forwarder

Documentation

Index

• type Alert
• type AlertDedupEvent
  • func FromDynamodDBAttribute(input map[string]events.DynamoDBAttributeValue) (event *AlertDedupEvent, err error)
• type Handler
  • func (h *Handler) Do(oldAlertDedupEvent, newAlertDedupEvent *AlertDedupEvent) (err error)
• type RuleCache
  • func NewCache(httpClient *http.Client, policyClient *policiesclient.PantherAnalysis) *RuleCache
  • func (c *RuleCache) Get(id, version string) (*models.Rule, error)

Types

type Alert

type Alert struct {
	ID              string  `dynamodbav:"id,string"`
	TimePartition   string  `dynamodbav:"timePartition,string"`
	Severity        string  `dynamodbav:"severity,string"`
	RuleDisplayName *string `dynamodbav:"ruleDisplayName,string"`
	Title           string  `dynamodbav:"title,string"` // The alert title. It will be the Python-generated title or a default one if
	// no Python-generated title is available.
	AlertDedupEvent
}

Alert contains all the fields associated to the alert stored in DDB

type AlertDedupEvent

type AlertDedupEvent struct {
	RuleID              string    `dynamodbav:"ruleId,string"`
	RuleVersion         string    `dynamodbav:"ruleVersion,string"`
	DeduplicationString string    `dynamodbav:"dedup,string"`
	CreationTime        time.Time `dynamodbav:"creationTime,string"`
	UpdateTime          time.Time `dynamodbav:"updateTime,string"`
	EventCount          int64     `dynamodbav:"eventCount,number"`
	LogTypes            []string  `dynamodbav:"logTypes,stringset"`
	GeneratedTitle      *string   `dynamodbav:"-"` // The title that was generated dynamically using Python. Might be null.
	AlertCount          int64     `dynamodbav:"-"` // There is no need to store this item in DDB
}

AlertDedupEvent represents the event stored in the alert dedup DDB table by the rules engine

func FromDynamodDBAttribute

func FromDynamodDBAttribute(input map[string]events.DynamoDBAttributeValue) (event *AlertDedupEvent, err error)

type Handler

type Handler struct {
	SqsClient        sqsiface.SQSAPI
	Cache            *RuleCache
	DdbClient        dynamodbiface.DynamoDBAPI
	AlertTable       string
	AlertingQueueURL string
}

func (*Handler) Do

func (h *Handler) Do(oldAlertDedupEvent, newAlertDedupEvent *AlertDedupEvent) (err error)

type RuleCache

type RuleCache struct {
	// contains filtered or unexported fields
}

s3ClientCacheKey -> S3 client

func NewCache

func NewCache(httpClient *http.Client, policyClient *policiesclient.PantherAnalysis) *RuleCache

func (*RuleCache) Get

func (c *RuleCache) Get(id, version string) (*models.Rule, error)