engine

Documentation

Index

• Constants
• type Config
• type Engine
  • func NewEngine(config Config, sources EventSources, output chan detect.Finding) (*Engine, error)
  • func (engine *Engine) GetSelectedEvents() []detect.SignatureEventSelector
  • func (engine *Engine) LoadSignature(signature detect.Signature) (string, error)
  • func (engine *Engine) Start(ctx context.Context)
  • func (engine *Engine) Stats() *metrics.Stats
  • func (engine *Engine) UnloadSignature(signatureId string) error
• type EventSources

Constants

const ALL_EVENT_ORIGINS = "*"

const ALL_EVENT_TYPES = "*"

const EVENT_CONTAINER_ORIGIN = "container"

const EVENT_HOST_ORIGIN = "host"

Types

type Config

type Config struct {
	// Enables the signatures engine to run in the events pipeline
	Enabled             bool
	SignatureBufferSize uint
	Signatures          []detect.Signature
}

Config defines the engine's configurable values

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

Engine is a signatures-engine that can process events coming from a set of input sources against a set of loaded signatures, and report the signatures' findings

func NewEngine

func NewEngine(config Config, sources EventSources, output chan detect.Finding) (*Engine, error)

NewEngine creates a new signatures-engine with the given arguments inputs and outputs are given as channels created by the consumer

func (*Engine) GetSelectedEvents

func (engine *Engine) GetSelectedEvents() []detect.SignatureEventSelector

GetSelectedEvents returns the event selectors that are relevant to the currently loaded signatures

func (*Engine) LoadSignature

func (engine *Engine) LoadSignature(signature detect.Signature) (string, error)

LoadSignature will call the internal signature loading logic and activate its handling business logics. It will return the signature ID as well as error.

func (*Engine) Start

func (engine *Engine) Start(ctx context.Context)

Start starts processing events and detecting signatures it runs continuously until stopped by the done channel once done, it cleans all internal resources, which means the engine is not reusable note that the input and output channels are created by the consumer and therefore are not closed

func (*Engine) Stats

func (engine *Engine) Stats() *metrics.Stats

func (*Engine) UnloadSignature

func (engine *Engine) UnloadSignature(signatureId string) error

UnloadSignature will remove from Engine data structures the given signature and stop its handling goroutine

type EventSources

type EventSources struct {
	Tracee chan protocol.Event
}

EventSources is a bundle of input sources used to configure the Engine