Documentation
¶
Index ¶
- type BaseEvent
- type BlockedEvent
- type ChildprocEvent
- type CrossprocEvent
- type DigSigResult
- type EmetEvent
- type Event
- type EventMessage
- type EventMessageWithHashes
- type FilemodEvent
- type HeaderHashes
- type ModInfoEvent
- type ModloadMessage
- type NetconEvent
- type NetworkV2Event
- type OldProtobufMessageProcessor
- func (pbmp OldProtobufMessageProcessor) ProcessProtobufBundle(routingKey string, body []byte, headers amqp.Table) ([]map[string]interface{}, error)
- func (pbmp OldProtobufMessageProcessor) ProcessProtobufMessage(routingKey string, body []byte, headers amqp.Table) (map[string]interface{}, error)
- func (pbmp OldProtobufMessageProcessor) ProcessRawZipBundle(routingKey string, body []byte, headers amqp.Table) ([]map[string]interface{}, error)
- type ParentCreateTime
- type ProcessEvent
- type ProtobufMessageProcessor
- func (pbm ProtobufMessageProcessor) GetMessageInOutputFormat(message Event) ([]byte, error)
- func (pbm *ProtobufMessageProcessor) NewBaseMessage(msg *CbEventMsg, routingKey, eventType string) *BaseEvent
- func (pbm ProtobufMessageProcessor) NewBlockedEvent(msg *CbEventMsg, routingKey string) *BlockedEvent
- func (pbm *ProtobufMessageProcessor) NewChildprocEvent(msg *CbEventMsg, routingKey string) *ChildprocEvent
- func (pbm *ProtobufMessageProcessor) NewCrossprocEvent(msg *CbEventMsg, routingKey string) *CrossprocEvent
- func (pbm *ProtobufMessageProcessor) NewEmetMessage(msg *CbEventMsg, routingKey string) *EmetEvent
- func (pbm *ProtobufMessageProcessor) NewEventMessage(msg *CbEventMsg) *EventMessage
- func (pbm *ProtobufMessageProcessor) NewEventMessageWithHashes(msg *CbEventMsg) *EventMessageWithHashes
- func (pbm *ProtobufMessageProcessor) NewFilemodEvent(msg *CbEventMsg, routingKey string) *FilemodEvent
- func (pbm ProtobufMessageProcessor) NewModLoadMessage(msg *CbEventMsg, routingKey string) *ModloadMessage
- func (pbm ProtobufMessageProcessor) NewModinfoEvent(msg *CbEventMsg, routingKey string) *ModInfoEvent
- func (pbm *ProtobufMessageProcessor) NewNetconEvent(msg *CbEventMsg, routingKey string) *NetconEvent
- func (pbm *ProtobufMessageProcessor) NewNetworkV2Event(msg *CbEventMsg, routingKey string) *NetworkV2Event
- func (pbm *ProtobufMessageProcessor) NewProcessEvent(msg *CbEventMsg, routingKey string) *ProcessEvent
- func (pbm *ProtobufMessageProcessor) NewRegmodEvent(msg *CbEventMsg, routingKey string) *RegmodEvent
- func (pbm *ProtobufMessageProcessor) NewScriptExEvent(msg *CbEventMsg, routingKey string) *ScriptExEvent
- func (pbm *ProtobufMessageProcessor) NewTamperAlert(msg *CbEventMsg, routingKey string) *TamperAlert
- func (pbm ProtobufMessageProcessor) ProcessProtobufBundle(routingKey string, body []byte, headers amqp.Table) ([][]byte, error)
- func (pbm ProtobufMessageProcessor) ProcessProtobufMessage(routingKey string, body []byte, headers amqp.Table) ([]byte, error)
- func (pbm ProtobufMessageProcessor) ProcessProtobufMessageWithEnv(routingKey string, body []byte, headers amqp.Table, env *CbEnvironmentMsg) ([]byte, error)
- func (pbm ProtobufMessageProcessor) ProcessRawZipBundle(routingKey string, body []byte, headers amqp.Table) ([][]byte, error)
- type RegmodEvent
- type ScriptExEvent
- type TamperAlert
- type UnixTimeStamp
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BaseEvent ¶
type BaseEvent struct { UnixTimeStamp `json:",inline"` CbServer string `json:"cb_server,omitempty,intern"` Type string `json:"type,intern"` SensorId int32 `json:"sensor_id"` ComputerName string `json:"computer_name"` EventType string `json:"event_type,intern"` }
func (BaseEvent) MarshalEasyJSON ¶
MarshalEasyJSON supports easyjson.Marshaler interface
func (BaseEvent) MarshalJSON ¶
MarshalJSON supports json.Marshaler interface
func (*BaseEvent) UnmarshalEasyJSON ¶
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*BaseEvent) UnmarshalJSON ¶
UnmarshalJSON supports json.Unmarshaler interface
type BlockedEvent ¶
type BlockedEvent struct { *BaseEvent Md5 string `json:"md5"` Path string `json:"path"` LinkTarget string `json:"link_target,omitempty"` ProcessGuid string `json:"process_guid,omitempty"` ProcessCreateTime uint64 `json:"process_create_time,omitempty"` CommandLine string `json:"command_line,omitempty"` Pid int32 `json:"pid,omitempty"` Uid string `json:"uid,omitempty"` Username string `json:"username,omitempty"` BlockedError uint32 `json:"blocked_error,omitempty"` BlockedEvent string `json:"blocked_event,omitempty"` BlockedReason string `json:"blocked_reason,omitempty"` BlockedResult string `json:"blocked_result,omitempty"` }
func (BlockedEvent) MarshalEasyJSON ¶
func (v BlockedEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (BlockedEvent) MarshalJSON ¶
func (v BlockedEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*BlockedEvent) UnmarshalEasyJSON ¶
func (v *BlockedEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*BlockedEvent) UnmarshalJSON ¶
func (v *BlockedEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ChildprocEvent ¶
type ChildprocEvent struct { *BaseEvent *EventMessage ParentGuid string `json:"parent_guid,omitempty"` LinkChild string `json:"link_child,omitempty"` Created bool `json:"created"` TamperSent bool `json:"tamper_sent"` Tamper bool `json:"tamper"` Path string `json:"path"` Md5 string `json:"md5"` Sha256 string `json:"sha256"` ChildprocType string `json:"childproc_type,intern"` ChildSuppressed bool `json:"childproc_suppressed"` ChildCommandLine string `json:"childproc_commandline,omitempty"` ChildUsername string `json:"childproc_username,omitempty"` ChildPid int64 `json:"child_pid"` }
func (ChildprocEvent) MarshalEasyJSON ¶
func (v ChildprocEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ChildprocEvent) MarshalJSON ¶
func (v ChildprocEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ChildprocEvent) UnmarshalEasyJSON ¶
func (v *ChildprocEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ChildprocEvent) UnmarshalJSON ¶
func (v *ChildprocEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type CrossprocEvent ¶
type CrossprocEvent struct { *BaseEvent *EventMessageWithHashes IsTarget bool `json:"is_target"` CrossProcessType string `json:"cross_process_type,intern"` TargetMd5 string `json:"target_md5"` RequestedAccess uint32 `json:"requested_access,omitempty"` LinkTarget string `json:"link_target,omitempty"` TargetPath string `json:"target_path"` TargetSha256 string `json:"target_sha256"` TargetPid uint32 `json:"target_pid"` TargetCreateTime uint64 `json:"target_create_time"` TargetProcessGuid string `json:"target_process_guid"` }
func (CrossprocEvent) MarshalEasyJSON ¶
func (v CrossprocEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (CrossprocEvent) MarshalJSON ¶
func (v CrossprocEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*CrossprocEvent) UnmarshalEasyJSON ¶
func (v *CrossprocEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*CrossprocEvent) UnmarshalJSON ¶
func (v *CrossprocEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type DigSigResult ¶
type DigSigResult struct { Result string `json:"result"` Publisher string `json:"publisher"` ProgramName string `json:"program_name"` IssuerName string `json:"issuer_name"` ResultCode string `json:"result_code"` SubjectName string `json:"subject_name"` SignTime string `json:"sign_time"` }
func (DigSigResult) MarshalEasyJSON ¶
func (v DigSigResult) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (DigSigResult) MarshalJSON ¶
func (v DigSigResult) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*DigSigResult) UnmarshalEasyJSON ¶
func (v *DigSigResult) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*DigSigResult) UnmarshalJSON ¶
func (v *DigSigResult) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type EmetEvent ¶
type EmetEvent struct { *BaseEvent *EventMessageWithHashes LogMessage string `json:"log_message"` Mitigation string `json:"mitigation,intern"` Blocked bool `json:"blocked"` EmetTimestamp uint64 `json:"emet_timestamp"` LogId uint64 `json:"log_id"` }
func (EmetEvent) MarshalEasyJSON ¶
MarshalEasyJSON supports easyjson.Marshaler interface
func (EmetEvent) MarshalJSON ¶
MarshalJSON supports json.Marshaler interface
func (*EmetEvent) UnmarshalEasyJSON ¶
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*EmetEvent) UnmarshalJSON ¶
UnmarshalJSON supports json.Unmarshaler interface
type EventMessage ¶
type EventMessage struct { ForkPid int32 `json:"fork_pid,omitempty"` Pid int32 `json:"pid,omitempty"` ProcessGuid string `json:"process_guid,omitempty"` LinkProcess string `json:"link_process,omitempty"` LinkSensor string `json:"link_sensor,omitempty"` ProcessPath string `json:"process_path,omitempty"` }
func (EventMessage) MarshalEasyJSON ¶
func (v EventMessage) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (EventMessage) MarshalJSON ¶
func (v EventMessage) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*EventMessage) UnmarshalEasyJSON ¶
func (v *EventMessage) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*EventMessage) UnmarshalJSON ¶
func (v *EventMessage) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type EventMessageWithHashes ¶
type EventMessageWithHashes struct { *EventMessage *HeaderHashes }
func (EventMessageWithHashes) MarshalEasyJSON ¶
func (v EventMessageWithHashes) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (EventMessageWithHashes) MarshalJSON ¶
func (v EventMessageWithHashes) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*EventMessageWithHashes) UnmarshalEasyJSON ¶
func (v *EventMessageWithHashes) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*EventMessageWithHashes) UnmarshalJSON ¶
func (v *EventMessageWithHashes) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type FilemodEvent ¶
type FilemodEvent struct { *BaseEvent *EventMessageWithHashes Path string `json:"path"` TamperSent bool `json:"tamper_sent"` Tamper bool `json:"tamper"` FileSha256 string `json:"file_sha256,omitempty"` FileMd5 string `json:"file_md5,omitempty"` FileTypeName string `json:"filetype_name,omitempty"` ActionType int32 `json:"action_type"` Action string `json:"action,intern"` FileType int32 `json:"file_type"` }
func (FilemodEvent) MarshalEasyJSON ¶
func (v FilemodEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (FilemodEvent) MarshalJSON ¶
func (v FilemodEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*FilemodEvent) UnmarshalEasyJSON ¶
func (v *FilemodEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*FilemodEvent) UnmarshalJSON ¶
func (v *FilemodEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type HeaderHashes ¶
type HeaderHashes struct { Sha256 string `json:"sha256,omitempty"` Md5 string `json:"md5,omitempty"` }
func NewHeaderHashes ¶
func NewHeaderHashes(msg *CbEventMsg) HeaderHashes
func (HeaderHashes) MarshalEasyJSON ¶
func (v HeaderHashes) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (HeaderHashes) MarshalJSON ¶
func (v HeaderHashes) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*HeaderHashes) UnmarshalEasyJSON ¶
func (v *HeaderHashes) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*HeaderHashes) UnmarshalJSON ¶
func (v *HeaderHashes) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ModInfoEvent ¶
type ModInfoEvent struct { *BaseEvent Digsig *DigSigResult `json:"digsig"` Utf8CopiedModuleLength uint32 `json:"utf_8_copied_module_length"` Utf8FileDescription string `json:"utf_8_file_dscription"` Utf8CompanyName string `json:"utf_8_company_name"` Utf8Comments string `json:"utf_8_comments"` Utf8FileVersion string `json:"utf_8_file_version"` Utf8LegalCopyRight string `json:"utf_8_legal_copyright"` Utf8LegalTradeMark string `json:"utf_8_legal_trademark"` Utf8InternalName string `json:"utf_8_internal_name"` Utf8ProductName string `json:"utf_8_product_name"` Utf8OriginalFileName string `json:"utf_8_original_file_name"` Utf8ProductDescription string `json:"utf_8_product_description"` Utf8ProductVersion string `json:"utf_8_product_version"` Utf8SpecialBuild string `json:"utf_8_special_build"` ImageFileHeader []byte `json:"image_file_header"` Utf8OnDiskFileName string `json:"utf_8_on_disk_filename"` Icon []byte `json:"icon"` Utf8PrivateBuild string `json:"utf_8_private_build"` Size uint64 `json:"size"` Sha256 string `json:"sha256"` Md5 string `json:"md5"` }
func (ModInfoEvent) MarshalEasyJSON ¶
func (v ModInfoEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ModInfoEvent) MarshalJSON ¶
func (v ModInfoEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ModInfoEvent) UnmarshalEasyJSON ¶
func (v *ModInfoEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ModInfoEvent) UnmarshalJSON ¶
func (v *ModInfoEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ModloadMessage ¶
type ModloadMessage struct { *BaseEvent *EventMessage Path string `json:"path"` Md5 string `json:"md5"` Sha256 string `json:"sha256"` CommandLine string `json:"command_line"` }
func (ModloadMessage) MarshalEasyJSON ¶
func (v ModloadMessage) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ModloadMessage) MarshalJSON ¶
func (v ModloadMessage) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ModloadMessage) UnmarshalEasyJSON ¶
func (v *ModloadMessage) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ModloadMessage) UnmarshalJSON ¶
func (v *ModloadMessage) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type NetconEvent ¶
type NetconEvent struct { *BaseEvent *EventMessageWithHashes RemotePort uint16 `json:"remote_port,omitempty"` LocalIp string `json:"local_ip,omitempty"` LocalPort uint16 `json:"local_port,omitempty"` Direction string `json:"direction"` Domain string `json:"domain"` Protocol int32 `json:"protocol"` Port uint16 `json:"port"` Ipv4 string `json:"ipv4"` RemoteIp string `json:"remote_ip,omitempty"` }
func (NetconEvent) MarshalEasyJSON ¶
func (v NetconEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (NetconEvent) MarshalJSON ¶
func (v NetconEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*NetconEvent) UnmarshalEasyJSON ¶
func (v *NetconEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*NetconEvent) UnmarshalJSON ¶
func (v *NetconEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type NetworkV2Event ¶
type NetworkV2Event struct { *BaseEvent *EventMessageWithHashes Protocol int32 Domain string `json:"domain"` Direction string `json:"direction"` Ja3 string `json:"ja3,omitempty"` Ja3s string `json:"ja3s,omitempty"` LocalIP string `json:"local_ip"` LocalPort uint16 `json:"local_port"` RemoteIP string `json:"remote_ip"` RemotePort uint16 `json:"remote_port"` Proxy bool `json:"proxy"` ProxyIP string `` /* 1127-byte string literal not displayed */ ProxyPort uint16 `json:"proxy_port,omitempty"` ProxyDomain string `json:"proxy_domain, omit_empty"` }
func (NetworkV2Event) MarshalEasyJSON ¶
func (v NetworkV2Event) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (NetworkV2Event) MarshalJSON ¶
func (v NetworkV2Event) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*NetworkV2Event) UnmarshalEasyJSON ¶
func (v *NetworkV2Event) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*NetworkV2Event) UnmarshalJSON ¶
func (v *NetworkV2Event) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type OldProtobufMessageProcessor ¶
type OldProtobufMessageProcessor struct {
// contains filtered or unexported fields
}
func NewOldProtobufMessageProcessor ¶
func NewOldProtobufMessageProcessor(cfg *Configuration) OldProtobufMessageProcessor
func (OldProtobufMessageProcessor) ProcessProtobufBundle ¶
func (OldProtobufMessageProcessor) ProcessProtobufMessage ¶
func (OldProtobufMessageProcessor) ProcessRawZipBundle ¶
type ParentCreateTime ¶
type ParentCreateTime struct {
ParentCreateTimestamp interface{} `json:"parent_create_time"`
}
func ParentCreateTimestampFromWindowsTime ¶
func ParentCreateTimestampFromWindowsTime(time int64, useTimeFloat bool) (unixTime ParentCreateTime)
func (ParentCreateTime) MarshalEasyJSON ¶
func (v ParentCreateTime) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ParentCreateTime) MarshalJSON ¶
func (v ParentCreateTime) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ParentCreateTime) UnmarshalEasyJSON ¶
func (v *ParentCreateTime) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ParentCreateTime) UnmarshalJSON ¶
func (v *ParentCreateTime) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ProcessEvent ¶
type ProcessEvent struct { *BaseEvent *EventMessage Path string `json:"path"` Md5 string `json:"md5"` Sha256 string `json:"sha256"` CommandLine string `json:"command_line"` ParentPath string `json:"parent_path"` ParentPid int32 `json:"parent_pid"` ParentGuid int64 `json:"parent_guid"` ParentCreateTime `json:",inline"` FilteringKnownDLLS bool `json:"filtering_known_dlls"` ParentMd5 string `json:"parent_md5,omitempty"` ParentSha256 string `json:"parent_sha256,omitempty"` ExpectFollowonWMd5 bool `json:"expect_followon_w_md5"` LinkParent string `json:"link_parent,omitempty"` Username string `json:"username,omitempty"` Uid string `json:"uid,omitempty"` }
func (ProcessEvent) MarshalEasyJSON ¶
func (v ProcessEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ProcessEvent) MarshalJSON ¶
func (v ProcessEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ProcessEvent) UnmarshalEasyJSON ¶
func (v *ProcessEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ProcessEvent) UnmarshalJSON ¶
func (v *ProcessEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ProtobufMessageProcessor ¶
type ProtobufMessageProcessor struct {
Config *Configuration
}
func NewProtobufMessageProcessor ¶
func NewProtobufMessageProcessor(conf *Configuration) ProtobufMessageProcessor
func (ProtobufMessageProcessor) GetMessageInOutputFormat ¶
func (pbm ProtobufMessageProcessor) GetMessageInOutputFormat(message Event) ([]byte, error)
func (*ProtobufMessageProcessor) NewBaseMessage ¶
func (pbm *ProtobufMessageProcessor) NewBaseMessage(msg *CbEventMsg, routingKey, eventType string) *BaseEvent
func (ProtobufMessageProcessor) NewBlockedEvent ¶
func (pbm ProtobufMessageProcessor) NewBlockedEvent(msg *CbEventMsg, routingKey string) *BlockedEvent
func (*ProtobufMessageProcessor) NewChildprocEvent ¶
func (pbm *ProtobufMessageProcessor) NewChildprocEvent(msg *CbEventMsg, routingKey string) *ChildprocEvent
func (*ProtobufMessageProcessor) NewCrossprocEvent ¶
func (pbm *ProtobufMessageProcessor) NewCrossprocEvent(msg *CbEventMsg, routingKey string) *CrossprocEvent
func (*ProtobufMessageProcessor) NewEmetMessage ¶
func (pbm *ProtobufMessageProcessor) NewEmetMessage(msg *CbEventMsg, routingKey string) *EmetEvent
func (*ProtobufMessageProcessor) NewEventMessage ¶
func (pbm *ProtobufMessageProcessor) NewEventMessage(msg *CbEventMsg) *EventMessage
func (*ProtobufMessageProcessor) NewEventMessageWithHashes ¶
func (pbm *ProtobufMessageProcessor) NewEventMessageWithHashes(msg *CbEventMsg) *EventMessageWithHashes
func (*ProtobufMessageProcessor) NewFilemodEvent ¶
func (pbm *ProtobufMessageProcessor) NewFilemodEvent(msg *CbEventMsg, routingKey string) *FilemodEvent
func (ProtobufMessageProcessor) NewModLoadMessage ¶
func (pbm ProtobufMessageProcessor) NewModLoadMessage(msg *CbEventMsg, routingKey string) *ModloadMessage
func (ProtobufMessageProcessor) NewModinfoEvent ¶
func (pbm ProtobufMessageProcessor) NewModinfoEvent(msg *CbEventMsg, routingKey string) *ModInfoEvent
func (*ProtobufMessageProcessor) NewNetconEvent ¶
func (pbm *ProtobufMessageProcessor) NewNetconEvent(msg *CbEventMsg, routingKey string) *NetconEvent
func (*ProtobufMessageProcessor) NewNetworkV2Event ¶
func (pbm *ProtobufMessageProcessor) NewNetworkV2Event(msg *CbEventMsg, routingKey string) *NetworkV2Event
func (*ProtobufMessageProcessor) NewProcessEvent ¶
func (pbm *ProtobufMessageProcessor) NewProcessEvent(msg *CbEventMsg, routingKey string) *ProcessEvent
func (*ProtobufMessageProcessor) NewRegmodEvent ¶
func (pbm *ProtobufMessageProcessor) NewRegmodEvent(msg *CbEventMsg, routingKey string) *RegmodEvent
func (*ProtobufMessageProcessor) NewScriptExEvent ¶
func (pbm *ProtobufMessageProcessor) NewScriptExEvent(msg *CbEventMsg, routingKey string) *ScriptExEvent
func (*ProtobufMessageProcessor) NewTamperAlert ¶
func (pbm *ProtobufMessageProcessor) NewTamperAlert(msg *CbEventMsg, routingKey string) *TamperAlert
func (ProtobufMessageProcessor) ProcessProtobufBundle ¶
func (ProtobufMessageProcessor) ProcessProtobufMessage ¶
func (ProtobufMessageProcessor) ProcessProtobufMessageWithEnv ¶
func (ProtobufMessageProcessor) ProcessRawZipBundle ¶
type RegmodEvent ¶
type RegmodEvent struct { *BaseEvent *EventMessageWithHashes Path string `json:"path"` Action string `json:"action,intern"` ActionType int32 `json:"action_type"` TamperSent bool `json:"tamper"` Tamper bool `json:"tamper_sent"` }
func (RegmodEvent) MarshalEasyJSON ¶
func (v RegmodEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (RegmodEvent) MarshalJSON ¶
func (v RegmodEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*RegmodEvent) UnmarshalEasyJSON ¶
func (v *RegmodEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*RegmodEvent) UnmarshalJSON ¶
func (v *RegmodEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ScriptExEvent ¶
type ScriptExEvent struct { *BaseEvent *EventMessageWithHashes ScriptSha256 string `json:"script_sha256"` Script string `json:"script"` }
func (ScriptExEvent) MarshalEasyJSON ¶
func (v ScriptExEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ScriptExEvent) MarshalJSON ¶
func (v ScriptExEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ScriptExEvent) UnmarshalEasyJSON ¶
func (v *ScriptExEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ScriptExEvent) UnmarshalJSON ¶
func (v *ScriptExEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type TamperAlert ¶
func (TamperAlert) MarshalEasyJSON ¶
func (v TamperAlert) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (TamperAlert) MarshalJSON ¶
func (v TamperAlert) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*TamperAlert) UnmarshalEasyJSON ¶
func (v *TamperAlert) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*TamperAlert) UnmarshalJSON ¶
func (v *TamperAlert) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type UnixTimeStamp ¶
type UnixTimeStamp struct {
EventTimestamp interface{} `json:"timestamp"`
}
func UnixTimestampFromWindowsTime ¶
func UnixTimestampFromWindowsTime(time int64, useTimeFloat bool) (unixTime UnixTimeStamp)
func (UnixTimeStamp) MarshalEasyJSON ¶
func (v UnixTimeStamp) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (UnixTimeStamp) MarshalJSON ¶
func (v UnixTimeStamp) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*UnixTimeStamp) UnmarshalEasyJSON ¶
func (v *UnixTimeStamp) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*UnixTimeStamp) UnmarshalJSON ¶
func (v *UnixTimeStamp) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface