Documentation
¶
Overview ¶
Package eventproc includes components to implement a simple security event management system.
This package is a work in progress and makes no API stability promises.
Index ¶
- func RegisterFilter(class string, f FilterBuilder)
- func RegisterPlugin(class string, f PluginBuilder)
- type Action
- type Builder
- func (b *Builder) Build(def StackDef) (*Stack, error)
- func (b Builder) CachePath(data string) string
- func (b Builder) CertPath(cert string) string
- func (b Builder) DataPath(data string) string
- func (b *Builder) Logger() yalogi.Logger
- func (b *Builder) OnShutdown(f func() error)
- func (b *Builder) OnStartup(f func() error)
- func (b *Builder) Service(id string) (apiservice.Service, bool)
- func (b *Builder) Shutdown() error
- func (b *Builder) Stack(name string) (*Stack, bool)
- func (b *Builder) StackNames() []string
- func (b *Builder) Start() error
- type BuilderOption
- type CbRequest
- type FilterBuilder
- type GUIDGenerator
- type Hooks
- type ItemDef
- type Module
- type ModuleDef
- type ModuleFilter
- type ModulePlugin
- type Option
- type PluginBuilder
- type Processor
- type Request
- type Stack
- type StackAction
- type StackDef
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RegisterFilter ¶
func RegisterFilter(class string, f FilterBuilder)
RegisterFilter register a filter for the class name passed.
func RegisterPlugin ¶
func RegisterPlugin(class string, f PluginBuilder)
RegisterPlugin register a plugin for the class name passed.
Types ¶
type Builder ¶
type Builder struct {
// contains filtered or unexported fields
}
Builder helps to create stacks using definitions structs.
func NewBuilder ¶
func NewBuilder(regsvc apiservice.Discover, opt ...BuilderOption) *Builder
NewBuilder instances a new builder.
func (*Builder) Build ¶
Build construct a stack with the name passed and the modules defined by the array ModuleDef
func (*Builder) OnShutdown ¶
OnShutdown registers the functions that will be executed during shutdown.
func (*Builder) Service ¶
func (b *Builder) Service(id string) (apiservice.Service, bool)
Service returns apiservice with the id passed, returns false if not registered.
func (*Builder) Stack ¶
Stack returns the stack with the name passed, it will returns false if the stack has not been built.
func (*Builder) StackNames ¶
StackNames returns the names of the stacks created by the builder.
type BuilderOption ¶
type BuilderOption func(*buildOpts)
BuilderOption is used for builder configuration.
func SetBuildLogger ¶
func SetBuildLogger(l yalogi.Logger) BuilderOption
SetBuildLogger sets a logger for the component.
type CbRequest ¶
type CbRequest func(*Request)
CbRequest defines the format of the callbacks used by the hooks.
type FilterBuilder ¶
type FilterBuilder func(*Builder, *ItemDef) (ModuleFilter, error)
FilterBuilder defines the signature for the constuctors of the filters.
type GUIDGenerator ¶
type GUIDGenerator func() string
GUIDGenerator must returns a new unique Global ID for events.
type Hooks ¶
type Hooks struct {
// contains filtered or unexported fields
}
Hooks stores information about the hooks.
func (*Hooks) AfterModule ¶
AfterModule adds a callback that will be executed before a stack module starts.
func (*Hooks) BeforeModule ¶
BeforeModule adds a callback that will be executed before a stack module starts.
func (*Hooks) BeforeProc ¶
BeforeProc adds a callback that will be executed before the process starts.
func (*Hooks) FinishProc ¶
FinishProc adds a callback that will be executed if the process finished ok.
type ItemDef ¶
type ItemDef struct {
Class string `json:"class"`
Args []string `json:"args,omitempty"`
Opts map[string]interface{} `json:"opts,omitempty"`
}
ItemDef defines a generic configuration item for filters and plugins.
type Module ¶
type Module struct {
// Name of the module, it must be unique in the stack
Name string
// Filters that will be applied before the plugins are executed. If one of
// them returns false, then will not be executed and the module result
// will be Next. If all of them returns true, then all plugin will be
// executed and the OnSuccess action will be returned (if no errors).
Filters []ModuleFilter
// Plugins will be executed if all filters returns true (or if Filters is
// empty). If there is an error in any of the plugins, the OnError action
// will be returned.
Plugins []ModulePlugin
// OnSucess will be returned to the processor if all the filters apply and
// the plugins execution don't returns errors.
OnSuccess StackAction
// OnError will be returned to the processor if there is an error in
// plugin execution.
OnError StackAction
}
Module defines the information that will be stacked for the processing.
type ModuleDef ¶
type ModuleDef struct {
Name string `json:"name"`
Filters []*ItemDef `json:"filters,omitempty"`
Plugins []*ItemDef `json:"plugins,omitempty"`
OnSuccess StackAction `json:"onsuccess"`
OnError StackAction `json:"onerror"`
Disabled bool `json:"disabled"`
}
ModuleDef defines configuration of the modules in the stack.
type ModuleFilter ¶
ModuleFilter is a signature for functions that filters events.
type ModulePlugin ¶
ModulePlugin is a signature for functions that process events.
type Option ¶
type Option func(*options)
Option defines Processor options.
func SetBufferSize ¶
SetBufferSize option defines the size of the event request buffer.
func SetGUIDGen ¶
func SetGUIDGen(g GUIDGenerator) Option
SetGUIDGen option sets a custom gid event generator.
type PluginBuilder ¶
type PluginBuilder func(*Builder, *ItemDef) (ModulePlugin, error)
PluginBuilder defines the signature for the constuctors of the plugins.
type Processor ¶
type Processor struct {
// contains filtered or unexported fields
}
Processor is the main class of the package.
func (*Processor) ForwardEvent ¶
ForwardEvent implements event.Forwarder.
type Request ¶
type Request struct {
Event event.Event
Enqueued time.Time
Started time.Time
Finished time.Time
StackTrace []string
Peer *peer.Peer
// contains filtered or unexported fields
}
Request is used to store information of the event processing.
type Stack ¶
type Stack struct {
// contains filtered or unexported fields
}
Stack is the struct used by the processor and contains the the modules that will be executed.
type StackAction ¶
StackAction defines the actions returned by the modules to define the processing flow.
func (StackAction) MarshalJSON ¶
func (a StackAction) MarshalJSON() ([]byte, error)
MarshalJSON implements interface.
func (StackAction) String ¶
func (a StackAction) String() string
func (*StackAction) UnmarshalJSON ¶
func (a *StackAction) UnmarshalJSON(data []byte) error
UnmarshalJSON implements interface.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
filters
|
|
|
basicexpr
Package basicexpr implements a basic expression filter for event processing.
|
Package basicexpr implements a basic expression filter for event processing. |
|
plugins
|
|
|
archiver
Package archiver implements a plugin for event archiving.
|
Package archiver implements a plugin for event archiving. |
|
executor
Package executor implements a plugin for exec commands.
|
Package executor implements a plugin for exec commands. |
|
forwarder
Package forwarder implements a plugin for event forwarding.
|
Package forwarder implements a plugin for event forwarding. |
|
jsonwriter
Package jsonwriter implements a plugin for event archiving.
|
Package jsonwriter implements a plugin for event archiving. |