slacklogs

Documentation

Index

• Constants
• func LogTypes() logtypes.Group
• type AccessLog
• type Actor
• type App
• type AuditLog
• type Channel
• type Context
• type Enterprise
• type Entity
• type File
• type IntegrationLog
• type Location
• type Message
• type User
• type Workflow
• type Workspace

Constants

const TypeAccessLogs = "Slack.AccessLogs"

const TypeAuditLogs = "Slack.AuditLogs"

const TypeIntegrationLogs = "Slack.IntegrationLogs"

Functions

func LogTypes

func LogTypes() logtypes.Group

Types

type AccessLog

type AccessLog struct {
	UserID    pantherlog.String `json:"user_id" validate:"required" description:"The id of the user accessing Slack."`
	UserName  pantherlog.String `json:"username" panther:"username" description:"The username of the user accessing Slack."`
	DateFirst pantherlog.Time   `` /* 165-byte string literal not displayed */
	DateLast  pantherlog.Time   `` /* 188-byte string literal not displayed */
	Count     pantherlog.Int64  `json:"count" validate:"required" description:"The total number of access log entries for that combination."`
	IP        pantherlog.String `json:"ip" validate:"required" panther:"ip" description:"The IP address of the device used to access Slack."`
	UserAgent pantherlog.String `json:"user_agent" description:"The reported user agent string from the browser or client application."`
	ISP       pantherlog.String `json:"isp" description:"Best guess at the internet service provider owning the IP address."`
	Country   pantherlog.String `json:"country" description:"Best guesses on where the access originated, based on the IP address."`
	Region    pantherlog.String `json:"region" description:"Best guesses on where the access originated, based on the IP address."`
}

type Actor

type Actor struct {
	Type pantherlog.String `json:"type" validate:"required,eq=user" description:"The type of actor (always user)"`
	User User              `json:"user" description:"Information about the user"`
}

nolint:lll

type App

type App struct {
	ID                pantherlog.String   `json:"id" validate:"required" description:"The id of the app"`
	Name              pantherlog.String   `json:"name" description:"The name of the app"`
	Distributed       pantherlog.Bool     `json:"is_distributed" description:"Whether the app is distributed"`
	DirectoryApproved pantherlog.Bool     `json:"is_directory_approved" description:"Whether the app is in the approved apps directory"`
	Scopes            []pantherlog.String `json:"scopes" description:"The OAuth2 scopes the app requires"`
}

nolint:lll

type AuditLog

type AuditLog struct {
	ID         pantherlog.String     `json:"id" validate:"required" description:"The event id"`
	DateCreate pantherlog.Time       `json:"date_create" validate:"required" tcodec:"unix" event_time:"true" description:"Creation timestamp for the event"`
	Action     pantherlog.String     `` /* 136-byte string literal not displayed */
	Actor      Actor                 `` /* 152-byte string literal not displayed */
	Entity     Entity                `` /* 153-byte string literal not displayed */
	Context    Context               `` /* 198-byte string literal not displayed */
	Details    pantherlog.RawMessage `json:"details" description:"Additional details about the audit log event"`
}

nolint:lll

type Channel

type Channel struct {
	ID          pantherlog.String   `json:"id" validate:"required" description:"The id of the channel"`
	Name        pantherlog.String   `json:"name" description:"The name of the channel"`
	Privacy     pantherlog.String   `json:"privacy" description:"The privacy mode of the channel"`
	Shared      pantherlog.Bool     `json:"is_shared" description:"Whether the channel is shared"`
	OrgShared   pantherlog.Bool     `json:"is_org_shared" description:"Whether the channel is shared in the organisation"`
	SharedTeams []pantherlog.String `json:"teams_shared_with" description:"The teams the channel is shared with"`
}

nolint:lll

type Context

type Context struct {
	UserAgent pantherlog.String `json:"ua" description:"The user agent used for the action"`
	IPAddress pantherlog.String `json:"ip_address" panther:"ip" description:"The ip address the action was performed from"`
	Location  Location          `json:"location" description:"The location that the actor took the action on the entity."`
}

nolint:lll

type Enterprise

type Enterprise struct {
	ID     pantherlog.String `json:"id" validate:"required" description:"The id of the enterprise"`
	Name   pantherlog.String `json:"name" description:"The name of the enterprise"`
	Domain pantherlog.String `json:"domain" description:"The enterprise domain"`
}

nolint:lll

type Entity

type Entity struct {
	Type       pantherlog.String `` /* 156-byte string literal not displayed */
	User       *User             `json:"user" description:"Information about the affected user"`
	Channel    *Channel          `json:"channel" description:"Information about the affected channel"`
	File       *File             `json:"file" description:"Information about the affected file"`
	App        *App              `json:"app" description:"Information about the affected app"`
	Workspace  *Workspace        `json:"workspace" description:"Information about the affected workspace"`
	Enterprise *Enterprise       `json:"enterprise" description:"Information about the affected enterprise"`
	Workflow   *Workflow         `json:"workflow" description:"Information about the affected workflow"`
	Message    *Message          `json:"message" description:"Information about the affected message"`
}

nolint:lll

type File

type File struct {
	ID       pantherlog.String `json:"id" validate:"required" description:"The id of the file"`
	Name     pantherlog.String `json:"name" description:"The filename"`
	Title    pantherlog.String `json:"title" description:"The file title"`
	Filetype pantherlog.String `json:"filetype" description:"The filetype"`
}

nolint:lll

type IntegrationLog

type IntegrationLog struct {
	UserID            pantherlog.String `json:"user_id" validate:"required" description:"The id of the user performing the action."`
	UserName          pantherlog.String `json:"user_name" panther:"username" description:"The username of the user performing the action."`
	ServiceID         pantherlog.String `json:"service_id" description:"The service id for which this log is about."`
	ServiceType       pantherlog.String `json:"service_type" description:"The service type for which this log is about."`
	AppID             pantherlog.String `json:"app_id" description:"The app id for which this log is about."`
	AppType           pantherlog.String `json:"app_type" description:"The app type for which this log is about."`
	Date              pantherlog.Time   `json:"date" validate:"required" tcodec:"unix" event_time:"true" description:"The date when the action happened."`
	ChangeType        pantherlog.String `json:"change_type" validate:"required" description:"The type of this action (added, removed, enabled, disabled, updated)."`
	Scope             pantherlog.String `json:"scope" validate:"required" description:"The scope used for this action."`
	Channel           pantherlog.String `json:"channel" description:"The related channel."`
	Reason            pantherlog.String `json:"reason" description:"The reason of the disable action, populated if this event refers to such an action."`
	RSSFeed           pantherlog.Bool   `json:"rss_feed" description:"True if this log entry is an RSS feed. If true, more RSS feed related fields will be present."`
	RSSFeedChangeType pantherlog.Bool   `json:"rss_feed_change_type" description:"The change type for the RSS feed."`
	RSSFeedTitle      pantherlog.Bool   `json:"rss_feed_title" description:"The title of the RSS feed."`
	RSSFeedURL        pantherlog.Bool   `json:"rss_feed_url" description:"The url of the RSS feed."`
}

type Location

type Location struct {
	Type   pantherlog.String `json:"type" validate:"required" description:"The location type. It will always be either a Workspace or an Enterprise"`
	ID     pantherlog.String `json:"id" validate:"required" description:"The location id"`
	Domain pantherlog.String `json:"domain" description:"The location domain"`
	Name   pantherlog.String `json:"name" description:"The location name"`
}

nolint:lll

type Message

type Message struct {
	Team    pantherlog.String `json:"team" description:"The team the message was posted in"`
	Channel pantherlog.String `json:"channel" description:"The channel the message was posted on"`
	// TODO: Get samples to find the format
	Timestamp pantherlog.String `json:"timestamp" description:"The timestamp of the message"`
}

nolint:lll

type User

type User struct {
	ID    pantherlog.String `json:"id" validate:"required" description:"The id of the user ('USLACKUSER' if no user performed the action)"`
	Name  pantherlog.String `json:"name" panther:"username" description:"The user's display name"`
	Email pantherlog.String `json:"email" panther:"email" description:"The user's email"`
	Team  pantherlog.String `json:"team" description:"The user's team"`
}

nolint:lll

type Workflow

type Workflow struct {
	ID   pantherlog.String `json:"id" validate:"required" description:"The id of the workflow"`
	Name pantherlog.String `json:"name" description:"The name of the workflow"`
}

nolint:lll

type Workspace

type Workspace struct {
	ID     pantherlog.String `json:"id" validate:"required" description:"The id of the workspace"`
	Name   pantherlog.String `json:"name" description:"The name of the workspace"`
	Domain pantherlog.String `json:"domain" description:"The workspace domain"`
}

nolint:lll