alertcontext

Documentation

Index

• Constants
• Variables
• func AppsecEventToContext(event types.AppsecEvent, request *http.Request) (models.Meta, []error)
• func EvalAlertContextRules(evt types.Event, match *types.MatchedRule, request *http.Request, ...) []error
• func EventToContext(events []types.Event) (models.Meta, []error)
• func LoadConsoleContext(c *csconfig.Config, hub *cwhub.Hub) error
• func NewAlertContext(contextToSend map[string][]string, valueLength int) error
• func TruncateContext(values []string, contextValueLen int) (string, error)
• func TruncateContextMap(contextMap map[string][]string, contextValueLen int) ([]*models.MetaItems0, []error)
• func ValidateContextExpr(key string, expressions []string) error
• type Context
• type HubItemWrapper

Constants

const (
	MaxContextValueLen = 4000
)

Variables

var ErrNoContextData = errors.New("no context to send")

Functions

func AppsecEventToContext

func AppsecEventToContext(event types.AppsecEvent, request *http.Request) (models.Meta, []error)

Iterate over the individual appsec matched rules to create the needed alert context.

func EvalAlertContextRules

func EvalAlertContextRules(evt types.Event, match *types.MatchedRule, request *http.Request, tmpContext map[string][]string) []error

func EventToContext

func EventToContext(events []types.Event) (models.Meta, []error)

Iterate over the individual events to create the needed alert context.

func LoadConsoleContext

func LoadConsoleContext(c *csconfig.Config, hub *cwhub.Hub) error

LoadConsoleContext loads the context from the hub (if provided) and the file console_context_path.

func NewAlertContext

func NewAlertContext(contextToSend map[string][]string, valueLength int) error

func TruncateContext

func TruncateContext(values []string, contextValueLen int) (string, error)

Truncate an individual []string to fit in the context value length

func TruncateContextMap

func TruncateContextMap(contextMap map[string][]string, contextValueLen int) ([]*models.MetaItems0, []error)

Truncate the context map to fit in the context value length

func ValidateContextExpr

func ValidateContextExpr(key string, expressions []string) error

Types

type Context

type Context struct {
	ContextToSend         map[string][]string
	ContextValueLen       int
	ContextToSendCompiled map[string][]*vm.Program
	Log                   *log.Logger
}

type HubItemWrapper

type HubItemWrapper struct {
	Context map[string][]string `yaml:"context"`
}

HubItemWrapper is a wrapper around a hub item to unmarshal only the context part because there are other fields like name etc.