Documentation
¶
Index ¶
- Constants
- func ClusterAlerts(ctx context.Context, alerts []*Alert, similarityThreshold float64, topN int) [][]*Alert
- func CosineSimilarity(a, b []float32) float64
- type Alert
- type AlertListRepository
- type Alerts
- type Attribute
- type Finding
- type GenAIConfig
- type GenAIResponse
- type List
- type ListStatus
- type Metadata
- type QueryOutput
Constants ¶
View Source
const ( DefaultAlertTitle = "(no title)" DefaultAlertDescription = "(no description)" )
Variables ¶
This section is empty.
Functions ¶
func ClusterAlerts ¶
func CosineSimilarity ¶
Types ¶
type Alert ¶
type Alert struct {
ID types.AlertID `json:"id"`
TicketID types.TicketID `json:"ticket_id"`
Schema types.AlertSchema `json:"schema"`
Data any `json:"data"`
Metadata
CreatedAt time.Time `json:"created_at"`
SlackThread *slack.Thread `json:"slack_thread"`
SlackMessageID string `json:"slack_message_id"`
Embedding firestore.Vector32 `json:"-"`
TagIDs map[string]bool `json:"tag_ids"`
}
Alert represents an event of a potential security incident. This model is designed to be immutable. An Alert can be linked to at most one ticket.
func (*Alert) CosineSimilarity ¶
func (*Alert) FillMetadata ¶
func (*Alert) GetTagNames ¶ added in v0.2.0
func (a *Alert) GetTagNames(ctx context.Context, tagGetter func(context.Context, []string) ([]*tag.Tag, error)) ([]string, error)
GetTagNames returns tag names for external API compatibility
func (*Alert) HasSlackThread ¶ added in v0.1.0
HasSlackThread returns true if the alert has a valid Slack thread
type AlertListRepository ¶
type Attribute ¶
type Attribute struct {
Key string `json:"key"`
Value string `json:"value"`
Link string `json:"link"`
Auto bool `json:"auto"`
}
func (*Attribute) UnmarshalJSON ¶ added in v0.5.0
UnmarshalJSON implements custom unmarshaling to handle both string and numeric values
type Finding ¶
type Finding struct {
Severity types.AlertSeverity `json:"severity"`
Summary string `json:"summary"`
Reason string `json:"reason"`
Recommendation string `json:"recommendation"`
}
Finding is the conclusion of the alert. This is set by the AI.
type GenAIConfig ¶ added in v0.4.0
type GenAIConfig struct {
Prompt string `json:"prompt"` // Prompt template file name
Format types.GenAIContentFormat `json:"format"` // Response format: "text" | "json" (default: "text")
}
GenAIConfig configures LLM processing for alerts
type GenAIResponse ¶ added in v0.4.0
type GenAIResponse struct {
Data any `json:"data"` // Raw response data
Format types.GenAIContentFormat `json:"format"` // Response format for formatting
}
GenAIResponse represents the LLM response for display purposes
type List ¶
type List struct {
ID types.AlertListID `json:"id"`
AlertIDs []types.AlertID `json:"alert_ids"`
SlackThread *slack.Thread `json:"slack_thread"`
SlackMessageID string `json:"slack_message_id"`
Status ListStatus `json:"status"`
CreatedAt time.Time `json:"created_at"`
CreatedBy *slack.User `json:"created_by"`
Metadata
Embedding firestore.Vector32 `json:"-"`
// contains filtered or unexported fields
}
func (*List) FillMetadata ¶
type ListStatus ¶
type ListStatus string
const ( ListStatusUnbound ListStatus = "unbound" ListStatusBound ListStatus = "bound" )
func (ListStatus) DisplayName ¶
func (s ListStatus) DisplayName() string
func (ListStatus) Icon ¶
func (s ListStatus) Icon() string
func (ListStatus) String ¶
func (s ListStatus) String() string
type Metadata ¶
type Metadata struct {
Title string `json:"title"`
Description string `json:"description"`
Attributes []Attribute `json:"attributes"`
TitleSource types.Source `json:"title_source"`
DescriptionSource types.Source `json:"description_source"`
// Tags field is used temporarily during policy processing to pass tag names
// These are converted to TagIDs and not persisted in this field
Tags []string `json:"tags,omitempty"`
// Channel field specifies target Slack channel for alert notification
// Set by action policy evaluation
Channel string `json:"channel,omitempty"`
}
type QueryOutput ¶
type QueryOutput struct {
Alert []Metadata `json:"alert"`
}
Click to show internal directories.
Click to hide internal directories.