Documentation
¶
Overview ¶
Package https is the audit sink adapter for a SIEM's HTTPS ingest endpoint (R-382, design 12 §5.1): one POST per batch, in the body shape the destination reads — newline-delimited JSON, a JSON array, Splunk HEC's envelope, Elastic's bulk action lines, or Datadog log items. A batch whose body would pass max_body_bytes goes as several POSTs, in order.
The provider's vocabulary stays here (R-251). Presets fill it in for Splunk, Datadog, Elastic, Sumo Logic and Azure Monitor; core knows none of them.
Index ¶
- Constants
- func Info() api.KindInfo
- type Adapter
- func (a *Adapter) AuditSinkCapabilities() api.AuditSinkCapabilities
- func (a *Adapter) Category() api.Category
- func (a *Adapter) Configure(_ context.Context, raw json.RawMessage) error
- func (a *Adapter) HealthCheck(context.Context) error
- func (a *Adapter) Kind() string
- func (a *Adapter) Send(ctx context.Context, b api.AuditBatch) error
- type Config
- type Credentials
Constants ¶
const ( BodyNDJSON = "ndjson" BodyJSONArray = "json_array" BodySplunkHEC = "splunk_hec" BodyElasticBulk = "elastic_bulk" BodyDatadog = "datadog" )
Body shapes.
const DatadogMaxBody = 5_000_000
DatadogMaxBody is Datadog's limit on one uncompressed payload, 5 MB. Read as decimal megabytes, the smaller reading, so a body never passes it.
const DefaultMaxBatch = 500
DefaultMaxBatch is how many events one POST carries unless max_batch says.
const Kind = "https"
Kind is the adapter's kind string.
const SchemeNone = "none"
SchemeNone sends the token as the whole header value, as Datadog's DD-API-KEY wants. A named value rather than an empty one, because an empty setting means the default, Bearer.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Adapter ¶
type Adapter struct {
// contains filtered or unexported fields
}
Adapter posts batches to one endpoint.
func (*Adapter) AuditSinkCapabilities ¶
func (a *Adapter) AuditSinkCapabilities() api.AuditSinkCapabilities
AuditSinkCapabilities reports how core feeds this adapter (R-254).
func (*Adapter) HealthCheck ¶
HealthCheck succeeds once configured. It posts nothing: a probe would be an event the SIEM indexes, and a destination that is down shows up as failed deliveries soon enough, with the answer it gave.
type Config ¶
type Config struct {
Credentials Credentials `json:"credentials,omitzero"`
sinkkit.Common
URL string `json:"url,omitempty"`
AllowHTTP bool `json:"allow_http,omitempty"`
Body string `json:"body,omitempty"`
AuthHeader string `json:"auth_header,omitempty"`
AuthScheme string `json:"auth_scheme,omitempty"`
ExtraHeaders string `json:"extra_headers,omitempty"`
SourceType string `json:"sourcetype,omitempty"`
CACertificate string `json:"ca_certificate,omitempty"`
TimeoutSeconds int `json:"timeout_seconds,omitempty"`
MaxBodyBytes int `json:"max_body_bytes,omitempty"`
}
Config is the adapter's configuration.
type Credentials ¶
type Credentials struct {
Token secret.Value `json:"token,omitzero"`
SecretURL secret.Value `json:"secret_url,omitzero"`
}
Credentials is what this adapter keeps secret (R-190).
SecretURL is for a destination whose URL is itself the credential — a Sumo Logic HTTP source embeds its token in the path. Set, it replaces url, and only its host is ever shown.
Source Files