siem

Documentation

Index

• func CountBackLogs() (sum int, activeDirectives int, ttlDirectives int)
• func InitBackLogManager(logFile string, bpChan chan<- bool, holdDuration int) (err error)
• func InitDirectives(confDir string, ch <-chan event.NormalizedEvent, ...) error
• type Directive
• type Directives
  • func LoadDirectivesFromFile(confDir string, namePattern string, includeDisabled bool) (res Directives, totalFromFile int, err error)

Functions

func CountBackLogs

func CountBackLogs() (sum int, activeDirectives int, ttlDirectives int)

CountBackLogs returns the number of active backlogs

func InitBackLogManager

func InitBackLogManager(logFile string, bpChan chan<- bool, holdDuration int) (err error)

InitBackLogManager initialize backlog and ticker

func InitDirectives

func InitDirectives(confDir string, ch <-chan event.NormalizedEvent, minAlarmLifetime, maxEPS, maxEventQueueLength int) error

InitDirectives initialize directive from directive_*.json files in confDir then start backlog manager for each directive

Types

type Directive

type Directive struct {
	ID                   int                   `json:"id"`
	Name                 string                `json:"name"`
	Priority             int                   `json:"priority"`
	Disabled             bool                  `json:"disabled"`
	AllRulesAlwaysActive bool                  `json:"all_rules_always_active"`
	Kingdom              string                `json:"kingdom"`
	Category             string                `json:"category"`
	Rules                []rule.DirectiveRule  `json:"rules"`
	StickyDiffs          []rule.StickyDiffData `json:"-"`
}

Directive represents a SIEM use case that has several correlation rules

type Directives

type Directives struct {
	Dirs []Directive `json:"directives"`
}

Directives group directive together

func LoadDirectivesFromFile

func LoadDirectivesFromFile(confDir string, namePattern string, includeDisabled bool) (res Directives, totalFromFile int, err error)

LoadDirectivesFromFile load directive from namePattern (glob) files in confDir