signature

Documentation

Index

• func Find(target string, partialEval bool, signaturesDir []string, signatures []string, ...) ([]detect.Signature, []detect.DataSource, error)
• type FakeSignature
  • func (fs *FakeSignature) Close()
  • func (fs FakeSignature) GetMetadata() (detect.SignatureMetadata, error)
  • func (fs FakeSignature) GetSelectedEvents() ([]detect.SignatureEventSelector, error)
  • func (fs FakeSignature) Init(ctx detect.SignatureContext) error
  • func (fs FakeSignature) OnEvent(event protocol.Event) error
  • func (fs FakeSignature) OnSignal(signal detect.Signal) error

Functions

func Find

func Find(target string, partialEval bool, signaturesDir []string, signatures []string, aioEnabled bool) ([]detect.Signature, []detect.DataSource, error)

Types

type FakeSignature

type FakeSignature struct {
	FakeGetMetadata       func() (detect.SignatureMetadata, error)
	FakeGetSelectedEvents func() ([]detect.SignatureEventSelector, error)
	FakeInit              func(detect.SignatureContext) error
	FakeOnEvent           func(protocol.Event) error
	FakeOnSignal          func(signal detect.Signal) error
}

FakeSignature is a mock for the detect.Signature interface, it allows customization of methods through the fields. It can be used for tests.

func (*FakeSignature) Close

func (fs *FakeSignature) Close()

func (FakeSignature) GetMetadata

func (fs FakeSignature) GetMetadata() (detect.SignatureMetadata, error)

func (FakeSignature) GetSelectedEvents

func (fs FakeSignature) GetSelectedEvents() ([]detect.SignatureEventSelector, error)

func (FakeSignature) Init

func (fs FakeSignature) Init(ctx detect.SignatureContext) error

func (FakeSignature) OnEvent

func (fs FakeSignature) OnEvent(event protocol.Event) error

func (FakeSignature) OnSignal

func (fs FakeSignature) OnSignal(signal detect.Signal) error