Documentation
¶
Overview ¶
Package chunk splits a large CTIS report into protocol v2 segments (api RFC-026 §3.5): SplitSegments returns complete CTIS documents, each with the report's tool and metadata and the assets its findings reference, within the platform's per-segment limits. The results client (pkg/client) uses it.
The protocol v1 chunk upload (Splitter, Manager) is gone with protocol v1.
Stability: Internal-bound (docs/STABILITY.md): public today because other public packages use it; it moves under internal/ before v1.0.0. Do not import it from a sensor.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BindFindingAssets ¶ added in v0.8.0
BindFindingAssets makes every finding's asset explicit, so a report can be split without changing which asset a finding belongs to:
- an asset without an id gets one ("asset-<index>"), so it can be referenced;
- a finding without asset_ref is bound to the report's only asset when there is exactly one (the server applies the same rule to a whole document, RFC-026 §10.1, but a segment may carry several assets).
It returns how many findings still resolve to no asset in the report (empty asset_ref with several or no assets, or a reference to an unknown id). The server rejects those findings; they are never bound to a guess. It modifies r.
func SplitSegments ¶ added in v0.8.0
SplitSegments splits a report into protocol v2 segments. Every segment is a complete CTIS document: the same version, schema, metadata and tool as the report (the server checks they are identical), the findings of that segment and every asset those findings reference. An asset referenced by findings in several segments is repeated in each (the ingest merge is idempotent). Assets no finding references are packed into segments of their own. Dependencies and report properties go into the first segment.
Findings that resolve to no asset (see BindFindingAssets) are put in segments that carry no asset, so they are rejected by the server rather than bound to whichever single asset a segment happens to hold.
Call BindFindingAssets first. One segment is returned when the report fits the limits; it is r itself.
Types ¶
type SegmentLimits ¶ added in v0.8.0
type SegmentLimits struct {
// MaxFindings and MaxAssets per segment.
MaxFindings int
MaxAssets int
// MaxBytes is the target size of a segment's JSON before compression.
// A single finding larger than this still gets a segment of its own.
MaxBytes int
}
SegmentLimits bound one protocol v2 segment (RFC-026 §3.5, §3.6). The v2 client derives them from the server's hello limits.
Source Files