Documentation
¶
Overview ¶
Package payload defines the v1 ingest envelope (mirrors api/ingest.v1.schema.json). Facts live only under components.*; per-port firewall posture is listeners[].firewall_rule.
Index ¶
- Constants
- func AgentUtcRFC3339(t time.Time) string
- type AuditCheck
- type AuditSection
- type Components
- type ContainerAndCloudNativeLinuxComponent
- type ContainerNativeHostRuntimes
- type CoreSystemAndKernelComponent
- type CronTimersInventory
- type CryptStorageHint
- type CryptographyComponent
- type CupsExposureFingerprint
- type DockerHostFingerprint
- type DuplicateIDEntry
- type DuplicateUidGid
- type FileIntegrityTooling
- type FileSystemAndStorageComponent
- type FilesystemEntry
- type Firewall
- type FirmwareBoot
- type GrubSnapshot
- type HighRiskProcessEntry
- type HighRiskProcessSurface
- type HostBackup
- type HostDisk
- type HostNetwork
- type HostPath
- type HostProcess
- type HostRuntimes
- type HostSSH
- type HostSuid
- type HostTime
- type HostUsersSummary
- type IdentityAccessAndAuthenticationComponent
- type IfaceAddress
- type KernelModulesBlock
- type KubeletNodeFingerprint
- type LegacyInsecureServices
- type Listener
- type LoggingAndSystemAuditingComponent
- type MountOptionsAudit
- type MountPathSignals
- type MtaFingerprint
- type NetworkAndHostFirewallComponent
- type NetworkIface
- type NfsExportEntry
- type NfsExportsFingerprint
- type OSInfo
- type OtherComponent
- type PackagesUpdates
- type PasswordPolicyFingerprint
- type PathEntry
- type PathPermissionsAudit
- type ProcessSignals
- type ProcessTopEntry
- type PwqualityKV
- type RedisExposureFingerprint
- type RuntimeEntry
- type SecurityFrameworksAndMalwareDefenseComponent
- type SelinuxApparmorBlock
- type ServiceEntry
- type ServicesBlock
- type SgidItem
- type ShadowAccountSummary
- type SoftwarePackagesAndApplicationsComponent
- type SudoersAudit
- type SuidItem
- type SysctlDriftEntry
- type SysctlKV
- type SysctlLiveBlock
- type SysctlOverlayBlock
- type SystemdHealth
- type TcpWrappersFingerprint
- type UsbStoragePosture
- type UserSample
- type V1
- type WebDbServersFingerprint
Constants ¶
const ( FirewallRuleFiltered = "filtered" FirewallRuleUnfiltered = "unfiltered" FirewallRuleBlocked = "blocked" FirewallRuleUnknown = "unknown" )
Variables ¶
This section is empty.
Functions ¶
func AgentUtcRFC3339 ¶
Types ¶
type AuditCheck ¶
type AuditSection ¶
type AuditSection struct {
ID string `json:"id"`
Title string `json:"title"`
Checks []AuditCheck `json:"checks"`
}
type Components ¶ added in v0.2.0
type Components struct {
CoreSystemAndKernel CoreSystemAndKernelComponent `json:"core_system_and_kernel"`
IdentityAccessAndAuthentication IdentityAccessAndAuthenticationComponent `json:"identity_access_and_authentication"`
FileSystemAndStorage FileSystemAndStorageComponent `json:"file_system_and_storage"`
NetworkAndHostFirewall NetworkAndHostFirewallComponent `json:"network_and_host_firewall"`
SoftwarePackagesAndApplications SoftwarePackagesAndApplicationsComponent `json:"software_packages_and_applications"`
ContainerAndCloudNativeLinux ContainerAndCloudNativeLinuxComponent `json:"container_and_cloud_native_linux"`
LoggingAndSystemAuditing LoggingAndSystemAuditingComponent `json:"logging_and_system_auditing"`
Cryptography CryptographyComponent `json:"cryptography"`
SecurityFrameworksAndMalwareDefense SecurityFrameworksAndMalwareDefenseComponent `json:"security_frameworks_and_malware_defense"`
Other OtherComponent `json:"other"`
}
Components groups inventory by competitor-audited sections (RBAC boundary).
type ContainerAndCloudNativeLinuxComponent ¶ added in v0.2.0
type ContainerAndCloudNativeLinuxComponent struct {
HostRuntimes *ContainerNativeHostRuntimes `json:"host_runtimes,omitempty"`
}
type ContainerNativeHostRuntimes ¶ added in v0.2.0
type ContainerNativeHostRuntimes struct {
Docker *DockerHostFingerprint `json:"docker,omitempty"`
Kubelet *KubeletNodeFingerprint `json:"kubelet,omitempty"`
Error string `json:"error,omitempty"`
}
ContainerNativeHostRuntimes is §6 host_runtimes: Docker daemon and kubelet hints only (no language runtime items).
type CoreSystemAndKernelComponent ¶ added in v0.2.0
type CoreSystemAndKernelComponent struct {
OS OSInfo `json:"os"`
HostTime *HostTime `json:"host_time,omitempty"`
HostProcess *HostProcess `json:"host_process,omitempty"`
Grub *GrubSnapshot `json:"grub,omitempty"`
FirmwareBoot *FirmwareBoot `json:"firmware_boot,omitempty"`
SystemdHealth *SystemdHealth `json:"systemd_health,omitempty"`
SysctlLive *SysctlLiveBlock `json:"sysctl_live,omitempty"`
SysctlOverlay *SysctlOverlayBlock `json:"sysctl_overlay,omitempty"`
KernelModules *KernelModulesBlock `json:"kernel_modules,omitempty"`
SelinuxApparmor *SelinuxApparmorBlock `json:"selinux_apparmor,omitempty"`
HighRiskProcess *HighRiskProcessSurface `json:"high_risk_process,omitempty"`
}
type CronTimersInventory ¶ added in v0.2.0
type CronTimersInventory struct {
SystemCrontabLineCount int `json:"system_crontab_line_count"`
SystemCrontabSample []string `json:"system_crontab_sample,omitempty"`
CronDropinFileNamesSample []string `json:"cron_dropin_file_names_sample,omitempty"`
UserCrontabsPresentCount int `json:"user_crontabs_present_count"`
UserCrontabUsersSample []string `json:"user_crontab_users_sample,omitempty"`
UserCrontabLinesSample []string `json:"user_crontab_lines_sample,omitempty"`
CronVarSpoolModeOctal string `json:"cron_var_spool_mode_octal,omitempty"`
SystemdTimersCount int `json:"systemd_timers_count"`
SystemdTimerUnitsSample []string `json:"systemd_timer_units_sample,omitempty"`
Error string `json:"error,omitempty"`
}
CronTimersInventory summarizes cron files, user crontabs, and systemd timers.
type CryptStorageHint ¶ added in v0.2.0
type CryptStorageHint struct {
CrypttabReadable bool `json:"crypttab_readable"`
CrypttabEntryCount int `json:"crypttab_entry_count"`
CrypttabMapperNamesSample []string `json:"crypttab_mapper_names_sample,omitempty"`
LsblkCryptVolumeCount int `json:"lsblk_crypt_volume_count"`
LsblkCryptNamesSample []string `json:"lsblk_crypt_names_sample,omitempty"`
Error string `json:"error,omitempty"`
}
CryptStorageHint summarizes crypttab and lsblk crypt volumes (no keys).
type CryptographyComponent ¶ added in v0.2.0
type CryptographyComponent struct{}
CryptographyComponent is reserved for TLS/cert inventory; time lives under core_system_and_kernel.host_time.
type CupsExposureFingerprint ¶ added in v0.2.0
type CupsExposureFingerprint struct {
UnitActiveState string `json:"unit_active_state,omitempty"`
ListenLinesSample []string `json:"listen_lines_sample,omitempty"`
WebInterfaceLinesSample []string `json:"web_interface_lines_sample,omitempty"`
Error string `json:"error,omitempty"`
}
CupsExposureFingerprint is CUPS unit state and bounded config lines.
type DockerHostFingerprint ¶ added in v0.2.0
type DockerHostFingerprint struct {
DockerCliPath string `json:"docker_cli_path,omitempty"`
DaemonJSONPath string `json:"daemon_json_path,omitempty"`
LiveRestore *bool `json:"live_restore,omitempty"`
Icc *bool `json:"icc,omitempty"`
UserlandProxy *bool `json:"userland_proxy,omitempty"`
TlsInDaemonJSON *bool `json:"tls_in_daemon_json,omitempty"`
TlsVerifyInDaemonJSON *bool `json:"tls_verify_in_daemon_json,omitempty"`
ContainerCount *int `json:"container_count,omitempty"`
RootlessHint string `json:"rootless_hint,omitempty"`
DockerSockPath string `json:"docker_sock_path,omitempty"`
DockerSockModeOctal string `json:"docker_sock_mode_octal,omitempty"`
DockerSockOwnerUID *int `json:"docker_sock_owner_uid,omitempty"`
DockerSockGroupGID *int `json:"docker_sock_group_gid,omitempty"`
Error string `json:"error,omitempty"`
}
DockerHostFingerprint is non-secret Docker daemon posture (CIS-style hints).
type DuplicateIDEntry ¶ added in v0.2.0
DuplicateIDEntry lists a numeric ID shared by more than one account (names capped for audit).
type DuplicateUidGid ¶ added in v0.2.0
type DuplicateUidGid struct {
DuplicateUidCount int `json:"duplicate_uid_count"`
DuplicateGidCount int `json:"duplicate_gid_count"`
DuplicateUids []DuplicateIDEntry `json:"duplicate_uids,omitempty"`
DuplicateGids []DuplicateIDEntry `json:"duplicate_gids,omitempty"`
Error string `json:"error,omitempty"`
}
DuplicateUidGid reports passwd/group collisions (bounded names per ID).
type FileIntegrityTooling ¶ added in v0.2.0
type FileIntegrityTooling struct {
AideSuspected bool `json:"aide_suspected"`
TripwireSuspected bool `json:"tripwire_suspected"`
EvidencePaths []string `json:"evidence_paths,omitempty"`
SystemdUnitsSample []string `json:"systemd_units_sample,omitempty"`
LatestDbUtcHint string `json:"latest_db_utc_hint,omitempty"`
Error string `json:"error,omitempty"`
}
FileIntegrityTooling detects AIDE/Tripwire-style tooling without uploading databases.
type FileSystemAndStorageComponent ¶ added in v0.2.0
type FileSystemAndStorageComponent struct {
HostDisk *HostDisk `json:"host_disk,omitempty"`
HostPath *HostPath `json:"host_path,omitempty"`
HostSuid *HostSuid `json:"host_suid,omitempty"`
MountOptionsAudit *MountOptionsAudit `json:"mount_options_audit,omitempty"`
PathPermissionsAudit *PathPermissionsAudit `json:"path_permissions_audit,omitempty"`
UsbStoragePosture *UsbStoragePosture `json:"usb_storage_posture,omitempty"`
FileIntegrityTooling *FileIntegrityTooling `json:"file_integrity_tooling,omitempty"`
CryptStorageHint *CryptStorageHint `json:"crypt_storage_hint,omitempty"`
NfsExportsFingerprint *NfsExportsFingerprint `json:"nfs_exports_fingerprint,omitempty"`
}
type FilesystemEntry ¶
type Firewall ¶
type Firewall struct {
Family string `json:"firewall_family"`
Active bool `json:"active"`
DefaultPolicyIn string `json:"default_policy_in,omitempty"`
DefaultPolicyOut string `json:"default_policy_out,omitempty"`
RuleCount *int `json:"rule_count,omitempty"`
HasEstablishedRelated *bool `json:"has_established_related,omitempty"`
FirewalldDefaultZone string `json:"firewalld_default_zone,omitempty"`
FirewalldZoneTarget string `json:"firewalld_zone_target,omitempty"`
UfwStatusVerboseSample []string `json:"ufw_status_verbose_sample,omitempty"`
BackendRulesetSha256Hex string `json:"backend_ruleset_sha256,omitempty"`
BackendRulesetExcerpt string `json:"backend_ruleset_excerpt,omitempty"`
Error string `json:"error,omitempty"`
}
type FirmwareBoot ¶ added in v0.2.0
type FirmwareBoot struct {
BootMode string `json:"boot_mode"`
EfiSysfsPresent bool `json:"efi_sysfs_present"`
EfibootmgrExitZero bool `json:"efibootmgr_exit_zero,omitempty"`
Error string `json:"error,omitempty"`
}
FirmwareBoot hints UEFI vs BIOS without requiring root.
type GrubSnapshot ¶ added in v0.2.0
type GrubSnapshot struct {
DefaultGrubPath string `json:"default_grub_path,omitempty"`
GrubCmdlineLinux string `json:"grub_cmdline_linux,omitempty"`
GrubTimeout string `json:"grub_timeout,omitempty"`
PasswordReferencePresent *bool `json:"password_reference_present,omitempty"`
GrubCfgReadablePath string `json:"grub_cfg_readable_path,omitempty"`
Error string `json:"error,omitempty"`
}
GrubSnapshot is parsed /etc/default/grub (and optional readable grub.cfg path); no secret values.
type HighRiskProcessEntry ¶ added in v0.2.0
type HighRiskProcessEntry struct {
Pid int32 `json:"pid"`
User string `json:"user"`
ExePath string `json:"exe_path,omitempty"`
BinaryDeleted bool `json:"binary_deleted"`
CmdlineEmpty bool `json:"cmdline_empty"`
ListenerPorts []int `json:"listener_ports,omitempty"`
Reason string `json:"reason,omitempty"`
}
HighRiskProcessEntry is one bounded process row.
type HighRiskProcessSurface ¶ added in v0.2.0
type HighRiskProcessSurface struct {
Items []HighRiskProcessEntry `json:"items"`
Error string `json:"error,omitempty"`
}
HighRiskProcessSurface samples listeners and root-owned processes with exe/cmdline hints.
type HostBackup ¶
type HostDisk ¶
type HostDisk struct {
Filesystems []FilesystemEntry `json:"filesystems,omitempty"`
Error string `json:"error,omitempty"`
}
type HostNetwork ¶
type HostNetwork struct {
DefaultRouteVia string `json:"default_route_via,omitempty"`
HasPublicIPv4 *bool `json:"has_public_ipv4,omitempty"`
HasPublicIPv6 *bool `json:"has_public_ipv6,omitempty"`
PublicIPCandidates []string `json:"public_ip_candidates,omitempty"`
Interfaces []NetworkIface `json:"interfaces,omitempty"`
ResolvConfNameservers []string `json:"resolv_conf_nameservers,omitempty"`
ResolvConfSearchDomains []string `json:"resolv_conf_search_domains,omitempty"`
ResolvConfSampleLines []string `json:"resolv_conf_sample_lines,omitempty"`
SystemdResolvedStub *bool `json:"systemd_resolved_stub,omitempty"`
Error string `json:"error,omitempty"`
}
type HostProcess ¶
type HostProcess struct {
Top []ProcessTopEntry `json:"top"`
Signals *ProcessSignals `json:"signals,omitempty"`
Error string `json:"error,omitempty"`
}
type HostRuntimes ¶
type HostRuntimes struct {
Items []RuntimeEntry `json:"items"`
Docker *DockerHostFingerprint `json:"docker,omitempty"`
Kubelet *KubeletNodeFingerprint `json:"kubelet,omitempty"`
Error string `json:"error,omitempty"`
}
type HostSSH ¶
type HostSSH struct {
PermitRootLogin string `json:"permit_root_login,omitempty"`
PasswordAuthentication string `json:"password_authentication,omitempty"`
ChallengeResponseAuth string `json:"challenge_response_auth,omitempty"`
KexAlgorithmsSample []string `json:"kex_algorithms_sample,omitempty"`
CiphersSample []string `json:"ciphers_sample,omitempty"`
ListenAddresses []string `json:"listen_addresses,omitempty"`
MaxAuthTries *int `json:"max_auth_tries,omitempty"`
ClientAliveIntervalSeconds *int `json:"client_alive_interval_seconds,omitempty"`
ClientAliveCountMax *int `json:"client_alive_count_max,omitempty"`
AllowUsersPresent *bool `json:"allow_users_present,omitempty"`
DenyUsersPresent *bool `json:"deny_users_present,omitempty"`
Subsystem string `json:"subsystem,omitempty"`
UsePAM string `json:"use_pam,omitempty"`
X11Forwarding string `json:"x11_forwarding,omitempty"`
Error string `json:"error,omitempty"`
}
type HostTime ¶
type HostTime struct {
UtcNow string `json:"utc_now"`
RtcInSync *bool `json:"rtc_in_sync,omitempty"`
NtpActive *bool `json:"ntp_active,omitempty"`
TimesyncDaemon string `json:"timesync_daemon,omitempty"`
OffsetMs *float64 `json:"offset_ms,omitempty"`
SkewVsServerSeconds *int `json:"skew_vs_server_seconds,omitempty"`
}
type HostUsersSummary ¶
type IdentityAccessAndAuthenticationComponent ¶ added in v0.2.0
type IdentityAccessAndAuthenticationComponent struct {
HostUsersSummary *HostUsersSummary `json:"host_users_summary,omitempty"`
HostSSH *HostSSH `json:"host_ssh,omitempty"`
ShadowAccountSummary *ShadowAccountSummary `json:"shadow_account_summary,omitempty"`
DuplicateUidGid *DuplicateUidGid `json:"duplicate_uid_gid,omitempty"`
PasswordPolicyFingerprint *PasswordPolicyFingerprint `json:"password_policy_fingerprint,omitempty"`
SudoersAudit *SudoersAudit `json:"sudoers_audit,omitempty"`
}
type IfaceAddress ¶
type KernelModulesBlock ¶ added in v0.2.0
type KernelModulesBlock struct {
Names []string `json:"names"`
DenylistMatches []string `json:"denylist_matches,omitempty"`
Error string `json:"error,omitempty"`
}
KernelModulesBlock lists loaded modules (capped) with optional denylist hits.
type KubeletNodeFingerprint ¶ added in v0.2.0
type KubeletNodeFingerprint struct {
KubeletBinaryPath string `json:"kubelet_binary_path,omitempty"`
ConfigSourcePaths []string `json:"config_source_paths,omitempty"`
ReadOnlyPort *int `json:"read_only_port,omitempty"`
ProtectKernelDefaults *bool `json:"protect_kernel_defaults,omitempty"`
AnonymousAuthEnabled *bool `json:"anonymous_auth_enabled,omitempty"`
DropInExecSampleLines []string `json:"drop_in_exec_sample_lines,omitempty"`
Error string `json:"error,omitempty"`
}
KubeletNodeFingerprint captures bounded kubelet config hints when the node runs Kubernetes.
type LegacyInsecureServices ¶ added in v0.2.0
type LegacyInsecureServices struct {
TelnetSuspected bool `json:"telnet_suspected"`
RshSuspected bool `json:"rsh_suspected"`
RloginSuspected bool `json:"rlogin_suspected"`
RexecSuspected bool `json:"rexec_suspected"`
VsftpdSuspected bool `json:"vsftpd_suspected"`
ProftpdSuspected bool `json:"proftpd_suspected"`
InetdConfPresent bool `json:"inetd_conf_present"`
InetdConfNonCommentLines int `json:"inetd_conf_non_comment_lines"`
SystemdUnitNamesSample []string `json:"systemd_unit_names_sample,omitempty"`
Error string `json:"error,omitempty"`
}
LegacyInsecureServices reports presence-only hints for legacy network services.
type Listener ¶
type Listener struct {
Port int `json:"port"`
Bind string `json:"bind"`
Process string `json:"process"`
ListenPid int32 `json:"listen_pid,omitempty"`
SystemdUnit string `json:"systemd_unit,omitempty"`
SystemdUnitMissing bool `json:"systemd_unit_missing,omitempty"`
BindScope string `json:"bind_scope,omitempty"`
ExposureRisk string `json:"exposure_risk,omitempty"`
FirewallRule string `json:"firewall_rule,omitempty"`
LanFirewallRule string `json:"lan_firewall_rule,omitempty"`
WanFirewallRule string `json:"wan_firewall_rule,omitempty"`
}
type LoggingAndSystemAuditingComponent ¶ added in v0.2.0
type LoggingAndSystemAuditingComponent struct {
AuditSections []AuditSection `json:"audit_sections,omitempty"`
}
type MountOptionsAudit ¶ added in v0.2.0
type MountOptionsAudit struct {
Paths []MountPathSignals `json:"paths,omitempty"`
Error string `json:"error,omitempty"`
}
MountOptionsAudit compares fstab and live mount options for standard hardening paths.
type MountPathSignals ¶ added in v0.2.0
type MountPathSignals struct {
Mountpoint string `json:"mountpoint"`
InFstab bool `json:"in_fstab"`
FstabOptions string `json:"fstab_options,omitempty"`
LiveMountOptions string `json:"live_mount_options,omitempty"`
Nodev bool `json:"nodev"`
Nosuid bool `json:"nosuid"`
Noexec bool `json:"noexec"`
}
MountPathSignals reports nodev/nosuid/noexec from live mounts (preferred) or fstab.
type MtaFingerprint ¶ added in v0.2.0
type MtaFingerprint struct {
DetectedMta string `json:"detected_mta,omitempty"`
PostfixInetInterfaces string `json:"postfix_inet_interfaces,omitempty"`
PostfixMynetworksStyle string `json:"postfix_mynetworks_style,omitempty"`
PostfixSmtpdRecipientRestrictionsPresent *bool `json:"postfix_smtpd_recipient_restrictions_present,omitempty"`
EximConfigPath string `json:"exim_config_path,omitempty"`
EximRelayDomainsHintSample []string `json:"exim_relay_domains_hint_sample,omitempty"`
SendmailCfPathPresent *bool `json:"sendmail_cf_path_present,omitempty"`
SendmailLinesSample []string `json:"sendmail_lines_sample,omitempty"`
Error string `json:"error,omitempty"`
}
MtaFingerprint is MTA presence and bounded relay/bind hints (no queue contents).
type NetworkAndHostFirewallComponent ¶ added in v0.2.0
type NetworkAndHostFirewallComponent struct {
Listeners []Listener `json:"listeners"`
HostNetwork *HostNetwork `json:"host_network,omitempty"`
Firewall *Firewall `json:"firewall,omitempty"`
TcpWrappersFingerprint *TcpWrappersFingerprint `json:"tcp_wrappers_fingerprint,omitempty"`
LegacyInsecureServices *LegacyInsecureServices `json:"legacy_insecure_services,omitempty"`
}
type NetworkIface ¶
type NfsExportEntry ¶ added in v0.2.0
type NfsExportEntry struct {
Index int `json:"index"`
PathHash string `json:"path_hash"`
CombinedOptionsFingerprint string `json:"combined_options_fingerprint"`
HasNoRootSquash bool `json:"has_no_root_squash"`
HasRootSquash bool `json:"has_root_squash"`
SecModeHint string `json:"sec_mode_hint,omitempty"`
}
NfsExportEntry is one export line fingerprint (path hashed).
type NfsExportsFingerprint ¶ added in v0.2.0
type NfsExportsFingerprint struct {
ExportsReadable bool `json:"exports_readable"`
Entries []NfsExportEntry `json:"entries,omitempty"`
Error string `json:"error,omitempty"`
}
NfsExportsFingerprint summarizes /etc/exports with hashed paths (no raw export paths).
type OSInfo ¶
type OSInfo struct {
Pretty string `json:"pretty"`
Kernel string `json:"kernel"`
KernelArch string `json:"kernel_arch,omitempty"`
DistroID string `json:"distro_id,omitempty"`
DistroName string `json:"distro_name,omitempty"`
DistroVersionID string `json:"distro_version_id,omitempty"`
OSReleaseID string `json:"os_release_id,omitempty"`
OSReleaseVersionID string `json:"os_release_version_id,omitempty"`
OSReleaseVersion string `json:"os_release_version,omitempty"`
OSReleaseName string `json:"os_release_name,omitempty"`
Platform string `json:"platform,omitempty"`
PlatformFamily string `json:"platform_family,omitempty"`
PlatformVersion string `json:"platform_version,omitempty"`
}
type OtherComponent ¶ added in v0.2.0
type OtherComponent struct{}
OtherComponent is reserved; send {} until extensions are defined.
type PackagesUpdates ¶
type PackagesUpdates struct {
Manager string `json:"manager,omitempty"`
LastPackageIndexRefreshUTC string `json:"last_package_index_refresh_utc,omitempty"`
InstalledPackageCount int `json:"installed_package_count"`
PendingUpdatesCount int `json:"pending_updates_count"`
SecurityUpdatesCount int `json:"security_updates_count"`
SecurityUpdatesSample []string `json:"security_updates_sample,omitempty"`
Error string `json:"error,omitempty"`
}
type PasswordPolicyFingerprint ¶ added in v0.2.0
type PasswordPolicyFingerprint struct {
PwqualityKeys []PwqualityKV `json:"pwquality_keys,omitempty"`
PamPasswordRequisiteLines []string `json:"pam_password_requisite_lines,omitempty"`
Error string `json:"error,omitempty"`
}
PasswordPolicyFingerprint reads pwquality.conf and PAM password stack lines (no secrets).
type PathPermissionsAudit ¶ added in v0.2.0
type PathPermissionsAudit struct {
TmpStickyBitPresent *bool `json:"tmp_sticky_bit_present,omitempty"`
WorldWritableDirsSample []string `json:"world_writable_dirs_sample,omitempty"`
SgidItemsSample []SgidItem `json:"sgid_items_sample,omitempty"`
UnownedFilesSample []string `json:"unowned_files_sample,omitempty"`
Error string `json:"error,omitempty"`
}
PathPermissionsAudit extends path posture: sticky /tmp, WW dirs, SGID, unowned samples.
type ProcessSignals ¶
type ProcessTopEntry ¶
type PwqualityKV ¶ added in v0.2.0
PwqualityKV is one non-secret pwquality.conf assignment.
type RedisExposureFingerprint ¶ added in v0.2.0
type RedisExposureFingerprint struct {
UnitActiveState string `json:"unit_active_state,omitempty"`
ConfigPathUsed string `json:"config_path_used,omitempty"`
Bind string `json:"bind,omitempty"`
Port *int `json:"port,omitempty"`
ProtectedMode string `json:"protected_mode,omitempty"`
RequirepassPresent *bool `json:"requirepass_present,omitempty"`
Error string `json:"error,omitempty"`
}
RedisExposureFingerprint is non-secret redis.conf exposure hints plus unit state.
type RuntimeEntry ¶
type SecurityFrameworksAndMalwareDefenseComponent ¶ added in v0.2.0
type SecurityFrameworksAndMalwareDefenseComponent struct{}
SecurityFrameworksAndMalwareDefenseComponent is reserved for AV/EDR/fim product signals; process inventory lives under core_system_and_kernel.host_process.
type SelinuxApparmorBlock ¶ added in v0.2.0
type SelinuxApparmorBlock struct {
SelinuxMode string `json:"selinux_mode,omitempty"`
ApparmorSummary string `json:"apparmor_summary,omitempty"`
Error string `json:"error,omitempty"`
}
SelinuxApparmorBlock reports MAC posture (no policy dump).
type ServiceEntry ¶
type ServicesBlock ¶
type ServicesBlock struct {
Items []ServiceEntry `json:"items"`
Error string `json:"error,omitempty"`
}
type SgidItem ¶ added in v0.2.0
type SgidItem struct {
Path string `json:"path"`
Owner string `json:"owner"`
Mode string `json:"mode"`
}
SgidItem is a bounded setgid file entry (same shape idea as SuidItem).
type ShadowAccountSummary ¶ added in v0.2.0
type ShadowAccountSummary struct {
ShadowReadable bool `json:"shadow_readable"`
AccountsLockedCount int `json:"accounts_locked_count"`
AccountsNoLoginPasswordCount int `json:"accounts_no_login_password_count"`
AccountsPasswordExpiredHintCount int `json:"accounts_password_expired_hint_count"`
AccountsNeverLoggedInHintCount int `json:"accounts_never_logged_in_hint_count"`
Error string `json:"error,omitempty"`
}
ShadowAccountSummary is non-secret metadata from /etc/shadow (no hash material).
type SoftwarePackagesAndApplicationsComponent ¶ added in v0.2.0
type SoftwarePackagesAndApplicationsComponent struct {
Services ServicesBlock `json:"services"`
PackagesUpdates *PackagesUpdates `json:"packages_updates,omitempty"`
HostBackup *HostBackup `json:"host_backup,omitempty"`
HostRuntimes *HostRuntimes `json:"host_runtimes,omitempty"`
WebDbServersFingerprint *WebDbServersFingerprint `json:"web_db_servers_fingerprint,omitempty"`
RedisExposureFingerprint *RedisExposureFingerprint `json:"redis_exposure_fingerprint,omitempty"`
CronTimersInventory *CronTimersInventory `json:"cron_timers_inventory,omitempty"`
CupsExposureFingerprint *CupsExposureFingerprint `json:"cups_exposure_fingerprint,omitempty"`
MtaFingerprint *MtaFingerprint `json:"mta_fingerprint,omitempty"`
}
type SudoersAudit ¶ added in v0.2.0
type SudoersAudit struct {
FilesScanned []string `json:"files_scanned,omitempty"`
NopasswdMentionCount int `json:"nopasswd_mention_count"`
AllAllPatternCount int `json:"all_all_pattern_count"`
WildcardRiskLineCount int `json:"wildcard_risk_line_count"`
IncludedirCount int `json:"includedir_count"`
DefaultsRequirettyPresent bool `json:"defaults_requiretty_present"`
DefaultsUsePtyPresent bool `json:"defaults_use_pty_present"`
DefaultsVisiblepwInvertedPresent bool `json:"defaults_visiblepw_inverted_present"`
Error string `json:"error,omitempty"`
}
SudoersAudit is structural sudoers signal without transmitting full rule bodies. When Error is set, MarshalJSON emits only "error" (no zero-valued counters or flags).
func (SudoersAudit) MarshalJSON ¶ added in v0.2.0
func (s SudoersAudit) MarshalJSON() ([]byte, error)
type SysctlDriftEntry ¶ added in v0.2.0
type SysctlDriftEntry struct {
Key string `json:"key"`
FileValue string `json:"file_value,omitempty"`
LiveValue string `json:"live_value,omitempty"`
}
SysctlDriftEntry compares file-based sysctl vs live kernel.
type SysctlLiveBlock ¶ added in v0.2.0
type SysctlLiveBlock struct {
Items []SysctlKV `json:"items"`
Error string `json:"error,omitempty"`
}
SysctlLiveBlock is a bounded CIS/STIG-style allowlist read from /proc/sys.
type SysctlOverlayBlock ¶ added in v0.2.0
type SysctlOverlayBlock struct {
ParsedFiles []string `json:"parsed_files,omitempty"`
Drift []SysctlDriftEntry `json:"drift,omitempty"`
Error string `json:"error,omitempty"`
}
SysctlOverlayBlock parses sysctl.conf / sysctl.d and detects drift vs live.
type SystemdHealth ¶ added in v0.2.0
type SystemdHealth struct {
SystemdPresent bool `json:"systemd_present"`
DefaultTarget string `json:"default_target,omitempty"`
IsSystemRunning string `json:"is_system_running,omitempty"`
FailedUnitsCount *int `json:"failed_units_count,omitempty"`
LegacyRunlevel string `json:"legacy_runlevel,omitempty"`
Error string `json:"error,omitempty"`
}
SystemdHealth is get-default / is-system-running / failed units (bounded).
type TcpWrappersFingerprint ¶ added in v0.2.0
type TcpWrappersFingerprint struct {
HostsAllowPresent bool `json:"hosts_allow_present"`
HostsDenyPresent bool `json:"hosts_deny_present"`
HostsAllowLineCount int `json:"hosts_allow_line_count"`
HostsDenyLineCount int `json:"hosts_deny_line_count"`
HostsAllowSampleLines []string `json:"hosts_allow_sample_lines,omitempty"`
HostsDenySampleLines []string `json:"hosts_deny_sample_lines,omitempty"`
Error string `json:"error,omitempty"`
}
TcpWrappersFingerprint summarizes hosts.allow / hosts.deny without deep semantics.
type UsbStoragePosture ¶ added in v0.2.0
type UsbStoragePosture struct {
UsbStorageLoaded bool `json:"usb_storage_loaded"`
BlacklistUsbStorageLinePresent bool `json:"blacklist_usb_storage_line_present"`
ModprobeFragmentLinesSample []string `json:"modprobe_fragment_lines_sample,omitempty"`
Error string `json:"error,omitempty"`
}
UsbStoragePosture reports usb_storage module and modprobe blacklist hints.
type UserSample ¶
UserSample is intentionally free of login names and home paths (PII); uid/gid/shell only.
type V1 ¶
type V1 struct {
SchemaVersion int `json:"schema_version"`
MachineUUID string `json:"machine_uuid"`
ScanSeq int `json:"scan_seq"`
Hostname string `json:"hostname,omitempty"`
Fqdn string `json:"fqdn,omitempty"`
Components Components `json:"components"`
}
V1 is the only supported ingest shape for schema_version == 1.
type WebDbServersFingerprint ¶ added in v0.2.0
type WebDbServersFingerprint struct {
NginxServerTokens string `json:"nginx_server_tokens,omitempty"`
NginxConfigPathUsed string `json:"nginx_config_path_used,omitempty"`
ApacheServerTokens string `json:"apache_server_tokens,omitempty"`
ApacheServerSignature string `json:"apache_server_signature,omitempty"`
ApacheConfigPathUsed string `json:"apache_config_path_used,omitempty"`
MysqlBindAddress string `json:"mysql_bind_address,omitempty"`
MysqlConfigPathUsed string `json:"mysql_config_path_used,omitempty"`
PostgresqlListenAddresses string `json:"postgresql_listen_addresses,omitempty"`
PostgresqlSsl string `json:"postgresql_ssl,omitempty"`
PostgresqlConfigPathUsed string `json:"postgresql_config_path_used,omitempty"`
Error string `json:"error,omitempty"`
}
WebDbServersFingerprint captures bounded web/DB server config hints (no secrets).