audit

package
v0.1.8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 4, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package audit provides a background monitor that periodically scans audit records for anomaly patterns and sends notifications when thresholds are exceeded.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func FormatAnomalyAlert 

func FormatAnomalyAlert(anomalies []Anomaly, start, end time.Time, lookbackHours, totalRecords int) string

FormatAnomalyAlert builds a human-readable notification message.

Types

type Anomaly 

type Anomaly struct {
	Category    string
	Source      string
	Count       int
	Window      string
	Description string
}

Anomaly tracks a detected anomaly pattern.

func AnalyzeRecords 

func AnalyzeRecords(cfg MonitorConfig, records []*types.AuditRecord) []Anomaly

AnalyzeRecords examines audit records and returns detected anomalies based on the provided configuration thresholds. It is used by both the background Monitor and the one-shot CLI.

type Monitor 

type Monitor struct {
	// contains filtered or unexported fields
}

Monitor is a background goroutine that periodically queries audit records for anomaly patterns and sends alerts via NotifyService.

func NewMonitor 

func NewMonitor(
	auditRepo storage.AuditRepository,
	notifyService *notify.NotifyService,
	channel *notify.Channel,
	cfg MonitorConfig,
	log *slog.Logger,
) (*Monitor, error)

NewMonitor creates a new audit monitor. Call Start() to begin scanning.

func (*Monitor) Start 

func (m *Monitor) Start(ctx context.Context)

Start launches the background scanning goroutine.

func (*Monitor) Stop 

func (m *Monitor) Stop()

Stop signals the monitor to stop and waits for it to finish.

type MonitorConfig 

type MonitorConfig struct {
	Enabled       bool          `yaml:"enabled"`
	Interval      time.Duration `yaml:"interval"`       // scan interval (default: 1h)
	LookbackHours int           `yaml:"lookback_hours"` // hours to look back per scan (default: 1)
	// Thresholds
	AuthFailureThreshold     int `yaml:"auth_failure_threshold"`     // per source per hour (default: 5)
	BlocklistRejectThreshold int `yaml:"blocklist_reject_threshold"` // per key per hour (default: 3)
	HighFreqThreshold        int `yaml:"high_freq_threshold"`        // requests per hour (default: 100)
}

MonitorConfig configures the background audit monitor.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.