syslog

Documentation

Index

• func Chop(rulePath string, outputType string, filePath string) interface{}
• func FindLog(file string) (string, error)
• type SyslogEvent
  • func ParseEvents(logFile string) ([]SyslogEvent, error)
  • func (e SyslogEvent) Keywords() ([]string, bool)
  • func (e SyslogEvent) Select(name string) (interface{}, bool)

Functions

func Chop

func Chop(rulePath string, outputType string, filePath string) interface{}

func FindLog

func FindLog(file string) (string, error)

Types

type SyslogEvent

type SyslogEvent struct {
	Facility  string
	Severity  string
	Message   string
	Timestamp string
}

Representation of syslog event

func ParseEvents

func ParseEvents(logFile string) ([]SyslogEvent, error)

ParseEvents interprets and parses the log file and builds a slice of SyslogEvent structs

func (SyslogEvent) Keywords

func (e SyslogEvent) Keywords() ([]string, bool)

Keywords is a function required for a sigma.Event to be passed to sigma.Rulset.EvalAll

Keywords returns a list of the different keys in our SyslogEvent struct.

func (SyslogEvent) Select

func (e SyslogEvent) Select(name string) (interface{}, bool)

Select is a function required for a sigma.Event to be passed to sigma.Rulset.EvalAll

Select returns the value for a specified key