splunk

package
v1.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Apr 3, 2024 License: MIT Imports: 13 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func FormatWithRandomSeconds

func FormatWithRandomSeconds(t time.Time) (string, time.Time)

func SendHECEvent

func SendHECEvent(hecURL, hecToken string, event SplunkEvent) (err error)

SendLoginEvent sends a generated login event to the Splunk HEC endpoint.

Types

type SplunkEvent

type SplunkEvent struct {
	Event      string                 `json:"event"`
	Sourcetype string                 `json:"sourcetype"`
	Source     string                 `json:"source"`
	Index      string                 `json:"index"`
	Host       string                 `json:"host"`
	Time       int64                  `json:"time"` // Unix timestamp field
	Fields     map[string]interface{} `json:"fields"`
}

LoginEvent represents the structure of a login event sent to Splunk.

func GenerateExecveEventFromCommand

func GenerateExecveEventFromCommand(eventTime time.Time, commandLine string, targetIp string, targetHostname string) SplunkEvent

func GenerateLoginEvent

func GenerateLoginEvent(domain, subnet string, eventTime time.Time, targetAcc string) (SplunkEvent, string, string)

func GenerateLoginFailedEvent

func GenerateLoginFailedEvent(domain, subnet string, eventTime time.Time, targetAcc string) (SplunkEvent, string, string)

func GenerateProcessCreationEvent

func GenerateProcessCreationEvent(domain, targetIp string, targetHostname string, eventTime time.Time, accountName, newProcessName string, parameters string) SplunkEvent

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL