Documentation
¶
Index ¶
Constants ¶
const ( DefaultAlertTitle = "(no title)" DefaultAlertDescription = "(no description)" )
Variables ¶
This section is empty.
Functions ¶
func CosineSimilarity ¶
Types ¶
type Alert ¶
type Alert struct {
ID types.AlertID `json:"id"`
TicketID types.TicketID `json:"ticket_id"`
Schema types.AlertSchema `json:"schema"`
Data any `json:"data"`
Status AlertStatus `json:"status"`
// Topic is the namespace for domain knowledge (defaults to Schema if not set by policy)
Topic types.KnowledgeTopic `json:"topic"`
Metadata
CreatedAt time.Time `json:"created_at"`
SlackThread *slack.Thread `json:"slack_thread"`
SlackMessageID string `json:"slack_message_id"`
Embedding firestore.Vector32 `json:"-"`
TagIDs map[string]bool `json:"tag_ids"`
}
Alert represents an event of a potential security incident. This model is designed to be immutable. An Alert can be linked to at most one ticket.
func (*Alert) CosineSimilarity ¶
func (*Alert) FillMetadata ¶
func (*Alert) GetTagNames ¶ added in v0.2.0
func (a *Alert) GetTagNames(ctx context.Context, tagGetter func(context.Context, []string) ([]*tag.Tag, error)) ([]string, error)
GetTagNames returns tag names for external API compatibility
func (*Alert) HasSlackThread ¶ added in v0.1.0
HasSlackThread returns true if the alert has a valid Slack thread
type AlertListRepository ¶
type AlertStatus ¶ added in v0.10.0
type AlertStatus string
AlertStatus represents the processing status of an alert
const ( AlertStatusActive AlertStatus = "active" AlertStatusDeclined AlertStatus = "declined" )
func (AlertStatus) MarshalGQL ¶ added in v0.10.0
func (s AlertStatus) MarshalGQL(w io.Writer)
MarshalGQL implements the graphql.Marshaler interface for GraphQL enum serialization.
func (*AlertStatus) UnmarshalGQL ¶ added in v0.10.0
func (s *AlertStatus) UnmarshalGQL(v any) error
UnmarshalGQL implements the graphql.Unmarshaler interface for GraphQL enum deserialization.
type Attribute ¶
type Attribute struct {
Key string `json:"key"`
Value string `json:"value"`
Link string `json:"link"`
Auto bool `json:"auto"`
}
func (*Attribute) UnmarshalJSON ¶ added in v0.5.0
UnmarshalJSON implements custom unmarshaling to handle both string and numeric values
type Finding ¶
type Finding struct {
Severity types.AlertSeverity `json:"severity"`
Summary string `json:"summary"`
Reason string `json:"reason"`
Recommendation string `json:"recommendation"`
}
Finding is the conclusion of the alert. This is set by the AI.
type GenAIConfig ¶ added in v0.4.0
type GenAIConfig struct {
Prompt string `json:"prompt"` // Prompt template file name
Format types.GenAIContentFormat `json:"format"` // Response format: "text" | "json" (default: "text")
}
GenAIConfig configures LLM processing for alerts
type GenAIResponse ¶ added in v0.4.0
type GenAIResponse struct {
Data any `json:"data"` // Raw response data
Format types.GenAIContentFormat `json:"format"` // Response format for formatting
}
GenAIResponse represents the LLM response for display purposes
type List ¶
type List struct {
ID types.AlertListID `json:"id"`
AlertIDs []types.AlertID `json:"alert_ids"`
SlackThread *slack.Thread `json:"slack_thread"`
SlackMessageID string `json:"slack_message_id"`
Status ListStatus `json:"status"`
CreatedAt time.Time `json:"created_at"`
CreatedBy *slack.User `json:"created_by"`
Metadata
Embedding firestore.Vector32 `json:"-"`
// contains filtered or unexported fields
}
func (*List) FillMetadata ¶
type ListStatus ¶
type ListStatus string
const ( ListStatusUnbound ListStatus = "unbound" ListStatusBound ListStatus = "bound" )
func (ListStatus) DisplayName ¶
func (s ListStatus) DisplayName() string
func (ListStatus) Icon ¶
func (s ListStatus) Icon() string
func (ListStatus) String ¶
func (s ListStatus) String() string
type Metadata ¶
type Metadata struct {
Title string `json:"title"`
Description string `json:"description"`
Attributes []Attribute `json:"attributes"`
TitleSource types.Source `json:"title_source"`
DescriptionSource types.Source `json:"description_source"`
// Tags field is used temporarily during policy processing to pass tag names
// These are converted to TagIDs and not persisted in this field
Tags []string `json:"tags,omitempty"`
// Channel field specifies target Slack channel for alert notification
// Set by action policy evaluation
Channel string `json:"channel,omitempty"`
}
type QueryOutput ¶
type QueryOutput struct {
Alerts []Metadata `json:"alerts"`
}