engine

type Behavior struct {
	Object      string   `yaml:"Object"`      // #一级主体
	Objects     []string `yaml:"Objects"`     // #一级主体
	Subject     string   `yaml:"Subject"`     // #一级主体为空选为二级
	When        string   `yaml:"When"`        // #执行时间
	Who         string   `yaml:"Who"`         // #身份权限/准确执行体
	What        string   `yaml:"What"`        // #动作
	Role        string   `yaml:"Role"`        // #权限
	Where       string   `yaml:"Where"`       // #执行位置
	Why         string   `yaml:"Why"`         // 应该为解释说明内容
	Whom        string   `yaml:"Whom"`        // 关联
	Which       string   `yaml:"Which"`       // 标识mark吧,正常/攻击/脚本/服务类似
	How         string   `yaml:"How"`         // 怎么做的描述
	HowMuch     string   `yaml:"HowMuch"`     // 频率
	Effect      string   `yaml:"Effect"`      // 应该为变化区间的东西
	Environment string   `yaml:"Environment"` // 应该为标识上下文
}

type ConditionMerge struct {
	TimeWindow string   `yaml:"time_window"` // time window ; 时间窗口； 支持: hour/min/sec
	GroupBys   []string `yaml:"group_by"`    // group by
}

type ConditionMul struct {
	TimeWindow  string         `yaml:"time_window"` // time window ; 时间窗口
	GroupBys    []string       `yaml:"group_by"`    // group by
	Havings     []string       `yaml:"having"`      // having ; group by 的 where 条件（WHERE 关键字无法与合计函数一起使用）
	CountLimits map[string]int `yaml:"count"`       // count limit ; 统计下限，低于统计值的数据行丢弃
}

type DataHit[T any] struct {
	MulRuleID    int64
	MainRuleID   int64 // 主事件ID
	SingleRuleID int64
	EventID      int64
	Score        int16
	RuleType     RuleType
	Data         *T
}

type DetectionMerge struct {
	Selection map[string]int64 `yaml:"selection"` // where 子语句; AND 关系
	Condition ConditionMerge   `yaml:"condition"` //  where 条件
}

type DetectionMul struct {
	Object    string           `yaml:"object"`    // # 主体规则，以该规则为主体，画关联图谱进程树。
	Ordered   bool             `yaml:"ordered"`   // 根据rule有序的；有序时 count不起作用
	Selection map[string]int64 `yaml:"selection"` // where 子语句; AND 关系
	Condition ConditionMul     `yaml:"condition"` //  where 条件
}

type Group[T any] struct {
	// contains filtered or unexported fields
}

type HavingElem struct {
	RuleID int64
	Key    string
	// contains filtered or unexported fields
}

type MGroup struct {
	sync.Mutex // 加锁实现单飞: singleflight
	// contains filtered or unexported fields
}

type MergeRuleset[T any] struct {
	// contains filtered or unexported fields
}

type Offsets struct {
	Object  uintptr
	Objects struct {
		Connectors []string // 连接符
		Offsets    []uintptr
	}
	ObjectType      int
	Subject         uintptr
	SubjectType     int
	When            uintptr
	WhenType        int
	Who             uintptr
	WhoType         int
	What            uintptr
	WhatType        int
	Role            uintptr
	RoleType        int
	Where           uintptr
	WhereType       int
	Why             uintptr
	WhyType         int
	Whom            uintptr
	WhomType        int
	Which           uintptr
	WhichType       int
	How             uintptr
	HowType         int
	HowMuch         uintptr
	HowMuchType     int
	Effect          uintptr
	EffectType      int
	Environment     uintptr
	EnvironmentType int
}

type RuleType int16

type Ruleset[T any] struct {
	// contains filtered or unexported fields
}

type Selection struct {
	Key    string
	Strs   []string
	Int64s []int64
	Bools  []bool
	Func   string
	All    bool
	Ti     *tag.TagInfo
}

type SigmaBranch[T any] struct {
	SelectionKey string    // selection 的名字
	Selection    Selection `json:"-"` // SelectionKey 在parse阶段就转成 Selection，避免运行时损耗

	CMD func(m *T) bool `json:"-"` // 最终执行的语句

	Not  bool
	OR   bool             // true: OR ; false:  AND ;
	Sons []SigmaBranch[T] // 子条件: 一个括号一个子条件; 条件变化时也要换一个条件，比如 OR 后出现 AND；
	// contains filtered or unexported fields
}

type SigmaRule[T any] struct {
	Selections map[string]Selection
	Conditions []SigmaBranch[T] // 树形结构，类似 AST (抽象语法树)
	// contains filtered or unexported fields
}

type SigmaYml[T any] struct {
	Title          string                 `yaml:"title"`          //规则名称
	RuleID         int64                  `yaml:"id"`             // 规则id
	Type           string                 `yaml:"type"`           // 规则类型 type: multiple/single/merger
	Status         int                    `yaml:"status"`         // 灰度状态(1是正常，0是关闭，2是灰度)
	Decisioncenter int                    `yaml:"decisioncenter"` // 是否进行多条判断(1是不进行多条判断，2是进行多条判断)
	Description    string                 `yaml:"description"`
	Detection      map[string]interface{} `yaml:"detection"` // 规则具体内容 // detection.condition 规则判断逻辑
	Level          string                 `yaml:"level"`     // 危险等级分为INFO(信息)、LOW(低)、MEDIUM(中)、HIGH(高)
	Tags           []string               `yaml:"tags"`      // attack分类
	Tag            string                 `yaml:"-"`
	TagInfos       map[string]*tag.TagInfo

	// 以下是新增的特性
	Time          string   `yaml:"time"` // 2023.9.13
	Example       string   `yaml:"example"`
	Analyze       string   `yaml:"analyze"`
	Common        string   `yaml:"common"`
	Environment   string   `yaml:"environment"`
	Class         string   `yaml:"class"`
	Source        string   `yaml:"source"`
	Focus         string   `yaml:"focus"`
	Author        string   `yaml:"author"`
	Version       string   `yaml:"version"`        // 1.0.0
	Application   string   `yaml:"application"`    // 默认规则
	Why           string   `yaml:"why"`            // 监控 ifconfig ip
	FalsePositive string   `yaml:"false_positive"` //
	Frequency     string   `yaml:"frequency"`      //
	Platform      string   `yaml:"platform"`       // Linux
	Much          string   `yaml:"much"`           //
	Initial       int      `yaml:"initial"`        // 30
	Analyzetype   int      `yaml:"analyzetype"`    // 1
	Behavior      Behavior `yaml:"behavior"`       // 30
	Offsets       Offsets  `yaml:"-"`              // Behavior 在pb.Log的偏移量
}

type SigmaYmlMerge struct {
	Title         string `yaml:"title"`          //规则名称
	RuleID        int64  `yaml:"id"`             // 规则id
	Type          string `yaml:"type"`           // 规则类型 type: multiple/single/merger
	Status        int    `yaml:"status"`         // 灰度状态(1是正常，0是关闭，2是灰度)
	TechniqueType string `yaml:"technique_type"` //
	Description   string `yaml:"description"`    // 描述
	Seriousness   string `yaml:"seriousness"`    // 危险等级分为INFO(信息)、LOW(低)、MEDIUM(中)、HIGH(高)
	Platform      string `yaml:"platform"`       //规则名称
	Initial       int    `yaml:"initial"`        // 30
	Analyzetype   int    `yaml:"analyzetype"`    // 1

	Detection DetectionMerge `yaml:"detection"` // 规则具体内容 // detection.condition 规则判断逻辑
}

type SigmaYmlMul struct {
	Title         string `yaml:"title"`          //规则名称
	RuleID        int64  `yaml:"id"`             // 规则id
	Type          string `yaml:"type"`           // 规则类型 type: multiple/single/merger
	Status        int    `yaml:"status"`         // 灰度状态(1是正常，0是关闭，2是灰度)
	TechniqueType string `yaml:"technique_type"` //
	Description   string `yaml:"description"`    // 描述
	Seriousness   string `yaml:"seriousness"`    // 危险等级分为INFO(信息)、LOW(低)、MEDIUM(中)、HIGH(高)
	Platform      string `yaml:"platform"`       //规则名称
	Initial       int    `yaml:"initial"`        // 30
	Analyzetype   int    `yaml:"analyzetype"`    // 1

	Detection DetectionMul `yaml:"detection"` // 规则具体内容 // detection.condition 规则判断逻辑
}

type StreamRuleset[T any] struct {
	// contains filtered or unexported fields
}