forensics

type Analyzer struct{}

type Credential struct {
	Protocol string `json:"protocol"`
	Type     string `json:"type"` // "basic_auth", "form", "ftp", "telnet"
	Source   string `json:"source"`
	Details  string `json:"details"`
}

type DNSQuery struct {
	Timestamp time.Time `json:"timestamp"`
	Domain    string    `json:"domain"`
	Type      string    `json:"type"` // "A", "AAAA", "CNAME", "MX"
	Response  string    `json:"response,omitempty"`
}

type FileExtract struct {
	Filename string `json:"filename"`
	MimeType string `json:"mime_type"`
	Size     int64  `json:"size"`
	Hash     string `json:"hash"`
}

type ForensicsReport struct {
	Title        string          `json:"title"`
	GeneratedAt  time.Time       `json:"generated_at"`
	Hash         string          `json:"hash"`
	Timeline     []TimelineEvent `json:"timeline"`
	Credentials  []Credential    `json:"credentials,omitempty"`
	DNSQueries   []DNSQuery      `json:"dns_queries,omitempty"`
	FileExtracts []FileExtract   `json:"file_extracts,omitempty"`
	Summary      string          `json:"summary"`
}

type TimelineEvent struct {
	Timestamp time.Time `json:"timestamp"`
	Protocol  string    `json:"protocol"`
	Source    string    `json:"source"`
	Dest      string    `json:"dest"`
	EventType string    `json:"event_type"` // "connection", "data", "credential", "file", "dns"
	Details   string    `json:"details"`
	Severity  string    `json:"severity"` // "info", "warning", "critical"
}