config

type Config struct {
	// Enabled indicates if YARA watcher is enabled.
	Enabled bool `json:"yara.enabled" yaml:"yara.enabled"`
	// Rule contains rule-specific settings.
	Rule Rule `json:"yara.rule" yaml:"yara.rule" mapstructure:"rule"`
	// AlertVia defines which alert sender is used to emit the alert on rule matches.
	AlertVia string `json:"yara.alert-via" yaml:"yara.alert-via"`
	// AlertTemplate defines the template that is used to render the text of the alert.
	AlertTextTemplate string `json:"yara.alert-text-template" yaml:"yara.alert-text-template"`
	// AlertTitle represents the template for the alert title
	AlertTitleTemplate string `json:"yara.alert-title-template" yaml:"yara.alert-title-template"`
	// FastScanMode avoids multiple matches of the same string when not necessary.
	FastScanMode bool `json:"yara.fastscan" yaml:"yara.fastscan"`
	// ScanTimeout sets the timeout for the scanner. If the timeout is reached, the scan operation is cancelled.
	ScanTimeout time.Duration `json:"yara.scan-timeout" yaml:"yara.scan-timeout"`
	// SkipFiles indicates whether file scanning is disabled
	SkipFiles bool `json:"yara.skip-files" yaml:"yara.skip-files"`
	// ExcludedProcesses contains the list of the process' image names that shouldn't be scanned
	ExcludedProcesses []string `json:"yara.excluded-procs" yaml:"yara.excluded-procs"`
	// ExcludedProcesses contains the list of the file names that shouldn't be scanned
	ExcludedFiles []string `json:"yara.excluded-files" yaml:"yara.excluded-files"`
}

type Rule struct {
	// Paths defines the location of the yara rules
	Paths []RulePath `json:"yara.rule.paths" yaml:"yara.rule.paths" mapstructure:"paths"`
	// Strings contains the raw rule definitions
	Strings []RuleString `json:"yara.rule.strings" yaml:"yara.rule.strings" mapstructure:"strings"`
}

type RulePath struct {
	Path      string `json:"path" yaml:"path" mapstructure:"path"`
	Namespace string `json:"namespace" yaml:"namespace" mapstructure:"namespace"`
}

type RuleString struct {
	String    string `json:"string" yaml:"string" mapstructure:"string"`
	Namespace string `json:"namespace" yaml:"namespace" mapstructure:"namespace"`
}