reducer

Documentation

Index

• type ReducedStats
  • func NewReducedStats(e *engine.Engine, identifier string) *ReducedStats
  • func (rs *ReducedStats) ComputeScore(cntSigs int) int
  • func (rs *ReducedStats) Copy() *ReducedStats
  • func (rs *ReducedStats) Finalize(cntSigs int)
  • func (rs ReducedStats) String() string
  • func (rs *ReducedStats) Update(t time.Time, matches []string)
• type Reducer
  • func NewReducer(e *engine.Engine) *Reducer
  • func (r *Reducer) CountUniqSigs() int
  • func (r *Reducer) Delete(identifier string)
  • func (r *Reducer) Print()
  • func (r *Reducer) ReduceCopy(identifier string) (crs *ReducedStats)
  • func (r *Reducer) Reset(identifier string)
  • func (r *Reducer) Score(identifier string) int
  • func (r *Reducer) Update(t time.Time, identifier string, matches []string)

Types

type ReducedStats

type ReducedStats struct {
	Identifier      string         `json:"identifier"`
	CntAlerts       int            `json:"alert-count"`
	CntBySig        map[string]int `json:"count-by-signature"`
	UniqSigs        []string       `json:"signatures"`
	Techniques      []string       `json:"techniques"`
	Tactics         []string       `json:"tactics"`
	TotalSigs       int            `json:"signature-count"`
	SumAlertCrit    int            `json:"sum-alert-criticality"`
	AvgAlertCrit    float64        `json:"avg-alert-criticality"`
	StdDevAlertCrit float64        `json:"std-dev-alert-criticality"`
	SumRuleCrit     int            `json:"sum-rule-criticality"`
	AvgSigCrit      float64        `json:"avg-signature-criticality"`
	StdDevSigCrit   float64        `json:"std-dev-signature-criticality"`
	SigDiv          float64        `json:"signature-diversity"`
	CntUniqSigs     int            `json:"count-uniq-signatures"`
	// signature criticality metric, the higher it is the more attention should be given to the report
	CntUniqByAvgCritBySig int `json:"signature-criticality-metric"`
	// alert criticality metric, the higher it is the more attention should be given to the report
	AvgAlertCritBySigDiv int `json:"alert-criticality-metric"`
	// aggregated metric used to sort statistic reports between them. Higher the score higher the priority
	Score      int       `json:"score"`
	StartTime  time.Time `json:"start-time"`
	MedianTime time.Time `json:"median-time"`
	StopTime   time.Time `json:"stop-time"`
	// contains filtered or unexported fields
}

ReducedStats structrure definition

func NewReducedStats

func NewReducedStats(e *engine.Engine, identifier string) *ReducedStats

NewReducedStats structure

func (*ReducedStats) ComputeScore

func (rs *ReducedStats) ComputeScore(cntSigs int) int

func (*ReducedStats) Copy

func (rs *ReducedStats) Copy() *ReducedStats

Copy returns a new copy of structure

func (*ReducedStats) Finalize

func (rs *ReducedStats) Finalize(cntSigs int)

Finalize the computation of the statistics

func (ReducedStats) String

func (rs ReducedStats) String() string

func (*ReducedStats) Update

func (rs *ReducedStats) Update(t time.Time, matches []string)

Update ReducedStats with data

type Reducer

type Reducer struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

Reducer structure to store statistics about several machines

func NewReducer

func NewReducer(e *engine.Engine) *Reducer

NewReducer creates a new Reducer structure

func (*Reducer) CountUniqSigs

func (r *Reducer) CountUniqSigs() int

CountUniqSigs counts all the uniq signatures seen in the reduced stats

func (*Reducer) Delete

func (r *Reducer) Delete(identifier string)

Delete deletes ReducedStats according to its identifier

func (*Reducer) Print

func (r *Reducer) Print()

Print prints out all the informations stored in the Reducer

func (*Reducer) ReduceCopy

func (r *Reducer) ReduceCopy(identifier string) (crs *ReducedStats)

ReduceCopy reduces alerts of a single computer and returns a copy of ReducedStats

func (*Reducer) Reset

func (r *Reducer) Reset(identifier string)

Reset ReducedStats according to its identifier

func (*Reducer) Score

func (r *Reducer) Score(identifier string) int

Score is a simpler primitive to return only the score

func (*Reducer) Update

func (r *Reducer) Update(t time.Time, identifier string, matches []string)

Update a ReducedStats stored in Reducer with data