types

type FieldRequirement ¶ added in v0.3.111

type FieldRequirement = armotypes.ProfileDataField

The profileDataRequired schema (the type, its match patterns, and the custom JSON/YAML/BSON (un)marshalling) lives in armoapi-go/armotypes — the single module imported by every consumer: node-agent (this query side: projection / was_path_opened), storage (the generation side: rule-aware collapse), and the backend (rules persisted in MongoDB). Defining it once there guarantees the matcher can never drift between the side that records a profile and the side that queries it.

These aliases preserve node-agent's historical type names. Note the shape change versus the old node-agent-local schema: a surface is now a *pointer* (ProfileDataRequired.Opens is *ProfileDataField); a nil pointer means "this rule does not declare this surface" — the role the old `Declared` bool played.

type PatternObject ¶ added in v0.3.111

type PatternObject = armotypes.ProfileDataPattern

The profileDataRequired schema (the type, its match patterns, and the custom JSON/YAML/BSON (un)marshalling) lives in armoapi-go/armotypes — the single module imported by every consumer: node-agent (this query side: projection / was_path_opened), storage (the generation side: rule-aware collapse), and the backend (rules persisted in MongoDB). Defining it once there guarantees the matcher can never drift between the side that records a profile and the side that queries it.

These aliases preserve node-agent's historical type names. Note the shape change versus the old node-agent-local schema: a surface is now a *pointer* (ProfileDataRequired.Opens is *ProfileDataField); a nil pointer means "this rule does not declare this surface" — the role the old `Declared` bool played.

type ProfileDataRequired ¶ added in v0.3.111

type ProfileDataRequired = armotypes.ProfileDataRequired

The profileDataRequired schema (the type, its match patterns, and the custom JSON/YAML/BSON (un)marshalling) lives in armoapi-go/armotypes — the single module imported by every consumer: node-agent (this query side: projection / was_path_opened), storage (the generation side: rule-aware collapse), and the backend (rules persisted in MongoDB). Defining it once there guarantees the matcher can never drift between the side that records a profile and the side that queries it.

These aliases preserve node-agent's historical type names. Note the shape change versus the old node-agent-local schema: a surface is now a *pointer* (ProfileDataRequired.Opens is *ProfileDataField); a nil pointer means "this rule does not declare this surface" — the role the old `Declared` bool played.

type Rule ¶

type Rule struct {
	Enabled                 bool                        `json:"enabled" yaml:"enabled"`
	ID                      string                      `json:"id" yaml:"id"`
	Name                    string                      `json:"name" yaml:"name"`
	Description             string                      `json:"description" yaml:"description"`
	Expressions             RuleExpressions             `json:"expressions" yaml:"expressions"`
	ProfileDependency       armotypes.ProfileDependency `json:"profileDependency" yaml:"profileDependency"`
	ProfileDataRequired     *ProfileDataRequired        `json:"profileDataRequired,omitempty" yaml:"profileDataRequired,omitempty"`
	Severity                int                         `json:"severity" yaml:"severity"`
	SupportPolicy           bool                        `json:"supportPolicy" yaml:"supportPolicy"`
	Tags                    []string                    `json:"tags" yaml:"tags"`
	State                   map[string]any              `json:"state,omitempty" yaml:"state,omitempty"`
	AgentVersionRequirement string                      `json:"agentVersionRequirement" yaml:"agentVersionRequirement"`
	IsTriggerAlert          bool                        `json:"isTriggerAlert" yaml:"isTriggerAlert"`
	MitreTactic             string                      `json:"mitreTactic" yaml:"mitreTactic"`
	MitreTechnique          string                      `json:"mitreTechnique" yaml:"mitreTechnique"`
	Prefilter               *prefilter.Params           `json:"-" yaml:"-"`
}

type RuleExpression ¶

type RuleExpression struct {
	EventType  utils.EventType `json:"eventType" yaml:"eventType"`
	Expression string          `json:"expression" yaml:"expression"`
}

type RuleExpressions ¶

type RuleExpressions struct {
	Message        string           `json:"message" yaml:"message"`
	UniqueID       string           `json:"uniqueId" yaml:"uniqueId"`
	RuleExpression []RuleExpression `json:"ruleExpression" yaml:"ruleExpression"`
}

type Rules ¶

type Rules struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata"`

	Spec RulesSpec `json:"spec"`
}

type RulesSpec ¶

type RulesSpec struct {
	Rules []Rule `json:"rules" yaml:"rules"`
}