Documentation
¶
Overview ¶
Package plugin provides the extensibility system for Chronicle. Plugins implement subsets of discovery-based interfaces. Chronicle discovers which interfaces a plugin implements at registration time and caches the dispatch paths for O(1) per-event overhead.
Index ¶
- Variables
- type AfterRecord
- type AlertHandler
- type AlertRule
- type BeforeRecord
- type ComplianceReporter
- type Exporter
- type OnInit
- type OnShutdown
- type Plugin
- type Registry
- func (r *Registry) EmitAfterRecord(ctx context.Context, event *audit.Event)
- func (r *Registry) EmitBeforeRecord(ctx context.Context, event *audit.Event) error
- func (r *Registry) EmitInit(ctx context.Context) error
- func (r *Registry) EmitShutdown(ctx context.Context) error
- func (r *Registry) Plugins() []Plugin
- func (r *Registry) Register(p Plugin)
- func (r *Registry) SetAlertRules(rules []AlertRule)
- func (r *Registry) Sinks() []sink.Sink
- type SinkProvider
Constants ¶
This section is empty.
Variables ¶
var ErrSkipEvent = errors.New("chronicle: skip event")
ErrSkipEvent is returned by BeforeRecord plugins to skip recording an event.
Functions ¶
This section is empty.
Types ¶
type AfterRecord ¶
AfterRecord fires AFTER an event is successfully persisted to the store. Use for notifications, alerts, forwarding.
type AlertHandler ¶
type AlertHandler interface {
OnAlert(ctx context.Context, event *audit.Event, rule *AlertRule) error
}
AlertHandler fires when an event matches alert criteria.
type AlertRule ¶
type AlertRule struct {
Severity string `json:"severity,omitempty"`
Category string `json:"category,omitempty"`
Action string `json:"action,omitempty"`
Outcome string `json:"outcome,omitempty"`
}
AlertRule defines criteria for triggering alerts.
type BeforeRecord ¶
BeforeRecord fires BEFORE an event is persisted. Use for enrichment (add metadata), filtering (return ErrSkipEvent), or transformation.
type ComplianceReporter ¶
type ComplianceReporter interface {
ReportType() string
}
ComplianceReporter provides a custom compliance report type.
type Exporter ¶
type Exporter interface {
Format() string
Export(ctx context.Context, data any, w io.Writer) error
}
Exporter provides a custom export format.
type OnShutdown ¶
OnShutdown is called when Chronicle stops.
type Plugin ¶
type Plugin interface {
Name() string
}
Plugin is the primary extensibility point for Chronicle. Implement any subset of the hook interfaces below.
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry manages plugins and dispatches hook calls.
func NewRegistry ¶
NewRegistry creates a new plugin Registry.
func (*Registry) EmitAfterRecord ¶
EmitAfterRecord calls OnAfterRecord on all registered plugins. Errors are logged but do not block the pipeline.
func (*Registry) EmitBeforeRecord ¶
EmitBeforeRecord calls OnBeforeRecord on all registered plugins. Returns ErrSkipEvent if any plugin returns it. Other errors are logged but do not block the pipeline.
func (*Registry) EmitShutdown ¶
EmitShutdown calls OnShutdown on all registered plugins.
func (*Registry) SetAlertRules ¶
SetAlertRules sets the alert rules for matching events.
type SinkProvider ¶
SinkProvider provides a custom sink to be added to the sink fan-out.
Source Files