kevent

package

Go to main page

Versions in this module

v1

v1.10.0

Mar 31, 2023

Changes in this version

type Kevent — windows/amd64

+ func (kevt *Kevent) SequenceBy() any

+ func (kevt Kevent) IsTerminateProcess() bool

type Kparams

+ func (kpars Kparams) MustGetTime(name string) time.Time

type MetadataKey

+ const RuleSequenceByKey

v1.8.0

Nov 30, 2022

Changes in this version

+ var Template = ...

type Kevent

+ func (kevt *Kevent) RenderCustomTemplate(tmpl *template.Template) ([]byte, error)

+ func (kevt *Kevent) RenderDefaultTemplate() ([]byte, error)

+ func (kevt *Kevent) Summary() string

+ func (kevt Kevent) PartialKey() uint64

type Kparams

+ func NewKparamBuilder(n int) Kparams

+ func (kpars Kparams) Build() Kparams

+ func (kpars Kparams) MustGetFileOperation() string

v1.6.0

Aug 31, 2022

Changes in this version

type Kparams

+ func KparamsFromSlice(pars ...*Kparam) Kparams

+ func (kpars Kparams) MustGetPid() uint32

+ func (kpars Kparams) MustGetString(name string) string

+ func (kpars Kparams) MustGetUint32(name string) uint32

+ func (kpars Kparams) SetValue(name string, value kparams.Value) error

+ func (kpars Kparams) TryGetHexAsUint32(name string) (uint32, error)

+ func (kpars Kparams) TryGetHexAsUint64(name string) (uint64, error)

+ func (kpars Kparams) TryGetHexAsUint8(name string) (uint8, error)

v1.5.0

Apr 29, 2022

Changes in this version

+ type MetadataKey string

+ const RuleGroupKey

+ const RuleNameKey

+ const YaraMatchesKey

+ func (key MetadataKey) String() string

v1.4.2

Dec 25, 2021

v1.4.1

Sep 18, 2021

v1.4.0

Aug 24, 2021

Changes in this version

type Kevent

+ func Empty() *Kevent

v1.2.0

Apr 27, 2021

Changes in this version

+ var ParamKVDelimiter = "➜ "

+ var ParamNameCaseStyle = SnakeCase

+ var SerializeEnvs bool

+ var SerializeHandles bool

+ var SerializeImages bool

+ var SerializePE bool

+ var SerializeThreads bool

+ var TimestampFormat string

+ type Batch struct

+ Events []*Kevent

+ func NewBatch(evts ...*Kevent) *Batch

+ func (b *Batch) Len() int64

+ func (b *Batch) MarshalJSON() []byte

+ func (b *Batch) Release()

+ type Formatter struct

+ func NewFormatter(template string) (*Formatter, error)

+ func (f *Formatter) Format(kevt *Kevent) []byte

+ type Kevent struct

+ CPU uint8

+ Category ktypes.Category

+ Description string

+ Host string

+ Kparams Kparams

+ Metadata Metadata

+ Name string

+ PID uint32

+ PS *pstypes.PS

+ Seq uint64

+ Tid uint32

+ Timestamp time.Time

+ Type ktypes.Ktype

+ func New(seq uint64, pid, tid uint32, cpu uint8, ktype ktypes.Ktype, ts time.Time, ...) *Kevent

+ func NewFromKcap(buf []byte) (*Kevent, error)

+ func (kevt *Kevent) AddMeta(k, v string)

+ func (kevt *Kevent) MarshalJSON() []byte

+ func (kevt *Kevent) MarshalRaw() []byte

+ func (kevt *Kevent) Release()

+ func (kevt *Kevent) String() string

+ func (kevt *Kevent) UnmarshalRaw(b []byte, ver kcapver.Version) error

+ func (kevt Kevent) IsNetworkTCP() bool

+ func (kevt Kevent) IsNetworkUDP() bool

+ type Kparam struct

+ Name string

+ Type kparams.Type

+ Value kparams.Value

+ func NewKparam(name string, typ kparams.Type, value kparams.Value) *Kparam

+ func NewKparamFromKcap(name string, typ kparams.Type, value kparams.Value) *Kparam

+ func (k *Kparam) Release()

+ func (k Kparam) String() string

+ type Kparams map[string]*Kparam

+ func (kpars Kparams) Append(name string, typ kparams.Type, value kparams.Value) Kparams

+ func (kpars Kparams) AppendFromKcap(name string, typ kparams.Type, value kparams.Value) Kparams

+ func (kpars Kparams) Contains(name string) bool

+ func (kpars Kparams) Find(name string) *Kparam

+ func (kpars Kparams) Get(name string) (kparams.Value, error)

+ func (kpars Kparams) GetDouble(name string) (float64, error)

+ func (kpars Kparams) GetFloat(name string) (float32, error)

+ func (kpars Kparams) GetHex(name string) (kparams.Hex, error)

+ func (kpars Kparams) GetHexAsUint32(name string) (uint32, error)

+ func (kpars Kparams) GetHexAsUint64(name string) (uint64, error)

+ func (kpars Kparams) GetHexAsUint8(name string) (uint8, error)

+ func (kpars Kparams) GetIP(name string) (net.IP, error)

+ func (kpars Kparams) GetIPv4(name string) (net.IP, error)

+ func (kpars Kparams) GetIPv6(name string) (net.IP, error)

+ func (kpars Kparams) GetInt16(name string) (int16, error)

+ func (kpars Kparams) GetInt32(name string) (int32, error)

+ func (kpars Kparams) GetInt64(name string) (int64, error)

+ func (kpars Kparams) GetInt8(name string) (int8, error)

+ func (kpars Kparams) GetPid() (uint32, error)

+ func (kpars Kparams) GetPpid() (uint32, error)

+ func (kpars Kparams) GetSlice(name string) (kparams.Value, error)

+ func (kpars Kparams) GetString(name string) (string, error)

+ func (kpars Kparams) GetStringSlice(name string) ([]string, error)

+ func (kpars Kparams) GetTid() (uint32, error)

+ func (kpars Kparams) GetTime(name string) (time.Time, error)

+ func (kpars Kparams) GetUint16(name string) (uint16, error)

+ func (kpars Kparams) GetUint32(name string) (uint32, error)

+ func (kpars Kparams) GetUint64(name string) (uint64, error)

+ func (kpars Kparams) GetUint8(name string) (uint8, error)

+ func (kpars Kparams) Len() int

+ func (kpars Kparams) Remove(name string)

+ func (kpars Kparams) Set(name string, value kparams.Value, typ kparams.Type) error

+ func (kpars Kparams) String() string

+ type Metadata map[string]string

+ func (md Metadata) String() string

+ type ParamCaseStyle uint8

+ const CamelCase

+ const DotCase

+ const PascalCase

+ const SnakeCase

+ type Sequencer struct

+ func NewSequencer() *Sequencer

+ func (s *Sequencer) Close() error

+ func (s *Sequencer) Get() uint64

+ func (s *Sequencer) Increment()

+ func (s *Sequencer) Reset() error

+ func (s *Sequencer) Store() error

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL