audit

Documentation

Index

• type EnrichedEvent
  • func (e *EnrichedEvent) GetMessage(ruleID int) *types.Message
  • func (e *EnrichedEvent) RequestHeaders() http.Header
• type Handler
  • func NewLoggerHandler(logger *logrus.Logger) Handler
  • func NewMetricsHandler(registry prometheus.Registerer, namespace string) (Handler, error)
• type Server
  • func StartServer() (Server, error)

Types

type EnrichedEvent

type EnrichedEvent struct {
	types.Event
	GeoIPLookup *geoip.City
	ASNLookup   *geoip.ASN
}

EnrichedEvent is an event that has been annotated additional context

func (*EnrichedEvent) GetMessage

func (e *EnrichedEvent) GetMessage(ruleID int) *types.Message

GetMessage returns the message generated by the specified rule ID, or nil if no message was generated for this event.

func (*EnrichedEvent) RequestHeaders

func (e *EnrichedEvent) RequestHeaders() http.Header

RequestHeaders returns the request headers from this event as an http.Header map

type Handler

type Handler interface {
	Handle(*EnrichedEvent) error
}

Handler for a ModSecurity audit event

func NewLoggerHandler

func NewLoggerHandler(logger *logrus.Logger) Handler

NewLoggerHandler creates an audit event handler that logs via the logrus log stream

func NewMetricsHandler

func NewMetricsHandler(registry prometheus.Registerer, namespace string) (Handler, error)

NewMetricsHandler creates a PrometheusAuditMetrics with the specified registry and namespace

type Server

type Server interface {
	URL() string
	AddHandler(Handler)
}

Server is a localhost ModSecurity audit event receiver

func StartServer

func StartServer() (Server, error)

StartServer starts a ModSecurity audit event receiver (in a goroutine)