event

Documentation

Index

• func Register(typ ...Type)
• type Event
  • func (e Event) Flatten() Event
  • func (e Event) Type() Type
• type Processor
  • func New() (p *Processor, err error)
  • func (p *Processor) ProductArn() string
  • func (p *Processor) Publish(evt ...Event) error
• type RawEvent
  • func (r RawEvent) Event() (Event, error)
• type Type

Functions

func Register

func Register(typ ...Type)

Register ... registers the given Type objects for use as Event matchers Type objects are sequentially called, so order matters

Types

type Event

type Event map[string]interface{}

Event ... holds raw CloudWatch event data

func (Event) Flatten

func (e Event) Flatten() Event

Flatten ... flattens an Event to a single-level map appending subsequent keys and zero-indexed array elements with '.' as the delimiter

func (Event) Type

func (e Event) Type() Type

Type ... calls Type.Is(Event) on each registered Type, returning the first Type that matches the provided Event type or nil if no matching Type is found

type Processor

type Processor struct {
	// contains filtered or unexported fields
}

Processor ... is used for retaining state data for processing Event objects

func New

func New() (p *Processor, err error)

New ... returns a new *Processor

func (*Processor) ProductArn

func (p *Processor) ProductArn() string

ProductArn ... returns the value for the default SecurityHub Arn format: arn:aws:securityhub:<region>:<account-id>:product/<account-id>/default

func (*Processor) Publish

func (p *Processor) Publish(evt ...Event) error

Publish ... calls securityhub.BatchImportFindings providing the results from calling Type.Finding(Event) on each provided Event, returns an error upon failure

type RawEvent

type RawEvent []byte

RawEvent ... is a []byte with a conversion method attached (Event)

func (RawEvent) Event

func (r RawEvent) Event() (Event, error)

Event ... converts a RawEvent to an Event

type Type

type Type interface {
	Is(Event) bool
	Init(*Processor)
	Finding(Event) *securityhub.AwsSecurityFinding
}

Type ... interface for creating custom Event matchers