Versions in this module Expand all Collapse all v0 v0.7.0 Aug 4, 2026 v0.6.0 Aug 3, 2026 v0.5.0 Aug 3, 2026 v0.4.0 Jul 29, 2026 v0.3.0 Jul 28, 2026 v0.2.0 Jul 23, 2026 Changes in this version + type IngestClient interface + ReportAudit func(ctx context.Context, nodeID string, events []api.AuditEvent) (*api.IngestReceipt, error) + type PlatformReporter struct + func NewPlatformReporter(client IngestClient, logger *slog.Logger) *PlatformReporter + func (r *PlatformReporter) ReportAudit(ctx context.Context, nodeID string, batch api.AuditBatch) error v0.1.0 Jul 18, 2026 Changes in this version + const DefaultBatchSize + const DefaultCollectInterval + const DefaultReportInterval + type AuditReporter interface + ReportAudit func(ctx context.Context, nodeID string, batch api.AuditBatch) error + type AuditSource interface + Collect func(ctx context.Context) ([]api.AuditEntry, error) + type AuditdEntry struct + GID int + Object string + PID int + Path string + Raw string + Success bool + Syscall string + Timestamp time.Time + Type string + UID int + type AuditdReader interface + ReadEvents func(ctx context.Context) ([]AuditdEntry, error) + type AuditdSource struct + func NewAuditdSource(reader AuditdReader, hostname string, logger *slog.Logger) *AuditdSource + func (s *AuditdSource) Collect(ctx context.Context) ([]api.AuditEntry, error) + type Config struct + BatchSize int + CollectInterval time.Duration + Enabled bool + LocalEndpoint api.LocalEndpointConfig + ReportInterval time.Duration + func (c *Config) ApplyDefaults() + func (c *Config) Validate() error + type Forwarder struct + func NewForwarder(cfg Config, sources []AuditSource, reporter AuditReporter, nodeID string, ...) *Forwarder + func (f *Forwarder) RegisterSource(s AuditSource) + func (f *Forwarder) Run(ctx context.Context) error + func (f *Forwarder) Status() (enabled bool, bufferSize, sourceCount, errorCount int, lastReport time.Time) + type K8sAuditEntry struct + ObjectRef K8sObjectRef + Raw string + RequestURI string + ResponseStatus int + Timestamp time.Time + User K8sUser + Verb string + type K8sAuditReader interface + ReadEvents func(ctx context.Context) ([]K8sAuditEntry, error) + type K8sAuditSource struct + func NewK8sAuditSource(reader K8sAuditReader, hostname string, logger *slog.Logger) *K8sAuditSource + func (s *K8sAuditSource) Collect(ctx context.Context) ([]api.AuditEntry, error) + type K8sObjectRef struct + Name string + Namespace string + Resource string + type K8sUser struct + Groups []string + Username string + type LocalReporter struct + func NewLocalReporter(cfg api.LocalEndpointConfig, fetcher SecretFetcher, nsk []byte, nodeID string, ...) *LocalReporter + func (r *LocalReporter) ReportAudit(ctx context.Context, nodeID string, batch api.AuditBatch) error + type MultiReporter struct + func NewMultiReporter(platform, local AuditReporter, logger *slog.Logger) *MultiReporter + func (m *MultiReporter) ReportAudit(ctx context.Context, nodeID string, batch api.AuditBatch) error + type ProcessSource struct + func NewProcessSource(hostname string) *ProcessSource + func (s *ProcessSource) Collect(_ context.Context) ([]api.AuditEntry, error) + type SecretFetcher interface + FetchSecret func(ctx context.Context, nodeID, key string) (*api.SecretResponse, error)
Go to main page