Documentation
¶
Index ¶
- func HasFileFields(fieldNames []string) bool
- func NewEnv() (*cel.Env, error)
- func Validate(expression string) error
- type CELSchema
- type ConstantInfo
- type FieldGetter
- type FieldInfo
- type Filter
- func (f *Filter) Expression() string
- func (f *Filter) FilterFiles(files []*unmarshal.FileDescriptor) ([]*unmarshal.FileDescriptor, error)
- func (f *Filter) FilterProcesses(tasks []*unmarshal.TaskDescriptor) ([]*unmarshal.TaskDescriptor, error)
- func (f *Filter) FilterProcessesWithMatch(tasks []*unmarshal.TaskDescriptor) ([]MatchResult, error)
- func (f *Filter) MatchFile(file *unmarshal.FileDescriptor) (bool, error)
- func (f *Filter) MatchProcess(task *unmarshal.TaskDescriptor) (bool, error)
- func (f *Filter) MatchProcessWithFile(task *unmarshal.TaskDescriptor, file *unmarshal.FileDescriptor) (bool, error)
- type MatchResult
- type VariableInfo
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func HasFileFields ¶ added in v0.2.0
HasFileFields returns true if any of the field names refer to file/socket fields
Types ¶
type CELSchema ¶ added in v0.2.0
type CELSchema struct {
Variables []VariableInfo
Constants []ConstantInfo
// FieldMap provides fast lookup by qualified name (e.g., "process.pid")
FieldMap map[string]FieldInfo
}
CELSchema contains all available CEL variables, fields, and constants
func GetCELSchema ¶ added in v0.2.0
func GetCELSchema() *CELSchema
GetCELSchema returns the complete CEL schema with all variables, fields, and constants
type ConstantInfo ¶ added in v0.2.0
type ConstantInfo struct {
Name string // Constant name (e.g., "docker", "tcp")
Type string // CEL type
Description string // Human-readable description
}
ConstantInfo describes a CEL constant
type FieldGetter ¶ added in v0.2.0
type FieldGetter func(result *MatchResult, fileIdx int, bootTime time.Time) string
FieldGetter extracts a field value from a MatchResult and file index
type FieldInfo ¶ added in v0.2.0
type FieldInfo struct {
Name string // Full qualified name (e.g., "process.pid", "socket.srcPort")
CELName string // CEL field name from struct tag
GoName string // Go field name
Type reflect.Type // Go type
CELType string // CEL-friendly type description
Variable string // Parent variable name (process, container, file, socket)
GetValue FieldGetter // Function to extract value from match result
}
FieldInfo describes a CEL-accessible field
type Filter ¶
type Filter struct {
// contains filtered or unexported fields
}
Filter holds a compiled CEL expression for filtering processes and files
func New ¶
New compiles a CEL expression into a Filter. The expression should return a boolean value.
Available variables:
- process: TaskDescriptor with fields: name, pid, ppid, tid, euid, user, cmdline, state, files, etc.
- file: FileDescriptor with fields: path, fd, srcPort, dstPort, protocol, etc.
- socket: Alias for file, use for network-related filtering
Example expressions:
- process.name == "nginx"
- process.name == "bash" || process.name == "zsh"
- process.user == "root" && process.pid > 1000
- file.path.startsWith("/etc/")
- socket.dstPort == 443
- socket.Protocol() == "tcp" && socket.IsListening()
func NewWithEnv ¶
NewWithEnv compiles a CEL expression using a pre-created environment. Use this when compiling multiple filters to avoid recreating the environment.
func (*Filter) Expression ¶
Expression returns the original CEL expression string
func (*Filter) FilterFiles ¶
func (f *Filter) FilterFiles(files []*unmarshal.FileDescriptor) ([]*unmarshal.FileDescriptor, error)
FilterFiles filters a slice of FileDescriptors, returning only those that match.
func (*Filter) FilterProcesses ¶
func (f *Filter) FilterProcesses(tasks []*unmarshal.TaskDescriptor) ([]*unmarshal.TaskDescriptor, error)
FilterProcesses filters a slice of TaskDescriptors, returning only those that match. If a process has files/sockets, the filter is evaluated against each file. A process matches if:
- The process-only filter matches, OR
- Any of the process's files match when evaluated with MatchProcessWithFile
func (*Filter) FilterProcessesWithMatch ¶ added in v0.2.0
func (f *Filter) FilterProcessesWithMatch(tasks []*unmarshal.TaskDescriptor) ([]MatchResult, error)
FilterProcessesWithMatch filters tasks and returns detailed match information. This includes which files/sockets caused the match for each process.
func (*Filter) MatchFile ¶
func (f *Filter) MatchFile(file *unmarshal.FileDescriptor) (bool, error)
MatchFile evaluates the filter against a FileDescriptor. Use this for file/socket-only filtering expressions.
func (*Filter) MatchProcess ¶
func (f *Filter) MatchProcess(task *unmarshal.TaskDescriptor) (bool, error)
MatchProcess evaluates the filter against a TaskDescriptor. Use this for process-only filtering expressions.
func (*Filter) MatchProcessWithFile ¶
func (f *Filter) MatchProcessWithFile(task *unmarshal.TaskDescriptor, file *unmarshal.FileDescriptor) (bool, error)
MatchProcessWithFile evaluates the filter with both process and file context. Use this for combined expressions like: process.name == "nginx" && socket.dstPort == 80
type MatchResult ¶ added in v0.2.0
type MatchResult struct {
Task *unmarshal.TaskDescriptor // The matched process
MatchedFiles []*unmarshal.FileDescriptor // Files/sockets that caused the match (empty if process-only match)
}
MatchResult contains a matched task and information about what caused the match
type VariableInfo ¶ added in v0.2.0
type VariableInfo struct {
Name string // Variable name (e.g., "process", "container")
Description string // Human-readable description
Fields []FieldInfo // Available fields
}
VariableInfo describes a CEL variable
Source Files