siem

Documentation

Index

• func InitBackLogManager(logFile string, bpChan chan<- bool, holdDuration int) (err error)
• func InitDirectives(confDir string, ch <-chan event.NormalizedEvent, minAlarmLifetime int) error
• type Directive
• type Directives
  • func LoadDirectivesFromFile(confDir string, namePattern string, includeDisabled bool) (res Directives, totalFromFile int, err error)

Functions

func InitBackLogManager

func InitBackLogManager(logFile string, bpChan chan<- bool, holdDuration int) (err error)

InitBackLogManager initialize backlog and ticker

func InitDirectives

func InitDirectives(confDir string, ch <-chan event.NormalizedEvent, minAlarmLifetime int) error

InitDirectives initialize directive from directive_*.json files in confDir then start backlog manager for each directive

Types

type Directive

type Directive struct {
	ID                   int                   `json:"id"`
	Name                 string                `json:"name"`
	Priority             int                   `json:"priority"`
	Disabled             bool                  `json:"disabled"`
	AllRulesAlwaysActive bool                  `json:"all_rules_always_active"`
	Kingdom              string                `json:"kingdom"`
	Category             string                `json:"category"`
	Rules                []rule.DirectiveRule  `json:"rules"`
	StickyDiffs          []rule.StickyDiffData `json:"-"`
}

Directive represents a SIEM use case that has several correlation rules

type Directives

type Directives struct {
	Dirs []Directive `json:"directives"`
}

Directives group directive together

func LoadDirectivesFromFile

func LoadDirectivesFromFile(confDir string, namePattern string, includeDisabled bool) (res Directives, totalFromFile int, err error)

LoadDirectivesFromFile load directive from namePattern (glob) files in confDir