config

package

Go to main page

Versions in this module

v1

v1.10.0

Mar 31, 2023

v1.8.0

Nov 30, 2022

Changes in this version

+ func FilterFuncMap() template.FuncMap

+ type ActionContext struct

+ Events []*kevent.Kevent

+ Filter *FilterConfig

+ Group FilterGroup

+ Kevt *kevent.Kevent

+ Kevts map[string]*kevent.Kevent

type FilterConfig

+ Description string

+ Labels map[string]string

type FilterGroup

+ Description string

+ Labels map[string]string

type Filters

+ Macros Macros

+ func FiltersWithMacros(macros map[string]*Macro) *Filters

+ func (f *Filters) LoadMacros() error

+ func (f Filters) GetMacro(id string) *Macro

+ func (f Filters) HasMacros() bool

+ func (f Filters) IsMacroList(id string) bool

type KstreamConfig — windows/amd64

+ EnableAntimalwareEngineEvents bool

+ EnableAuditAPIEvents bool

+ type Macro struct

+ Description string

+ Expr string

+ ID string

+ List []string

+ type Macros struct

+ FromPaths []string

v1.6.0

Aug 31, 2022

Changes in this version

type FilterConfig

+ Condition string

+ MaxSpan time.Duration

type FilterGroup

+ Action string

+ Rules []*FilterConfig

+ func (g FilterGroup) Hash() uint32

+ func (g FilterGroup) IsDisabled() bool

type FilterGroupPolicy

+ const SequencePolicy

type FilterGroupSelector

+ func (s FilterGroupSelector) Hash() uint32

type KstreamConfig — windows/amd64

+ RawEventParsing bool

+ func (c *KstreamConfig) Init()

v1.5.0

Apr 29, 2022

Changes in this version

type KstreamConfig — windows/amd64

+ ExcludedImages []string

+ ExcludedKevents []string

+ func (c *KstreamConfig) ExcludeImage(ps *pstypes.PS) bool

+ func (c *KstreamConfig) ExcludeKevent(kevt *kevent.Kevent) bool

v1.4.2

Dec 25, 2021

v1.4.1

Sep 18, 2021

v1.4.0

Aug 24, 2021

Changes in this version

type Config

+ Filters *Filters

+ type FilterConfig struct

+ Action string

+ Def string

+ Name string

+ type FilterGroup struct

+ Enabled bool

+ FromStrings []*FilterConfig

+ Name string

+ Policy FilterGroupPolicy

+ Relation FilterGroupRelation

+ Selector FilterGroupSelector

+ Tags []string

+ type FilterGroupPolicy uint8

+ const ExcludePolicy

+ const IncludePolicy

+ const UnknownPolicy

+ func (p *FilterGroupPolicy) UnmarshalYAML(unmarshal func(interface{}) error) error

+ func (p FilterGroupPolicy) String() string

+ type FilterGroupRelation uint8

+ const AndRelation

+ const OrRelation

+ const UnknownRelation

+ func (r *FilterGroupRelation) UnmarshalYAML(unmarshal func(interface{}) error) error

+ func (r FilterGroupRelation) String() string

+ type FilterGroupSelector struct

+ Category ktypes.Category

+ Type ktypes.Ktype

+ type Filters struct

+ Rules Rules

+ func (f Filters) LoadGroups() ([]FilterGroup, error)

+ type Rules struct

+ FromPaths []string

+ FromURLs []string

+ type TmplData struct

+ Filter *FilterConfig

+ Group *FilterGroup

+ Kevt *kevent.Kevent

v1.2.0

Apr 27, 2021

Changes in this version

+ type APIConfig struct

+ Timeout time.Duration

+ Transport string

+ type Config struct

+ API APIConfig

+ Aggregator aggregator.Config

+ Alertsenders []alertsender.Config

+ DebugPrivilege bool

+ Filament FilamentConfig

+ InitHandleSnapshot bool

+ KcapFile string

+ Kstream KstreamConfig

+ Log log.Config

+ Output outputs.Config

+ PE pe.Config

+ Transformers []transformers.Config

+ Yara yara.Config

+ func NewWithOpts(options ...Option) *Config

+ func (c *Config) File() string

+ func (c *Config) Init() error

+ func (c *Config) MustViperize(cmd *cobra.Command)

+ func (c *Config) Print() string

+ func (c *Config) TryLoadFile(file string) error

+ func (c *Config) Validate() error

+ func (c Config) GetConfigFile() string

+ type FilamentConfig struct

+ FlushPeriod time.Duration

+ Name string

+ Path string

+ type KstreamConfig struct

+ BlacklistImages []string

+ BlacklistKevents []string

+ BufferSize uint32

+ EnableFileIOKevents bool

+ EnableHandleKevents bool

+ EnableImageKevents bool

+ EnableNetKevents bool

+ EnableRegistryKevents bool

+ EnableThreadKevents bool

+ FlushTimer time.Duration

+ MaxBuffers uint32

+ MinBuffers uint32

+ type Option func(*Options)

+ func WithCapture() Option

+ func WithList() Option

+ func WithReplay() Option

+ func WithRun() Option

+ func WithStats() Option

+ type Options struct

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL