Documentation
¶
Overview ¶
Package ocsf encodes native audit lines as OCSF events (design 12 §6.2, R-384).
Everything in an OCSF event is derived from the line it encodes; nothing is looked up. The line's detail never holds a secret (R-194), so carrying it whole under unmapped adds nothing a native line does not already say.
Index ¶
Constants ¶
const SchemaVersion = "1.3.0"
SchemaVersion is the OCSF schema version the events conform to.
Variables ¶
var BaseFields = []Field{ {"class_uid, class_name", "The action's row under Classes."}, {"category_uid, category_name", "`class_uid / 1000`."}, {"activity_id, activity_name", "The action's row under Classes."}, {"type_uid, type_name", "`class_uid × 100 + activity_id`; the name is `<class>: <activity>`."}, {"time", "`occurred_at`, in epoch milliseconds."}, {"severity_id, severity", "1 Informational for `success`, 3 Medium for `denied`, 4 High for `failed`."}, {"status_id, status", "1 Success for `success`, 2 Failure otherwise."}, {"status_detail", "`denied` or `failed`; absent on success."}, {"message", "`<action> by <actor> on <target_kind> <target_id>`. The actor is `actor_name`, else `principal_id`, else `principal_kind`."}, {"metadata.uid", "`id`, as a string."}, {"metadata.version", "`" + SchemaVersion + "`."}, {"metadata.product", "`{name: \"Pando\", vendor_name: \"Pando\", version}`."}, {"metadata.correlation_uid", "`request_id`, when set."}, {"metadata.log_name", "`audit`."}, {"actor.user", "`{uid: principal_id, type_id, type, name: actor_name, email_addr: actor_email}`. `type` is `User` (1), `System` (3) or `Token` (99 Other); absent for an anonymous principal."}, {"actor.invoked_by", "`on_behalf_of`: the person a token acted for (R-229, R-262)."}, {"src_endpoint.ip", "`source_ip`, when set."}, {"http_request.user_agent", "`user_agent`, when set."}, {"api.operation", "`action`."}, {"resources", "`{type: target_kind, uid: target_id}`, then `{type: \"app\", uid: app_id}` when `app_id` is set and is not the target."}, {"unmapped", "`detail` whole, `peer_ip`, `schema_version`, `principal_kind` and `on_behalf_of`."}, }
BaseFields is the field-by-field mapping Encode implements, in the order the generated reference lists it. TestR384_OCSFBaseFields holds Encode's output to it, so a field cannot be added to one and not the other.
var ProcessFields = []Field{
{"process.name", "The command's first argument; `shell` when the session opened the runtime's default shell."},
{"process.cmd_line", "The command's arguments, joined with spaces. The command, never the session's input or output (R-086)."},
{"process.container.name", "The workload the session ran in."},
}
ProcessFields are the fields Process Activity (1007) adds, which only a terminal session's events carry: `app.exec` and `app.exec.end`.
var ProductVersion = "dev"
ProductVersion is Pando's version, reported as metadata.product.version. Set by main at startup.
Functions ¶
func Encode ¶
func Encode(line json.RawMessage) (json.RawMessage, error)
Encode is an audit.Encoder: one native line in, one OCSF event out.
Types ¶
type Field ¶
Field is one row of the base-field table: an OCSF field and the native column(s) it comes from.
type Mapping ¶
Mapping is the OCSF class and activity one audit action is recorded as.
func Lookup ¶
Lookup is the mapping for an action, and whether the table has one. An action it does not have is encoded as 6003 API Activity, 99 Other.
func (Mapping) CategoryName ¶
CategoryName is the category's OCSF caption.
func (Mapping) CategoryUID ¶
CategoryUID is the class's category: OCSF numbers a class category*1000+n.
Source Files