Documentation
¶
Overview ¶
Package sidecar implements the Universal Sidecar (§5.5) — a zero-dependency Go binary that runs alongside SENTINEL sensors, tails their STDOUT/logs, and pushes parsed security events to the SOC Event Bus.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BusClient ¶
type BusClient struct {
// contains filtered or unexported fields
}
BusClient sends security events to the SOC Event Bus via HTTP POST.
func NewBusClient ¶
NewBusClient creates a client for the SOC Event Bus.
type Config ¶
type Config struct {
SensorType string // sentinel-core, shield, immune, generic
LogPath string // Path to sensor log file, or "stdin"
BusURL string // SOC Event Bus URL (e.g., http://localhost:9100)
SensorID string // Sensor registration ID
APIKey string // Sensor API key
PollInterval time.Duration // Log file poll interval
}
Config holds sidecar runtime configuration.
type GenericParser ¶
type GenericParser struct {
Pattern *regexp.Regexp
Source domsoc.EventSource
}
GenericParser uses a configurable regex with named groups. Named groups: "category", "severity", "description", "confidence".
func NewGenericParser ¶
func NewGenericParser(pattern string, source domsoc.EventSource) (*GenericParser, error)
type ImmuneParser ¶
type ImmuneParser struct{}
ImmuneParser parses immune system anomaly/response logs. Expected format: [ANOMALY] type=<type> score=<float> detail=<text>
or: [RESPONSE] action=<action> target=<target> reason=<text>
type Parser ¶
Parser converts a raw log line into a SOCEvent. Returns nil, false if the line is not a security event.
func ParserForSensor ¶
ParserForSensor returns the appropriate parser for a sensor type.
type SentinelCoreParser ¶
type SentinelCoreParser struct{}
SentinelCoreParser parses sentinel-core detection output. Expected format: [DETECT] engine=<name> confidence=<float> pattern=<desc> [severity=<sev>]
type ShieldParser ¶
type ShieldParser struct{}
ShieldParser parses shield network block logs. Expected format: BLOCKED protocol=<proto> reason=<reason> source_ip=<ip>
type Sidecar ¶
type Sidecar struct {
// contains filtered or unexported fields
}
Sidecar is the main orchestrator: tailer → parser → bus client.
func (*Sidecar) GetStats ¶
func (s *Sidecar) GetStats() StatsSnapshot
GetStats returns a snapshot of current runtime metrics (thread-safe).
type Stats ¶
type Stats struct {
LinesRead atomic.Int64
EventsSent atomic.Int64
Errors atomic.Int64
StartedAt time.Time
}
Stats tracks sidecar runtime metrics (thread-safe via atomic).
type StatsSnapshot ¶
type StatsSnapshot struct {
LinesRead int64 `json:"lines_read"`
EventsSent int64 `json:"events_sent"`
Errors int64 `json:"errors"`
StartedAt time.Time `json:"started_at"`
}
StatsSnapshot is a non-atomic copy for reading/logging.
type Tailer ¶
type Tailer struct {
// contains filtered or unexported fields
}
Tailer follows a log file or stdin, emitting lines via a channel.
func (*Tailer) FollowFile ¶
FollowFile tails a file, seeking to end on start. Sends lines on the returned channel until ctx is cancelled.
func (*Tailer) FollowReader ¶
FollowReader reads from any io.Reader (for testing).
Source Files