forwarder

Documentation

Index

• Constants
• Variables
• type Alert
• type AlertDedupEvent
  • func FromDynamodDBAttribute(input map[string]events.DynamoDBAttributeValue) (event *AlertDedupEvent, err error)
• type Handler
  • func (h *Handler) Do(oldAlertDedupEvent, newAlertDedupEvent *AlertDedupEvent) (err error)
• type RuleCache
  • func NewCache(httpClient *http.Client, policyClient *policiesclient.PantherAnalysisAPI) *RuleCache
  • func (c *RuleCache) Get(id, version string) (*models.Rule, error)

Constants

const (
	// The type of an Alert that is triggered because of a rule encountering an error
	RuleErrorType = "RULE_ERROR"
)

Variables

var (
	StaticLogger = metrics.MustStaticLogger([]metrics.DimensionSet{
		{
			"AnalysisType",
			"Severity",
		},
		{
			"AnalysisType",
			"AnalysisID",
		},
		{
			"AnalysisType",
		},
	}, []metrics.Metric{
		{
			Name: "AlertsCreated",
			Unit: metrics.UnitCount,
		},
	})
	AnalysisTypeDimension = metrics.Dimension{
		Name:  "AnalysisType",
		Value: "Rule",
	}
)

Types

type Alert

type Alert struct {
	ID                  string    `dynamodbav:"id,string"`
	TimePartition       string    `dynamodbav:"timePartition,string"`
	Severity            string    `dynamodbav:"severity,string"`
	RuleDisplayName     *string   `dynamodbav:"ruleDisplayName,string"`
	FirstEventMatchTime time.Time `dynamodbav:"firstEventMatchTime,string"`
	LogTypes            []string  `dynamodbav:"logTypes,stringset"`
	Title               string    `dynamodbav:"title,string"` // The alert title. It will be the Python-generated title or a default one if
	// no Python-generated title is available.
	AlertDedupEvent
}

Alert contains all the fields associated to the alert stored in DDB

type AlertDedupEvent

type AlertDedupEvent struct {
	RuleID              string    `dynamodbav:"ruleId,string"`
	RuleVersion         string    `dynamodbav:"ruleVersion,string"`
	DeduplicationString string    `dynamodbav:"dedup,string"`
	CreationTime        time.Time `dynamodbav:"creationTime,string"`
	UpdateTime          time.Time `dynamodbav:"updateTime,string"`
	EventCount          int64     `dynamodbav:"eventCount,number"`
	LogTypes            []string  `dynamodbav:"logTypes,stringset"`
	Type                *string   `dynamodbav:"-"` // There is no need to store this item in DDB
	GeneratedTitle      *string   `dynamodbav:"-"` // The title that was generated dynamically using Python. Might be null.
	AlertCount          int64     `dynamodbav:"-"` // There is no need to store this item in DDB

}

AlertDedupEvent represents the event stored in the alert dedup DDB table by the rules engine

func FromDynamodDBAttribute

func FromDynamodDBAttribute(input map[string]events.DynamoDBAttributeValue) (event *AlertDedupEvent, err error)

type Handler

type Handler struct {
	SqsClient        sqsiface.SQSAPI
	Cache            *RuleCache
	DdbClient        dynamodbiface.DynamoDBAPI
	AlertTable       string
	AlertingQueueURL string
}

func (*Handler) Do

func (h *Handler) Do(oldAlertDedupEvent, newAlertDedupEvent *AlertDedupEvent) (err error)

type RuleCache

type RuleCache struct {
	// contains filtered or unexported fields
}

s3ClientCacheKey -> S3 client

func NewCache

func NewCache(httpClient *http.Client, policyClient *policiesclient.PantherAnalysisAPI) *RuleCache

func (*RuleCache) Get

func (c *RuleCache) Get(id, version string) (*models.Rule, error)