default_target,omitempty"`
	IsSystemRunning  string `json:"is_system_running,omitempty"`
	FailedUnitsCount *int   `json:"failed_units_count,omitempty"`
	LegacyRunlevel   string `json:"legacy_runlevel,omitempty"`
	Error            string `json:"error,omitempty"`
}

SystemdHealth is get-default / is-system-running / failed units (bounded).

type TcpWrappersFingerprint added in v0.2.0

type TcpWrappersFingerprint struct {
	HostsAllowPresent     bool     `json:"hosts_allow_present"`
	HostsDenyPresent      bool     `json:"hosts_deny_present"`
	HostsAllowLineCount   int      `json:"hosts_allow_line_count"`
	HostsDenyLineCount    int      `json:"hosts_deny_line_count"`
	HostsAllowSampleLines []string `json:"hosts_allow_sample_lines,omitempty"`
	HostsDenySampleLines  []string `json:"hosts_deny_sample_lines,omitempty"`
	Error                 string   `json:"error,omitempty"`
}

TcpWrappersFingerprint summarizes hosts.allow / hosts.deny without deep semantics.

type UsbStoragePosture added in v0.2.0

type UsbStoragePosture struct {
	UsbStorageLoaded               bool     `json:"usb_storage_loaded"`
	BlacklistUsbStorageLinePresent bool     `json:"blacklist_usb_storage_line_present"`
	ModprobeFragmentLinesSample    []string `json:"modprobe_fragment_lines_sample,omitempty"`
	Error                          string   `json:"error,omitempty"`
}

UsbStoragePosture reports usb_storage module and modprobe blacklist hints.

type UserSample

type UserSample struct {
	UID   int    `json:"uid"`
	GID   int    `json:"gid"`
	Shell string `json:"shell"`
}

UserSample is intentionally free of login names and home paths (PII); uid/gid/shell only.

type V1

type V1 struct {
	SchemaVersion int        `json:"schema_version"`
	MachineUUID   string     `json:"machine_uuid"`
	ScanSeq       int        `json:"scan_seq"`
	Hostname      string     `json:"hostname,omitempty"`
	Fqdn          string     `json:"fqdn,omitempty"`
	Components    Components `json:"components"`
}

V1 is the only supported ingest shape for schema_version == 1.

type WebDbServersFingerprint added in v0.2.0

type WebDbServersFingerprint struct {
	NginxServerTokens         string `json:"nginx_server_tokens,omitempty"`
	NginxConfigPathUsed       string `json:"nginx_config_path_used,omitempty"`
	ApacheServerTokens        string `json:"apache_server_tokens,omitempty"`
	ApacheServerSignature     string `json:"apache_server_signature,omitempty"`
	ApacheConfigPathUsed      string `json:"apache_config_path_used,omitempty"`
	MysqlBindAddress          string `json:"mysql_bind_address,omitempty"`
	MysqlConfigPathUsed       string `json:"mysql_config_path_used,omitempty"`
	PostgresqlListenAddresses string `json:"postgresql_listen_addresses,omitempty"`
	PostgresqlSsl             string `json:"postgresql_ssl,omitempty"`
	PostgresqlConfigPathUsed  string `json:"postgresql_config_path_used,omitempty"`
	Error                     string `json:"error,omitempty"`
}

WebDbServersFingerprint captures bounded web/DB server config hints (no secrets).

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL