pantherdb

Documentation

Index

• Constants
• Variables
• func DatabaseName(typ DataType) string
• func IsInDatabase(logtype, db string) bool
• func TableName(logType string) string
• type DataType
  • func GetDataType(logtype string) DataType

Constants

const (
	CloudSecurityDatabase            = "panther_cloudsecurity"
	CloudSecurityDatabaseDescription = "Hold tables related to Panther cloud security scanning"

	LogProcessingDatabase            = "panther_logs"
	LogProcessingDatabaseDescription = "Holds tables with data from Panther log processing"

	RuleMatchDatabase            = "panther_rule_matches"
	RuleMatchDatabaseDescription = "Holds tables with data from Panther rule matching (same table structure as panther_logs)"

	ViewsDatabase            = "panther_views"
	ViewsDatabaseDescription = "Holds views useful for querying Panther data"

	RuleErrorsDatabase            = "panther_rule_errors"
	RuleErrorsDatabaseDescription = "Holds tables with data that failed Panther rule matching (same table structure as panther_logs)"

	TempDatabase            = "panther_temp"
	TempDatabaseDescription = "Holds temporary tables used for processing tasks"
)

Variables

var Databases = map[string]string{
	CloudSecurityDatabase: CloudSecurityDatabaseDescription,
	LogProcessingDatabase: LogProcessingDatabaseDescription,
	RuleMatchDatabase:     RuleMatchDatabaseDescription,
	RuleErrorsDatabase:    RuleErrorsDatabaseDescription,
	ViewsDatabase:         ViewsDatabaseDescription,
	TempDatabase:          TempDatabaseDescription,
}

Functions

func DatabaseName

func DatabaseName(typ DataType) string

Returns the database in which exists the

func IsInDatabase

func IsInDatabase(logtype, db string) bool

Returns true if the given logtype has a corresponding table in a Database

func TableName

func TableName(logType string) string

Returns the name of the table for the given log type

Types

type DataType

type DataType string

The type of data that are stored in the Panther

const (
	// LogData represents log data processed by Panther
	LogData DataType = "LogData"
	// RuleData represents parsed log data that have matched some rule
	RuleData DataType = "RuleMatches"
	// RuleData represents parsed log data that have generated an error while running over rules
	RuleErrors DataType = "RuleErrors"
	// CloudSecurity represents CloudSecurity data processed by Panther
	CloudSecurity DataType = "CloudSecurity"
)

func GetDataType

func GetDataType(logtype string) DataType

Returns the datatype associated to this LogType