api

Documentation

Overview

Package api defines CRUD actions for the Panther alerts database.

Index

• type API
  • func Setup() *API
  • func (api *API) GetAlert(input *models.GetAlertInput) (*models.GetAlertOutput, error)
  • func (api *API) ListAlerts(input *models.ListAlertsInput) (result *models.ListAlertsOutput, err error)
  • func (api *API) UpdateAlertDelivery(input *models.UpdateAlertDeliveryInput) (result *models.UpdateAlertDeliveryOutput, err error)
  • func (api *API) UpdateAlertStatus(input *models.UpdateAlertStatusInput) (models.UpdateAlertStatusOutput, error)
• type Event
• type EventPaginationToken
• type LogTypeToken
• type S3Search
  • func (s *S3Search) Do(ctx context.Context) (*S3SearchResult, error)
• type S3SearchResult
• type S3Select
  • func (s *S3Select) Query(ctx context.Context) (*S3SelectResult, error)
  • func (s *S3Select) QueryAsync(ctx context.Context, outChan chan<- *S3SelectResult) error
• type S3SelectResult

Types

type API

type API struct {
	// contains filtered or unexported fields
}

API has all of the handlers as receiver methods.

func Setup

func Setup() *API

Setup - parses the environment and builds the AWS and http clients.

func (*API) GetAlert

func (api *API) GetAlert(input *models.GetAlertInput) (*models.GetAlertOutput, error)

GetAlert retrieves details for a given alert

func (*API) ListAlerts

func (api *API) ListAlerts(input *models.ListAlertsInput) (result *models.ListAlertsOutput, err error)

ListAlerts retrieves alert and event details.

func (*API) UpdateAlertDelivery

func (api *API) UpdateAlertDelivery(input *models.UpdateAlertDeliveryInput) (result *models.UpdateAlertDeliveryOutput, err error)

UpdateAlertDelivery modifies an alert's attributes.

func (*API) UpdateAlertStatus

func (api *API) UpdateAlertStatus(input *models.UpdateAlertStatusInput) (models.UpdateAlertStatusOutput, error)

UpdateAlertStatus modifies an alert's attributes.

type Event

type Event struct {
	// contains filtered or unexported fields
}

type EventPaginationToken

type EventPaginationToken struct {
	LogTypeToToken map[string]*LogTypeToken `json:"logTypeToToken"`
}

EventPaginationToken - token used for paginating through the events in an alert

type LogTypeToken

type LogTypeToken struct {
	S3ObjectKey string `json:"s3ObjectKey"`
	EventIndex  int    `json:"eventIndex"`
}

LogTypeToken - token used for paginating in the events of a specific log type

type S3Search

type S3Search struct {
	// contains filtered or unexported fields
}

func (*S3Search) Do

func (s *S3Search) Do(ctx context.Context) (*S3SearchResult, error)

Do runs the search for the objects specified It will retrieve results by query each S3 object in parallel, using S3 Select

type S3SearchResult

type S3SearchResult struct {
	// contains filtered or unexported fields
}

type S3Select

type S3Select struct {
	// contains filtered or unexported fields
}

func (*S3Select) Query

func (s *S3Select) Query(ctx context.Context) (*S3SelectResult, error)

Queries a specific S3 object events associated to `alertID`. Returns : 1. The events that are associated to the given alertID that are present in that S3 object. It will return maximum `maxResults` events 2. The index of the last event returned. This will be used as a pagination token - future queries to the same S3 object can start listing after that.

func (*S3Select) QueryAsync

func (s *S3Select) QueryAsync(ctx context.Context, outChan chan<- *S3SelectResult) error

Same as above, but writes the results in a channel

type S3SelectResult

type S3SelectResult struct {
	// contains filtered or unexported fields
}