event

Documentation

Index

• Constants
• type Data
• type Event
• type Reporter
  • func NewLogReporter(stopper restart.Stopper, sourceName, sourceType, runPath string, ...) (Reporter, error)
  • func NewReporter(logSource *config.LogSource, logChan chan *message.Message) Reporter

Constants

const (
	// Passed is used to report successful result of a rule check (condition passed)
	Passed = "passed"
	// Failed is used to report unsuccessful result of a rule check (condition failed)
	Failed = "failed"
	// Error is used to report result of a rule check that resulted in an error (unable to evaluate condition)
	Error = "error"
)

Types

type Data

type Data map[string]interface{}

Data defines a key value map for storing attributes of a reported rule event

type Event

type Event struct {
	AgentRuleID      string      `json:"agent_rule_id,omitempty"`
	AgentRuleVersion int         `json:"agent_rule_version,omitempty"`
	AgentFrameworkID string      `json:"agent_framework_id,omitempty"`
	AgentVersion     string      `json:"agent_version,omitempty"`
	Result           string      `json:"result,omitempty"`
	ResourceType     string      `json:"resource_type,omitempty"`
	ResourceID       string      `json:"resource_id,omitempty"`
	Tags             []string    `json:"tags"`
	Data             interface{} `json:"data,omitempty"`
	ExpireAt         time.Time   `json:"expire_at,omitempty"`
	Evaluator        string      `json:"evaluator,omitempty"`
}

Event describes a log event sent for an evaluated compliance/security rule.

type Reporter

type Reporter interface {
	Report(event *Event)
	ReportRaw(content []byte, service string, tags ...string)
}

Reporter defines an interface for reporting rule events

func NewLogReporter

func NewLogReporter(stopper restart.Stopper, sourceName, sourceType, runPath string, endpoints *config.Endpoints, context *client.DestinationsContext) (Reporter, error)

NewLogReporter instantiates a new log reporter

func NewReporter

func NewReporter(logSource *config.LogSource, logChan chan *message.Message) Reporter

NewReporter returns an instance of Reporter