processing

Apr 12, 2024

Changes in this version

type Winlog

+ SuricataHandler []MapHandlerFunc

type WinlogConfig

+ SuricataHandler []MapHandlerFunc

Dec 4, 2022

Changes in this version

+ func ConsumeRedis(c ConfigConsumeRedis) error

+ func CorrelateSuricataEvents(c SuricataCorrelateConfig) error

+ type ConfigConsumeRedis struct

+ Handler MapHandlerFunc

+ type ConfigStreamRedis struct

+ Client *redis.Client

+ Key string

+ func (c ConfigStreamRedis) Validate() error

+ type ConfigStreamWorkers struct

+ Ctx context.Context

+ Logger *logrus.Logger

+ Name string

+ Pool *errgroup.Group

+ Workers int

+ func (c *ConfigStreamWorkers) SetNoWorkers() ConfigStreamWorkers

+ func (c ConfigStreamWorkers) Validate() error

type DataMapShards

+ CountMissingKey uint64

+ Name string

+ type SafeCorrelationEventMap struct

+ func NewSafeConcurrentMap() *SafeCorrelationEventMap

+ func (s *SafeCorrelationEventMap) Insert(key string, value datamodels.Map)

+ func (s *SafeCorrelationEventMap) Len() int

+ func (s *SafeCorrelationEventMap) Lookup(key string) (datamodels.Map, bool)

+ type SuricataCorrelateConfig struct

+ CorrelatedEventShards *DataMapShards

+ InputEventShards *DataMapShards

+ Output ConfigStreamRedis

type Winlog

+ ResultHandler MapHandlerFunc

type WinlogConfig

+ ResultHandler MapHandlerFunc

type WiseConfig

+ func (c *WiseConfig) SetNoWorkers() WiseConfig

Jun 10, 2022

Changes in this version

type SysmonCorrelateConfig

+ LogCorrelations bool

type WinlogConfig

+ Commands buckets

Jun 4, 2022

Changes in this version

+ func ConsumeSysmonEvents(c SysmonConsumeConfig) error

+ func CorrelateSysmonEvents(c SysmonCorrelateConfig) error

+ func OutputWISE(c WiseConfig) error

+ type DataMapShards struct

+ Channels []chan datamodels.Map

+ Ctx context.Context

+ Len uint64

+ func NewDataMapShards(ctx context.Context, workers int) (*DataMapShards, error)

+ func (s *DataMapShards) Close() error

+ func (s *DataMapShards) Handler() MapHandlerFunc

+ type EncodedEntry struct

+ Entry []byte

+ Key string

+ type MapHandlerFunc func(datamodels.Map)

+ type SysmonConsumeConfig struct

+ Client *redis.Client

+ Ctx context.Context

+ Handler MapHandlerFunc

+ Key string

+ Logger *logrus.Logger

+ Pool *errgroup.Group

+ Workers int

+ type SysmonCorrelateConfig struct

+ Ctx context.Context

+ Logger *logrus.Logger

+ Pool *errgroup.Group

+ Shards *DataMapShards

+ Workers int

type WinlogConfig

+ ChanCorrelated chan EncodedEntry

+ ChanOnlyNetwork chan EncodedEntry

+ ForwardNetworkEvents bool

+ type WiseConfig struct

+ ChanCorrelated <-chan EncodedEntry

+ ChanOnlyNetwork <-chan EncodedEntry

+ ClientCorrelated *redis.Client

+ ClientOnlyNetwork *redis.Client

+ Ctx context.Context

+ ForwardNetworkEvents bool

+ Logger *logrus.Logger

+ Pool *errgroup.Group

May 29, 2022

Changes in this version

+ func CheckRedisConn(ctx context.Context, rdb *redis.Client, log *logrus.Logger, addr string, ...) bool

+ func ReadWinlogRedis(ctx context.Context, log *logrus.Logger, w *Winlog, c ConfigRedisInstance) error

+ func ReadWinlogStdin(ctx context.Context, log *logrus.Logger, w *Winlog) error

+ func RedisBatchProcess(pipeline redis.Pipeliner, p Processor, src, dest string, batch int64, ...) error

+ type Bucket struct

+ Data any

+ Time time.Time

+ type BucketsConfig struct

+ Count int

+ Size time.Duration

+ type CommandEvents map[string]datamodels.Map

+ type ConfigRedisInstance struct

+ Batch int64

+ Database int

+ Host string

+ Key string

+ Password string

+ type Enrichment struct

+ Entry datamodels.Map

+ Key string

+ type ErrInvalidEvent struct

+ Key string

+ Raw datamodels.Map

+ func (e ErrInvalidEvent) Error() string

+ type Processor interface

+ Process func(datamodels.Map) (entries, error)

+ type Suricata struct

+ Commands *buckets

+ EVE *buckets

+ Stats suricataStats

+ func NewSuricata(c SuricataConfig) (*Suricata, error)

+ func (s *Suricata) Process(e datamodels.Map) (entries, error)

+ func (s Suricata) Close() error

+ type SuricataConfig struct

+ CommandBuckets BucketsConfig

+ EnrichedJSONPath string

+ Mu *sync.RWMutex

+ type Winlog struct

+ Stats winlogStats

+ func NewWinlog(c WinlogConfig) (*Winlog, error)

+ func (c *Winlog) Close() error

+ func (c *Winlog) Enrichments() <-chan Enrichment

+ func (c *Winlog) Process(e datamodels.Map) (entries, error)

+ func (c Winlog) CmdLen() int

+ type WinlogBucketsConfig struct

+ Command BucketsConfig

+ Network BucketsConfig

+ type WinlogConfig struct

+ Buckets WinlogBucketsConfig

+ Destination chan Enrichment

+ Mu *sync.RWMutex

+ StoreNetEvents bool

+ WorkDir string