hooks

Documentation

Index

• type Filter
  • func NewFilter(eids []int64, channel string) *Filter
  • func (f *Filter) Match(e *evtx.GoEvtxMap) bool
• type Hook
• type HookManager
  • func NewHookMan() *HookManager
  • func (hm *HookManager) Hook(h Hook, f *Filter)
  • func (hm *HookManager) RunHooksOn(e *evtx.GoEvtxMap) (ret bool)

Types

type Filter

type Filter struct {
	EventIDs datastructs.SyncedSet
	//Channels datastructs.SyncedSet
	Channel string
}

Filter structure

func NewFilter

func NewFilter(eids []int64, channel string) *Filter

NewFilter creates a new Filter structure

func (*Filter) Match

func (f *Filter) Match(e *evtx.GoEvtxMap) bool

Match checks if an event matches the filter

type Hook

type Hook func(*evtx.GoEvtxMap)

Hook structure definition hooking functions are supposed to run quickly since it is run synchronously with the Gene scanner. Likewise, the hooking functions should never panic the program.

type HookManager

type HookManager struct {
	sync.RWMutex
	Filters []*Filter
	Hooks   []Hook
	// contains filtered or unexported fields
}

HookManager structure definition to easier handle hooks

func NewHookMan

func NewHookMan() *HookManager

NewHookMan creates a new HookManager structure

func (*HookManager) Hook

func (hm *HookManager) Hook(h Hook, f *Filter)

Hook register a hook for a given filter

func (*HookManager) RunHooksOn

func (hm *HookManager) RunHooksOn(e *evtx.GoEvtxMap) (ret bool)

RunHooksOn runs the hook on a given event