exporters

type CEFFormatter struct{}

type DatadogConfig struct {
	APIKey  string        `json:"apiKey"`  // Datadog API key
	Site    string        `json:"site"`    // Datadog site (e.g., datadoghq.com, datadoghq.eu)
	Service string        `json:"service"` // Service name
	Source  string        `json:"source"`  // Log source
	Tags    []string      `json:"tags"`    // Additional tags
	Timeout time.Duration `json:"timeout"`
}

type DatadogExporter struct {
	// contains filtered or unexported fields
}

type EventFormatter interface {
	Format(event *audit.Event) ([]byte, error)
}

type ExportManager struct {
	// contains filtered or unexported fields
}

type Exporter interface {
	// Name returns the exporter name (e.g., "splunk", "datadog")
	Name() string

	// Export exports a batch of events
	Export(ctx context.Context, events []*audit.Event) error

	// HealthCheck checks if the exporter is healthy
	HealthCheck(ctx context.Context) error

	// Close closes the exporter and releases resources
	Close() error
}

type ExporterConfig struct {
	Name           string        `json:"name"`
	Enabled        bool          `json:"enabled"`
	BatchSize      int           `json:"batchSize"`      // Number of events per batch
	FlushInterval  time.Duration `json:"flushInterval"`  // Max time between flushes
	RetryAttempts  int           `json:"retryAttempts"`  // Number of retry attempts
	RetryBackoff   time.Duration `json:"retryBackoff"`   // Initial retry backoff
	BufferSize     int           `json:"bufferSize"`     // Event buffer size
	ErrorThreshold int           `json:"errorThreshold"` // Consecutive errors before circuit breaker
}

type ExporterStats struct {
	EventsExported  int64     `json:"eventsExported"`
	EventsFailed    int64     `json:"eventsFailed"`
	BatchesExported int64     `json:"batchesExported"`
	BatchesFailed   int64     `json:"batchesFailed"`
	LastExportAt    time.Time `json:"lastExportAt"`
	LastErrorAt     time.Time `json:"lastErrorAt"`
	LastError       string    `json:"lastError"`
	CircuitOpen     bool      `json:"circuitOpen"`
}

type JSONFormatter struct{}

type LEEFFormatter struct{}

type ManagedExporter struct {
	// contains filtered or unexported fields
}

type SplunkConfig struct {
	Endpoint   string        `json:"endpoint"`   // Splunk HEC endpoint (e.g., https://splunk:8088/services/collector)
	Token      string        `json:"token"`      // HEC token
	Index      string        `json:"index"`      // Splunk index
	Source     string        `json:"source"`     // Event source
	SourceType string        `json:"sourceType"` // Source type
	VerifySSL  bool          `json:"verifySSL"`  // Verify SSL certificates
	Timeout    time.Duration `json:"timeout"`
}

type SplunkExporter struct {
	// contains filtered or unexported fields
}

type SyslogConfig struct {
	Network   string        `json:"network"`  // tcp, udp, tcp+tls
	Address   string        `json:"address"`  // host:port
	Tag       string        `json:"tag"`      // Syslog tag
	Facility  string        `json:"facility"` // Syslog facility (e.g., local0)
	Severity  string        `json:"severity"` // Default severity (e.g., info)
	UseTLS    bool          `json:"useTls"`   // Use TLS for TCP
	TLSConfig *tls.Config   `json:"-"`        // TLS configuration
	Timeout   time.Duration `json:"timeout"`
	Format    string        `json:"format"` // rfc5424 or rfc3164
}

type SyslogExporter struct {
	// contains filtered or unexported fields
}