telemetryv1

package
v1.36.12-2026090413560... Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 4, 2026 License: Apache-2.0 Imports: 8 Imported by: 1

Documentation

Index

Constants

View Source 
const AuthenticationOD_AuthInstigator_not_set_case case_AuthenticationOD_AuthInstigator = 0
View Source 
const AuthenticationOD_TriggerId_case case_AuthenticationOD_AuthInstigator = 3
View Source 
const AuthenticationOD_TriggerProcess_case case_AuthenticationOD_AuthInstigator = 2
View Source 
const AuthenticationToken_AuthInstigator_not_set_case case_AuthenticationToken_AuthInstigator = 0
View Source 
const AuthenticationToken_TriggerId_case case_AuthenticationToken_AuthInstigator = 3
View Source 
const AuthenticationToken_TriggerProcess_case case_AuthenticationToken_AuthInstigator = 2
View Source 
const AuthenticationTouchID_AuthInstigator_not_set_case case_AuthenticationTouchID_AuthInstigator = 0
View Source 
const AuthenticationTouchID_TriggerId_case case_AuthenticationTouchID_AuthInstigator = 3
View Source 
const AuthenticationTouchID_TriggerProcess_case case_AuthenticationTouchID_AuthInstigator = 2
View Source 
const Authentication_AuthenticationAutoUnlock_case case_Authentication_Event = 5
View Source 
const Authentication_AuthenticationOd_case case_Authentication_Event = 2
View Source 
const Authentication_AuthenticationToken_case case_Authentication_Event = 4
View Source 
const Authentication_AuthenticationTouchId_case case_Authentication_Event = 3
View Source 
const Authentication_Event_not_set_case case_Authentication_Event = 0
View Source 
const Exit_ExitType_not_set_case case_Exit_ExitType = 0
View Source 
const Exit_Exited_case case_Exit_ExitType = 2
View Source 
const Exit_Signaled_case case_Exit_ExitType = 3
View Source 
const Exit_Stopped_case case_Exit_ExitType = 4
View Source 
const LaunchItem_App_not_set_case case_LaunchItem_App = 0
View Source 
const LaunchItem_BtmInstigator_not_set_case case_LaunchItem_BtmInstigator = 0
View Source 
const LaunchItem_RegistrantId_case case_LaunchItem_App = 6
View Source 
const LaunchItem_RegistrantProcess_case case_LaunchItem_App = 5
View Source 
const LaunchItem_TriggerId_case case_LaunchItem_BtmInstigator = 4
View Source 
const LaunchItem_TriggerProcess_case case_LaunchItem_BtmInstigator = 3
View Source 
const LoginLogout_Event_not_set_case case_LoginLogout_Event = 0
View Source 
const LoginLogout_Login_case case_LoginLogout_Event = 1
View Source 
const LoginLogout_Logout_case case_LoginLogout_Event = 2
View Source 
const LoginWindowSession_Event_not_set_case case_LoginWindowSession_Event = 0
View Source 
const LoginWindowSession_Lock_case case_LoginWindowSession_Event = 3
View Source 
const LoginWindowSession_Login_case case_LoginWindowSession_Event = 1
View Source 
const LoginWindowSession_Logout_case case_LoginWindowSession_Event = 2
View Source 
const LoginWindowSession_Unlock_case case_LoginWindowSession_Event = 4
View Source 
const OpenSSH_Event_not_set_case case_OpenSSH_Event = 0
View Source 
const OpenSSH_Login_case case_OpenSSH_Event = 1
View Source 
const OpenSSH_Logout_case case_OpenSSH_Event = 2
View Source 
const SantaMessage_Allowlist_case case_SantaMessage_Event = 20
View Source 
const SantaMessage_Authentication_case case_SantaMessage_Event = 27
View Source 
const SantaMessage_Bundle_case case_SantaMessage_Event = 19
View Source 
const SantaMessage_Clone_case case_SantaMessage_Event = 28
View Source 
const SantaMessage_Close_case case_SantaMessage_Event = 13
View Source 
const SantaMessage_CodesigningInvalidated_case case_SantaMessage_Event = 22
View Source 
const SantaMessage_Copyfile_case case_SantaMessage_Event = 29
View Source 
const SantaMessage_Disk_case case_SantaMessage_Event = 18
View Source 
const SantaMessage_Event_not_set_case case_SantaMessage_Event = 0
View Source 
const SantaMessage_Exchangedata_case case_SantaMessage_Event = 17
View Source 
const SantaMessage_Execution_case case_SantaMessage_Event = 10
View Source 
const SantaMessage_Exit_case case_SantaMessage_Event = 12
View Source 
const SantaMessage_FileAccess_case case_SantaMessage_Event = 21
View Source 
const SantaMessage_Fork_case case_SantaMessage_Event = 11
View Source 
const SantaMessage_GatekeeperOverride_case case_SantaMessage_Event = 30
View Source 
const SantaMessage_LaunchItem_case case_SantaMessage_Event = 31
View Source 
const SantaMessage_Link_case case_SantaMessage_Event = 16
View Source 
const SantaMessage_LoginLogout_case case_SantaMessage_Event = 24
View Source 
const SantaMessage_LoginWindowSession_case case_SantaMessage_Event = 23
View Source 
const SantaMessage_NetworkActivity_case case_SantaMessage_Event = 34
View Source 
const SantaMessage_OpenSsh_case case_SantaMessage_Event = 26
View Source 
const SantaMessage_ProcSuspendResume_case case_SantaMessage_Event = 35
View Source 
const SantaMessage_Rename_case case_SantaMessage_Event = 14
View Source 
const SantaMessage_ScreenSharing_case case_SantaMessage_Event = 25
View Source 
const SantaMessage_TccModification_case case_SantaMessage_Event = 32
View Source 
const SantaMessage_Unlink_case case_SantaMessage_Event = 15
View Source 
const SantaMessage_Xprotect_case case_SantaMessage_Event = 33
View Source 
const ScreenSharing_Attach_case case_ScreenSharing_Event = 1
View Source 
const ScreenSharing_Detach_case case_ScreenSharing_Event = 2
View Source 
const ScreenSharing_Event_not_set_case case_ScreenSharing_Event = 0
View Source 
const SleighConfig_BinaryUpload_case case_SleighConfig_Command = 4
View Source 
const SleighConfig_Command_not_set_case case_SleighConfig_Command = 0
View Source 
const SleighConfig_ExportTelemetry_case case_SleighConfig_Command = 3
View Source 
const SleighConfig_PackageInventoryScan_case case_SleighConfig_Command = 5
View Source 
const SleighConfig_SignalScan_case case_SleighConfig_Command = 6
View Source 
const SleighExportTelemetry_ExportConfig_not_set_case case_SleighExportTelemetry_ExportConfig = 0
View Source 
const SleighExportTelemetry_SignedPost_case case_SleighExportTelemetry_ExportConfig = 4
View Source 
const SleighResponse_BinaryUpload_case case_SleighResponse_Response = 2
View Source 
const SleighResponse_Response_not_set_case case_SleighResponse_Response = 0
View Source 
const SleighResponse_SignalScan_case case_SleighResponse_Response = 1
View Source 
const TCCModification_ResponsibleId_case case_TCCModification_ResponsibleInstigator = 11
View Source 
const TCCModification_ResponsibleInstigator_not_set_case case_TCCModification_ResponsibleInstigator = 0
View Source 
const TCCModification_ResponsibleProcess_case case_TCCModification_ResponsibleInstigator = 10
View Source 
const TCCModification_TccInstigator_not_set_case case_TCCModification_TccInstigator = 0
View Source 
const TCCModification_TriggerId_case case_TCCModification_TccInstigator = 9
View Source 
const TCCModification_TriggerProcess_case case_TCCModification_TccInstigator = 8
View Source 
const XProtect_Detected_case case_XProtect_Event = 1
View Source 
const XProtect_Event_not_set_case case_XProtect_Event = 0
View Source 
const XProtect_Remediated_case case_XProtect_Event = 2

Variables

View Source 
var (
	Hash_HashAlgo_name = map[int32]string{
		0: "HASH_ALGO_UNKNOWN",
		1: "HASH_ALGO_SHA256",
	}
	Hash_HashAlgo_value = map[string]int32{
		"HASH_ALGO_UNKNOWN": 0,
		"HASH_ALGO_SHA256":  1,
	}
)

Enum value maps for Hash_HashAlgo.

View Source 
var (
	FileDescriptor_FDType_name = map[int32]string{
		0:  "FD_TYPE_UNKNOWN",
		1:  "FD_TYPE_ATALK",
		2:  "FD_TYPE_VNODE",
		3:  "FD_TYPE_SOCKET",
		4:  "FD_TYPE_PSHM",
		5:  "FD_TYPE_PSEM",
		6:  "FD_TYPE_KQUEUE",
		7:  "FD_TYPE_PIPE",
		8:  "FD_TYPE_FSEVENTS",
		9:  "FD_TYPE_NETPOLICY",
		10: "FD_TYPE_CHANNEL",
		11: "FD_TYPE_NEXUS",
	}
	FileDescriptor_FDType_value = map[string]int32{
		"FD_TYPE_UNKNOWN":   0,
		"FD_TYPE_ATALK":     1,
		"FD_TYPE_VNODE":     2,
		"FD_TYPE_SOCKET":    3,
		"FD_TYPE_PSHM":      4,
		"FD_TYPE_PSEM":      5,
		"FD_TYPE_KQUEUE":    6,
		"FD_TYPE_PIPE":      7,
		"FD_TYPE_FSEVENTS":  8,
		"FD_TYPE_NETPOLICY": 9,
		"FD_TYPE_CHANNEL":   10,
		"FD_TYPE_NEXUS":     11,
	}
)

Enum value maps for FileDescriptor_FDType.

View Source 
var (
	Execution_Decision_name = map[int32]string{
		0: "DECISION_UNKNOWN",
		1: "DECISION_ALLOW",
		2: "DECISION_DENY",
		3: "DECISION_ALLOW_COMPILER",
	}
	Execution_Decision_value = map[string]int32{
		"DECISION_UNKNOWN":        0,
		"DECISION_ALLOW":          1,
		"DECISION_DENY":           2,
		"DECISION_ALLOW_COMPILER": 3,
	}
)

Enum value maps for Execution_Decision.

View Source 
var (
	Execution_Reason_name = map[int32]string{
		0:  "REASON_UNKNOWN",
		1:  "REASON_BINARY",
		2:  "REASON_CERT",
		3:  "REASON_COMPILER",
		5:  "REASON_PENDING_TRANSITIVE",
		6:  "REASON_SCOPE",
		7:  "REASON_TEAM_ID",
		8:  "REASON_TRANSITIVE",
		9:  "REASON_LONG_PATH",
		10: "REASON_NOT_RUNNING",
		11: "REASON_SIGNING_ID",
		12: "REASON_CDHASH",
		13: "REASON_CEL_FALLBACK",
		14: "REASON_PLATFORM",
	}
	Execution_Reason_value = map[string]int32{
		"REASON_UNKNOWN":            0,
		"REASON_BINARY":             1,
		"REASON_CERT":               2,
		"REASON_COMPILER":           3,
		"REASON_PENDING_TRANSITIVE": 5,
		"REASON_SCOPE":              6,
		"REASON_TEAM_ID":            7,
		"REASON_TRANSITIVE":         8,
		"REASON_LONG_PATH":          9,
		"REASON_NOT_RUNNING":        10,
		"REASON_SIGNING_ID":         11,
		"REASON_CDHASH":             12,
		"REASON_CEL_FALLBACK":       13,
		"REASON_PLATFORM":           14,
	}
)

Enum value maps for Execution_Reason.

View Source 
var (
	Execution_Mode_name = map[int32]string{
		0: "MODE_UNKNOWN",
		1: "MODE_LOCKDOWN",
		2: "MODE_MONITOR",
		3: "MODE_STANDALONE",
	}
	Execution_Mode_value = map[string]int32{
		"MODE_UNKNOWN":    0,
		"MODE_LOCKDOWN":   1,
		"MODE_MONITOR":    2,
		"MODE_STANDALONE": 3,
	}
)

Enum value maps for Execution_Mode.

View Source 
var (
	Disk_Action_name = map[int32]string{
		0: "ACTION_UNKNOWN",
		1: "ACTION_APPEARED",
		2: "ACTION_DISAPPEARED",
		3: "ACTION_BLOCKED",
	}
	Disk_Action_value = map[string]int32{
		"ACTION_UNKNOWN":     0,
		"ACTION_APPEARED":    1,
		"ACTION_DISAPPEARED": 2,
		"ACTION_BLOCKED":     3,
	}
)

Enum value maps for Disk_Action.

View Source 
var (
	FileAccess_AccessType_name = map[int32]string{
		0: "ACCESS_TYPE_UNKNOWN",
		1: "ACCESS_TYPE_OPEN",
		2: "ACCESS_TYPE_RENAME",
		3: "ACCESS_TYPE_UNLINK",
		4: "ACCESS_TYPE_LINK",
		5: "ACCESS_TYPE_CLONE",
		6: "ACCESS_TYPE_EXCHANGEDATA",
		7: "ACCESS_TYPE_COPYFILE",
		8: "ACCESS_TYPE_CREATE",
		9: "ACCESS_TYPE_TRUNCATE",
	}
	FileAccess_AccessType_value = map[string]int32{
		"ACCESS_TYPE_UNKNOWN":      0,
		"ACCESS_TYPE_OPEN":         1,
		"ACCESS_TYPE_RENAME":       2,
		"ACCESS_TYPE_UNLINK":       3,
		"ACCESS_TYPE_LINK":         4,
		"ACCESS_TYPE_CLONE":        5,
		"ACCESS_TYPE_EXCHANGEDATA": 6,
		"ACCESS_TYPE_COPYFILE":     7,
		"ACCESS_TYPE_CREATE":       8,
		"ACCESS_TYPE_TRUNCATE":     9,
	}
)

Enum value maps for FileAccess_AccessType.

View Source 
var (
	FileAccess_PolicyDecision_name = map[int32]string{
		0: "POLICY_DECISION_UNKNOWN",
		1: "POLICY_DECISION_DENIED",
		2: "POLICY_DECISION_DENIED_INVALID_SIGNATURE",
		3: "POLICY_DECISION_ALLOWED_AUDIT_ONLY",
	}
	FileAccess_PolicyDecision_value = map[string]int32{
		"POLICY_DECISION_UNKNOWN":                  0,
		"POLICY_DECISION_DENIED":                   1,
		"POLICY_DECISION_DENIED_INVALID_SIGNATURE": 2,
		"POLICY_DECISION_ALLOWED_AUDIT_ONLY":       3,
	}
)

Enum value maps for FileAccess_PolicyDecision.

View Source 
var (
	SocketAddress_Type_name = map[int32]string{
		0: "TYPE_UNKNOWN",
		1: "TYPE_NONE",
		2: "TYPE_IPV4",
		3: "TYPE_IPV6",
		4: "TYPE_NAMED_SOCKET",
	}
	SocketAddress_Type_value = map[string]int32{
		"TYPE_UNKNOWN":      0,
		"TYPE_NONE":         1,
		"TYPE_IPV4":         2,
		"TYPE_IPV6":         3,
		"TYPE_NAMED_SOCKET": 4,
	}
)

Enum value maps for SocketAddress_Type.

View Source 
var (
	OpenSSHLogin_Result_name = map[int32]string{
		0:  "RESULT_UNKNOWN",
		1:  "RESULT_LOGIN_EXCEED_MAXTRIES",
		2:  "RESULT_LOGIN_ROOT_DENIED",
		3:  "RESULT_AUTH_SUCCESS",
		4:  "RESULT_AUTH_FAIL_NONE",
		5:  "RESULT_AUTH_FAIL_PASSWD",
		6:  "RESULT_AUTH_FAIL_KBDINT",
		7:  "RESULT_AUTH_FAIL_PUBKEY",
		8:  "RESULT_AUTH_FAIL_HOSTBASED",
		9:  "RESULT_AUTH_FAIL_GSSAPI",
		10: "RESULT_INVALID_USER",
	}
	OpenSSHLogin_Result_value = map[string]int32{
		"RESULT_UNKNOWN":               0,
		"RESULT_LOGIN_EXCEED_MAXTRIES": 1,
		"RESULT_LOGIN_ROOT_DENIED":     2,
		"RESULT_AUTH_SUCCESS":          3,
		"RESULT_AUTH_FAIL_NONE":        4,
		"RESULT_AUTH_FAIL_PASSWD":      5,
		"RESULT_AUTH_FAIL_KBDINT":      6,
		"RESULT_AUTH_FAIL_PUBKEY":      7,
		"RESULT_AUTH_FAIL_HOSTBASED":   8,
		"RESULT_AUTH_FAIL_GSSAPI":      9,
		"RESULT_INVALID_USER":          10,
	}
)

Enum value maps for OpenSSHLogin_Result.

View Source 
var (
	AuthenticationTouchID_Mode_name = map[int32]string{
		0: "MODE_UNKNOWN",
		1: "MODE_VERIFICATION",
		2: "MODE_IDENTIFICATION",
	}
	AuthenticationTouchID_Mode_value = map[string]int32{
		"MODE_UNKNOWN":        0,
		"MODE_VERIFICATION":   1,
		"MODE_IDENTIFICATION": 2,
	}
)

Enum value maps for AuthenticationTouchID_Mode.

View Source 
var (
	AuthenticationAutoUnlock_Type_name = map[int32]string{
		0: "TYPE_UNKNOWN",
		1: "TYPE_MACHINE_UNLOCK",
		2: "TYPE_AUTH_PROMPT",
	}
	AuthenticationAutoUnlock_Type_value = map[string]int32{
		"TYPE_UNKNOWN":        0,
		"TYPE_MACHINE_UNLOCK": 1,
		"TYPE_AUTH_PROMPT":    2,
	}
)

Enum value maps for AuthenticationAutoUnlock_Type.

View Source 
var (
	LaunchItem_Action_name = map[int32]string{
		0: "ACTION_UNKNOWN",
		1: "ACTION_ADD",
		2: "ACTION_REMOVE",
	}
	LaunchItem_Action_value = map[string]int32{
		"ACTION_UNKNOWN": 0,
		"ACTION_ADD":     1,
		"ACTION_REMOVE":  2,
	}
)

Enum value maps for LaunchItem_Action.

View Source 
var (
	LaunchItem_ItemType_name = map[int32]string{
		0: "ITEM_TYPE_UNKNOWN",
		1: "ITEM_TYPE_USER_ITEM",
		2: "ITEM_TYPE_APP",
		3: "ITEM_TYPE_LOGIN_ITEM",
		4: "ITEM_TYPE_AGENT",
		5: "ITEM_TYPE_DAEMON",
	}
	LaunchItem_ItemType_value = map[string]int32{
		"ITEM_TYPE_UNKNOWN":    0,
		"ITEM_TYPE_USER_ITEM":  1,
		"ITEM_TYPE_APP":        2,
		"ITEM_TYPE_LOGIN_ITEM": 3,
		"ITEM_TYPE_AGENT":      4,
		"ITEM_TYPE_DAEMON":     5,
	}
)

Enum value maps for LaunchItem_ItemType.

View Source 
var (
	TCCModification_IdentityType_name = map[int32]string{
		0: "IDENTITY_TYPE_UNKNOWN",
		1: "IDENTITY_TYPE_BUNDLE_ID",
		2: "IDENTITY_TYPE_EXECUTABLE_PATH",
		3: "IDENTITY_TYPE_POLICY_ID",
		4: "IDENTITY_TYPE_FILE_PROVIDER_DOMAIN_ID",
	}
	TCCModification_IdentityType_value = map[string]int32{
		"IDENTITY_TYPE_UNKNOWN":                 0,
		"IDENTITY_TYPE_BUNDLE_ID":               1,
		"IDENTITY_TYPE_EXECUTABLE_PATH":         2,
		"IDENTITY_TYPE_POLICY_ID":               3,
		"IDENTITY_TYPE_FILE_PROVIDER_DOMAIN_ID": 4,
	}
)

Enum value maps for TCCModification_IdentityType.

View Source 
var (
	TCCModification_EventType_name = map[int32]string{
		0: "EVENT_TYPE_UNKNOWN",
		1: "EVENT_TYPE_CREATE",
		2: "EVENT_TYPE_MODIFY",
		3: "EVENT_TYPE_DELETE",
	}
	TCCModification_EventType_value = map[string]int32{
		"EVENT_TYPE_UNKNOWN": 0,
		"EVENT_TYPE_CREATE":  1,
		"EVENT_TYPE_MODIFY":  2,
		"EVENT_TYPE_DELETE":  3,
	}
)

Enum value maps for TCCModification_EventType.

View Source 
var (
	TCCModification_AuthorizationRight_name = map[int32]string{
		0: "AUTHORIZATION_RIGHT_UNKNOWN",
		1: "AUTHORIZATION_RIGHT_DENIED",
		2: "AUTHORIZATION_RIGHT_ALLOWED",
		3: "AUTHORIZATION_RIGHT_LIMITED",
		4: "AUTHORIZATION_RIGHT_ADD_MODIFY_ADDED",
		5: "AUTHORIZATION_RIGHT_SESSION_PID",
		6: "AUTHORIZATION_RIGHT_LEARN_MORE",
	}
	TCCModification_AuthorizationRight_value = map[string]int32{
		"AUTHORIZATION_RIGHT_UNKNOWN":          0,
		"AUTHORIZATION_RIGHT_DENIED":           1,
		"AUTHORIZATION_RIGHT_ALLOWED":          2,
		"AUTHORIZATION_RIGHT_LIMITED":          3,
		"AUTHORIZATION_RIGHT_ADD_MODIFY_ADDED": 4,
		"AUTHORIZATION_RIGHT_SESSION_PID":      5,
		"AUTHORIZATION_RIGHT_LEARN_MORE":       6,
	}
)

Enum value maps for TCCModification_AuthorizationRight.

View Source 
var (
	TCCModification_AuthorizationReason_name = map[int32]string{
		0:  "AUTHORIZATION_REASON_UNKNOWN",
		1:  "AUTHORIZATION_REASON_NONE",
		2:  "AUTHORIZATION_REASON_ERROR",
		3:  "AUTHORIZATION_REASON_USER_CONSENT",
		4:  "AUTHORIZATION_REASON_USER_SET",
		5:  "AUTHORIZATION_REASON_SYSTEM_SET",
		6:  "AUTHORIZATION_REASON_SERVICE_POLICY",
		7:  "AUTHORIZATION_REASON_MDM_POLICY",
		8:  "AUTHORIZATION_REASON_SERVICE_OVERRIDE_POLICY",
		9:  "AUTHORIZATION_REASON_MISSING_USAGE_STRING",
		10: "AUTHORIZATION_REASON_PROMPT_TIMEOUT",
		11: "AUTHORIZATION_REASON_PREFLIGHT_UNKNOWN",
		12: "AUTHORIZATION_REASON_ENTITLED",
		13: "AUTHORIZATION_REASON_APP_TYPE_POLICY",
		14: "AUTHORIZATION_REASON_PROMPT_CANCEL",
	}
	TCCModification_AuthorizationReason_value = map[string]int32{
		"AUTHORIZATION_REASON_UNKNOWN":                 0,
		"AUTHORIZATION_REASON_NONE":                    1,
		"AUTHORIZATION_REASON_ERROR":                   2,
		"AUTHORIZATION_REASON_USER_CONSENT":            3,
		"AUTHORIZATION_REASON_USER_SET":                4,
		"AUTHORIZATION_REASON_SYSTEM_SET":              5,
		"AUTHORIZATION_REASON_SERVICE_POLICY":          6,
		"AUTHORIZATION_REASON_MDM_POLICY":              7,
		"AUTHORIZATION_REASON_SERVICE_OVERRIDE_POLICY": 8,
		"AUTHORIZATION_REASON_MISSING_USAGE_STRING":    9,
		"AUTHORIZATION_REASON_PROMPT_TIMEOUT":          10,
		"AUTHORIZATION_REASON_PREFLIGHT_UNKNOWN":       11,
		"AUTHORIZATION_REASON_ENTITLED":                12,
		"AUTHORIZATION_REASON_APP_TYPE_POLICY":         13,
		"AUTHORIZATION_REASON_PROMPT_CANCEL":           14,
	}
)

Enum value maps for TCCModification_AuthorizationReason.

View Source 
var (
	NetworkActivity_Flow_SocketFamily_name = map[int32]string{
		0: "SOCKET_FAMILY_UNKNOWN",
		1: "SOCKET_FAMILY_INET",
		2: "SOCKET_FAMILY_INET6",
	}
	NetworkActivity_Flow_SocketFamily_value = map[string]int32{
		"SOCKET_FAMILY_UNKNOWN": 0,
		"SOCKET_FAMILY_INET":    1,
		"SOCKET_FAMILY_INET6":   2,
	}
)

Enum value maps for NetworkActivity_Flow_SocketFamily.

View Source 
var (
	NetworkActivity_Flow_Direction_name = map[int32]string{
		0: "DIRECTION_UNKNOWN",
		1: "DIRECTION_INBOUND",
		2: "DIRECTION_OUTBOUND",
	}
	NetworkActivity_Flow_Direction_value = map[string]int32{
		"DIRECTION_UNKNOWN":  0,
		"DIRECTION_INBOUND":  1,
		"DIRECTION_OUTBOUND": 2,
	}
)

Enum value maps for NetworkActivity_Flow_Direction.

View Source 
var (
	NetworkActivity_Flow_Decision_name = map[int32]string{
		0: "DECISION_UNKNOWN",
		1: "DECISION_ALLOW",
		2: "DECISION_BLOCK",
		3: "DECISION_AUDIT",
	}
	NetworkActivity_Flow_Decision_value = map[string]int32{
		"DECISION_UNKNOWN": 0,
		"DECISION_ALLOW":   1,
		"DECISION_BLOCK":   2,
		"DECISION_AUDIT":   3,
	}
)

Enum value maps for NetworkActivity_Flow_Decision.

View Source 
var (
	NetworkActivity_Flow_Tier_name = map[int32]string{
		0: "TIER_UNKNOWN",
		1: "TIER_EXACT_IP",
		2: "TIER_CIDR",
		3: "TIER_HOSTNAME",
		4: "TIER_DOMAIN",
		5: "TIER_ANY_REMOTE",
	}
	NetworkActivity_Flow_Tier_value = map[string]int32{
		"TIER_UNKNOWN":    0,
		"TIER_EXACT_IP":   1,
		"TIER_CIDR":       2,
		"TIER_HOSTNAME":   3,
		"TIER_DOMAIN":     4,
		"TIER_ANY_REMOTE": 5,
	}
)

Enum value maps for NetworkActivity_Flow_Tier.

View Source 
var (
	ProcSuspendResume_Type_name = map[int32]string{
		0: "TYPE_UNKNOWN",
		1: "TYPE_SUSPEND",
		2: "TYPE_RESUME",
		3: "TYPE_SHUTDOWN_SOCKETS",
	}
	ProcSuspendResume_Type_value = map[string]int32{
		"TYPE_UNKNOWN":          0,
		"TYPE_SUSPEND":          1,
		"TYPE_RESUME":           2,
		"TYPE_SHUTDOWN_SOCKETS": 3,
	}
)

Enum value maps for ProcSuspendResume_Type.

View Source 
var File_telemetry_sleighconfig_proto protoreflect.FileDescriptor
View Source 
var File_telemetry_v1_proto protoreflect.FileDescriptor

Functions

This section is empty.

Types

type Allowlist 

type Allowlist struct {

	// The process that caused the allowlist rule to be generated
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The file the new allowlist rule applies to
	Target *FileInfo `protobuf:"bytes,2,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// contains filtered or unexported fields
}

Information for a transitive allowlist rule

func (*Allowlist) ClearInstigator 

func (x *Allowlist) ClearInstigator()

func (*Allowlist) ClearTarget 

func (x *Allowlist) ClearTarget()

func (*Allowlist) GetInstigator 

func (x *Allowlist) GetInstigator() *ProcessInfoLight

func (*Allowlist) GetTarget 

func (x *Allowlist) GetTarget() *FileInfo

func (*Allowlist) HasInstigator 

func (x *Allowlist) HasInstigator() bool

func (*Allowlist) HasTarget 

func (x *Allowlist) HasTarget() bool

func (*Allowlist) ProtoMessage 

func (*Allowlist) ProtoMessage()

func (*Allowlist) ProtoReflect 

func (x *Allowlist) ProtoReflect() protoreflect.Message

func (*Allowlist) Reset 

func (x *Allowlist) Reset()

func (*Allowlist) SetInstigator 

func (x *Allowlist) SetInstigator(v *ProcessInfoLight)

func (*Allowlist) SetTarget 

func (x *Allowlist) SetTarget(v *FileInfo)

func (*Allowlist) String 

func (x *Allowlist) String() string

type Allowlist_builder 

type Allowlist_builder struct {

	// The process that caused the allowlist rule to be generated
	Instigator *ProcessInfoLight
	// The file the new allowlist rule applies to
	Target *FileInfo
	// contains filtered or unexported fields
}

func (Allowlist_builder) Build 

func (b0 Allowlist_builder) Build() *Allowlist

type Authentication 

type Authentication struct {
	Success *bool `protobuf:"varint,1,opt,name=success,proto3,oneof" json:"success,omitempty"`
	// Types that are valid to be assigned to Event:
	//
	//	*Authentication_AuthenticationOd
	//	*Authentication_AuthenticationTouchId
	//	*Authentication_AuthenticationToken
	//	*Authentication_AuthenticationAutoUnlock
	Event isAuthentication_Event `protobuf_oneof:"event"`
	// contains filtered or unexported fields
}

Information related to various authentication events

func (*Authentication) ClearAuthenticationAutoUnlock 

func (x *Authentication) ClearAuthenticationAutoUnlock()

func (*Authentication) ClearAuthenticationOd 

func (x *Authentication) ClearAuthenticationOd()

func (*Authentication) ClearAuthenticationToken 

func (x *Authentication) ClearAuthenticationToken()

func (*Authentication) ClearAuthenticationTouchId 

func (x *Authentication) ClearAuthenticationTouchId()

func (*Authentication) ClearEvent 

func (x *Authentication) ClearEvent()

func (*Authentication) ClearSuccess 

func (x *Authentication) ClearSuccess()

func (*Authentication) GetAuthenticationAutoUnlock 

func (x *Authentication) GetAuthenticationAutoUnlock() *AuthenticationAutoUnlock

func (*Authentication) GetAuthenticationOd 

func (x *Authentication) GetAuthenticationOd() *AuthenticationOD

func (*Authentication) GetAuthenticationToken 

func (x *Authentication) GetAuthenticationToken() *AuthenticationToken

func (*Authentication) GetAuthenticationTouchId 

func (x *Authentication) GetAuthenticationTouchId() *AuthenticationTouchID

func (*Authentication) GetEvent 

func (x *Authentication) GetEvent() isAuthentication_Event

func (*Authentication) GetSuccess 

func (x *Authentication) GetSuccess() bool

func (*Authentication) HasAuthenticationAutoUnlock 

func (x *Authentication) HasAuthenticationAutoUnlock() bool

func (*Authentication) HasAuthenticationOd 

func (x *Authentication) HasAuthenticationOd() bool

func (*Authentication) HasAuthenticationToken 

func (x *Authentication) HasAuthenticationToken() bool

func (*Authentication) HasAuthenticationTouchId 

func (x *Authentication) HasAuthenticationTouchId() bool

func (*Authentication) HasEvent 

func (x *Authentication) HasEvent() bool

func (*Authentication) HasSuccess 

func (x *Authentication) HasSuccess() bool

func (*Authentication) ProtoMessage 

func (*Authentication) ProtoMessage()

func (*Authentication) ProtoReflect 

func (x *Authentication) ProtoReflect() protoreflect.Message

func (*Authentication) Reset 

func (x *Authentication) Reset()

func (*Authentication) SetAuthenticationAutoUnlock 

func (x *Authentication) SetAuthenticationAutoUnlock(v *AuthenticationAutoUnlock)

func (*Authentication) SetAuthenticationOd 

func (x *Authentication) SetAuthenticationOd(v *AuthenticationOD)

func (*Authentication) SetAuthenticationToken 

func (x *Authentication) SetAuthenticationToken(v *AuthenticationToken)

func (*Authentication) SetAuthenticationTouchId 

func (x *Authentication) SetAuthenticationTouchId(v *AuthenticationTouchID)

func (*Authentication) SetSuccess 

func (x *Authentication) SetSuccess(v bool)

func (*Authentication) String 

func (x *Authentication) String() string

func (*Authentication) WhichEvent 

func (x *Authentication) WhichEvent() case_Authentication_Event

type AuthenticationAutoUnlock 

type AuthenticationAutoUnlock struct {

	// The process that emitted the authentication event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Username for which the authentication was attempted
	UserInfo *UserInfo `protobuf:"bytes,2,opt,name=user_info,json=userInfo,proto3" json:"user_info,omitempty"`
	// Purpose of the authentication
	Type AuthenticationAutoUnlock_Type `protobuf:"varint,3,opt,name=type,proto3,enum=santa.telemetry.v1.AuthenticationAutoUnlock_Type" json:"type,omitempty"`
	// contains filtered or unexported fields
}

Information related to auto unlock authentication

func (*AuthenticationAutoUnlock) ClearInstigator 

func (x *AuthenticationAutoUnlock) ClearInstigator()

func (*AuthenticationAutoUnlock) ClearUserInfo 

func (x *AuthenticationAutoUnlock) ClearUserInfo()

func (*AuthenticationAutoUnlock) GetInstigator 

func (x *AuthenticationAutoUnlock) GetInstigator() *ProcessInfoLight

func (*AuthenticationAutoUnlock) GetType 

func (x *AuthenticationAutoUnlock) GetType() AuthenticationAutoUnlock_Type

func (*AuthenticationAutoUnlock) GetUserInfo 

func (x *AuthenticationAutoUnlock) GetUserInfo() *UserInfo

func (*AuthenticationAutoUnlock) HasInstigator 

func (x *AuthenticationAutoUnlock) HasInstigator() bool

func (*AuthenticationAutoUnlock) HasUserInfo 

func (x *AuthenticationAutoUnlock) HasUserInfo() bool

func (*AuthenticationAutoUnlock) ProtoMessage 

func (*AuthenticationAutoUnlock) ProtoMessage()

func (*AuthenticationAutoUnlock) ProtoReflect 

func (x *AuthenticationAutoUnlock) ProtoReflect() protoreflect.Message

func (*AuthenticationAutoUnlock) Reset 

func (x *AuthenticationAutoUnlock) Reset()

func (*AuthenticationAutoUnlock) SetInstigator 

func (x *AuthenticationAutoUnlock) SetInstigator(v *ProcessInfoLight)

func (*AuthenticationAutoUnlock) SetType 

func (x *AuthenticationAutoUnlock) SetType(v AuthenticationAutoUnlock_Type)

func (*AuthenticationAutoUnlock) SetUserInfo 

func (x *AuthenticationAutoUnlock) SetUserInfo(v *UserInfo)

func (*AuthenticationAutoUnlock) String 

func (x *AuthenticationAutoUnlock) String() string

type AuthenticationAutoUnlock_Type 

type AuthenticationAutoUnlock_Type int32
const (
	AuthenticationAutoUnlock_TYPE_UNKNOWN AuthenticationAutoUnlock_Type = 0
	// Unlock the machine using Apple Watch
	AuthenticationAutoUnlock_TYPE_MACHINE_UNLOCK AuthenticationAutoUnlock_Type = 1
	// Approve an authorization prompt using Apple Watch
	AuthenticationAutoUnlock_TYPE_AUTH_PROMPT AuthenticationAutoUnlock_Type = 2
)

func (AuthenticationAutoUnlock_Type) Descriptor 

func (AuthenticationAutoUnlock_Type) Descriptor() protoreflect.EnumDescriptor

func (AuthenticationAutoUnlock_Type) Enum 

func (x AuthenticationAutoUnlock_Type) Enum() *AuthenticationAutoUnlock_Type

func (AuthenticationAutoUnlock_Type) Number 

func (x AuthenticationAutoUnlock_Type) Number() protoreflect.EnumNumber

func (AuthenticationAutoUnlock_Type) String 

func (x AuthenticationAutoUnlock_Type) String() string

func (AuthenticationAutoUnlock_Type) Type 

func (AuthenticationAutoUnlock_Type) Type() protoreflect.EnumType

type AuthenticationAutoUnlock_builder 

type AuthenticationAutoUnlock_builder struct {

	// The process that emitted the authentication event
	Instigator *ProcessInfoLight
	// Username for which the authentication was attempted
	UserInfo *UserInfo
	// Purpose of the authentication
	Type AuthenticationAutoUnlock_Type
	// contains filtered or unexported fields
}

func (AuthenticationAutoUnlock_builder) Build 

func (b0 AuthenticationAutoUnlock_builder) Build() *AuthenticationAutoUnlock

type AuthenticationOD 

type AuthenticationOD struct {

	// The process that emitted the authentication event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The process that triggered authentication
	// Note: Due to macOS system limitations, the process that triggered the
	// event may have already exited before the event could be generated. This
	// results in only a small subset of the information from the triggering
	// process to be reported.
	//
	// Types that are valid to be assigned to AuthInstigator:
	//
	//	*AuthenticationOD_TriggerProcess
	//	*AuthenticationOD_TriggerId
	AuthInstigator isAuthenticationOD_AuthInstigator `protobuf_oneof:"auth_instigator"`
	// OD record type against which OD is authenticating
	// Typically "Users"
	RecordType *string `protobuf:"bytes,4,opt,name=record_type,json=recordType,proto3,oneof" json:"record_type,omitempty"`
	// OD record name against which OD is authenticating
	// For record type "Users", this is the username.
	RecordName *string `protobuf:"bytes,5,opt,name=record_name,json=recordName,proto3,oneof" json:"record_name,omitempty"`
	// OD node against which OD is authenticating
	// Typically one of "/Local/Default", "/LDAPv3/<server>" or
	// "/Active Directory/<domain>".
	NodeName *string `protobuf:"bytes,6,opt,name=node_name,json=nodeName,proto3,oneof" json:"node_name,omitempty"`
	// If node_name is "/Local/Default", this is the path of the database
	// against which OD is authenticating.
	DbPath *string `protobuf:"bytes,7,opt,name=db_path,json=dbPath,proto3,oneof" json:"db_path,omitempty"`
	// contains filtered or unexported fields
}

Information related to OpenDirectory authentication

func (*AuthenticationOD) ClearAuthInstigator 

func (x *AuthenticationOD) ClearAuthInstigator()

func (*AuthenticationOD) ClearDbPath 

func (x *AuthenticationOD) ClearDbPath()

func (*AuthenticationOD) ClearInstigator 

func (x *AuthenticationOD) ClearInstigator()

func (*AuthenticationOD) ClearNodeName 

func (x *AuthenticationOD) ClearNodeName()

func (*AuthenticationOD) ClearRecordName 

func (x *AuthenticationOD) ClearRecordName()

func (*AuthenticationOD) ClearRecordType 

func (x *AuthenticationOD) ClearRecordType()

func (*AuthenticationOD) ClearTriggerId 

func (x *AuthenticationOD) ClearTriggerId()

func (*AuthenticationOD) ClearTriggerProcess 

func (x *AuthenticationOD) ClearTriggerProcess()

func (*AuthenticationOD) GetAuthInstigator 

func (x *AuthenticationOD) GetAuthInstigator() isAuthenticationOD_AuthInstigator

func (*AuthenticationOD) GetDbPath 

func (x *AuthenticationOD) GetDbPath() string

func (*AuthenticationOD) GetInstigator 

func (x *AuthenticationOD) GetInstigator() *ProcessInfoLight

func (*AuthenticationOD) GetNodeName 

func (x *AuthenticationOD) GetNodeName() string

func (*AuthenticationOD) GetRecordName 

func (x *AuthenticationOD) GetRecordName() string

func (*AuthenticationOD) GetRecordType 

func (x *AuthenticationOD) GetRecordType() string

func (*AuthenticationOD) GetTriggerId 

func (x *AuthenticationOD) GetTriggerId() *ProcessID

func (*AuthenticationOD) GetTriggerProcess 

func (x *AuthenticationOD) GetTriggerProcess() *ProcessInfoLight

func (*AuthenticationOD) HasAuthInstigator 

func (x *AuthenticationOD) HasAuthInstigator() bool

func (*AuthenticationOD) HasDbPath 

func (x *AuthenticationOD) HasDbPath() bool

func (*AuthenticationOD) HasInstigator 

func (x *AuthenticationOD) HasInstigator() bool

func (*AuthenticationOD) HasNodeName 

func (x *AuthenticationOD) HasNodeName() bool

func (*AuthenticationOD) HasRecordName 

func (x *AuthenticationOD) HasRecordName() bool

func (*AuthenticationOD) HasRecordType 

func (x *AuthenticationOD) HasRecordType() bool

func (*AuthenticationOD) HasTriggerId 

func (x *AuthenticationOD) HasTriggerId() bool

func (*AuthenticationOD) HasTriggerProcess 

func (x *AuthenticationOD) HasTriggerProcess() bool

func (*AuthenticationOD) ProtoMessage 

func (*AuthenticationOD) ProtoMessage()

func (*AuthenticationOD) ProtoReflect 

func (x *AuthenticationOD) ProtoReflect() protoreflect.Message

func (*AuthenticationOD) Reset 

func (x *AuthenticationOD) Reset()

func (*AuthenticationOD) SetDbPath 

func (x *AuthenticationOD) SetDbPath(v string)

func (*AuthenticationOD) SetInstigator 

func (x *AuthenticationOD) SetInstigator(v *ProcessInfoLight)

func (*AuthenticationOD) SetNodeName 

func (x *AuthenticationOD) SetNodeName(v string)

func (*AuthenticationOD) SetRecordName 

func (x *AuthenticationOD) SetRecordName(v string)

func (*AuthenticationOD) SetRecordType 

func (x *AuthenticationOD) SetRecordType(v string)

func (*AuthenticationOD) SetTriggerId 

func (x *AuthenticationOD) SetTriggerId(v *ProcessID)

func (*AuthenticationOD) SetTriggerProcess 

func (x *AuthenticationOD) SetTriggerProcess(v *ProcessInfoLight)

func (*AuthenticationOD) String 

func (x *AuthenticationOD) String() string

func (*AuthenticationOD) WhichAuthInstigator 

func (x *AuthenticationOD) WhichAuthInstigator() case_AuthenticationOD_AuthInstigator

type AuthenticationOD_TriggerId 

type AuthenticationOD_TriggerId struct {
	TriggerId *ProcessID `protobuf:"bytes,3,opt,name=trigger_id,json=triggerId,proto3,oneof"`
}

type AuthenticationOD_TriggerProcess 

type AuthenticationOD_TriggerProcess struct {
	TriggerProcess *ProcessInfoLight `protobuf:"bytes,2,opt,name=trigger_process,json=triggerProcess,proto3,oneof"`
}

type AuthenticationOD_builder 

type AuthenticationOD_builder struct {

	// The process that emitted the authentication event
	Instigator *ProcessInfoLight

	// Fields of oneof AuthInstigator:
	TriggerProcess *ProcessInfoLight
	TriggerId      *ProcessID
	// -- end of AuthInstigator
	// OD record type against which OD is authenticating
	// Typically "Users"
	RecordType *string
	// OD record name against which OD is authenticating
	// For record type "Users", this is the username.
	RecordName *string
	// OD node against which OD is authenticating
	// Typically one of "/Local/Default", "/LDAPv3/<server>" or
	// "/Active Directory/<domain>".
	NodeName *string
	// If node_name is "/Local/Default", this is the path of the database
	// against which OD is authenticating.
	DbPath *string
	// contains filtered or unexported fields
}

func (AuthenticationOD_builder) Build 

func (b0 AuthenticationOD_builder) Build() *AuthenticationOD

type AuthenticationToken 

type AuthenticationToken struct {

	// The process that emitted the authentication event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The process that triggered authentication
	// Note: Due to macOS system limitations, the process that triggered the
	// event may have already exited before the event could be generated. This
	// results in only a small subset of the information from the triggering
	// process to be reported.
	//
	// Types that are valid to be assigned to AuthInstigator:
	//
	//	*AuthenticationToken_TriggerProcess
	//	*AuthenticationToken_TriggerId
	AuthInstigator isAuthenticationToken_AuthInstigator `protobuf_oneof:"auth_instigator"`
	// Hash of the public key which CryptoTokenKit is authenticating
	PubkeyHash *string `protobuf:"bytes,4,opt,name=pubkey_hash,json=pubkeyHash,proto3,oneof" json:"pubkey_hash,omitempty"`
	// Token identifier of the event which CryptoTokenKit is authenticating
	TokenId *string `protobuf:"bytes,5,opt,name=token_id,json=tokenId,proto3,oneof" json:"token_id,omitempty"`
	// This will be available if token is used for GSS PKINIT authentication for
	// obtaining a kerberos TGT.  NULL in all other cases.
	KerberosPrincipal *string `protobuf:"bytes,6,opt,name=kerberos_principal,json=kerberosPrincipal,proto3,oneof" json:"kerberos_principal,omitempty"`
	// contains filtered or unexported fields
}

Information related to token-based authentication

func (*AuthenticationToken) ClearAuthInstigator 

func (x *AuthenticationToken) ClearAuthInstigator()

func (*AuthenticationToken) ClearInstigator 

func (x *AuthenticationToken) ClearInstigator()

func (*AuthenticationToken) ClearKerberosPrincipal 

func (x *AuthenticationToken) ClearKerberosPrincipal()

func (*AuthenticationToken) ClearPubkeyHash 

func (x *AuthenticationToken) ClearPubkeyHash()

func (*AuthenticationToken) ClearTokenId 

func (x *AuthenticationToken) ClearTokenId()

func (*AuthenticationToken) ClearTriggerId 

func (x *AuthenticationToken) ClearTriggerId()

func (*AuthenticationToken) ClearTriggerProcess 

func (x *AuthenticationToken) ClearTriggerProcess()

func (*AuthenticationToken) GetAuthInstigator 

func (x *AuthenticationToken) GetAuthInstigator() isAuthenticationToken_AuthInstigator

func (*AuthenticationToken) GetInstigator 

func (x *AuthenticationToken) GetInstigator() *ProcessInfoLight

func (*AuthenticationToken) GetKerberosPrincipal 

func (x *AuthenticationToken) GetKerberosPrincipal() string

func (*AuthenticationToken) GetPubkeyHash 

func (x *AuthenticationToken) GetPubkeyHash() string

func (*AuthenticationToken) GetTokenId 

func (x *AuthenticationToken) GetTokenId() string

func (*AuthenticationToken) GetTriggerId 

func (x *AuthenticationToken) GetTriggerId() *ProcessID

func (*AuthenticationToken) GetTriggerProcess 

func (x *AuthenticationToken) GetTriggerProcess() *ProcessInfoLight

func (*AuthenticationToken) HasAuthInstigator 

func (x *AuthenticationToken) HasAuthInstigator() bool

func (*AuthenticationToken) HasInstigator 

func (x *AuthenticationToken) HasInstigator() bool

func (*AuthenticationToken) HasKerberosPrincipal 

func (x *AuthenticationToken) HasKerberosPrincipal() bool

func (*AuthenticationToken) HasPubkeyHash 

func (x *AuthenticationToken) HasPubkeyHash() bool

func (*AuthenticationToken) HasTokenId 

func (x *AuthenticationToken) HasTokenId() bool

func (*AuthenticationToken) HasTriggerId 

func (x *AuthenticationToken) HasTriggerId() bool

func (*AuthenticationToken) HasTriggerProcess 

func (x *AuthenticationToken) HasTriggerProcess() bool

func (*AuthenticationToken) ProtoMessage 

func (*AuthenticationToken) ProtoMessage()

func (*AuthenticationToken) ProtoReflect 

func (x *AuthenticationToken) ProtoReflect() protoreflect.Message

func (*AuthenticationToken) Reset 

func (x *AuthenticationToken) Reset()

func (*AuthenticationToken) SetInstigator 

func (x *AuthenticationToken) SetInstigator(v *ProcessInfoLight)

func (*AuthenticationToken) SetKerberosPrincipal 

func (x *AuthenticationToken) SetKerberosPrincipal(v string)

func (*AuthenticationToken) SetPubkeyHash 

func (x *AuthenticationToken) SetPubkeyHash(v string)

func (*AuthenticationToken) SetTokenId 

func (x *AuthenticationToken) SetTokenId(v string)

func (*AuthenticationToken) SetTriggerId 

func (x *AuthenticationToken) SetTriggerId(v *ProcessID)

func (*AuthenticationToken) SetTriggerProcess 

func (x *AuthenticationToken) SetTriggerProcess(v *ProcessInfoLight)

func (*AuthenticationToken) String 

func (x *AuthenticationToken) String() string

func (*AuthenticationToken) WhichAuthInstigator 

func (x *AuthenticationToken) WhichAuthInstigator() case_AuthenticationToken_AuthInstigator

type AuthenticationToken_TriggerId 

type AuthenticationToken_TriggerId struct {
	TriggerId *ProcessID `protobuf:"bytes,3,opt,name=trigger_id,json=triggerId,proto3,oneof"`
}

type AuthenticationToken_TriggerProcess 

type AuthenticationToken_TriggerProcess struct {
	TriggerProcess *ProcessInfoLight `protobuf:"bytes,2,opt,name=trigger_process,json=triggerProcess,proto3,oneof"`
}

type AuthenticationToken_builder 

type AuthenticationToken_builder struct {

	// The process that emitted the authentication event
	Instigator *ProcessInfoLight

	// Fields of oneof AuthInstigator:
	TriggerProcess *ProcessInfoLight
	TriggerId      *ProcessID
	// -- end of AuthInstigator
	// Hash of the public key which CryptoTokenKit is authenticating
	PubkeyHash *string
	// Token identifier of the event which CryptoTokenKit is authenticating
	TokenId *string
	// This will be available if token is used for GSS PKINIT authentication for
	// obtaining a kerberos TGT.  NULL in all other cases.
	KerberosPrincipal *string
	// contains filtered or unexported fields
}

func (AuthenticationToken_builder) Build 

func (b0 AuthenticationToken_builder) Build() *AuthenticationToken

type AuthenticationTouchID 

type AuthenticationTouchID struct {

	// The process that emitted the authentication event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The process that triggered authentication
	// Note: Due to macOS system limitations, the process that triggered the
	// event may have already exited before the event could be generated. This
	// results in only a small subset of the information from the triggering
	// process to be reported.
	//
	// Types that are valid to be assigned to AuthInstigator:
	//
	//	*AuthenticationTouchID_TriggerProcess
	//	*AuthenticationTouchID_TriggerId
	AuthInstigator isAuthenticationTouchID_AuthInstigator `protobuf_oneof:"auth_instigator"`
	// The mode of authentication used
	Mode *AuthenticationTouchID_Mode `protobuf:"varint,4,opt,name=mode,proto3,enum=santa.telemetry.v1.AuthenticationTouchID_Mode,oneof" json:"mode,omitempty"`
	// If authentication was successful, will be populated with the authenticated
	// user.
	User *UserInfo `protobuf:"bytes,5,opt,name=user,proto3,oneof" json:"user,omitempty"`
	// contains filtered or unexported fields
}

Information related to TouchID authentication

func (*AuthenticationTouchID) ClearAuthInstigator 

func (x *AuthenticationTouchID) ClearAuthInstigator()

func (*AuthenticationTouchID) ClearInstigator 

func (x *AuthenticationTouchID) ClearInstigator()

func (*AuthenticationTouchID) ClearMode 

func (x *AuthenticationTouchID) ClearMode()

func (*AuthenticationTouchID) ClearTriggerId 

func (x *AuthenticationTouchID) ClearTriggerId()

func (*AuthenticationTouchID) ClearTriggerProcess 

func (x *AuthenticationTouchID) ClearTriggerProcess()

func (*AuthenticationTouchID) ClearUser 

func (x *AuthenticationTouchID) ClearUser()

func (*AuthenticationTouchID) GetAuthInstigator 

func (x *AuthenticationTouchID) GetAuthInstigator() isAuthenticationTouchID_AuthInstigator

func (*AuthenticationTouchID) GetInstigator 

func (x *AuthenticationTouchID) GetInstigator() *ProcessInfoLight

func (*AuthenticationTouchID) GetMode 

func (x *AuthenticationTouchID) GetMode() AuthenticationTouchID_Mode

func (*AuthenticationTouchID) GetTriggerId 

func (x *AuthenticationTouchID) GetTriggerId() *ProcessID

func (*AuthenticationTouchID) GetTriggerProcess 

func (x *AuthenticationTouchID) GetTriggerProcess() *ProcessInfoLight

func (*AuthenticationTouchID) GetUser 

func (x *AuthenticationTouchID) GetUser() *UserInfo

func (*AuthenticationTouchID) HasAuthInstigator 

func (x *AuthenticationTouchID) HasAuthInstigator() bool

func (*AuthenticationTouchID) HasInstigator 

func (x *AuthenticationTouchID) HasInstigator() bool

func (*AuthenticationTouchID) HasMode 

func (x *AuthenticationTouchID) HasMode() bool

func (*AuthenticationTouchID) HasTriggerId 

func (x *AuthenticationTouchID) HasTriggerId() bool

func (*AuthenticationTouchID) HasTriggerProcess 

func (x *AuthenticationTouchID) HasTriggerProcess() bool

func (*AuthenticationTouchID) HasUser 

func (x *AuthenticationTouchID) HasUser() bool

func (*AuthenticationTouchID) ProtoMessage 

func (*AuthenticationTouchID) ProtoMessage()

func (*AuthenticationTouchID) ProtoReflect 

func (x *AuthenticationTouchID) ProtoReflect() protoreflect.Message

func (*AuthenticationTouchID) Reset 

func (x *AuthenticationTouchID) Reset()

func (*AuthenticationTouchID) SetInstigator 

func (x *AuthenticationTouchID) SetInstigator(v *ProcessInfoLight)

func (*AuthenticationTouchID) SetMode 

func (x *AuthenticationTouchID) SetMode(v AuthenticationTouchID_Mode)

func (*AuthenticationTouchID) SetTriggerId 

func (x *AuthenticationTouchID) SetTriggerId(v *ProcessID)

func (*AuthenticationTouchID) SetTriggerProcess 

func (x *AuthenticationTouchID) SetTriggerProcess(v *ProcessInfoLight)

func (*AuthenticationTouchID) SetUser 

func (x *AuthenticationTouchID) SetUser(v *UserInfo)

func (*AuthenticationTouchID) String 

func (x *AuthenticationTouchID) String() string

func (*AuthenticationTouchID) WhichAuthInstigator 

func (x *AuthenticationTouchID) WhichAuthInstigator() case_AuthenticationTouchID_AuthInstigator

type AuthenticationTouchID_Mode 

type AuthenticationTouchID_Mode int32
const (
	AuthenticationTouchID_MODE_UNKNOWN        AuthenticationTouchID_Mode = 0
	AuthenticationTouchID_MODE_VERIFICATION   AuthenticationTouchID_Mode = 1
	AuthenticationTouchID_MODE_IDENTIFICATION AuthenticationTouchID_Mode = 2
)

func (AuthenticationTouchID_Mode) Descriptor 

func (AuthenticationTouchID_Mode) Descriptor() protoreflect.EnumDescriptor

func (AuthenticationTouchID_Mode) Enum 

func (x AuthenticationTouchID_Mode) Enum() *AuthenticationTouchID_Mode

func (AuthenticationTouchID_Mode) Number 

func (x AuthenticationTouchID_Mode) Number() protoreflect.EnumNumber

func (AuthenticationTouchID_Mode) String 

func (x AuthenticationTouchID_Mode) String() string

func (AuthenticationTouchID_Mode) Type 

func (AuthenticationTouchID_Mode) Type() protoreflect.EnumType

type AuthenticationTouchID_TriggerId 

type AuthenticationTouchID_TriggerId struct {
	TriggerId *ProcessID `protobuf:"bytes,3,opt,name=trigger_id,json=triggerId,proto3,oneof"`
}

type AuthenticationTouchID_TriggerProcess 

type AuthenticationTouchID_TriggerProcess struct {
	TriggerProcess *ProcessInfoLight `protobuf:"bytes,2,opt,name=trigger_process,json=triggerProcess,proto3,oneof"`
}

type AuthenticationTouchID_builder 

type AuthenticationTouchID_builder struct {

	// The process that emitted the authentication event
	Instigator *ProcessInfoLight

	// Fields of oneof AuthInstigator:
	TriggerProcess *ProcessInfoLight
	TriggerId      *ProcessID
	// -- end of AuthInstigator
	// The mode of authentication used
	Mode *AuthenticationTouchID_Mode
	// If authentication was successful, will be populated with the authenticated
	// user.
	User *UserInfo
	// contains filtered or unexported fields
}

func (AuthenticationTouchID_builder) Build 

func (b0 AuthenticationTouchID_builder) Build() *AuthenticationTouchID

type Authentication_AuthenticationAutoUnlock 

type Authentication_AuthenticationAutoUnlock struct {
	AuthenticationAutoUnlock *AuthenticationAutoUnlock `protobuf:"bytes,5,opt,name=authentication_auto_unlock,json=authenticationAutoUnlock,proto3,oneof"`
}

type Authentication_AuthenticationOd 

type Authentication_AuthenticationOd struct {
	AuthenticationOd *AuthenticationOD `protobuf:"bytes,2,opt,name=authentication_od,json=authenticationOd,proto3,oneof"`
}

type Authentication_AuthenticationToken 

type Authentication_AuthenticationToken struct {
	AuthenticationToken *AuthenticationToken `protobuf:"bytes,4,opt,name=authentication_token,json=authenticationToken,proto3,oneof"`
}

type Authentication_AuthenticationTouchId 

type Authentication_AuthenticationTouchId struct {
	AuthenticationTouchId *AuthenticationTouchID `protobuf:"bytes,3,opt,name=authentication_touch_id,json=authenticationTouchId,proto3,oneof"`
}

type Authentication_builder 

type Authentication_builder struct {
	Success *bool
	// Fields of oneof Event:
	AuthenticationOd         *AuthenticationOD
	AuthenticationTouchId    *AuthenticationTouchID
	AuthenticationToken      *AuthenticationToken
	AuthenticationAutoUnlock *AuthenticationAutoUnlock
	// contains filtered or unexported fields
}

func (Authentication_builder) Build 

func (b0 Authentication_builder) Build() *Authentication

type BinaryMetadata 

type BinaryMetadata struct {
	Path             string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	SigningId        string `protobuf:"bytes,2,opt,name=signing_id,json=signingId,proto3" json:"signing_id,omitempty"`
	TeamId           string `protobuf:"bytes,3,opt,name=team_id,json=teamId,proto3" json:"team_id,omitempty"`
	Cdhash           string `protobuf:"bytes,4,opt,name=cdhash,proto3" json:"cdhash,omitempty"`
	IsPlatformBinary bool   `protobuf:"varint,5,opt,name=is_platform_binary,json=isPlatformBinary,proto3" json:"is_platform_binary,omitempty"`
	FileSize         int64  `protobuf:"varint,6,opt,name=file_size,json=fileSize,proto3" json:"file_size,omitempty"`
	MachoType        string `protobuf:"bytes,7,opt,name=macho_type,json=machoType,proto3" json:"macho_type,omitempty"`
	// contains filtered or unexported fields
}

BinaryMetadata is computed by santa (via SNTFileInfo + MOLCodesignChecker) and carried in SleighBinaryUpload for sleigh's CEL upload filter to evaluate. In filter expressions the variable is `binary` (e.g. `binary.is_platform_binary`).

func (*BinaryMetadata) GetCdhash 

func (x *BinaryMetadata) GetCdhash() string

func (*BinaryMetadata) GetFileSize 

func (x *BinaryMetadata) GetFileSize() int64

func (*BinaryMetadata) GetIsPlatformBinary 

func (x *BinaryMetadata) GetIsPlatformBinary() bool

func (*BinaryMetadata) GetMachoType 

func (x *BinaryMetadata) GetMachoType() string

func (*BinaryMetadata) GetPath 

func (x *BinaryMetadata) GetPath() string

func (*BinaryMetadata) GetSigningId 

func (x *BinaryMetadata) GetSigningId() string

func (*BinaryMetadata) GetTeamId 

func (x *BinaryMetadata) GetTeamId() string

func (*BinaryMetadata) ProtoMessage 

func (*BinaryMetadata) ProtoMessage()

func (*BinaryMetadata) ProtoReflect 

func (x *BinaryMetadata) ProtoReflect() protoreflect.Message

func (*BinaryMetadata) Reset 

func (x *BinaryMetadata) Reset()

func (*BinaryMetadata) SetCdhash 

func (x *BinaryMetadata) SetCdhash(v string)

func (*BinaryMetadata) SetFileSize 

func (x *BinaryMetadata) SetFileSize(v int64)

func (*BinaryMetadata) SetIsPlatformBinary 

func (x *BinaryMetadata) SetIsPlatformBinary(v bool)

func (*BinaryMetadata) SetMachoType 

func (x *BinaryMetadata) SetMachoType(v string)

func (*BinaryMetadata) SetPath 

func (x *BinaryMetadata) SetPath(v string)

func (*BinaryMetadata) SetSigningId 

func (x *BinaryMetadata) SetSigningId(v string)

func (*BinaryMetadata) SetTeamId 

func (x *BinaryMetadata) SetTeamId(v string)

func (*BinaryMetadata) String 

func (x *BinaryMetadata) String() string

type BinaryMetadata_builder 

type BinaryMetadata_builder struct {
	Path             string
	SigningId        string
	TeamId           string
	Cdhash           string
	IsPlatformBinary bool
	FileSize         int64
	MachoType        string
	// contains filtered or unexported fields
}

func (BinaryMetadata_builder) Build 

func (b0 BinaryMetadata_builder) Build() *BinaryMetadata

type Bundle 

type Bundle struct {

	// This is the hash of the file within the bundle that triggered the event
	FileHash *Hash `protobuf:"bytes,1,opt,name=file_hash,json=fileHash,proto3,oneof" json:"file_hash,omitempty"`
	// This is the hash of the hashes of all executables in the bundle
	BundleHash *Hash `protobuf:"bytes,2,opt,name=bundle_hash,json=bundleHash,proto3,oneof" json:"bundle_hash,omitempty"`
	// Name of the bundle
	BundleName *string `protobuf:"bytes,3,opt,name=bundle_name,json=bundleName,proto3,oneof" json:"bundle_name,omitempty"`
	// Bundle identifier
	BundleId *string `protobuf:"bytes,4,opt,name=bundle_id,json=bundleId,proto3,oneof" json:"bundle_id,omitempty"`
	// Bundle path
	BundlePath *string `protobuf:"bytes,5,opt,name=bundle_path,json=bundlePath,proto3,oneof" json:"bundle_path,omitempty"`
	// Path of the file within the bundle that triggered the event
	Path *string `protobuf:"bytes,6,opt,name=path,proto3,oneof" json:"path,omitempty"`
	// contains filtered or unexported fields
}

Information emitted when Santa captures bundle information

func (*Bundle) ClearBundleHash 

func (x *Bundle) ClearBundleHash()

func (*Bundle) ClearBundleId 

func (x *Bundle) ClearBundleId()

func (*Bundle) ClearBundleName 

func (x *Bundle) ClearBundleName()

func (*Bundle) ClearBundlePath 

func (x *Bundle) ClearBundlePath()

func (*Bundle) ClearFileHash 

func (x *Bundle) ClearFileHash()

func (*Bundle) ClearPath 

func (x *Bundle) ClearPath()

func (*Bundle) GetBundleHash 

func (x *Bundle) GetBundleHash() *Hash

func (*Bundle) GetBundleId 

func (x *Bundle) GetBundleId() string

func (*Bundle) GetBundleName 

func (x *Bundle) GetBundleName() string

func (*Bundle) GetBundlePath 

func (x *Bundle) GetBundlePath() string

func (*Bundle) GetFileHash 

func (x *Bundle) GetFileHash() *Hash

func (*Bundle) GetPath 

func (x *Bundle) GetPath() string

func (*Bundle) HasBundleHash 

func (x *Bundle) HasBundleHash() bool

func (*Bundle) HasBundleId 

func (x *Bundle) HasBundleId() bool

func (*Bundle) HasBundleName 

func (x *Bundle) HasBundleName() bool

func (*Bundle) HasBundlePath 

func (x *Bundle) HasBundlePath() bool

func (*Bundle) HasFileHash 

func (x *Bundle) HasFileHash() bool

func (*Bundle) HasPath 

func (x *Bundle) HasPath() bool

func (*Bundle) ProtoMessage 

func (*Bundle) ProtoMessage()

func (*Bundle) ProtoReflect 

func (x *Bundle) ProtoReflect() protoreflect.Message

func (*Bundle) Reset 

func (x *Bundle) Reset()

func (*Bundle) SetBundleHash 

func (x *Bundle) SetBundleHash(v *Hash)

func (*Bundle) SetBundleId 

func (x *Bundle) SetBundleId(v string)

func (*Bundle) SetBundleName 

func (x *Bundle) SetBundleName(v string)

func (*Bundle) SetBundlePath 

func (x *Bundle) SetBundlePath(v string)

func (*Bundle) SetFileHash 

func (x *Bundle) SetFileHash(v *Hash)

func (*Bundle) SetPath 

func (x *Bundle) SetPath(v string)

func (*Bundle) String 

func (x *Bundle) String() string

type Bundle_builder 

type Bundle_builder struct {

	// This is the hash of the file within the bundle that triggered the event
	FileHash *Hash
	// This is the hash of the hashes of all executables in the bundle
	BundleHash *Hash
	// Name of the bundle
	BundleName *string
	// Bundle identifier
	BundleId *string
	// Bundle path
	BundlePath *string
	// Path of the file within the bundle that triggered the event
	Path *string
	// contains filtered or unexported fields
}

func (Bundle_builder) Build 

func (b0 Bundle_builder) Build() *Bundle

type CertificateInfo 

type CertificateInfo struct {

	// Hash of the certificate data
	Hash *Hash `protobuf:"bytes,1,opt,name=hash,proto3,oneof" json:"hash,omitempty"`
	// Common name used in the certificate
	CommonName *string `protobuf:"bytes,2,opt,name=common_name,json=commonName,proto3,oneof" json:"common_name,omitempty"`
	// contains filtered or unexported fields
}

Certificate information

func (*CertificateInfo) ClearCommonName 

func (x *CertificateInfo) ClearCommonName()

func (*CertificateInfo) ClearHash 

func (x *CertificateInfo) ClearHash()

func (*CertificateInfo) GetCommonName 

func (x *CertificateInfo) GetCommonName() string

func (*CertificateInfo) GetHash 

func (x *CertificateInfo) GetHash() *Hash

func (*CertificateInfo) HasCommonName 

func (x *CertificateInfo) HasCommonName() bool

func (*CertificateInfo) HasHash 

func (x *CertificateInfo) HasHash() bool

func (*CertificateInfo) ProtoMessage 

func (*CertificateInfo) ProtoMessage()

func (*CertificateInfo) ProtoReflect 

func (x *CertificateInfo) ProtoReflect() protoreflect.Message

func (*CertificateInfo) Reset 

func (x *CertificateInfo) Reset()

func (*CertificateInfo) SetCommonName 

func (x *CertificateInfo) SetCommonName(v string)

func (*CertificateInfo) SetHash 

func (x *CertificateInfo) SetHash(v *Hash)

func (*CertificateInfo) String 

func (x *CertificateInfo) String() string

type CertificateInfo_builder 

type CertificateInfo_builder struct {

	// Hash of the certificate data
	Hash *Hash
	// Common name used in the certificate
	CommonName *string
	// contains filtered or unexported fields
}

func (CertificateInfo_builder) Build 

func (b0 CertificateInfo_builder) Build() *CertificateInfo

type Clone 

type Clone struct {

	// The process cloning the file
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The source file being cloned
	Source *FileInfo `protobuf:"bytes,2,opt,name=source,proto3,oneof" json:"source,omitempty"`
	// The target path when the clone is complete
	Target *string `protobuf:"bytes,3,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// contains filtered or unexported fields
}

Information about a clone event

func (*Clone) ClearInstigator 

func (x *Clone) ClearInstigator()

func (*Clone) ClearSource 

func (x *Clone) ClearSource()

func (*Clone) ClearTarget 

func (x *Clone) ClearTarget()

func (*Clone) GetInstigator 

func (x *Clone) GetInstigator() *ProcessInfoLight

func (*Clone) GetSource 

func (x *Clone) GetSource() *FileInfo

func (*Clone) GetTarget 

func (x *Clone) GetTarget() string

func (*Clone) HasInstigator 

func (x *Clone) HasInstigator() bool

func (*Clone) HasSource 

func (x *Clone) HasSource() bool

func (*Clone) HasTarget 

func (x *Clone) HasTarget() bool

func (*Clone) ProtoMessage 

func (*Clone) ProtoMessage()

func (*Clone) ProtoReflect 

func (x *Clone) ProtoReflect() protoreflect.Message

func (*Clone) Reset 

func (x *Clone) Reset()

func (*Clone) SetInstigator 

func (x *Clone) SetInstigator(v *ProcessInfoLight)

func (*Clone) SetSource 

func (x *Clone) SetSource(v *FileInfo)

func (*Clone) SetTarget 

func (x *Clone) SetTarget(v string)

func (*Clone) String 

func (x *Clone) String() string

type Clone_builder 

type Clone_builder struct {

	// The process cloning the file
	Instigator *ProcessInfoLight
	// The source file being cloned
	Source *FileInfo
	// The target path when the clone is complete
	Target *string
	// contains filtered or unexported fields
}

func (Clone_builder) Build 

func (b0 Clone_builder) Build() *Clone

type Close 

type Close struct {

	// The process closing the file
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The file being closed
	Target *FileInfo `protobuf:"bytes,2,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// Whether or not the file was written to
	Modified *bool `protobuf:"varint,3,opt,name=modified,proto3,oneof" json:"modified,omitempty"`
	// contains filtered or unexported fields
}

Information about a close event

func (*Close) ClearInstigator 

func (x *Close) ClearInstigator()

func (*Close) ClearModified 

func (x *Close) ClearModified()

func (*Close) ClearTarget 

func (x *Close) ClearTarget()

func (*Close) GetInstigator 

func (x *Close) GetInstigator() *ProcessInfoLight

func (*Close) GetModified 

func (x *Close) GetModified() bool

func (*Close) GetTarget 

func (x *Close) GetTarget() *FileInfo

func (*Close) HasInstigator 

func (x *Close) HasInstigator() bool

func (*Close) HasModified 

func (x *Close) HasModified() bool

func (*Close) HasTarget 

func (x *Close) HasTarget() bool

func (*Close) ProtoMessage 

func (*Close) ProtoMessage()

func (*Close) ProtoReflect 

func (x *Close) ProtoReflect() protoreflect.Message

func (*Close) Reset 

func (x *Close) Reset()

func (*Close) SetInstigator 

func (x *Close) SetInstigator(v *ProcessInfoLight)

func (*Close) SetModified 

func (x *Close) SetModified(v bool)

func (*Close) SetTarget 

func (x *Close) SetTarget(v *FileInfo)

func (*Close) String 

func (x *Close) String() string

type Close_builder 

type Close_builder struct {

	// The process closing the file
	Instigator *ProcessInfoLight
	// The file being closed
	Target *FileInfo
	// Whether or not the file was written to
	Modified *bool
	// contains filtered or unexported fields
}

func (Close_builder) Build 

func (b0 Close_builder) Build() *Close

type CodeSignature 

type CodeSignature struct {

	// The code directory hash identifies a specific version of a program
	Cdhash []byte `protobuf:"bytes,1,opt,name=cdhash,proto3,oneof" json:"cdhash,omitempty"`
	// The signing id of the code signature
	SigningId *string `protobuf:"bytes,2,opt,name=signing_id,json=signingId,proto3,oneof" json:"signing_id,omitempty"`
	// The team id of the code signature
	TeamId *string `protobuf:"bytes,3,opt,name=team_id,json=teamId,proto3,oneof" json:"team_id,omitempty"`
	// The secure timestamp of when this binary was signed, as provided by the
	// timestamp service. Not populated for unsigned or ad-hoc signed binaries,
	// or if the secure timestamp is missing.
	SecureSigningTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=secure_signing_time,json=secureSigningTime,proto3,oneof" json:"secure_signing_time,omitempty"`
	// The timestamp provided by the developer when this binary was signed.
	// It is possible for developers to set this to whatever they wish when signing
	// unlike the secure_signing_time.
	SigningTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=signing_time,json=signingTime,proto3,oneof" json:"signing_time,omitempty"`
	// contains filtered or unexported fields
}

Code signature information

func (*CodeSignature) ClearCdhash 

func (x *CodeSignature) ClearCdhash()

func (*CodeSignature) ClearSecureSigningTime 

func (x *CodeSignature) ClearSecureSigningTime()

func (*CodeSignature) ClearSigningId 

func (x *CodeSignature) ClearSigningId()

func (*CodeSignature) ClearSigningTime 

func (x *CodeSignature) ClearSigningTime()

func (*CodeSignature) ClearTeamId 

func (x *CodeSignature) ClearTeamId()

func (*CodeSignature) GetCdhash 

func (x *CodeSignature) GetCdhash() []byte

func (*CodeSignature) GetSecureSigningTime 

func (x *CodeSignature) GetSecureSigningTime() *timestamppb.Timestamp

func (*CodeSignature) GetSigningId 

func (x *CodeSignature) GetSigningId() string

func (*CodeSignature) GetSigningTime 

func (x *CodeSignature) GetSigningTime() *timestamppb.Timestamp

func (*CodeSignature) GetTeamId 

func (x *CodeSignature) GetTeamId() string

func (*CodeSignature) HasCdhash 

func (x *CodeSignature) HasCdhash() bool

func (*CodeSignature) HasSecureSigningTime 

func (x *CodeSignature) HasSecureSigningTime() bool

func (*CodeSignature) HasSigningId 

func (x *CodeSignature) HasSigningId() bool

func (*CodeSignature) HasSigningTime 

func (x *CodeSignature) HasSigningTime() bool

func (*CodeSignature) HasTeamId 

func (x *CodeSignature) HasTeamId() bool

func (*CodeSignature) ProtoMessage 

func (*CodeSignature) ProtoMessage()

func (*CodeSignature) ProtoReflect 

func (x *CodeSignature) ProtoReflect() protoreflect.Message

func (*CodeSignature) Reset 

func (x *CodeSignature) Reset()

func (*CodeSignature) SetCdhash 

func (x *CodeSignature) SetCdhash(v []byte)

func (*CodeSignature) SetSecureSigningTime 

func (x *CodeSignature) SetSecureSigningTime(v *timestamppb.Timestamp)

func (*CodeSignature) SetSigningId 

func (x *CodeSignature) SetSigningId(v string)

func (*CodeSignature) SetSigningTime 

func (x *CodeSignature) SetSigningTime(v *timestamppb.Timestamp)

func (*CodeSignature) SetTeamId 

func (x *CodeSignature) SetTeamId(v string)

func (*CodeSignature) String 

func (x *CodeSignature) String() string

type CodeSignature_builder 

type CodeSignature_builder struct {

	// The code directory hash identifies a specific version of a program
	Cdhash []byte
	// The signing id of the code signature
	SigningId *string
	// The team id of the code signature
	TeamId *string
	// The secure timestamp of when this binary was signed, as provided by the
	// timestamp service. Not populated for unsigned or ad-hoc signed binaries,
	// or if the secure timestamp is missing.
	SecureSigningTime *timestamppb.Timestamp
	// The timestamp provided by the developer when this binary was signed.
	// It is possible for developers to set this to whatever they wish when signing
	// unlike the secure_signing_time.
	SigningTime *timestamppb.Timestamp
	// contains filtered or unexported fields
}

func (CodeSignature_builder) Build 

func (b0 CodeSignature_builder) Build() *CodeSignature

type CodesigningInvalidated 

type CodesigningInvalidated struct {
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// contains filtered or unexported fields
}

Information about a processes codesigning invalidation event

func (*CodesigningInvalidated) ClearInstigator 

func (x *CodesigningInvalidated) ClearInstigator()

func (*CodesigningInvalidated) GetInstigator 

func (x *CodesigningInvalidated) GetInstigator() *ProcessInfoLight

func (*CodesigningInvalidated) HasInstigator 

func (x *CodesigningInvalidated) HasInstigator() bool

func (*CodesigningInvalidated) ProtoMessage 

func (*CodesigningInvalidated) ProtoMessage()

func (*CodesigningInvalidated) ProtoReflect 

func (x *CodesigningInvalidated) ProtoReflect() protoreflect.Message

func (*CodesigningInvalidated) Reset 

func (x *CodesigningInvalidated) Reset()

func (*CodesigningInvalidated) SetInstigator 

func (x *CodesigningInvalidated) SetInstigator(v *ProcessInfoLight)

func (*CodesigningInvalidated) String 

func (x *CodesigningInvalidated) String() string

type CodesigningInvalidated_builder 

type CodesigningInvalidated_builder struct {
	Instigator *ProcessInfoLight
	// contains filtered or unexported fields
}

func (CodesigningInvalidated_builder) Build 

func (b0 CodesigningInvalidated_builder) Build() *CodesigningInvalidated

type Copyfile 

type Copyfile struct {

	// The process calling the copyfile syscall
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The source file being copied
	Source *FileInfo `protobuf:"bytes,2,opt,name=source,proto3,oneof" json:"source,omitempty"`
	// The target path when the copyfile is complete
	Target *string `protobuf:"bytes,3,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// Whether or not the target path previously existed
	TargetExisted *bool `protobuf:"varint,4,opt,name=target_existed,json=targetExisted,proto3,oneof" json:"target_existed,omitempty"`
	// The mode argument of the copyfile syscall
	Mode uint32 `protobuf:"varint,5,opt,name=mode,proto3" json:"mode,omitempty"`
	// Flags used in the copyfile syscall
	Flags int32 `protobuf:"varint,6,opt,name=flags,proto3" json:"flags,omitempty"`
	// contains filtered or unexported fields
}

Information about a copyfile syscall event (not to be confused with `copyfile(3)`)

func (*Copyfile) ClearInstigator 

func (x *Copyfile) ClearInstigator()

func (*Copyfile) ClearSource 

func (x *Copyfile) ClearSource()

func (*Copyfile) ClearTarget 

func (x *Copyfile) ClearTarget()

func (*Copyfile) ClearTargetExisted 

func (x *Copyfile) ClearTargetExisted()

func (*Copyfile) GetFlags 

func (x *Copyfile) GetFlags() int32

func (*Copyfile) GetInstigator 

func (x *Copyfile) GetInstigator() *ProcessInfoLight

func (*Copyfile) GetMode 

func (x *Copyfile) GetMode() uint32

func (*Copyfile) GetSource 

func (x *Copyfile) GetSource() *FileInfo

func (*Copyfile) GetTarget 

func (x *Copyfile) GetTarget() string

func (*Copyfile) GetTargetExisted 

func (x *Copyfile) GetTargetExisted() bool

func (*Copyfile) HasInstigator 

func (x *Copyfile) HasInstigator() bool

func (*Copyfile) HasSource 

func (x *Copyfile) HasSource() bool

func (*Copyfile) HasTarget 

func (x *Copyfile) HasTarget() bool

func (*Copyfile) HasTargetExisted 

func (x *Copyfile) HasTargetExisted() bool

func (*Copyfile) ProtoMessage 

func (*Copyfile) ProtoMessage()

func (*Copyfile) ProtoReflect 

func (x *Copyfile) ProtoReflect() protoreflect.Message

func (*Copyfile) Reset 

func (x *Copyfile) Reset()

func (*Copyfile) SetFlags 

func (x *Copyfile) SetFlags(v int32)

func (*Copyfile) SetInstigator 

func (x *Copyfile) SetInstigator(v *ProcessInfoLight)

func (*Copyfile) SetMode 

func (x *Copyfile) SetMode(v uint32)

func (*Copyfile) SetSource 

func (x *Copyfile) SetSource(v *FileInfo)

func (*Copyfile) SetTarget 

func (x *Copyfile) SetTarget(v string)

func (*Copyfile) SetTargetExisted 

func (x *Copyfile) SetTargetExisted(v bool)

func (*Copyfile) String 

func (x *Copyfile) String() string

type Copyfile_builder 

type Copyfile_builder struct {

	// The process calling the copyfile syscall
	Instigator *ProcessInfoLight
	// The source file being copied
	Source *FileInfo
	// The target path when the copyfile is complete
	Target *string
	// Whether or not the target path previously existed
	TargetExisted *bool
	// The mode argument of the copyfile syscall
	Mode uint32
	// Flags used in the copyfile syscall
	Flags int32
	// contains filtered or unexported fields
}

func (Copyfile_builder) Build 

func (b0 Copyfile_builder) Build() *Copyfile

type Disk 

type Disk struct {
	Action *Disk_Action `protobuf:"varint,1,opt,name=action,proto3,enum=santa.telemetry.v1.Disk_Action,oneof" json:"action,omitempty"`
	// Volume path
	Mount *string `protobuf:"bytes,2,opt,name=mount,proto3,oneof" json:"mount,omitempty"`
	// Volume name
	Volume *string `protobuf:"bytes,3,opt,name=volume,proto3,oneof" json:"volume,omitempty"`
	// Media BSD name
	BsdName *string `protobuf:"bytes,4,opt,name=bsd_name,json=bsdName,proto3,oneof" json:"bsd_name,omitempty"`
	// Kind of volume
	Fs *string `protobuf:"bytes,5,opt,name=fs,proto3,oneof" json:"fs,omitempty"`
	// Device vendor and model information
	Model *string `protobuf:"bytes,6,opt,name=model,proto3,oneof" json:"model,omitempty"`
	// Serial number of the device
	Serial *string `protobuf:"bytes,7,opt,name=serial,proto3,oneof" json:"serial,omitempty"`
	// Device protocol
	Bus *string `protobuf:"bytes,8,opt,name=bus,proto3,oneof" json:"bus,omitempty"`
	// Path of the DMG
	DmgPath *string `protobuf:"bytes,9,opt,name=dmg_path,json=dmgPath,proto3,oneof" json:"dmg_path,omitempty"`
	// Time device appeared/disappeared
	Appearance *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=appearance,proto3,oneof" json:"appearance,omitempty"`
	// Path mounted from
	MountFrom *string `protobuf:"bytes,11,opt,name=mount_from,json=mountFrom,proto3,oneof" json:"mount_from,omitempty"`
	// Indicates whether the disk is encrypted or not
	Encrypted *bool `protobuf:"varint,12,opt,name=encrypted,proto3,oneof" json:"encrypted,omitempty"`
	// contains filtered or unexported fields
}

Information about when disks are added or removed

func (*Disk) ClearAction 

func (x *Disk) ClearAction()

func (*Disk) ClearAppearance 

func (x *Disk) ClearAppearance()

func (*Disk) ClearBsdName 

func (x *Disk) ClearBsdName()

func (*Disk) ClearBus 

func (x *Disk) ClearBus()

func (*Disk) ClearDmgPath 

func (x *Disk) ClearDmgPath()

func (*Disk) ClearEncrypted 

func (x *Disk) ClearEncrypted()

func (*Disk) ClearFs 

func (x *Disk) ClearFs()

func (*Disk) ClearModel 

func (x *Disk) ClearModel()

func (*Disk) ClearMount 

func (x *Disk) ClearMount()

func (*Disk) ClearMountFrom 

func (x *Disk) ClearMountFrom()

func (*Disk) ClearSerial 

func (x *Disk) ClearSerial()

func (*Disk) ClearVolume 

func (x *Disk) ClearVolume()

func (*Disk) GetAction 

func (x *Disk) GetAction() Disk_Action

func (*Disk) GetAppearance 

func (x *Disk) GetAppearance() *timestamppb.Timestamp

func (*Disk) GetBsdName 

func (x *Disk) GetBsdName() string

func (*Disk) GetBus 

func (x *Disk) GetBus() string

func (*Disk) GetDmgPath 

func (x *Disk) GetDmgPath() string

func (*Disk) GetEncrypted 

func (x *Disk) GetEncrypted() bool

func (*Disk) GetFs 

func (x *Disk) GetFs() string

func (*Disk) GetModel 

func (x *Disk) GetModel() string

func (*Disk) GetMount 

func (x *Disk) GetMount() string

func (*Disk) GetMountFrom 

func (x *Disk) GetMountFrom() string

func (*Disk) GetSerial 

func (x *Disk) GetSerial() string

func (*Disk) GetVolume 

func (x *Disk) GetVolume() string

func (*Disk) HasAction 

func (x *Disk) HasAction() bool

func (*Disk) HasAppearance 

func (x *Disk) HasAppearance() bool

func (*Disk) HasBsdName 

func (x *Disk) HasBsdName() bool

func (*Disk) HasBus 

func (x *Disk) HasBus() bool

func (*Disk) HasDmgPath 

func (x *Disk) HasDmgPath() bool

func (*Disk) HasEncrypted 

func (x *Disk) HasEncrypted() bool

func (*Disk) HasFs 

func (x *Disk) HasFs() bool

func (*Disk) HasModel 

func (x *Disk) HasModel() bool

func (*Disk) HasMount 

func (x *Disk) HasMount() bool

func (*Disk) HasMountFrom 

func (x *Disk) HasMountFrom() bool

func (*Disk) HasSerial 

func (x *Disk) HasSerial() bool

func (*Disk) HasVolume 

func (x *Disk) HasVolume() bool

func (*Disk) ProtoMessage 

func (*Disk) ProtoMessage()

func (*Disk) ProtoReflect 

func (x *Disk) ProtoReflect() protoreflect.Message

func (*Disk) Reset 

func (x *Disk) Reset()

func (*Disk) SetAction 

func (x *Disk) SetAction(v Disk_Action)

func (*Disk) SetAppearance 

func (x *Disk) SetAppearance(v *timestamppb.Timestamp)

func (*Disk) SetBsdName 

func (x *Disk) SetBsdName(v string)

func (*Disk) SetBus 

func (x *Disk) SetBus(v string)

func (*Disk) SetDmgPath 

func (x *Disk) SetDmgPath(v string)

func (*Disk) SetEncrypted 

func (x *Disk) SetEncrypted(v bool)

func (*Disk) SetFs 

func (x *Disk) SetFs(v string)

func (*Disk) SetModel 

func (x *Disk) SetModel(v string)

func (*Disk) SetMount 

func (x *Disk) SetMount(v string)

func (*Disk) SetMountFrom 

func (x *Disk) SetMountFrom(v string)

func (*Disk) SetSerial 

func (x *Disk) SetSerial(v string)

func (*Disk) SetVolume 

func (x *Disk) SetVolume(v string)

func (*Disk) String 

func (x *Disk) String() string

type Disk_Action 

type Disk_Action int32

Whether the disk just appeared or disappeared from the system 

const (
	Disk_ACTION_UNKNOWN     Disk_Action = 0
	Disk_ACTION_APPEARED    Disk_Action = 1
	Disk_ACTION_DISAPPEARED Disk_Action = 2
	Disk_ACTION_BLOCKED     Disk_Action = 3
)

func (Disk_Action) Descriptor 

func (Disk_Action) Descriptor() protoreflect.EnumDescriptor

func (Disk_Action) Enum 

func (x Disk_Action) Enum() *Disk_Action

func (Disk_Action) Number 

func (x Disk_Action) Number() protoreflect.EnumNumber

func (Disk_Action) String 

func (x Disk_Action) String() string

func (Disk_Action) Type 

func (Disk_Action) Type() protoreflect.EnumType

type Disk_builder 

type Disk_builder struct {
	Action *Disk_Action
	// Volume path
	Mount *string
	// Volume name
	Volume *string
	// Media BSD name
	BsdName *string
	// Kind of volume
	Fs *string
	// Device vendor and model information
	Model *string
	// Serial number of the device
	Serial *string
	// Device protocol
	Bus *string
	// Path of the DMG
	DmgPath *string
	// Time device appeared/disappeared
	Appearance *timestamppb.Timestamp
	// Path mounted from
	MountFrom *string
	// Indicates whether the disk is encrypted or not
	Encrypted *bool
	// contains filtered or unexported fields
}

func (Disk_builder) Build 

func (b0 Disk_builder) Build() *Disk

type Entitlement 

type Entitlement struct {

	// The name of an entitlement
	Key *string `protobuf:"bytes,1,opt,name=key,proto3,oneof" json:"key,omitempty"`
	// The value of an entitlement
	Value *string `protobuf:"bytes,2,opt,name=value,proto3,oneof" json:"value,omitempty"`
	// contains filtered or unexported fields
}

Information about a single entitlement key/value pair

func (*Entitlement) ClearKey 

func (x *Entitlement) ClearKey()

func (*Entitlement) ClearValue 

func (x *Entitlement) ClearValue()

func (*Entitlement) GetKey 

func (x *Entitlement) GetKey() string

func (*Entitlement) GetValue 

func (x *Entitlement) GetValue() string

func (*Entitlement) HasKey 

func (x *Entitlement) HasKey() bool

func (*Entitlement) HasValue 

func (x *Entitlement) HasValue() bool

func (*Entitlement) ProtoMessage 

func (*Entitlement) ProtoMessage()

func (*Entitlement) ProtoReflect 

func (x *Entitlement) ProtoReflect() protoreflect.Message

func (*Entitlement) Reset 

func (x *Entitlement) Reset()

func (*Entitlement) SetKey 

func (x *Entitlement) SetKey(v string)

func (*Entitlement) SetValue 

func (x *Entitlement) SetValue(v string)

func (*Entitlement) String 

func (x *Entitlement) String() string

type EntitlementInfo 

type EntitlementInfo struct {

	// Whether or not the set of reported entilements is complete or has been
	// filtered (e.g. by configuration or clipped because too many to log).
	EntitlementsFiltered *bool `` /* 128-byte string literal not displayed */
	// The set of entitlements associated with the target executable
	// Only top level keys are represented
	// Values (including nested keys) are JSON serialized
	Entitlements []*Entitlement `protobuf:"bytes,2,rep,name=entitlements,proto3" json:"entitlements,omitempty"`
	// contains filtered or unexported fields
}

Information about entitlements

func (*EntitlementInfo) ClearEntitlementsFiltered 

func (x *EntitlementInfo) ClearEntitlementsFiltered()

func (*EntitlementInfo) GetEntitlements 

func (x *EntitlementInfo) GetEntitlements() []*Entitlement

func (*EntitlementInfo) GetEntitlementsFiltered 

func (x *EntitlementInfo) GetEntitlementsFiltered() bool

func (*EntitlementInfo) HasEntitlementsFiltered 

func (x *EntitlementInfo) HasEntitlementsFiltered() bool

func (*EntitlementInfo) ProtoMessage 

func (*EntitlementInfo) ProtoMessage()

func (*EntitlementInfo) ProtoReflect 

func (x *EntitlementInfo) ProtoReflect() protoreflect.Message

func (*EntitlementInfo) Reset 

func (x *EntitlementInfo) Reset()

func (*EntitlementInfo) SetEntitlements 

func (x *EntitlementInfo) SetEntitlements(v []*Entitlement)

func (*EntitlementInfo) SetEntitlementsFiltered 

func (x *EntitlementInfo) SetEntitlementsFiltered(v bool)

func (*EntitlementInfo) String 

func (x *EntitlementInfo) String() string

type EntitlementInfo_builder 

type EntitlementInfo_builder struct {

	// Whether or not the set of reported entilements is complete or has been
	// filtered (e.g. by configuration or clipped because too many to log).
	EntitlementsFiltered *bool
	// The set of entitlements associated with the target executable
	// Only top level keys are represented
	// Values (including nested keys) are JSON serialized
	Entitlements []*Entitlement
	// contains filtered or unexported fields
}

func (EntitlementInfo_builder) Build 

func (b0 EntitlementInfo_builder) Build() *EntitlementInfo

type Entitlement_builder 

type Entitlement_builder struct {

	// The name of an entitlement
	Key *string
	// The value of an entitlement
	Value *string
	// contains filtered or unexported fields
}

func (Entitlement_builder) Build 

func (b0 Entitlement_builder) Build() *Entitlement

type Exchangedata 

type Exchangedata struct {

	// The process that is exchanging the data
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// File information for the two files in the exchangedata operation
	File1 *FileInfo `protobuf:"bytes,2,opt,name=file1,proto3,oneof" json:"file1,omitempty"`
	File2 *FileInfo `protobuf:"bytes,3,opt,name=file2,proto3,oneof" json:"file2,omitempty"`
	// contains filtered or unexported fields
}

Information about an exchagedata event This event is not applicable to all filesystems (notably APFS)

func (*Exchangedata) ClearFile1 

func (x *Exchangedata) ClearFile1()

func (*Exchangedata) ClearFile2 

func (x *Exchangedata) ClearFile2()

func (*Exchangedata) ClearInstigator 

func (x *Exchangedata) ClearInstigator()

func (*Exchangedata) GetFile1 

func (x *Exchangedata) GetFile1() *FileInfo

func (*Exchangedata) GetFile2 

func (x *Exchangedata) GetFile2() *FileInfo

func (*Exchangedata) GetInstigator 

func (x *Exchangedata) GetInstigator() *ProcessInfoLight

func (*Exchangedata) HasFile1 

func (x *Exchangedata) HasFile1() bool

func (*Exchangedata) HasFile2 

func (x *Exchangedata) HasFile2() bool

func (*Exchangedata) HasInstigator 

func (x *Exchangedata) HasInstigator() bool

func (*Exchangedata) ProtoMessage 

func (*Exchangedata) ProtoMessage()

func (*Exchangedata) ProtoReflect 

func (x *Exchangedata) ProtoReflect() protoreflect.Message

func (*Exchangedata) Reset 

func (x *Exchangedata) Reset()

func (*Exchangedata) SetFile1 

func (x *Exchangedata) SetFile1(v *FileInfo)

func (*Exchangedata) SetFile2 

func (x *Exchangedata) SetFile2(v *FileInfo)

func (*Exchangedata) SetInstigator 

func (x *Exchangedata) SetInstigator(v *ProcessInfoLight)

func (*Exchangedata) String 

func (x *Exchangedata) String() string

type Exchangedata_builder 

type Exchangedata_builder struct {

	// The process that is exchanging the data
	Instigator *ProcessInfoLight
	// File information for the two files in the exchangedata operation
	File1 *FileInfo
	File2 *FileInfo
	// contains filtered or unexported fields
}

func (Exchangedata_builder) Build 

func (b0 Exchangedata_builder) Build() *Exchangedata

type Execution 

type Execution struct {

	// The process that executed the new image (e.g. the process that called
	// `execve(2)` or `posix_spawn(2)“)
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Process info for the newly formed execution
	Target *ProcessInfo `protobuf:"bytes,2,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// Script file information
	// Only valid when a script was executed directly and not as an argument to
	// an interpreter (e.g.  `./foo.sh`, not `/bin/sh ./foo.sh`)
	Script *FileInfo `protobuf:"bytes,3,opt,name=script,proto3,oneof" json:"script,omitempty"`
	// The current working directory of the `target` at exec time
	WorkingDirectory *FileInfo `protobuf:"bytes,4,opt,name=working_directory,json=workingDirectory,proto3,oneof" json:"working_directory,omitempty"`
	// List of process arguments
	Args [][]byte `protobuf:"bytes,5,rep,name=args,proto3" json:"args,omitempty"`
	// List of environment variables
	Envs [][]byte `protobuf:"bytes,6,rep,name=envs,proto3" json:"envs,omitempty"`
	// List of file descriptors
	Fds []*FileDescriptor `protobuf:"bytes,7,rep,name=fds,proto3" json:"fds,omitempty"`
	// Whether or not the list of `fds` is complete or contains partial info
	FdListTruncated *bool               `protobuf:"varint,8,opt,name=fd_list_truncated,json=fdListTruncated,proto3,oneof" json:"fd_list_truncated,omitempty"`
	Decision        *Execution_Decision `protobuf:"varint,9,opt,name=decision,proto3,enum=santa.telemetry.v1.Execution_Decision,oneof" json:"decision,omitempty"`
	Reason          *Execution_Reason   `protobuf:"varint,10,opt,name=reason,proto3,enum=santa.telemetry.v1.Execution_Reason,oneof" json:"reason,omitempty"`
	Mode            *Execution_Mode     `protobuf:"varint,11,opt,name=mode,proto3,enum=santa.telemetry.v1.Execution_Mode,oneof" json:"mode,omitempty"`
	// Certificate information for the target executable
	CertificateInfo *CertificateInfo `protobuf:"bytes,12,opt,name=certificate_info,json=certificateInfo,proto3,oneof" json:"certificate_info,omitempty"`
	// Additional Santa metadata
	Explain *string `protobuf:"bytes,13,opt,name=explain,proto3,oneof" json:"explain,omitempty"`
	// Information known to LaunchServices about the target executable file
	QuarantineUrl *string `protobuf:"bytes,14,opt,name=quarantine_url,json=quarantineUrl,proto3,oneof" json:"quarantine_url,omitempty"`
	// The original path on disk of the target executable
	// Applies when executables are translocated
	OriginalPath *string `protobuf:"bytes,15,opt,name=original_path,json=originalPath,proto3,oneof" json:"original_path,omitempty"`
	// Entitlement information about the target executbale
	EntitlementInfo *EntitlementInfo `protobuf:"bytes,16,opt,name=entitlement_info,json=entitlementInfo,proto3,oneof" json:"entitlement_info,omitempty"`
	// Indicates whether the decision was made by a static rule or not
	StaticRule *bool `protobuf:"varint,17,opt,name=static_rule,json=staticRule,proto3,oneof" json:"static_rule,omitempty"`
	// The server-assigned rule ID that was used to make the decision
	RuleId *int64 `protobuf:"varint,18,opt,name=rule_id,json=ruleId,proto3,oneof" json:"rule_id,omitempty"`
	// True if the matching rule returned AUDIT from a CEL expression. The
	// execution was allowed (as if the rule had returned ALLOWLIST), but the
	// event is logged with this flag set so audit matches can be distinguished
	// from regular allow decisions. The `decision` and `reason` fields still
	// report the underlying allow decision (e.g. DECISION_ALLOW / REASON_BINARY).
	AuditReturn *bool `protobuf:"varint,19,opt,name=audit_return,json=auditReturn,proto3,oneof" json:"audit_return,omitempty"`
	// contains filtered or unexported fields
}

Information about a process execution event

func (*Execution) ClearAuditReturn 

func (x *Execution) ClearAuditReturn()

func (*Execution) ClearCertificateInfo 

func (x *Execution) ClearCertificateInfo()

func (*Execution) ClearDecision 

func (x *Execution) ClearDecision()

func (*Execution) ClearEntitlementInfo 

func (x *Execution) ClearEntitlementInfo()

func (*Execution) ClearExplain 

func (x *Execution) ClearExplain()

func (*Execution) ClearFdListTruncated 

func (x *Execution) ClearFdListTruncated()

func (*Execution) ClearInstigator 

func (x *Execution) ClearInstigator()

func (*Execution) ClearMode 

func (x *Execution) ClearMode()

func (*Execution) ClearOriginalPath 

func (x *Execution) ClearOriginalPath()

func (*Execution) ClearQuarantineUrl 

func (x *Execution) ClearQuarantineUrl()

func (*Execution) ClearReason 

func (x *Execution) ClearReason()

func (*Execution) ClearRuleId 

func (x *Execution) ClearRuleId()

func (*Execution) ClearScript 

func (x *Execution) ClearScript()

func (*Execution) ClearStaticRule 

func (x *Execution) ClearStaticRule()

func (*Execution) ClearTarget 

func (x *Execution) ClearTarget()

func (*Execution) ClearWorkingDirectory 

func (x *Execution) ClearWorkingDirectory()

func (*Execution) GetArgs 

func (x *Execution) GetArgs() [][]byte

func (*Execution) GetAuditReturn 

func (x *Execution) GetAuditReturn() bool

func (*Execution) GetCertificateInfo 

func (x *Execution) GetCertificateInfo() *CertificateInfo

func (*Execution) GetDecision 

func (x *Execution) GetDecision() Execution_Decision

func (*Execution) GetEntitlementInfo 

func (x *Execution) GetEntitlementInfo() *EntitlementInfo

func (*Execution) GetEnvs 

func (x *Execution) GetEnvs() [][]byte

func (*Execution) GetExplain 

func (x *Execution) GetExplain() string

func (*Execution) GetFdListTruncated 

func (x *Execution) GetFdListTruncated() bool

func (*Execution) GetFds 

func (x *Execution) GetFds() []*FileDescriptor

func (*Execution) GetInstigator 

func (x *Execution) GetInstigator() *ProcessInfoLight

func (*Execution) GetMode 

func (x *Execution) GetMode() Execution_Mode

func (*Execution) GetOriginalPath 

func (x *Execution) GetOriginalPath() string

func (*Execution) GetQuarantineUrl 

func (x *Execution) GetQuarantineUrl() string

func (*Execution) GetReason 

func (x *Execution) GetReason() Execution_Reason

func (*Execution) GetRuleId 

func (x *Execution) GetRuleId() int64

func (*Execution) GetScript 

func (x *Execution) GetScript() *FileInfo

func (*Execution) GetStaticRule 

func (x *Execution) GetStaticRule() bool

func (*Execution) GetTarget 

func (x *Execution) GetTarget() *ProcessInfo

func (*Execution) GetWorkingDirectory 

func (x *Execution) GetWorkingDirectory() *FileInfo

func (*Execution) HasAuditReturn 

func (x *Execution) HasAuditReturn() bool

func (*Execution) HasCertificateInfo 

func (x *Execution) HasCertificateInfo() bool

func (*Execution) HasDecision 

func (x *Execution) HasDecision() bool

func (*Execution) HasEntitlementInfo 

func (x *Execution) HasEntitlementInfo() bool

func (*Execution) HasExplain 

func (x *Execution) HasExplain() bool

func (*Execution) HasFdListTruncated 

func (x *Execution) HasFdListTruncated() bool

func (*Execution) HasInstigator 

func (x *Execution) HasInstigator() bool

func (*Execution) HasMode 

func (x *Execution) HasMode() bool

func (*Execution) HasOriginalPath 

func (x *Execution) HasOriginalPath() bool

func (*Execution) HasQuarantineUrl 

func (x *Execution) HasQuarantineUrl() bool

func (*Execution) HasReason 

func (x *Execution) HasReason() bool

func (*Execution) HasRuleId 

func (x *Execution) HasRuleId() bool

func (*Execution) HasScript 

func (x *Execution) HasScript() bool

func (*Execution) HasStaticRule 

func (x *Execution) HasStaticRule() bool

func (*Execution) HasTarget 

func (x *Execution) HasTarget() bool

func (*Execution) HasWorkingDirectory 

func (x *Execution) HasWorkingDirectory() bool

func (*Execution) ProtoMessage 

func (*Execution) ProtoMessage()

func (*Execution) ProtoReflect 

func (x *Execution) ProtoReflect() protoreflect.Message

func (*Execution) Reset 

func (x *Execution) Reset()

func (*Execution) SetArgs 

func (x *Execution) SetArgs(v [][]byte)

func (*Execution) SetAuditReturn 

func (x *Execution) SetAuditReturn(v bool)

func (*Execution) SetCertificateInfo 

func (x *Execution) SetCertificateInfo(v *CertificateInfo)

func (*Execution) SetDecision 

func (x *Execution) SetDecision(v Execution_Decision)

func (*Execution) SetEntitlementInfo 

func (x *Execution) SetEntitlementInfo(v *EntitlementInfo)

func (*Execution) SetEnvs 

func (x *Execution) SetEnvs(v [][]byte)

func (*Execution) SetExplain 

func (x *Execution) SetExplain(v string)

func (*Execution) SetFdListTruncated 

func (x *Execution) SetFdListTruncated(v bool)

func (*Execution) SetFds 

func (x *Execution) SetFds(v []*FileDescriptor)

func (*Execution) SetInstigator 

func (x *Execution) SetInstigator(v *ProcessInfoLight)

func (*Execution) SetMode 

func (x *Execution) SetMode(v Execution_Mode)

func (*Execution) SetOriginalPath 

func (x *Execution) SetOriginalPath(v string)

func (*Execution) SetQuarantineUrl 

func (x *Execution) SetQuarantineUrl(v string)

func (*Execution) SetReason 

func (x *Execution) SetReason(v Execution_Reason)

func (*Execution) SetRuleId 

func (x *Execution) SetRuleId(v int64)

func (*Execution) SetScript 

func (x *Execution) SetScript(v *FileInfo)

func (*Execution) SetStaticRule 

func (x *Execution) SetStaticRule(v bool)

func (*Execution) SetTarget 

func (x *Execution) SetTarget(v *ProcessInfo)

func (*Execution) SetWorkingDirectory 

func (x *Execution) SetWorkingDirectory(v *FileInfo)

func (*Execution) String 

func (x *Execution) String() string

type Execution_Decision 

type Execution_Decision int32

Whether or not the target execution was allowed 

const (
	Execution_DECISION_UNKNOWN        Execution_Decision = 0
	Execution_DECISION_ALLOW          Execution_Decision = 1
	Execution_DECISION_DENY           Execution_Decision = 2
	Execution_DECISION_ALLOW_COMPILER Execution_Decision = 3
)

func (Execution_Decision) Descriptor 

func (Execution_Decision) Descriptor() protoreflect.EnumDescriptor

func (Execution_Decision) Enum 

func (x Execution_Decision) Enum() *Execution_Decision

func (Execution_Decision) Number 

func (x Execution_Decision) Number() protoreflect.EnumNumber

func (Execution_Decision) String 

func (x Execution_Decision) String() string

func (Execution_Decision) Type 

func (Execution_Decision) Type() protoreflect.EnumType

type Execution_Mode 

type Execution_Mode int32

The mode Santa was in when the decision was applied 

const (
	Execution_MODE_UNKNOWN    Execution_Mode = 0
	Execution_MODE_LOCKDOWN   Execution_Mode = 1
	Execution_MODE_MONITOR    Execution_Mode = 2
	Execution_MODE_STANDALONE Execution_Mode = 3
)

func (Execution_Mode) Descriptor 

func (Execution_Mode) Descriptor() protoreflect.EnumDescriptor

func (Execution_Mode) Enum 

func (x Execution_Mode) Enum() *Execution_Mode

func (Execution_Mode) Number 

func (x Execution_Mode) Number() protoreflect.EnumNumber

func (Execution_Mode) String 

func (x Execution_Mode) String() string

func (Execution_Mode) Type 

func (Execution_Mode) Type() protoreflect.EnumType

type Execution_Reason 

type Execution_Reason int32

The policy applied when determining the decision 

const (
	Execution_REASON_UNKNOWN Execution_Reason = 0
	Execution_REASON_BINARY  Execution_Reason = 1
	Execution_REASON_CERT    Execution_Reason = 2
	// Deprecated: Marked as deprecated in telemetry/v1.proto.
	Execution_REASON_COMPILER           Execution_Reason = 3
	Execution_REASON_PENDING_TRANSITIVE Execution_Reason = 5
	Execution_REASON_SCOPE              Execution_Reason = 6
	Execution_REASON_TEAM_ID            Execution_Reason = 7
	Execution_REASON_TRANSITIVE         Execution_Reason = 8
	Execution_REASON_LONG_PATH          Execution_Reason = 9
	Execution_REASON_NOT_RUNNING        Execution_Reason = 10
	Execution_REASON_SIGNING_ID         Execution_Reason = 11
	Execution_REASON_CDHASH             Execution_Reason = 12
	Execution_REASON_CEL_FALLBACK       Execution_Reason = 13
	Execution_REASON_PLATFORM           Execution_Reason = 14
)

func (Execution_Reason) Descriptor 

func (Execution_Reason) Descriptor() protoreflect.EnumDescriptor

func (Execution_Reason) Enum 

func (x Execution_Reason) Enum() *Execution_Reason

func (Execution_Reason) Number 

func (x Execution_Reason) Number() protoreflect.EnumNumber

func (Execution_Reason) String 

func (x Execution_Reason) String() string

func (Execution_Reason) Type 

func (Execution_Reason) Type() protoreflect.EnumType

type Execution_builder 

type Execution_builder struct {

	// The process that executed the new image (e.g. the process that called
	// `execve(2)` or `posix_spawn(2)“)
	Instigator *ProcessInfoLight
	// Process info for the newly formed execution
	Target *ProcessInfo
	// Script file information
	// Only valid when a script was executed directly and not as an argument to
	// an interpreter (e.g.  `./foo.sh`, not `/bin/sh ./foo.sh`)
	Script *FileInfo
	// The current working directory of the `target` at exec time
	WorkingDirectory *FileInfo
	// List of process arguments
	Args [][]byte
	// List of environment variables
	Envs [][]byte
	// List of file descriptors
	Fds []*FileDescriptor
	// Whether or not the list of `fds` is complete or contains partial info
	FdListTruncated *bool
	Decision        *Execution_Decision
	Reason          *Execution_Reason
	Mode            *Execution_Mode
	// Certificate information for the target executable
	CertificateInfo *CertificateInfo
	// Additional Santa metadata
	Explain *string
	// Information known to LaunchServices about the target executable file
	QuarantineUrl *string
	// The original path on disk of the target executable
	// Applies when executables are translocated
	OriginalPath *string
	// Entitlement information about the target executbale
	EntitlementInfo *EntitlementInfo
	// Indicates whether the decision was made by a static rule or not
	StaticRule *bool
	// The server-assigned rule ID that was used to make the decision
	RuleId *int64
	// True if the matching rule returned AUDIT from a CEL expression. The
	// execution was allowed (as if the rule had returned ALLOWLIST), but the
	// event is logged with this flag set so audit matches can be distinguished
	// from regular allow decisions. The `decision` and `reason` fields still
	// report the underlying allow decision (e.g. DECISION_ALLOW / REASON_BINARY).
	AuditReturn *bool
	// contains filtered or unexported fields
}

func (Execution_builder) Build 

func (b0 Execution_builder) Build() *Execution

type Exit 

type Exit struct {

	// The process that is exiting
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Information on how/why the process exited
	//
	// Types that are valid to be assigned to ExitType:
	//
	//	*Exit_Exited_
	//	*Exit_Signaled_
	//	*Exit_Stopped
	ExitType isExit_ExitType `protobuf_oneof:"ExitType"`
	// contains filtered or unexported fields
}

Information about an exit event

func (*Exit) ClearExitType 

func (x *Exit) ClearExitType()

func (*Exit) ClearExited 

func (x *Exit) ClearExited()

func (*Exit) ClearInstigator 

func (x *Exit) ClearInstigator()

func (*Exit) ClearSignaled 

func (x *Exit) ClearSignaled()

func (*Exit) ClearStopped 

func (x *Exit) ClearStopped()

func (*Exit) GetExitType 

func (x *Exit) GetExitType() isExit_ExitType

func (*Exit) GetExited 

func (x *Exit) GetExited() *Exit_Exited

func (*Exit) GetInstigator 

func (x *Exit) GetInstigator() *ProcessInfoLight

func (*Exit) GetSignaled 

func (x *Exit) GetSignaled() *Exit_Signaled

func (*Exit) GetStopped 

func (x *Exit) GetStopped() *Exit_Signaled

func (*Exit) HasExitType 

func (x *Exit) HasExitType() bool

func (*Exit) HasExited 

func (x *Exit) HasExited() bool

func (*Exit) HasInstigator 

func (x *Exit) HasInstigator() bool

func (*Exit) HasSignaled 

func (x *Exit) HasSignaled() bool

func (*Exit) HasStopped 

func (x *Exit) HasStopped() bool

func (*Exit) ProtoMessage 

func (*Exit) ProtoMessage()

func (*Exit) ProtoReflect 

func (x *Exit) ProtoReflect() protoreflect.Message

func (*Exit) Reset 

func (x *Exit) Reset()

func (*Exit) SetExited 

func (x *Exit) SetExited(v *Exit_Exited)

func (*Exit) SetInstigator 

func (x *Exit) SetInstigator(v *ProcessInfoLight)

func (*Exit) SetSignaled 

func (x *Exit) SetSignaled(v *Exit_Signaled)

func (*Exit) SetStopped 

func (x *Exit) SetStopped(v *Exit_Signaled)

func (*Exit) String 

func (x *Exit) String() string

func (*Exit) WhichExitType 

func (x *Exit) WhichExitType() case_Exit_ExitType

type Exit_Exited 

type Exit_Exited struct {
	ExitStatus *int32 `protobuf:"varint,1,opt,name=exit_status,json=exitStatus,proto3,oneof" json:"exit_status,omitempty"`
	// contains filtered or unexported fields
}

Exit status code information

func (*Exit_Exited) ClearExitStatus 

func (x *Exit_Exited) ClearExitStatus()

func (*Exit_Exited) GetExitStatus 

func (x *Exit_Exited) GetExitStatus() int32

func (*Exit_Exited) HasExitStatus 

func (x *Exit_Exited) HasExitStatus() bool

func (*Exit_Exited) ProtoMessage 

func (*Exit_Exited) ProtoMessage()

func (*Exit_Exited) ProtoReflect 

func (x *Exit_Exited) ProtoReflect() protoreflect.Message

func (*Exit_Exited) Reset 

func (x *Exit_Exited) Reset()

func (*Exit_Exited) SetExitStatus 

func (x *Exit_Exited) SetExitStatus(v int32)

func (*Exit_Exited) String 

func (x *Exit_Exited) String() string

type Exit_Exited_ 

type Exit_Exited_ struct {
	Exited *Exit_Exited `protobuf:"bytes,2,opt,name=exited,proto3,oneof"`
}

type Exit_Exited_builder 

type Exit_Exited_builder struct {
	ExitStatus *int32
	// contains filtered or unexported fields
}

func (Exit_Exited_builder) Build 

func (b0 Exit_Exited_builder) Build() *Exit_Exited

type Exit_Signaled 

type Exit_Signaled struct {
	Signal *int32 `protobuf:"varint,1,opt,name=signal,proto3,oneof" json:"signal,omitempty"`
	// contains filtered or unexported fields
}

Signal code

func (*Exit_Signaled) ClearSignal 

func (x *Exit_Signaled) ClearSignal()

func (*Exit_Signaled) GetSignal 

func (x *Exit_Signaled) GetSignal() int32

func (*Exit_Signaled) HasSignal 

func (x *Exit_Signaled) HasSignal() bool

func (*Exit_Signaled) ProtoMessage 

func (*Exit_Signaled) ProtoMessage()

func (*Exit_Signaled) ProtoReflect 

func (x *Exit_Signaled) ProtoReflect() protoreflect.Message

func (*Exit_Signaled) Reset 

func (x *Exit_Signaled) Reset()

func (*Exit_Signaled) SetSignal 

func (x *Exit_Signaled) SetSignal(v int32)

func (*Exit_Signaled) String 

func (x *Exit_Signaled) String() string

type Exit_Signaled_ 

type Exit_Signaled_ struct {
	Signaled *Exit_Signaled `protobuf:"bytes,3,opt,name=signaled,proto3,oneof"`
}

type Exit_Signaled_builder 

type Exit_Signaled_builder struct {
	Signal *int32
	// contains filtered or unexported fields
}

func (Exit_Signaled_builder) Build 

func (b0 Exit_Signaled_builder) Build() *Exit_Signaled

type Exit_Stopped 

type Exit_Stopped struct {
	Stopped *Exit_Signaled `protobuf:"bytes,4,opt,name=stopped,proto3,oneof"`
}

type Exit_builder 

type Exit_builder struct {

	// The process that is exiting
	Instigator *ProcessInfoLight

	// Fields of oneof ExitType:
	Exited   *Exit_Exited
	Signaled *Exit_Signaled
	Stopped  *Exit_Signaled
	// contains filtered or unexported fields
}

func (Exit_builder) Build 

func (b0 Exit_builder) Build() *Exit

type FileAccess 

type FileAccess struct {

	// The process that attempted to access the watched path
	Instigator *ProcessInfo `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The path that was accessed
	Target *FileInfo `protobuf:"bytes,2,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// The version of the policy when the decision was made
	PolicyVersion *string `protobuf:"bytes,3,opt,name=policy_version,json=policyVersion,proto3,oneof" json:"policy_version,omitempty"`
	// The name of the specific policy that triggered this log
	PolicyName     *string                    `protobuf:"bytes,4,opt,name=policy_name,json=policyName,proto3,oneof" json:"policy_name,omitempty"`
	AccessType     *FileAccess_AccessType     `` /* 144-byte string literal not displayed */
	PolicyDecision *FileAccess_PolicyDecision `` /* 160-byte string literal not displayed */
	// Used to link a single operation emitting multiple FileAccess messages.
	// This can happen, for example, when a single operation violates both Data
	// and Process File Access Authorization rules.
	OperationId *string `protobuf:"bytes,7,opt,name=operation_id,json=operationId,proto3,oneof" json:"operation_id,omitempty"`
	// The server-assigned rule ID that triggered the file access event
	RuleId *int64 `protobuf:"varint,8,opt,name=rule_id,json=ruleId,proto3,oneof" json:"rule_id,omitempty"`
	// contains filtered or unexported fields
}

Information about access to a watched path

func (*FileAccess) ClearAccessType 

func (x *FileAccess) ClearAccessType()

func (*FileAccess) ClearInstigator 

func (x *FileAccess) ClearInstigator()

func (*FileAccess) ClearOperationId 

func (x *FileAccess) ClearOperationId()

func (*FileAccess) ClearPolicyDecision 

func (x *FileAccess) ClearPolicyDecision()

func (*FileAccess) ClearPolicyName 

func (x *FileAccess) ClearPolicyName()

func (*FileAccess) ClearPolicyVersion 

func (x *FileAccess) ClearPolicyVersion()

func (*FileAccess) ClearRuleId 

func (x *FileAccess) ClearRuleId()

func (*FileAccess) ClearTarget 

func (x *FileAccess) ClearTarget()

func (*FileAccess) GetAccessType 

func (x *FileAccess) GetAccessType() FileAccess_AccessType

func (*FileAccess) GetInstigator 

func (x *FileAccess) GetInstigator() *ProcessInfo

func (*FileAccess) GetOperationId 

func (x *FileAccess) GetOperationId() string

func (*FileAccess) GetPolicyDecision 

func (x *FileAccess) GetPolicyDecision() FileAccess_PolicyDecision

func (*FileAccess) GetPolicyName 

func (x *FileAccess) GetPolicyName() string

func (*FileAccess) GetPolicyVersion 

func (x *FileAccess) GetPolicyVersion() string

func (*FileAccess) GetRuleId 

func (x *FileAccess) GetRuleId() int64

func (*FileAccess) GetTarget 

func (x *FileAccess) GetTarget() *FileInfo

func (*FileAccess) HasAccessType 

func (x *FileAccess) HasAccessType() bool

func (*FileAccess) HasInstigator 

func (x *FileAccess) HasInstigator() bool

func (*FileAccess) HasOperationId 

func (x *FileAccess) HasOperationId() bool

func (*FileAccess) HasPolicyDecision 

func (x *FileAccess) HasPolicyDecision() bool

func (*FileAccess) HasPolicyName 

func (x *FileAccess) HasPolicyName() bool

func (*FileAccess) HasPolicyVersion 

func (x *FileAccess) HasPolicyVersion() bool

func (*FileAccess) HasRuleId 

func (x *FileAccess) HasRuleId() bool

func (*FileAccess) HasTarget 

func (x *FileAccess) HasTarget() bool

func (*FileAccess) ProtoMessage 

func (*FileAccess) ProtoMessage()

func (*FileAccess) ProtoReflect 

func (x *FileAccess) ProtoReflect() protoreflect.Message

func (*FileAccess) Reset 

func (x *FileAccess) Reset()

func (*FileAccess) SetAccessType 

func (x *FileAccess) SetAccessType(v FileAccess_AccessType)

func (*FileAccess) SetInstigator 

func (x *FileAccess) SetInstigator(v *ProcessInfo)

func (*FileAccess) SetOperationId 

func (x *FileAccess) SetOperationId(v string)

func (*FileAccess) SetPolicyDecision 

func (x *FileAccess) SetPolicyDecision(v FileAccess_PolicyDecision)

func (*FileAccess) SetPolicyName 

func (x *FileAccess) SetPolicyName(v string)

func (*FileAccess) SetPolicyVersion 

func (x *FileAccess) SetPolicyVersion(v string)

func (*FileAccess) SetRuleId 

func (x *FileAccess) SetRuleId(v int64)

func (*FileAccess) SetTarget 

func (x *FileAccess) SetTarget(v *FileInfo)

func (*FileAccess) String 

func (x *FileAccess) String() string

type FileAccess_AccessType 

type FileAccess_AccessType int32

The event type that attempted to access the watched path 

const (
	FileAccess_ACCESS_TYPE_UNKNOWN      FileAccess_AccessType = 0
	FileAccess_ACCESS_TYPE_OPEN         FileAccess_AccessType = 1
	FileAccess_ACCESS_TYPE_RENAME       FileAccess_AccessType = 2
	FileAccess_ACCESS_TYPE_UNLINK       FileAccess_AccessType = 3
	FileAccess_ACCESS_TYPE_LINK         FileAccess_AccessType = 4
	FileAccess_ACCESS_TYPE_CLONE        FileAccess_AccessType = 5
	FileAccess_ACCESS_TYPE_EXCHANGEDATA FileAccess_AccessType = 6
	FileAccess_ACCESS_TYPE_COPYFILE     FileAccess_AccessType = 7
	FileAccess_ACCESS_TYPE_CREATE       FileAccess_AccessType = 8
	FileAccess_ACCESS_TYPE_TRUNCATE     FileAccess_AccessType = 9
)

func (FileAccess_AccessType) Descriptor 

func (FileAccess_AccessType) Descriptor() protoreflect.EnumDescriptor

func (FileAccess_AccessType) Enum 

func (x FileAccess_AccessType) Enum() *FileAccess_AccessType

func (FileAccess_AccessType) Number 

func (x FileAccess_AccessType) Number() protoreflect.EnumNumber

func (FileAccess_AccessType) String 

func (x FileAccess_AccessType) String() string

func (FileAccess_AccessType) Type 

func (FileAccess_AccessType) Type() protoreflect.EnumType

type FileAccess_PolicyDecision 

type FileAccess_PolicyDecision int32

Whether the operation was allowed or denied and why 

const (
	FileAccess_POLICY_DECISION_UNKNOWN                  FileAccess_PolicyDecision = 0
	FileAccess_POLICY_DECISION_DENIED                   FileAccess_PolicyDecision = 1
	FileAccess_POLICY_DECISION_DENIED_INVALID_SIGNATURE FileAccess_PolicyDecision = 2
	FileAccess_POLICY_DECISION_ALLOWED_AUDIT_ONLY       FileAccess_PolicyDecision = 3
)

func (FileAccess_PolicyDecision) Descriptor 

func (FileAccess_PolicyDecision) Descriptor() protoreflect.EnumDescriptor

func (FileAccess_PolicyDecision) Enum 

func (x FileAccess_PolicyDecision) Enum() *FileAccess_PolicyDecision

func (FileAccess_PolicyDecision) Number 

func (x FileAccess_PolicyDecision) Number() protoreflect.EnumNumber

func (FileAccess_PolicyDecision) String 

func (x FileAccess_PolicyDecision) String() string

func (FileAccess_PolicyDecision) Type 

func (FileAccess_PolicyDecision) Type() protoreflect.EnumType

type FileAccess_builder 

type FileAccess_builder struct {

	// The process that attempted to access the watched path
	Instigator *ProcessInfo
	// The path that was accessed
	Target *FileInfo
	// The version of the policy when the decision was made
	PolicyVersion *string
	// The name of the specific policy that triggered this log
	PolicyName     *string
	AccessType     *FileAccess_AccessType
	PolicyDecision *FileAccess_PolicyDecision
	// Used to link a single operation emitting multiple FileAccess messages.
	// This can happen, for example, when a single operation violates both Data
	// and Process File Access Authorization rules.
	OperationId *string
	// The server-assigned rule ID that triggered the file access event
	RuleId *int64
	// contains filtered or unexported fields
}

func (FileAccess_builder) Build 

func (b0 FileAccess_builder) Build() *FileAccess

type FileDescriptor 

type FileDescriptor struct {

	// File descriptor value
	Fd *int32 `protobuf:"varint,1,opt,name=fd,proto3,oneof" json:"fd,omitempty"`
	// Type of file object
	FdType *FileDescriptor_FDType `` /* 132-byte string literal not displayed */
	// Unique id of the pipe for correlation with other file descriptors
	// pointing to the same or other end of the same pipe
	// Note: Only valid when `fd_type` is `FD_TYPE_PIPE`
	PipeId *uint64 `protobuf:"varint,3,opt,name=pipe_id,json=pipeId,proto3,oneof" json:"pipe_id,omitempty"`
	// contains filtered or unexported fields
}

File descriptor information

func (*FileDescriptor) ClearFd 

func (x *FileDescriptor) ClearFd()

func (*FileDescriptor) ClearFdType 

func (x *FileDescriptor) ClearFdType()

func (*FileDescriptor) ClearPipeId 

func (x *FileDescriptor) ClearPipeId()

func (*FileDescriptor) GetFd 

func (x *FileDescriptor) GetFd() int32

func (*FileDescriptor) GetFdType 

func (x *FileDescriptor) GetFdType() FileDescriptor_FDType

func (*FileDescriptor) GetPipeId 

func (x *FileDescriptor) GetPipeId() uint64

func (*FileDescriptor) HasFd 

func (x *FileDescriptor) HasFd() bool

func (*FileDescriptor) HasFdType 

func (x *FileDescriptor) HasFdType() bool

func (*FileDescriptor) HasPipeId 

func (x *FileDescriptor) HasPipeId() bool

func (*FileDescriptor) ProtoMessage 

func (*FileDescriptor) ProtoMessage()

func (*FileDescriptor) ProtoReflect 

func (x *FileDescriptor) ProtoReflect() protoreflect.Message

func (*FileDescriptor) Reset 

func (x *FileDescriptor) Reset()

func (*FileDescriptor) SetFd 

func (x *FileDescriptor) SetFd(v int32)

func (*FileDescriptor) SetFdType 

func (x *FileDescriptor) SetFdType(v FileDescriptor_FDType)

func (*FileDescriptor) SetPipeId 

func (x *FileDescriptor) SetPipeId(v uint64)

func (*FileDescriptor) String 

func (x *FileDescriptor) String() string

type FileDescriptor_FDType 

type FileDescriptor_FDType int32

Enum types gathered from `<sys/proc_info.h>` 

const (
	FileDescriptor_FD_TYPE_UNKNOWN   FileDescriptor_FDType = 0
	FileDescriptor_FD_TYPE_ATALK     FileDescriptor_FDType = 1
	FileDescriptor_FD_TYPE_VNODE     FileDescriptor_FDType = 2
	FileDescriptor_FD_TYPE_SOCKET    FileDescriptor_FDType = 3
	FileDescriptor_FD_TYPE_PSHM      FileDescriptor_FDType = 4
	FileDescriptor_FD_TYPE_PSEM      FileDescriptor_FDType = 5
	FileDescriptor_FD_TYPE_KQUEUE    FileDescriptor_FDType = 6
	FileDescriptor_FD_TYPE_PIPE      FileDescriptor_FDType = 7
	FileDescriptor_FD_TYPE_FSEVENTS  FileDescriptor_FDType = 8
	FileDescriptor_FD_TYPE_NETPOLICY FileDescriptor_FDType = 9
	FileDescriptor_FD_TYPE_CHANNEL   FileDescriptor_FDType = 10
	FileDescriptor_FD_TYPE_NEXUS     FileDescriptor_FDType = 11
)

func (FileDescriptor_FDType) Descriptor 

func (FileDescriptor_FDType) Descriptor() protoreflect.EnumDescriptor

func (FileDescriptor_FDType) Enum 

func (x FileDescriptor_FDType) Enum() *FileDescriptor_FDType

func (FileDescriptor_FDType) Number 

func (x FileDescriptor_FDType) Number() protoreflect.EnumNumber

func (FileDescriptor_FDType) String 

func (x FileDescriptor_FDType) String() string

func (FileDescriptor_FDType) Type 

func (FileDescriptor_FDType) Type() protoreflect.EnumType

type FileDescriptor_builder 

type FileDescriptor_builder struct {

	// File descriptor value
	Fd *int32
	// Type of file object
	FdType *FileDescriptor_FDType
	// Unique id of the pipe for correlation with other file descriptors
	// pointing to the same or other end of the same pipe
	// Note: Only valid when `fd_type` is `FD_TYPE_PIPE`
	PipeId *uint64
	// contains filtered or unexported fields
}

func (FileDescriptor_builder) Build 

func (b0 FileDescriptor_builder) Build() *FileDescriptor

type FileInfo 

type FileInfo struct {

	// File path
	Path *string `protobuf:"bytes,1,opt,name=path,proto3,oneof" json:"path,omitempty"`
	// Whether or not the path is truncated
	Truncated *bool `protobuf:"varint,2,opt,name=truncated,proto3,oneof" json:"truncated,omitempty"`
	// Stat information
	Stat *Stat `protobuf:"bytes,3,opt,name=stat,proto3,oneof" json:"stat,omitempty"`
	// Hash of file contents
	Hash *Hash `protobuf:"bytes,4,opt,name=hash,proto3,oneof" json:"hash,omitempty"`
	// contains filtered or unexported fields
}

File information

func (*FileInfo) ClearHash 

func (x *FileInfo) ClearHash()

func (*FileInfo) ClearPath 

func (x *FileInfo) ClearPath()

func (*FileInfo) ClearStat 

func (x *FileInfo) ClearStat()

func (*FileInfo) ClearTruncated 

func (x *FileInfo) ClearTruncated()

func (*FileInfo) GetHash 

func (x *FileInfo) GetHash() *Hash

func (*FileInfo) GetPath 

func (x *FileInfo) GetPath() string

func (*FileInfo) GetStat 

func (x *FileInfo) GetStat() *Stat

func (*FileInfo) GetTruncated 

func (x *FileInfo) GetTruncated() bool

func (*FileInfo) HasHash 

func (x *FileInfo) HasHash() bool

func (*FileInfo) HasPath 

func (x *FileInfo) HasPath() bool

func (*FileInfo) HasStat 

func (x *FileInfo) HasStat() bool

func (*FileInfo) HasTruncated 

func (x *FileInfo) HasTruncated() bool

func (*FileInfo) ProtoMessage 

func (*FileInfo) ProtoMessage()

func (*FileInfo) ProtoReflect 

func (x *FileInfo) ProtoReflect() protoreflect.Message

func (*FileInfo) Reset 

func (x *FileInfo) Reset()

func (*FileInfo) SetHash 

func (x *FileInfo) SetHash(v *Hash)

func (*FileInfo) SetPath 

func (x *FileInfo) SetPath(v string)

func (*FileInfo) SetStat 

func (x *FileInfo) SetStat(v *Stat)

func (*FileInfo) SetTruncated 

func (x *FileInfo) SetTruncated(v bool)

func (*FileInfo) String 

func (x *FileInfo) String() string

type FileInfoLight 

type FileInfoLight struct {

	// File path
	Path *string `protobuf:"bytes,1,opt,name=path,proto3,oneof" json:"path,omitempty"`
	// Whether or not the path is truncated
	Truncated *bool `protobuf:"varint,2,opt,name=truncated,proto3,oneof" json:"truncated,omitempty"`
	// contains filtered or unexported fields
}

Light variant of `FileInfo` message to help minimize on-disk/on-wire sizes

func (*FileInfoLight) ClearPath 

func (x *FileInfoLight) ClearPath()

func (*FileInfoLight) ClearTruncated 

func (x *FileInfoLight) ClearTruncated()

func (*FileInfoLight) GetPath 

func (x *FileInfoLight) GetPath() string

func (*FileInfoLight) GetTruncated 

func (x *FileInfoLight) GetTruncated() bool

func (*FileInfoLight) HasPath 

func (x *FileInfoLight) HasPath() bool

func (*FileInfoLight) HasTruncated 

func (x *FileInfoLight) HasTruncated() bool

func (*FileInfoLight) ProtoMessage 

func (*FileInfoLight) ProtoMessage()

func (*FileInfoLight) ProtoReflect 

func (x *FileInfoLight) ProtoReflect() protoreflect.Message

func (*FileInfoLight) Reset 

func (x *FileInfoLight) Reset()

func (*FileInfoLight) SetPath 

func (x *FileInfoLight) SetPath(v string)

func (*FileInfoLight) SetTruncated 

func (x *FileInfoLight) SetTruncated(v bool)

func (*FileInfoLight) String 

func (x *FileInfoLight) String() string

type FileInfoLight_builder 

type FileInfoLight_builder struct {

	// File path
	Path *string
	// Whether or not the path is truncated
	Truncated *bool
	// contains filtered or unexported fields
}

func (FileInfoLight_builder) Build 

func (b0 FileInfoLight_builder) Build() *FileInfoLight

type FileInfo_builder 

type FileInfo_builder struct {

	// File path
	Path *string
	// Whether or not the path is truncated
	Truncated *bool
	// Stat information
	Stat *Stat
	// Hash of file contents
	Hash *Hash
	// contains filtered or unexported fields
}

func (FileInfo_builder) Build 

func (b0 FileInfo_builder) Build() *FileInfo

type Fork 

type Fork struct {

	// The forking process
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The newly formed child process
	Child *ProcessInfoLight `protobuf:"bytes,2,opt,name=child,proto3,oneof" json:"child,omitempty"`
	// contains filtered or unexported fields
}

Information about a fork event

func (*Fork) ClearChild 

func (x *Fork) ClearChild()

func (*Fork) ClearInstigator 

func (x *Fork) ClearInstigator()

func (*Fork) GetChild 

func (x *Fork) GetChild() *ProcessInfoLight

func (*Fork) GetInstigator 

func (x *Fork) GetInstigator() *ProcessInfoLight

func (*Fork) HasChild 

func (x *Fork) HasChild() bool

func (*Fork) HasInstigator 

func (x *Fork) HasInstigator() bool

func (*Fork) ProtoMessage 

func (*Fork) ProtoMessage()

func (*Fork) ProtoReflect 

func (x *Fork) ProtoReflect() protoreflect.Message

func (*Fork) Reset 

func (x *Fork) Reset()

func (*Fork) SetChild 

func (x *Fork) SetChild(v *ProcessInfoLight)

func (*Fork) SetInstigator 

func (x *Fork) SetInstigator(v *ProcessInfoLight)

func (*Fork) String 

func (x *Fork) String() string

type Fork_builder 

type Fork_builder struct {

	// The forking process
	Instigator *ProcessInfoLight
	// The newly formed child process
	Child *ProcessInfoLight
	// contains filtered or unexported fields
}

func (Fork_builder) Build 

func (b0 Fork_builder) Build() *Fork

type GatekeeperOverride 

type GatekeeperOverride struct {

	// The process creating the override
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The target file that had Gatekeeper policy overridden
	// Note: Due to macOS system limitations, the file on disk for which
	// gatekeeper settings were overridden may have been deleted (or even
	// entirely replaced) by the time the system attempts to capture data
	// for the event to send to Santa. This means that ES might only send
	// path information instead of full path+stat+hash information.
	Target *FileInfo `protobuf:"bytes,2,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// Codesigning information related to the target file
	CodeSignature *CodeSignature `protobuf:"bytes,3,opt,name=code_signature,json=codeSignature,proto3,oneof" json:"code_signature,omitempty"`
	// contains filtered or unexported fields
}

Information captured when a user overrides Gatekeeper decisions

func (*GatekeeperOverride) ClearCodeSignature 

func (x *GatekeeperOverride) ClearCodeSignature()

func (*GatekeeperOverride) ClearInstigator 

func (x *GatekeeperOverride) ClearInstigator()

func (*GatekeeperOverride) ClearTarget 

func (x *GatekeeperOverride) ClearTarget()

func (*GatekeeperOverride) GetCodeSignature 

func (x *GatekeeperOverride) GetCodeSignature() *CodeSignature

func (*GatekeeperOverride) GetInstigator 

func (x *GatekeeperOverride) GetInstigator() *ProcessInfoLight

func (*GatekeeperOverride) GetTarget 

func (x *GatekeeperOverride) GetTarget() *FileInfo

func (*GatekeeperOverride) HasCodeSignature 

func (x *GatekeeperOverride) HasCodeSignature() bool

func (*GatekeeperOverride) HasInstigator 

func (x *GatekeeperOverride) HasInstigator() bool

func (*GatekeeperOverride) HasTarget 

func (x *GatekeeperOverride) HasTarget() bool

func (*GatekeeperOverride) ProtoMessage 

func (*GatekeeperOverride) ProtoMessage()

func (*GatekeeperOverride) ProtoReflect 

func (x *GatekeeperOverride) ProtoReflect() protoreflect.Message

func (*GatekeeperOverride) Reset 

func (x *GatekeeperOverride) Reset()

func (*GatekeeperOverride) SetCodeSignature 

func (x *GatekeeperOverride) SetCodeSignature(v *CodeSignature)

func (*GatekeeperOverride) SetInstigator 

func (x *GatekeeperOverride) SetInstigator(v *ProcessInfoLight)

func (*GatekeeperOverride) SetTarget 

func (x *GatekeeperOverride) SetTarget(v *FileInfo)

func (*GatekeeperOverride) String 

func (x *GatekeeperOverride) String() string

type GatekeeperOverride_builder 

type GatekeeperOverride_builder struct {

	// The process creating the override
	Instigator *ProcessInfoLight
	// The target file that had Gatekeeper policy overridden
	// Note: Due to macOS system limitations, the file on disk for which
	// gatekeeper settings were overridden may have been deleted (or even
	// entirely replaced) by the time the system attempts to capture data
	// for the event to send to Santa. This means that ES might only send
	// path information instead of full path+stat+hash information.
	Target *FileInfo
	// Codesigning information related to the target file
	CodeSignature *CodeSignature
	// contains filtered or unexported fields
}

func (GatekeeperOverride_builder) Build 

func (b0 GatekeeperOverride_builder) Build() *GatekeeperOverride

type GraphicalSession 

type GraphicalSession struct {
	Id *uint32 `protobuf:"varint,1,opt,name=id,proto3,oneof" json:"id,omitempty"`
	// contains filtered or unexported fields
}

Session identifier for a graphical session Note: Identifiers are opaque and have no meaning outside of correlating Santa events with the same identifier

func (*GraphicalSession) ClearId 

func (x *GraphicalSession) ClearId()

func (*GraphicalSession) GetId 

func (x *GraphicalSession) GetId() uint32

func (*GraphicalSession) HasId 

func (x *GraphicalSession) HasId() bool

func (*GraphicalSession) ProtoMessage 

func (*GraphicalSession) ProtoMessage()

func (*GraphicalSession) ProtoReflect 

func (x *GraphicalSession) ProtoReflect() protoreflect.Message

func (*GraphicalSession) Reset 

func (x *GraphicalSession) Reset()

func (*GraphicalSession) SetId 

func (x *GraphicalSession) SetId(v uint32)

func (*GraphicalSession) String 

func (x *GraphicalSession) String() string

type GraphicalSession_builder 

type GraphicalSession_builder struct {
	Id *uint32
	// contains filtered or unexported fields
}

func (GraphicalSession_builder) Build 

func (b0 GraphicalSession_builder) Build() *GraphicalSession

type GroupInfo 

type GroupInfo struct {
	Gid  *int32  `protobuf:"varint,1,opt,name=gid,proto3,oneof" json:"gid,omitempty"`
	Name *string `protobuf:"bytes,2,opt,name=name,proto3,oneof" json:"name,omitempty"`
	// contains filtered or unexported fields
}

Group ID and associated group name

func (*GroupInfo) ClearGid 

func (x *GroupInfo) ClearGid()

func (*GroupInfo) ClearName 

func (x *GroupInfo) ClearName()

func (*GroupInfo) GetGid 

func (x *GroupInfo) GetGid() int32

func (*GroupInfo) GetName 

func (x *GroupInfo) GetName() string

func (*GroupInfo) HasGid 

func (x *GroupInfo) HasGid() bool

func (*GroupInfo) HasName 

func (x *GroupInfo) HasName() bool

func (*GroupInfo) ProtoMessage 

func (*GroupInfo) ProtoMessage()

func (*GroupInfo) ProtoReflect 

func (x *GroupInfo) ProtoReflect() protoreflect.Message

func (*GroupInfo) Reset 

func (x *GroupInfo) Reset()

func (*GroupInfo) SetGid 

func (x *GroupInfo) SetGid(v int32)

func (*GroupInfo) SetName 

func (x *GroupInfo) SetName(v string)

func (*GroupInfo) String 

func (x *GroupInfo) String() string

type GroupInfo_builder 

type GroupInfo_builder struct {
	Gid  *int32
	Name *string
	// contains filtered or unexported fields
}

func (GroupInfo_builder) Build 

func (b0 GroupInfo_builder) Build() *GroupInfo

type Hash 

type Hash struct {
	Type *Hash_HashAlgo `protobuf:"varint,1,opt,name=type,proto3,enum=santa.telemetry.v1.Hash_HashAlgo,oneof" json:"type,omitempty"`
	Hash *string        `protobuf:"bytes,2,opt,name=hash,proto3,oneof" json:"hash,omitempty"`
	// contains filtered or unexported fields
}

Hash value and metadata describing hash algorithm used

func (*Hash) ClearHash 

func (x *Hash) ClearHash()

func (*Hash) ClearType 

func (x *Hash) ClearType()

func (*Hash) GetHash 

func (x *Hash) GetHash() string

func (*Hash) GetType 

func (x *Hash) GetType() Hash_HashAlgo

func (*Hash) HasHash 

func (x *Hash) HasHash() bool

func (*Hash) HasType 

func (x *Hash) HasType() bool

func (*Hash) ProtoMessage 

func (*Hash) ProtoMessage()

func (*Hash) ProtoReflect 

func (x *Hash) ProtoReflect() protoreflect.Message

func (*Hash) Reset 

func (x *Hash) Reset()

func (*Hash) SetHash 

func (x *Hash) SetHash(v string)

func (*Hash) SetType 

func (x *Hash) SetType(v Hash_HashAlgo)

func (*Hash) String 

func (x *Hash) String() string

type Hash_HashAlgo 

type Hash_HashAlgo int32
const (
	Hash_HASH_ALGO_UNKNOWN Hash_HashAlgo = 0
	Hash_HASH_ALGO_SHA256  Hash_HashAlgo = 1
)

func (Hash_HashAlgo) Descriptor 

func (Hash_HashAlgo) Descriptor() protoreflect.EnumDescriptor

func (Hash_HashAlgo) Enum 

func (x Hash_HashAlgo) Enum() *Hash_HashAlgo

func (Hash_HashAlgo) Number 

func (x Hash_HashAlgo) Number() protoreflect.EnumNumber

func (Hash_HashAlgo) String 

func (x Hash_HashAlgo) String() string

func (Hash_HashAlgo) Type 

func (Hash_HashAlgo) Type() protoreflect.EnumType

type Hash_builder 

type Hash_builder struct {
	Type *Hash_HashAlgo
	Hash *string
	// contains filtered or unexported fields
}

func (Hash_builder) Build 

func (b0 Hash_builder) Build() *Hash

type LaunchItem 

type LaunchItem struct {

	// The process that emitted the event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	Action     LaunchItem_Action `protobuf:"varint,2,opt,name=action,proto3,enum=santa.telemetry.v1.LaunchItem_Action" json:"action,omitempty"`
	// The process that triggered the BTM operation. One will always be set.
	// Note: Due to macOS system limitations, the process that triggered the
	// event may have already exited before the event could be generated. This
	// results in only a small subset of the information from the triggering
	// process to be reported.
	//
	// Types that are valid to be assigned to BtmInstigator:
	//
	//	*LaunchItem_TriggerProcess
	//	*LaunchItem_TriggerId
	BtmInstigator isLaunchItem_BtmInstigator `protobuf_oneof:"btm_instigator"`
	// The app the registered the launch item. This field is optional and it is
	// possible that neither case is set.
	// Note: If the registering app has exited, only registrant_id information will
	// exist. It is also possible no app information exists.
	//
	// Types that are valid to be assigned to App:
	//
	//	*LaunchItem_RegistrantProcess
	//	*LaunchItem_RegistrantId
	App      isLaunchItem_App    `protobuf_oneof:"app"`
	ItemType LaunchItem_ItemType `` /* 130-byte string literal not displayed */
	// Whether or not the launch item is a legacy plist
	Legacy *bool `protobuf:"varint,8,opt,name=legacy,proto3,oneof" json:"legacy,omitempty"`
	// Whether or not the launch item is managed by MDM
	Managed *bool `protobuf:"varint,9,opt,name=managed,proto3,oneof" json:"managed,omitempty"`
	// User information related to the launch item
	ItemUser *UserInfo `protobuf:"bytes,10,opt,name=item_user,json=itemUser,proto3,oneof" json:"item_user,omitempty"`
	// Location of the launch item
	ItemPath *string `protobuf:"bytes,11,opt,name=item_path,json=itemPath,proto3,oneof" json:"item_path,omitempty"`
	// Path of the app the launch item is attributed to
	AppPath *string `protobuf:"bytes,12,opt,name=app_path,json=appPath,proto3,oneof" json:"app_path,omitempty"`
	// If available, associated executable path from a launch item's plist
	ExecutablePath *string `protobuf:"bytes,13,opt,name=executable_path,json=executablePath,proto3,oneof" json:"executable_path,omitempty"`
	// contains filtered or unexported fields
}

Information captured when Background Task Management (BTM) becomes aware of a launch item being added or removed. This includes launch agents and daemons as well as login items added by the user, via MDM or by an app.

func (*LaunchItem) ClearApp 

func (x *LaunchItem) ClearApp()

func (*LaunchItem) ClearAppPath 

func (x *LaunchItem) ClearAppPath()

func (*LaunchItem) ClearBtmInstigator 

func (x *LaunchItem) ClearBtmInstigator()

func (*LaunchItem) ClearExecutablePath 

func (x *LaunchItem) ClearExecutablePath()

func (*LaunchItem) ClearInstigator 

func (x *LaunchItem) ClearInstigator()

func (*LaunchItem) ClearItemPath 

func (x *LaunchItem) ClearItemPath()

func (*LaunchItem) ClearItemUser 

func (x *LaunchItem) ClearItemUser()

func (*LaunchItem) ClearLegacy 

func (x *LaunchItem) ClearLegacy()

func (*LaunchItem) ClearManaged 

func (x *LaunchItem) ClearManaged()

func (*LaunchItem) ClearRegistrantId 

func (x *LaunchItem) ClearRegistrantId()

func (*LaunchItem) ClearRegistrantProcess 

func (x *LaunchItem) ClearRegistrantProcess()

func (*LaunchItem) ClearTriggerId 

func (x *LaunchItem) ClearTriggerId()

func (*LaunchItem) ClearTriggerProcess 

func (x *LaunchItem) ClearTriggerProcess()

func (*LaunchItem) GetAction 

func (x *LaunchItem) GetAction() LaunchItem_Action

func (*LaunchItem) GetApp 

func (x *LaunchItem) GetApp() isLaunchItem_App

func (*LaunchItem) GetAppPath 

func (x *LaunchItem) GetAppPath() string

func (*LaunchItem) GetBtmInstigator 

func (x *LaunchItem) GetBtmInstigator() isLaunchItem_BtmInstigator

func (*LaunchItem) GetExecutablePath 

func (x *LaunchItem) GetExecutablePath() string

func (*LaunchItem) GetInstigator 

func (x *LaunchItem) GetInstigator() *ProcessInfoLight

func (*LaunchItem) GetItemPath 

func (x *LaunchItem) GetItemPath() string

func (*LaunchItem) GetItemType 

func (x *LaunchItem) GetItemType() LaunchItem_ItemType

func (*LaunchItem) GetItemUser 

func (x *LaunchItem) GetItemUser() *UserInfo

func (*LaunchItem) GetLegacy 

func (x *LaunchItem) GetLegacy() bool

func (*LaunchItem) GetManaged 

func (x *LaunchItem) GetManaged() bool

func (*LaunchItem) GetRegistrantId 

func (x *LaunchItem) GetRegistrantId() *ProcessID

func (*LaunchItem) GetRegistrantProcess 

func (x *LaunchItem) GetRegistrantProcess() *ProcessInfoLight

func (*LaunchItem) GetTriggerId 

func (x *LaunchItem) GetTriggerId() *ProcessID

func (*LaunchItem) GetTriggerProcess 

func (x *LaunchItem) GetTriggerProcess() *ProcessInfoLight

func (*LaunchItem) HasApp 

func (x *LaunchItem) HasApp() bool

func (*LaunchItem) HasAppPath 

func (x *LaunchItem) HasAppPath() bool

func (*LaunchItem) HasBtmInstigator 

func (x *LaunchItem) HasBtmInstigator() bool

func (*LaunchItem) HasExecutablePath 

func (x *LaunchItem) HasExecutablePath() bool

func (*LaunchItem) HasInstigator 

func (x *LaunchItem) HasInstigator() bool

func (*LaunchItem) HasItemPath 

func (x *LaunchItem) HasItemPath() bool

func (*LaunchItem) HasItemUser 

func (x *LaunchItem) HasItemUser() bool

func (*LaunchItem) HasLegacy 

func (x *LaunchItem) HasLegacy() bool

func (*LaunchItem) HasManaged 

func (x *LaunchItem) HasManaged() bool

func (*LaunchItem) HasRegistrantId 

func (x *LaunchItem) HasRegistrantId() bool

func (*LaunchItem) HasRegistrantProcess 

func (x *LaunchItem) HasRegistrantProcess() bool

func (*LaunchItem) HasTriggerId 

func (x *LaunchItem) HasTriggerId() bool

func (*LaunchItem) HasTriggerProcess 

func (x *LaunchItem) HasTriggerProcess() bool

func (*LaunchItem) ProtoMessage 

func (*LaunchItem) ProtoMessage()

func (*LaunchItem) ProtoReflect 

func (x *LaunchItem) ProtoReflect() protoreflect.Message

func (*LaunchItem) Reset 

func (x *LaunchItem) Reset()

func (*LaunchItem) SetAction 

func (x *LaunchItem) SetAction(v LaunchItem_Action)

func (*LaunchItem) SetAppPath 

func (x *LaunchItem) SetAppPath(v string)

func (*LaunchItem) SetExecutablePath 

func (x *LaunchItem) SetExecutablePath(v string)

func (*LaunchItem) SetInstigator 

func (x *LaunchItem) SetInstigator(v *ProcessInfoLight)

func (*LaunchItem) SetItemPath 

func (x *LaunchItem) SetItemPath(v string)

func (*LaunchItem) SetItemType 

func (x *LaunchItem) SetItemType(v LaunchItem_ItemType)

func (*LaunchItem) SetItemUser 

func (x *LaunchItem) SetItemUser(v *UserInfo)

func (*LaunchItem) SetLegacy 

func (x *LaunchItem) SetLegacy(v bool)

func (*LaunchItem) SetManaged 

func (x *LaunchItem) SetManaged(v bool)

func (*LaunchItem) SetRegistrantId 

func (x *LaunchItem) SetRegistrantId(v *ProcessID)

func (*LaunchItem) SetRegistrantProcess 

func (x *LaunchItem) SetRegistrantProcess(v *ProcessInfoLight)

func (*LaunchItem) SetTriggerId 

func (x *LaunchItem) SetTriggerId(v *ProcessID)

func (*LaunchItem) SetTriggerProcess 

func (x *LaunchItem) SetTriggerProcess(v *ProcessInfoLight)

func (*LaunchItem) String 

func (x *LaunchItem) String() string

func (*LaunchItem) WhichApp 

func (x *LaunchItem) WhichApp() case_LaunchItem_App

func (*LaunchItem) WhichBtmInstigator 

func (x *LaunchItem) WhichBtmInstigator() case_LaunchItem_BtmInstigator

type LaunchItem_Action 

type LaunchItem_Action int32

Whether or not the launch item is being added or removed 

const (
	LaunchItem_ACTION_UNKNOWN LaunchItem_Action = 0
	LaunchItem_ACTION_ADD     LaunchItem_Action = 1
	LaunchItem_ACTION_REMOVE  LaunchItem_Action = 2
)

func (LaunchItem_Action) Descriptor 

func (LaunchItem_Action) Descriptor() protoreflect.EnumDescriptor

func (LaunchItem_Action) Enum 

func (x LaunchItem_Action) Enum() *LaunchItem_Action

func (LaunchItem_Action) Number 

func (x LaunchItem_Action) Number() protoreflect.EnumNumber

func (LaunchItem_Action) String 

func (x LaunchItem_Action) String() string

func (LaunchItem_Action) Type 

func (LaunchItem_Action) Type() protoreflect.EnumType

type LaunchItem_ItemType 

type LaunchItem_ItemType int32

The type of launch item corresponding to this event 

const (
	LaunchItem_ITEM_TYPE_UNKNOWN    LaunchItem_ItemType = 0
	LaunchItem_ITEM_TYPE_USER_ITEM  LaunchItem_ItemType = 1
	LaunchItem_ITEM_TYPE_APP        LaunchItem_ItemType = 2
	LaunchItem_ITEM_TYPE_LOGIN_ITEM LaunchItem_ItemType = 3
	LaunchItem_ITEM_TYPE_AGENT      LaunchItem_ItemType = 4
	LaunchItem_ITEM_TYPE_DAEMON     LaunchItem_ItemType = 5
)

func (LaunchItem_ItemType) Descriptor 

func (LaunchItem_ItemType) Descriptor() protoreflect.EnumDescriptor

func (LaunchItem_ItemType) Enum 

func (x LaunchItem_ItemType) Enum() *LaunchItem_ItemType

func (LaunchItem_ItemType) Number 

func (x LaunchItem_ItemType) Number() protoreflect.EnumNumber

func (LaunchItem_ItemType) String 

func (x LaunchItem_ItemType) String() string

func (LaunchItem_ItemType) Type 

func (LaunchItem_ItemType) Type() protoreflect.EnumType

type LaunchItem_RegistrantId 

type LaunchItem_RegistrantId struct {
	RegistrantId *ProcessID `protobuf:"bytes,6,opt,name=registrant_id,json=registrantId,proto3,oneof"`
}

type LaunchItem_RegistrantProcess 

type LaunchItem_RegistrantProcess struct {
	RegistrantProcess *ProcessInfoLight `protobuf:"bytes,5,opt,name=registrant_process,json=registrantProcess,proto3,oneof"`
}

type LaunchItem_TriggerId 

type LaunchItem_TriggerId struct {
	TriggerId *ProcessID `protobuf:"bytes,4,opt,name=trigger_id,json=triggerId,proto3,oneof"`
}

type LaunchItem_TriggerProcess 

type LaunchItem_TriggerProcess struct {
	TriggerProcess *ProcessInfoLight `protobuf:"bytes,3,opt,name=trigger_process,json=triggerProcess,proto3,oneof"`
}

type LaunchItem_builder 

type LaunchItem_builder struct {

	// The process that emitted the event
	Instigator *ProcessInfoLight
	Action     LaunchItem_Action

	// Fields of oneof BtmInstigator:
	TriggerProcess *ProcessInfoLight
	TriggerId      *ProcessID

	// Fields of oneof App:
	RegistrantProcess *ProcessInfoLight
	RegistrantId      *ProcessID
	// -- end of App
	ItemType LaunchItem_ItemType
	// Whether or not the launch item is a legacy plist
	Legacy *bool
	// Whether or not the launch item is managed by MDM
	Managed *bool
	// User information related to the launch item
	ItemUser *UserInfo
	// Location of the launch item
	ItemPath *string
	// Path of the app the launch item is attributed to
	AppPath *string
	// If available, associated executable path from a launch item's plist
	ExecutablePath *string
	// contains filtered or unexported fields
}

func (LaunchItem_builder) Build 

func (b0 LaunchItem_builder) Build() *LaunchItem
type Link struct {

	// The process performing the link
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The source file being linked
	Source *FileInfo `protobuf:"bytes,2,opt,name=source,proto3,oneof" json:"source,omitempty"`
	// The path of the new link
	Target *string `protobuf:"bytes,3,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// contains filtered or unexported fields
}

Information about a link event

func (*Link) ClearInstigator 

func (x *Link) ClearInstigator()

func (*Link) ClearSource 

func (x *Link) ClearSource()

func (*Link) ClearTarget 

func (x *Link) ClearTarget()

func (*Link) GetInstigator 

func (x *Link) GetInstigator() *ProcessInfoLight

func (*Link) GetSource 

func (x *Link) GetSource() *FileInfo

func (*Link) GetTarget 

func (x *Link) GetTarget() string

func (*Link) HasInstigator 

func (x *Link) HasInstigator() bool

func (*Link) HasSource 

func (x *Link) HasSource() bool

func (*Link) HasTarget 

func (x *Link) HasTarget() bool

func (*Link) ProtoMessage 

func (*Link) ProtoMessage()

func (*Link) ProtoReflect 

func (x *Link) ProtoReflect() protoreflect.Message

func (*Link) Reset 

func (x *Link) Reset()

func (*Link) SetInstigator 

func (x *Link) SetInstigator(v *ProcessInfoLight)

func (*Link) SetSource 

func (x *Link) SetSource(v *FileInfo)

func (*Link) SetTarget 

func (x *Link) SetTarget(v string)

func (*Link) String 

func (x *Link) String() string
type Link_builder struct {

	// The process performing the link
	Instigator *ProcessInfoLight
	// The source file being linked
	Source *FileInfo
	// The path of the new link
	Target *string
	// contains filtered or unexported fields
}
func (b0 Link_builder) Build() *Link

type LogBatch 

type LogBatch struct {
	Records []*anypb.Any `protobuf:"bytes,1,rep,name=records,proto3" json:"records,omitempty"`
	// contains filtered or unexported fields
}

func (*LogBatch) GetRecords 

func (x *LogBatch) GetRecords() []*anypb.Any

func (*LogBatch) ProtoMessage 

func (*LogBatch) ProtoMessage()

func (*LogBatch) ProtoReflect 

func (x *LogBatch) ProtoReflect() protoreflect.Message

func (*LogBatch) Reset 

func (x *LogBatch) Reset()

func (*LogBatch) SetRecords 

func (x *LogBatch) SetRecords(v []*anypb.Any)

func (*LogBatch) String 

func (x *LogBatch) String() string

type LogBatch_builder 

type LogBatch_builder struct {
	Records []*anypb.Any
	// contains filtered or unexported fields
}

func (LogBatch_builder) Build 

func (b0 LogBatch_builder) Build() *LogBatch

type Login 

type Login struct {

	// The process that emitted the login event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Whether or not the login was successful
	Success *bool `protobuf:"varint,2,opt,name=success,proto3,oneof" json:"success,omitempty"`
	// Login failure message, if applicable
	FailureMessage []byte `protobuf:"bytes,3,opt,name=failure_message,json=failureMessage,proto3,oneof" json:"failure_message,omitempty"`
	// Information about the user that attempted to log in
	// Note: `uid` data may not always exist on failed attempts
	User *UserInfo `protobuf:"bytes,4,opt,name=user,proto3,oneof" json:"user,omitempty"`
	// contains filtered or unexported fields
}

Information about a login event from the `login(1)` utility

func (*Login) ClearFailureMessage 

func (x *Login) ClearFailureMessage()

func (*Login) ClearInstigator 

func (x *Login) ClearInstigator()

func (*Login) ClearSuccess 

func (x *Login) ClearSuccess()

func (*Login) ClearUser 

func (x *Login) ClearUser()

func (*Login) GetFailureMessage 

func (x *Login) GetFailureMessage() []byte

func (*Login) GetInstigator 

func (x *Login) GetInstigator() *ProcessInfoLight

func (*Login) GetSuccess 

func (x *Login) GetSuccess() bool

func (*Login) GetUser 

func (x *Login) GetUser() *UserInfo

func (*Login) HasFailureMessage 

func (x *Login) HasFailureMessage() bool

func (*Login) HasInstigator 

func (x *Login) HasInstigator() bool

func (*Login) HasSuccess 

func (x *Login) HasSuccess() bool

func (*Login) HasUser 

func (x *Login) HasUser() bool

func (*Login) ProtoMessage 

func (*Login) ProtoMessage()

func (*Login) ProtoReflect 

func (x *Login) ProtoReflect() protoreflect.Message

func (*Login) Reset 

func (x *Login) Reset()

func (*Login) SetFailureMessage 

func (x *Login) SetFailureMessage(v []byte)

func (*Login) SetInstigator 

func (x *Login) SetInstigator(v *ProcessInfoLight)

func (*Login) SetSuccess 

func (x *Login) SetSuccess(v bool)

func (*Login) SetUser 

func (x *Login) SetUser(v *UserInfo)

func (*Login) String 

func (x *Login) String() string

type LoginLogout 

type LoginLogout struct {

	// Types that are valid to be assigned to Event:
	//
	//	*LoginLogout_Login
	//	*LoginLogout_Logout
	Event isLoginLogout_Event `protobuf_oneof:"event"`
	// contains filtered or unexported fields
}

Information about login and logout events from the `login(1)` utility

func (*LoginLogout) ClearEvent 

func (x *LoginLogout) ClearEvent()

func (*LoginLogout) ClearLogin 

func (x *LoginLogout) ClearLogin()

func (*LoginLogout) ClearLogout 

func (x *LoginLogout) ClearLogout()

func (*LoginLogout) GetEvent 

func (x *LoginLogout) GetEvent() isLoginLogout_Event

func (*LoginLogout) GetLogin 

func (x *LoginLogout) GetLogin() *Login

func (*LoginLogout) GetLogout 

func (x *LoginLogout) GetLogout() *Logout

func (*LoginLogout) HasEvent 

func (x *LoginLogout) HasEvent() bool

func (*LoginLogout) HasLogin 

func (x *LoginLogout) HasLogin() bool

func (*LoginLogout) HasLogout 

func (x *LoginLogout) HasLogout() bool

func (*LoginLogout) ProtoMessage 

func (*LoginLogout) ProtoMessage()

func (*LoginLogout) ProtoReflect 

func (x *LoginLogout) ProtoReflect() protoreflect.Message

func (*LoginLogout) Reset 

func (x *LoginLogout) Reset()

func (*LoginLogout) SetLogin 

func (x *LoginLogout) SetLogin(v *Login)

func (*LoginLogout) SetLogout 

func (x *LoginLogout) SetLogout(v *Logout)

func (*LoginLogout) String 

func (x *LoginLogout) String() string

func (*LoginLogout) WhichEvent 

func (x *LoginLogout) WhichEvent() case_LoginLogout_Event

type LoginLogout_Login 

type LoginLogout_Login struct {
	Login *Login `protobuf:"bytes,1,opt,name=login,proto3,oneof"`
}

type LoginLogout_Logout 

type LoginLogout_Logout struct {
	Logout *Logout `protobuf:"bytes,2,opt,name=logout,proto3,oneof"`
}

type LoginLogout_builder 

type LoginLogout_builder struct {

	// Fields of oneof Event:
	Login  *Login
	Logout *Logout
	// contains filtered or unexported fields
}

func (LoginLogout_builder) Build 

func (b0 LoginLogout_builder) Build() *LoginLogout

type LoginWindowSession 

type LoginWindowSession struct {

	// Types that are valid to be assigned to Event:
	//
	//	*LoginWindowSession_Login
	//	*LoginWindowSession_Logout
	//	*LoginWindowSession_Lock
	//	*LoginWindowSession_Unlock
	Event isLoginWindowSession_Event `protobuf_oneof:"event"`
	// contains filtered or unexported fields
}

Information about loginwindow events

func (*LoginWindowSession) ClearEvent 

func (x *LoginWindowSession) ClearEvent()

func (*LoginWindowSession) ClearLock 

func (x *LoginWindowSession) ClearLock()

func (*LoginWindowSession) ClearLogin 

func (x *LoginWindowSession) ClearLogin()

func (*LoginWindowSession) ClearLogout 

func (x *LoginWindowSession) ClearLogout()

func (*LoginWindowSession) ClearUnlock 

func (x *LoginWindowSession) ClearUnlock()

func (*LoginWindowSession) GetEvent 

func (x *LoginWindowSession) GetEvent() isLoginWindowSession_Event

func (*LoginWindowSession) GetLock 

func (x *LoginWindowSession) GetLock() *LoginWindowSessionLock

func (*LoginWindowSession) GetLogin 

func (x *LoginWindowSession) GetLogin() *LoginWindowSessionLogin

func (*LoginWindowSession) GetLogout 

func (x *LoginWindowSession) GetLogout() *LoginWindowSessionLogout

func (*LoginWindowSession) GetUnlock 

func (x *LoginWindowSession) GetUnlock() *LoginWindowSessionUnlock

func (*LoginWindowSession) HasEvent 

func (x *LoginWindowSession) HasEvent() bool

func (*LoginWindowSession) HasLock 

func (x *LoginWindowSession) HasLock() bool

func (*LoginWindowSession) HasLogin 

func (x *LoginWindowSession) HasLogin() bool

func (*LoginWindowSession) HasLogout 

func (x *LoginWindowSession) HasLogout() bool

func (*LoginWindowSession) HasUnlock 

func (x *LoginWindowSession) HasUnlock() bool

func (*LoginWindowSession) ProtoMessage 

func (*LoginWindowSession) ProtoMessage()

func (*LoginWindowSession) ProtoReflect 

func (x *LoginWindowSession) ProtoReflect() protoreflect.Message

func (*LoginWindowSession) Reset 

func (x *LoginWindowSession) Reset()

func (*LoginWindowSession) SetLock 

func (x *LoginWindowSession) SetLock(v *LoginWindowSessionLock)

func (*LoginWindowSession) SetLogin 

func (x *LoginWindowSession) SetLogin(v *LoginWindowSessionLogin)

func (*LoginWindowSession) SetLogout 

func (x *LoginWindowSession) SetLogout(v *LoginWindowSessionLogout)

func (*LoginWindowSession) SetUnlock 

func (x *LoginWindowSession) SetUnlock(v *LoginWindowSessionUnlock)

func (*LoginWindowSession) String 

func (x *LoginWindowSession) String() string

func (*LoginWindowSession) WhichEvent 

func (x *LoginWindowSession) WhichEvent() case_LoginWindowSession_Event

type LoginWindowSessionLock 

type LoginWindowSessionLock struct {

	// The process that emitted the lock event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Name of the user locking their session
	User *UserInfo `protobuf:"bytes,2,opt,name=user,proto3,oneof" json:"user,omitempty"`
	// Graphical session information for this session
	GraphicalSession *GraphicalSession `protobuf:"bytes,3,opt,name=graphical_session,json=graphicalSession,proto3,oneof" json:"graphical_session,omitempty"`
	// contains filtered or unexported fields
}

Information about a user locking their session via loginwindow

func (*LoginWindowSessionLock) ClearGraphicalSession 

func (x *LoginWindowSessionLock) ClearGraphicalSession()

func (*LoginWindowSessionLock) ClearInstigator 

func (x *LoginWindowSessionLock) ClearInstigator()

func (*LoginWindowSessionLock) ClearUser 

func (x *LoginWindowSessionLock) ClearUser()

func (*LoginWindowSessionLock) GetGraphicalSession 

func (x *LoginWindowSessionLock) GetGraphicalSession() *GraphicalSession

func (*LoginWindowSessionLock) GetInstigator 

func (x *LoginWindowSessionLock) GetInstigator() *ProcessInfoLight

func (*LoginWindowSessionLock) GetUser 

func (x *LoginWindowSessionLock) GetUser() *UserInfo

func (*LoginWindowSessionLock) HasGraphicalSession 

func (x *LoginWindowSessionLock) HasGraphicalSession() bool

func (*LoginWindowSessionLock) HasInstigator 

func (x *LoginWindowSessionLock) HasInstigator() bool

func (*LoginWindowSessionLock) HasUser 

func (x *LoginWindowSessionLock) HasUser() bool

func (*LoginWindowSessionLock) ProtoMessage 

func (*LoginWindowSessionLock) ProtoMessage()

func (*LoginWindowSessionLock) ProtoReflect 

func (x *LoginWindowSessionLock) ProtoReflect() protoreflect.Message

func (*LoginWindowSessionLock) Reset 

func (x *LoginWindowSessionLock) Reset()

func (*LoginWindowSessionLock) SetGraphicalSession 

func (x *LoginWindowSessionLock) SetGraphicalSession(v *GraphicalSession)

func (*LoginWindowSessionLock) SetInstigator 

func (x *LoginWindowSessionLock) SetInstigator(v *ProcessInfoLight)

func (*LoginWindowSessionLock) SetUser 

func (x *LoginWindowSessionLock) SetUser(v *UserInfo)

func (*LoginWindowSessionLock) String 

func (x *LoginWindowSessionLock) String() string

type LoginWindowSessionLock_builder 

type LoginWindowSessionLock_builder struct {

	// The process that emitted the lock event
	Instigator *ProcessInfoLight
	// Name of the user locking their session
	User *UserInfo
	// Graphical session information for this session
	GraphicalSession *GraphicalSession
	// contains filtered or unexported fields
}

func (LoginWindowSessionLock_builder) Build 

func (b0 LoginWindowSessionLock_builder) Build() *LoginWindowSessionLock

type LoginWindowSessionLogin 

type LoginWindowSessionLogin struct {

	// The process that emitted the login event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Name of the user logging in
	User *UserInfo `protobuf:"bytes,2,opt,name=user,proto3,oneof" json:"user,omitempty"`
	// Graphical session information for this session
	GraphicalSession *GraphicalSession `protobuf:"bytes,3,opt,name=graphical_session,json=graphicalSession,proto3,oneof" json:"graphical_session,omitempty"`
	// contains filtered or unexported fields
}

Information about a user logging in via loginwindow

func (*LoginWindowSessionLogin) ClearGraphicalSession 

func (x *LoginWindowSessionLogin) ClearGraphicalSession()

func (*LoginWindowSessionLogin) ClearInstigator 

func (x *LoginWindowSessionLogin) ClearInstigator()

func (*LoginWindowSessionLogin) ClearUser 

func (x *LoginWindowSessionLogin) ClearUser()

func (*LoginWindowSessionLogin) GetGraphicalSession 

func (x *LoginWindowSessionLogin) GetGraphicalSession() *GraphicalSession

func (*LoginWindowSessionLogin) GetInstigator 

func (x *LoginWindowSessionLogin) GetInstigator() *ProcessInfoLight

func (*LoginWindowSessionLogin) GetUser 

func (x *LoginWindowSessionLogin) GetUser() *UserInfo

func (*LoginWindowSessionLogin) HasGraphicalSession 

func (x *LoginWindowSessionLogin) HasGraphicalSession() bool

func (*LoginWindowSessionLogin) HasInstigator 

func (x *LoginWindowSessionLogin) HasInstigator() bool

func (*LoginWindowSessionLogin) HasUser 

func (x *LoginWindowSessionLogin) HasUser() bool

func (*LoginWindowSessionLogin) ProtoMessage 

func (*LoginWindowSessionLogin) ProtoMessage()

func (*LoginWindowSessionLogin) ProtoReflect 

func (x *LoginWindowSessionLogin) ProtoReflect() protoreflect.Message

func (*LoginWindowSessionLogin) Reset 

func (x *LoginWindowSessionLogin) Reset()

func (*LoginWindowSessionLogin) SetGraphicalSession 

func (x *LoginWindowSessionLogin) SetGraphicalSession(v *GraphicalSession)

func (*LoginWindowSessionLogin) SetInstigator 

func (x *LoginWindowSessionLogin) SetInstigator(v *ProcessInfoLight)

func (*LoginWindowSessionLogin) SetUser 

func (x *LoginWindowSessionLogin) SetUser(v *UserInfo)

func (*LoginWindowSessionLogin) String 

func (x *LoginWindowSessionLogin) String() string

type LoginWindowSessionLogin_builder 

type LoginWindowSessionLogin_builder struct {

	// The process that emitted the login event
	Instigator *ProcessInfoLight
	// Name of the user logging in
	User *UserInfo
	// Graphical session information for this session
	GraphicalSession *GraphicalSession
	// contains filtered or unexported fields
}

func (LoginWindowSessionLogin_builder) Build 

func (b0 LoginWindowSessionLogin_builder) Build() *LoginWindowSessionLogin

type LoginWindowSessionLogout 

type LoginWindowSessionLogout struct {

	// The process that emitted the logout event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Name of the user logging out
	User *UserInfo `protobuf:"bytes,2,opt,name=user,proto3,oneof" json:"user,omitempty"`
	// Graphical session information for this session
	GraphicalSession *GraphicalSession `protobuf:"bytes,3,opt,name=graphical_session,json=graphicalSession,proto3,oneof" json:"graphical_session,omitempty"`
	// contains filtered or unexported fields
}

Information about a user logging out via loginwindow

func (*LoginWindowSessionLogout) ClearGraphicalSession 

func (x *LoginWindowSessionLogout) ClearGraphicalSession()

func (*LoginWindowSessionLogout) ClearInstigator 

func (x *LoginWindowSessionLogout) ClearInstigator()

func (*LoginWindowSessionLogout) ClearUser 

func (x *LoginWindowSessionLogout) ClearUser()

func (*LoginWindowSessionLogout) GetGraphicalSession 

func (x *LoginWindowSessionLogout) GetGraphicalSession() *GraphicalSession

func (*LoginWindowSessionLogout) GetInstigator 

func (x *LoginWindowSessionLogout) GetInstigator() *ProcessInfoLight

func (*LoginWindowSessionLogout) GetUser 

func (x *LoginWindowSessionLogout) GetUser() *UserInfo

func (*LoginWindowSessionLogout) HasGraphicalSession 

func (x *LoginWindowSessionLogout) HasGraphicalSession() bool

func (*LoginWindowSessionLogout) HasInstigator 

func (x *LoginWindowSessionLogout) HasInstigator() bool

func (*LoginWindowSessionLogout) HasUser 

func (x *LoginWindowSessionLogout) HasUser() bool

func (*LoginWindowSessionLogout) ProtoMessage 

func (*LoginWindowSessionLogout) ProtoMessage()

func (*LoginWindowSessionLogout) ProtoReflect 

func (x *LoginWindowSessionLogout) ProtoReflect() protoreflect.Message

func (*LoginWindowSessionLogout) Reset 

func (x *LoginWindowSessionLogout) Reset()

func (*LoginWindowSessionLogout) SetGraphicalSession 

func (x *LoginWindowSessionLogout) SetGraphicalSession(v *GraphicalSession)

func (*LoginWindowSessionLogout) SetInstigator 

func (x *LoginWindowSessionLogout) SetInstigator(v *ProcessInfoLight)

func (*LoginWindowSessionLogout) SetUser 

func (x *LoginWindowSessionLogout) SetUser(v *UserInfo)

func (*LoginWindowSessionLogout) String 

func (x *LoginWindowSessionLogout) String() string

type LoginWindowSessionLogout_builder 

type LoginWindowSessionLogout_builder struct {

	// The process that emitted the logout event
	Instigator *ProcessInfoLight
	// Name of the user logging out
	User *UserInfo
	// Graphical session information for this session
	GraphicalSession *GraphicalSession
	// contains filtered or unexported fields
}

func (LoginWindowSessionLogout_builder) Build 

func (b0 LoginWindowSessionLogout_builder) Build() *LoginWindowSessionLogout

type LoginWindowSessionUnlock 

type LoginWindowSessionUnlock struct {

	// The process that emitted the unlock event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Name of the user unlocking their session
	User *UserInfo `protobuf:"bytes,2,opt,name=user,proto3,oneof" json:"user,omitempty"`
	// Graphical session information for this session
	GraphicalSession *GraphicalSession `protobuf:"bytes,3,opt,name=graphical_session,json=graphicalSession,proto3,oneof" json:"graphical_session,omitempty"`
	// contains filtered or unexported fields
}

Information about a user unlocking their session via loginwindow

func (*LoginWindowSessionUnlock) ClearGraphicalSession 

func (x *LoginWindowSessionUnlock) ClearGraphicalSession()

func (*LoginWindowSessionUnlock) ClearInstigator 

func (x *LoginWindowSessionUnlock) ClearInstigator()

func (*LoginWindowSessionUnlock) ClearUser 

func (x *LoginWindowSessionUnlock) ClearUser()

func (*LoginWindowSessionUnlock) GetGraphicalSession 

func (x *LoginWindowSessionUnlock) GetGraphicalSession() *GraphicalSession

func (*LoginWindowSessionUnlock) GetInstigator 

func (x *LoginWindowSessionUnlock) GetInstigator() *ProcessInfoLight

func (*LoginWindowSessionUnlock) GetUser 

func (x *LoginWindowSessionUnlock) GetUser() *UserInfo

func (*LoginWindowSessionUnlock) HasGraphicalSession 

func (x *LoginWindowSessionUnlock) HasGraphicalSession() bool

func (*LoginWindowSessionUnlock) HasInstigator 

func (x *LoginWindowSessionUnlock) HasInstigator() bool

func (*LoginWindowSessionUnlock) HasUser 

func (x *LoginWindowSessionUnlock) HasUser() bool

func (*LoginWindowSessionUnlock) ProtoMessage 

func (*LoginWindowSessionUnlock) ProtoMessage()

func (*LoginWindowSessionUnlock) ProtoReflect 

func (x *LoginWindowSessionUnlock) ProtoReflect() protoreflect.Message

func (*LoginWindowSessionUnlock) Reset 

func (x *LoginWindowSessionUnlock) Reset()

func (*LoginWindowSessionUnlock) SetGraphicalSession 

func (x *LoginWindowSessionUnlock) SetGraphicalSession(v *GraphicalSession)

func (*LoginWindowSessionUnlock) SetInstigator 

func (x *LoginWindowSessionUnlock) SetInstigator(v *ProcessInfoLight)

func (*LoginWindowSessionUnlock) SetUser 

func (x *LoginWindowSessionUnlock) SetUser(v *UserInfo)

func (*LoginWindowSessionUnlock) String 

func (x *LoginWindowSessionUnlock) String() string

type LoginWindowSessionUnlock_builder 

type LoginWindowSessionUnlock_builder struct {

	// The process that emitted the unlock event
	Instigator *ProcessInfoLight
	// Name of the user unlocking their session
	User *UserInfo
	// Graphical session information for this session
	GraphicalSession *GraphicalSession
	// contains filtered or unexported fields
}

func (LoginWindowSessionUnlock_builder) Build 

func (b0 LoginWindowSessionUnlock_builder) Build() *LoginWindowSessionUnlock

type LoginWindowSession_Lock 

type LoginWindowSession_Lock struct {
	Lock *LoginWindowSessionLock `protobuf:"bytes,3,opt,name=lock,proto3,oneof"`
}

type LoginWindowSession_Login 

type LoginWindowSession_Login struct {
	Login *LoginWindowSessionLogin `protobuf:"bytes,1,opt,name=login,proto3,oneof"`
}

type LoginWindowSession_Logout 

type LoginWindowSession_Logout struct {
	Logout *LoginWindowSessionLogout `protobuf:"bytes,2,opt,name=logout,proto3,oneof"`
}

type LoginWindowSession_Unlock 

type LoginWindowSession_Unlock struct {
	Unlock *LoginWindowSessionUnlock `protobuf:"bytes,4,opt,name=unlock,proto3,oneof"`
}

type LoginWindowSession_builder 

type LoginWindowSession_builder struct {

	// Fields of oneof Event:
	Login  *LoginWindowSessionLogin
	Logout *LoginWindowSessionLogout
	Lock   *LoginWindowSessionLock
	Unlock *LoginWindowSessionUnlock
	// contains filtered or unexported fields
}

func (LoginWindowSession_builder) Build 

func (b0 LoginWindowSession_builder) Build() *LoginWindowSession

type Login_builder 

type Login_builder struct {

	// The process that emitted the login event
	Instigator *ProcessInfoLight
	// Whether or not the login was successful
	Success *bool
	// Login failure message, if applicable
	FailureMessage []byte
	// Information about the user that attempted to log in
	// Note: `uid` data may not always exist on failed attempts
	User *UserInfo
	// contains filtered or unexported fields
}

func (Login_builder) Build 

func (b0 Login_builder) Build() *Login

type Logout 

type Logout struct {

	// The process that emitted the logout event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Information about the user that logged out
	User *UserInfo `protobuf:"bytes,2,opt,name=user,proto3,oneof" json:"user,omitempty"`
	// contains filtered or unexported fields
}

Information about a logout event from the `login(1)` utility

func (*Logout) ClearInstigator 

func (x *Logout) ClearInstigator()

func (*Logout) ClearUser 

func (x *Logout) ClearUser()

func (*Logout) GetInstigator 

func (x *Logout) GetInstigator() *ProcessInfoLight

func (*Logout) GetUser 

func (x *Logout) GetUser() *UserInfo

func (*Logout) HasInstigator 

func (x *Logout) HasInstigator() bool

func (*Logout) HasUser 

func (x *Logout) HasUser() bool

func (*Logout) ProtoMessage 

func (*Logout) ProtoMessage()

func (*Logout) ProtoReflect 

func (x *Logout) ProtoReflect() protoreflect.Message

func (*Logout) Reset 

func (x *Logout) Reset()

func (*Logout) SetInstigator 

func (x *Logout) SetInstigator(v *ProcessInfoLight)

func (*Logout) SetUser 

func (x *Logout) SetUser(v *UserInfo)

func (*Logout) String 

func (x *Logout) String() string

type Logout_builder 

type Logout_builder struct {

	// The process that emitted the logout event
	Instigator *ProcessInfoLight
	// Information about the user that logged out
	User *UserInfo
	// contains filtered or unexported fields
}

func (Logout_builder) Build 

func (b0 Logout_builder) Build() *Logout

type NetworkActivity 

type NetworkActivity struct {

	// All processes with network activity during this window
	Processes []*NetworkActivity_Process `protobuf:"bytes,1,rep,name=processes,proto3" json:"processes,omitempty"`
	// contains filtered or unexported fields
}

Per-process network activity collected during a single monitoring window Note: The SantaMessage fields 'event_time' and 'processed_time' are set to the start and end times of the window within which the NetworkActivity was collected.

func (*NetworkActivity) GetProcesses 

func (x *NetworkActivity) GetProcesses() []*NetworkActivity_Process

func (*NetworkActivity) ProtoMessage 

func (*NetworkActivity) ProtoMessage()

func (*NetworkActivity) ProtoReflect 

func (x *NetworkActivity) ProtoReflect() protoreflect.Message

func (*NetworkActivity) Reset 

func (x *NetworkActivity) Reset()

func (*NetworkActivity) SetProcesses 

func (x *NetworkActivity) SetProcesses(v []*NetworkActivity_Process)

func (*NetworkActivity) String 

func (x *NetworkActivity) String() string

type NetworkActivity_Flow 

type NetworkActivity_Flow struct {

	// Identifier for this flow.
	// Note: Apple can reuse flow identifiers under certain conditions.
	// Use `id + hash` as a unique identifier.
	Id *string `protobuf:"bytes,1,opt,name=id,proto3,oneof" json:"id,omitempty"`
	// A Santa-computed identifier to help distinguish duplicate flow ids.
	Hash *string `protobuf:"bytes,2,opt,name=hash,proto3,oneof" json:"hash,omitempty"`
	// Remote endpoint address (IPv4 or IPv6 string representation)
	RemoteAddress *string `protobuf:"bytes,3,opt,name=remote_address,json=remoteAddress,proto3,oneof" json:"remote_address,omitempty"`
	RemotePort    *uint32 `protobuf:"varint,4,opt,name=remote_port,json=remotePort,proto3,oneof" json:"remote_port,omitempty"`
	// Remote endpoint hostname, when known. Set when the flow was created
	// via Network.framework/NSURLSession, or when the remote address was
	// resolved through the DNS cache.
	RemoteHostname *string `protobuf:"bytes,14,opt,name=remote_hostname,json=remoteHostname,proto3,oneof" json:"remote_hostname,omitempty"`
	// Local endpoint address (IPv4 or IPv6 string representation)
	LocalAddress *string `protobuf:"bytes,5,opt,name=local_address,json=localAddress,proto3,oneof" json:"local_address,omitempty"`
	LocalPort    *uint32 `protobuf:"varint,6,opt,name=local_port,json=localPort,proto3,oneof" json:"local_port,omitempty"`
	// IP protocol number (e.g. 6 for TCP, 17 for UDP)
	Protocol     *int32                             `protobuf:"varint,7,opt,name=protocol,proto3,oneof" json:"protocol,omitempty"`
	SocketFamily *NetworkActivity_Flow_SocketFamily `` /* 162-byte string literal not displayed */
	Direction    *NetworkActivity_Flow_Direction    `` /* 133-byte string literal not displayed */
	// Cumulative byte counts for this flow
	BytesInbound  *uint64 `protobuf:"varint,10,opt,name=bytes_inbound,json=bytesInbound,proto3,oneof" json:"bytes_inbound,omitempty"`
	BytesOutbound *uint64 `protobuf:"varint,11,opt,name=bytes_outbound,json=bytesOutbound,proto3,oneof" json:"bytes_outbound,omitempty"`
	// When the flow was first observed
	// Only present if the flow started during this window
	// If a flow began before Santa began monitoring then this field will never
	// be set for the flow id
	StartTime *timestamppb.Timestamp `protobuf:"bytes,12,opt,name=start_time,json=startTime,proto3,oneof" json:"start_time,omitempty"`
	// When the flow was closed
	// Only present if the flow closed during this window
	CloseTime    *timestamppb.Timestamp         `protobuf:"bytes,13,opt,name=close_time,json=closeTime,proto3,oneof" json:"close_time,omitempty"`
	Decision     *NetworkActivity_Flow_Decision `` /* 131-byte string literal not displayed */
	DecisionTier *NetworkActivity_Flow_Tier     `` /* 155-byte string literal not displayed */
	// Winning rule id (0 if no rule matched) and name (empty if none).
	RuleId   *int64  `protobuf:"varint,17,opt,name=rule_id,json=ruleId,proto3,oneof" json:"rule_id,omitempty"`
	RuleName *string `protobuf:"bytes,18,opt,name=rule_name,json=ruleName,proto3,oneof" json:"rule_name,omitempty"`
	// contains filtered or unexported fields
}

A single network socket flow observed during the monitoring window

func (*NetworkActivity_Flow) ClearBytesInbound 

func (x *NetworkActivity_Flow) ClearBytesInbound()

func (*NetworkActivity_Flow) ClearBytesOutbound 

func (x *NetworkActivity_Flow) ClearBytesOutbound()

func (*NetworkActivity_Flow) ClearCloseTime 

func (x *NetworkActivity_Flow) ClearCloseTime()

func (*NetworkActivity_Flow) ClearDecision 

func (x *NetworkActivity_Flow) ClearDecision()

func (*NetworkActivity_Flow) ClearDecisionTier 

func (x *NetworkActivity_Flow) ClearDecisionTier()

func (*NetworkActivity_Flow) ClearDirection 

func (x *NetworkActivity_Flow) ClearDirection()

func (*NetworkActivity_Flow) ClearHash 

func (x *NetworkActivity_Flow) ClearHash()

func (*NetworkActivity_Flow) ClearId 

func (x *NetworkActivity_Flow) ClearId()

func (*NetworkActivity_Flow) ClearLocalAddress 

func (x *NetworkActivity_Flow) ClearLocalAddress()

func (*NetworkActivity_Flow) ClearLocalPort 

func (x *NetworkActivity_Flow) ClearLocalPort()

func (*NetworkActivity_Flow) ClearProtocol 

func (x *NetworkActivity_Flow) ClearProtocol()

func (*NetworkActivity_Flow) ClearRemoteAddress 

func (x *NetworkActivity_Flow) ClearRemoteAddress()

func (*NetworkActivity_Flow) ClearRemoteHostname 

func (x *NetworkActivity_Flow) ClearRemoteHostname()

func (*NetworkActivity_Flow) ClearRemotePort 

func (x *NetworkActivity_Flow) ClearRemotePort()

func (*NetworkActivity_Flow) ClearRuleId 

func (x *NetworkActivity_Flow) ClearRuleId()

func (*NetworkActivity_Flow) ClearRuleName 

func (x *NetworkActivity_Flow) ClearRuleName()

func (*NetworkActivity_Flow) ClearSocketFamily 

func (x *NetworkActivity_Flow) ClearSocketFamily()

func (*NetworkActivity_Flow) ClearStartTime 

func (x *NetworkActivity_Flow) ClearStartTime()

func (*NetworkActivity_Flow) GetBytesInbound 

func (x *NetworkActivity_Flow) GetBytesInbound() uint64

func (*NetworkActivity_Flow) GetBytesOutbound 

func (x *NetworkActivity_Flow) GetBytesOutbound() uint64

func (*NetworkActivity_Flow) GetCloseTime 

func (x *NetworkActivity_Flow) GetCloseTime() *timestamppb.Timestamp

func (*NetworkActivity_Flow) GetDecision 

func (x *NetworkActivity_Flow) GetDecision() NetworkActivity_Flow_Decision

func (*NetworkActivity_Flow) GetDecisionTier 

func (x *NetworkActivity_Flow) GetDecisionTier() NetworkActivity_Flow_Tier

func (*NetworkActivity_Flow) GetDirection 

func (x *NetworkActivity_Flow) GetDirection() NetworkActivity_Flow_Direction

func (*NetworkActivity_Flow) GetHash 

func (x *NetworkActivity_Flow) GetHash() string

func (*NetworkActivity_Flow) GetId 

func (x *NetworkActivity_Flow) GetId() string

func (*NetworkActivity_Flow) GetLocalAddress 

func (x *NetworkActivity_Flow) GetLocalAddress() string

func (*NetworkActivity_Flow) GetLocalPort 

func (x *NetworkActivity_Flow) GetLocalPort() uint32

func (*NetworkActivity_Flow) GetProtocol 

func (x *NetworkActivity_Flow) GetProtocol() int32

func (*NetworkActivity_Flow) GetRemoteAddress 

func (x *NetworkActivity_Flow) GetRemoteAddress() string

func (*NetworkActivity_Flow) GetRemoteHostname 

func (x *NetworkActivity_Flow) GetRemoteHostname() string

func (*NetworkActivity_Flow) GetRemotePort 

func (x *NetworkActivity_Flow) GetRemotePort() uint32

func (*NetworkActivity_Flow) GetRuleId 

func (x *NetworkActivity_Flow) GetRuleId() int64

func (*NetworkActivity_Flow) GetRuleName 

func (x *NetworkActivity_Flow) GetRuleName() string

func (*NetworkActivity_Flow) GetSocketFamily 

func (x *NetworkActivity_Flow) GetSocketFamily() NetworkActivity_Flow_SocketFamily

func (*NetworkActivity_Flow) GetStartTime 

func (x *NetworkActivity_Flow) GetStartTime() *timestamppb.Timestamp

func (*NetworkActivity_Flow) HasBytesInbound 

func (x *NetworkActivity_Flow) HasBytesInbound() bool

func (*NetworkActivity_Flow) HasBytesOutbound 

func (x *NetworkActivity_Flow) HasBytesOutbound() bool

func (*NetworkActivity_Flow) HasCloseTime 

func (x *NetworkActivity_Flow) HasCloseTime() bool

func (*NetworkActivity_Flow) HasDecision 

func (x *NetworkActivity_Flow) HasDecision() bool

func (*NetworkActivity_Flow) HasDecisionTier 

func (x *NetworkActivity_Flow) HasDecisionTier() bool

func (*NetworkActivity_Flow) HasDirection 

func (x *NetworkActivity_Flow) HasDirection() bool

func (*NetworkActivity_Flow) HasHash 

func (x *NetworkActivity_Flow) HasHash() bool

func (*NetworkActivity_Flow) HasId 

func (x *NetworkActivity_Flow) HasId() bool

func (*NetworkActivity_Flow) HasLocalAddress 

func (x *NetworkActivity_Flow) HasLocalAddress() bool

func (*NetworkActivity_Flow) HasLocalPort 

func (x *NetworkActivity_Flow) HasLocalPort() bool

func (*NetworkActivity_Flow) HasProtocol 

func (x *NetworkActivity_Flow) HasProtocol() bool

func (*NetworkActivity_Flow) HasRemoteAddress 

func (x *NetworkActivity_Flow) HasRemoteAddress() bool

func (*NetworkActivity_Flow) HasRemoteHostname 

func (x *NetworkActivity_Flow) HasRemoteHostname() bool

func (*NetworkActivity_Flow) HasRemotePort 

func (x *NetworkActivity_Flow) HasRemotePort() bool

func (*NetworkActivity_Flow) HasRuleId 

func (x *NetworkActivity_Flow) HasRuleId() bool

func (*NetworkActivity_Flow) HasRuleName 

func (x *NetworkActivity_Flow) HasRuleName() bool

func (*NetworkActivity_Flow) HasSocketFamily 

func (x *NetworkActivity_Flow) HasSocketFamily() bool

func (*NetworkActivity_Flow) HasStartTime 

func (x *NetworkActivity_Flow) HasStartTime() bool

func (*NetworkActivity_Flow) ProtoMessage 

func (*NetworkActivity_Flow) ProtoMessage()

func (*NetworkActivity_Flow) ProtoReflect 

func (x *NetworkActivity_Flow) ProtoReflect() protoreflect.Message

func (*NetworkActivity_Flow) Reset 

func (x *NetworkActivity_Flow) Reset()

func (*NetworkActivity_Flow) SetBytesInbound 

func (x *NetworkActivity_Flow) SetBytesInbound(v uint64)

func (*NetworkActivity_Flow) SetBytesOutbound 

func (x *NetworkActivity_Flow) SetBytesOutbound(v uint64)

func (*NetworkActivity_Flow) SetCloseTime 

func (x *NetworkActivity_Flow) SetCloseTime(v *timestamppb.Timestamp)

func (*NetworkActivity_Flow) SetDecision 

func (x *NetworkActivity_Flow) SetDecision(v NetworkActivity_Flow_Decision)

func (*NetworkActivity_Flow) SetDecisionTier 

func (x *NetworkActivity_Flow) SetDecisionTier(v NetworkActivity_Flow_Tier)

func (*NetworkActivity_Flow) SetDirection 

func (x *NetworkActivity_Flow) SetDirection(v NetworkActivity_Flow_Direction)

func (*NetworkActivity_Flow) SetHash 

func (x *NetworkActivity_Flow) SetHash(v string)

func (*NetworkActivity_Flow) SetId 

func (x *NetworkActivity_Flow) SetId(v string)

func (*NetworkActivity_Flow) SetLocalAddress 

func (x *NetworkActivity_Flow) SetLocalAddress(v string)

func (*NetworkActivity_Flow) SetLocalPort 

func (x *NetworkActivity_Flow) SetLocalPort(v uint32)

func (*NetworkActivity_Flow) SetProtocol 

func (x *NetworkActivity_Flow) SetProtocol(v int32)

func (*NetworkActivity_Flow) SetRemoteAddress 

func (x *NetworkActivity_Flow) SetRemoteAddress(v string)

func (*NetworkActivity_Flow) SetRemoteHostname 

func (x *NetworkActivity_Flow) SetRemoteHostname(v string)

func (*NetworkActivity_Flow) SetRemotePort 

func (x *NetworkActivity_Flow) SetRemotePort(v uint32)

func (*NetworkActivity_Flow) SetRuleId 

func (x *NetworkActivity_Flow) SetRuleId(v int64)

func (*NetworkActivity_Flow) SetRuleName 

func (x *NetworkActivity_Flow) SetRuleName(v string)

func (*NetworkActivity_Flow) SetSocketFamily 

func (x *NetworkActivity_Flow) SetSocketFamily(v NetworkActivity_Flow_SocketFamily)

func (*NetworkActivity_Flow) SetStartTime 

func (x *NetworkActivity_Flow) SetStartTime(v *timestamppb.Timestamp)

func (*NetworkActivity_Flow) String 

func (x *NetworkActivity_Flow) String() string

type NetworkActivity_Flow_Decision 

type NetworkActivity_Flow_Decision int32

The filter's evaluation outcome. Set for every evaluated flow (allowed included); unset when evaluation did not run. 

const (
	NetworkActivity_Flow_DECISION_UNKNOWN NetworkActivity_Flow_Decision = 0
	NetworkActivity_Flow_DECISION_ALLOW   NetworkActivity_Flow_Decision = 1
	NetworkActivity_Flow_DECISION_BLOCK   NetworkActivity_Flow_Decision = 2
	NetworkActivity_Flow_DECISION_AUDIT   NetworkActivity_Flow_Decision = 3
)

func (NetworkActivity_Flow_Decision) Descriptor 

func (NetworkActivity_Flow_Decision) Descriptor() protoreflect.EnumDescriptor

func (NetworkActivity_Flow_Decision) Enum 

func (x NetworkActivity_Flow_Decision) Enum() *NetworkActivity_Flow_Decision

func (NetworkActivity_Flow_Decision) Number 

func (x NetworkActivity_Flow_Decision) Number() protoreflect.EnumNumber

func (NetworkActivity_Flow_Decision) String 

func (x NetworkActivity_Flow_Decision) String() string

func (NetworkActivity_Flow_Decision) Type 

func (NetworkActivity_Flow_Decision) Type() protoreflect.EnumType

type NetworkActivity_Flow_Direction 

type NetworkActivity_Flow_Direction int32
const (
	NetworkActivity_Flow_DIRECTION_UNKNOWN  NetworkActivity_Flow_Direction = 0
	NetworkActivity_Flow_DIRECTION_INBOUND  NetworkActivity_Flow_Direction = 1
	NetworkActivity_Flow_DIRECTION_OUTBOUND NetworkActivity_Flow_Direction = 2
)

func (NetworkActivity_Flow_Direction) Descriptor 

func (NetworkActivity_Flow_Direction) Descriptor() protoreflect.EnumDescriptor

func (NetworkActivity_Flow_Direction) Enum 

func (x NetworkActivity_Flow_Direction) Enum() *NetworkActivity_Flow_Direction

func (NetworkActivity_Flow_Direction) Number 

func (x NetworkActivity_Flow_Direction) Number() protoreflect.EnumNumber

func (NetworkActivity_Flow_Direction) String 

func (x NetworkActivity_Flow_Direction) String() string

func (NetworkActivity_Flow_Direction) Type 

func (NetworkActivity_Flow_Direction) Type() protoreflect.EnumType

type NetworkActivity_Flow_SocketFamily 

type NetworkActivity_Flow_SocketFamily int32
const (
	NetworkActivity_Flow_SOCKET_FAMILY_UNKNOWN NetworkActivity_Flow_SocketFamily = 0
	NetworkActivity_Flow_SOCKET_FAMILY_INET    NetworkActivity_Flow_SocketFamily = 1
	NetworkActivity_Flow_SOCKET_FAMILY_INET6   NetworkActivity_Flow_SocketFamily = 2
)

func (NetworkActivity_Flow_SocketFamily) Descriptor 

func (NetworkActivity_Flow_SocketFamily) Descriptor() protoreflect.EnumDescriptor

func (NetworkActivity_Flow_SocketFamily) Enum 

func (x NetworkActivity_Flow_SocketFamily) Enum() *NetworkActivity_Flow_SocketFamily

func (NetworkActivity_Flow_SocketFamily) Number 

func (x NetworkActivity_Flow_SocketFamily) Number() protoreflect.EnumNumber

func (NetworkActivity_Flow_SocketFamily) String 

func (x NetworkActivity_Flow_SocketFamily) String() string

func (NetworkActivity_Flow_SocketFamily) Type 

func (NetworkActivity_Flow_SocketFamily) Type() protoreflect.EnumType

type NetworkActivity_Flow_Tier 

type NetworkActivity_Flow_Tier int32

How the winning rule's remote matcher matched, most to least specific. 

const (
	NetworkActivity_Flow_TIER_UNKNOWN    NetworkActivity_Flow_Tier = 0
	NetworkActivity_Flow_TIER_EXACT_IP   NetworkActivity_Flow_Tier = 1
	NetworkActivity_Flow_TIER_CIDR       NetworkActivity_Flow_Tier = 2
	NetworkActivity_Flow_TIER_HOSTNAME   NetworkActivity_Flow_Tier = 3
	NetworkActivity_Flow_TIER_DOMAIN     NetworkActivity_Flow_Tier = 4
	NetworkActivity_Flow_TIER_ANY_REMOTE NetworkActivity_Flow_Tier = 5
)

func (NetworkActivity_Flow_Tier) Descriptor 

func (NetworkActivity_Flow_Tier) Descriptor() protoreflect.EnumDescriptor

func (NetworkActivity_Flow_Tier) Enum 

func (x NetworkActivity_Flow_Tier) Enum() *NetworkActivity_Flow_Tier

func (NetworkActivity_Flow_Tier) Number 

func (x NetworkActivity_Flow_Tier) Number() protoreflect.EnumNumber

func (NetworkActivity_Flow_Tier) String 

func (x NetworkActivity_Flow_Tier) String() string

func (NetworkActivity_Flow_Tier) Type 

func (NetworkActivity_Flow_Tier) Type() protoreflect.EnumType

type NetworkActivity_Flow_builder 

type NetworkActivity_Flow_builder struct {

	// Identifier for this flow.
	// Note: Apple can reuse flow identifiers under certain conditions.
	// Use `id + hash` as a unique identifier.
	Id *string
	// A Santa-computed identifier to help distinguish duplicate flow ids.
	Hash *string
	// Remote endpoint address (IPv4 or IPv6 string representation)
	RemoteAddress *string
	RemotePort    *uint32
	// Remote endpoint hostname, when known. Set when the flow was created
	// via Network.framework/NSURLSession, or when the remote address was
	// resolved through the DNS cache.
	RemoteHostname *string
	// Local endpoint address (IPv4 or IPv6 string representation)
	LocalAddress *string
	LocalPort    *uint32
	// IP protocol number (e.g. 6 for TCP, 17 for UDP)
	Protocol     *int32
	SocketFamily *NetworkActivity_Flow_SocketFamily
	Direction    *NetworkActivity_Flow_Direction
	// Cumulative byte counts for this flow
	BytesInbound  *uint64
	BytesOutbound *uint64
	// When the flow was first observed
	// Only present if the flow started during this window
	// If a flow began before Santa began monitoring then this field will never
	// be set for the flow id
	StartTime *timestamppb.Timestamp
	// When the flow was closed
	// Only present if the flow closed during this window
	CloseTime    *timestamppb.Timestamp
	Decision     *NetworkActivity_Flow_Decision
	DecisionTier *NetworkActivity_Flow_Tier
	// Winning rule id (0 if no rule matched) and name (empty if none).
	RuleId   *int64
	RuleName *string
	// contains filtered or unexported fields
}

func (NetworkActivity_Flow_builder) Build 

func (b0 NetworkActivity_Flow_builder) Build() *NetworkActivity_Flow

type NetworkActivity_Process 

type NetworkActivity_Process struct {

	// Information about the process performing network activity
	Process *ProcessInfo `protobuf:"bytes,1,opt,name=process,proto3,oneof" json:"process,omitempty"`
	// Active flows for this process during the window
	Flows []*NetworkActivity_Flow `protobuf:"bytes,2,rep,name=flows,proto3" json:"flows,omitempty"`
	// contains filtered or unexported fields
}

Network activity for a single process

func (*NetworkActivity_Process) ClearProcess 

func (x *NetworkActivity_Process) ClearProcess()

func (*NetworkActivity_Process) GetFlows 

func (x *NetworkActivity_Process) GetFlows() []*NetworkActivity_Flow

func (*NetworkActivity_Process) GetProcess 

func (x *NetworkActivity_Process) GetProcess() *ProcessInfo

func (*NetworkActivity_Process) HasProcess 

func (x *NetworkActivity_Process) HasProcess() bool

func (*NetworkActivity_Process) ProtoMessage 

func (*NetworkActivity_Process) ProtoMessage()

func (*NetworkActivity_Process) ProtoReflect 

func (x *NetworkActivity_Process) ProtoReflect() protoreflect.Message

func (*NetworkActivity_Process) Reset 

func (x *NetworkActivity_Process) Reset()

func (*NetworkActivity_Process) SetFlows 

func (x *NetworkActivity_Process) SetFlows(v []*NetworkActivity_Flow)

func (*NetworkActivity_Process) SetProcess 

func (x *NetworkActivity_Process) SetProcess(v *ProcessInfo)

func (*NetworkActivity_Process) String 

func (x *NetworkActivity_Process) String() string

type NetworkActivity_Process_builder 

type NetworkActivity_Process_builder struct {

	// Information about the process performing network activity
	Process *ProcessInfo
	// Active flows for this process during the window
	Flows []*NetworkActivity_Flow
	// contains filtered or unexported fields
}

func (NetworkActivity_Process_builder) Build 

func (b0 NetworkActivity_Process_builder) Build() *NetworkActivity_Process

type NetworkActivity_builder 

type NetworkActivity_builder struct {

	// All processes with network activity during this window
	Processes []*NetworkActivity_Process
	// contains filtered or unexported fields
}

func (NetworkActivity_builder) Build 

func (b0 NetworkActivity_builder) Build() *NetworkActivity

type Open 

type Open struct {

	// The process that is opening the file
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The file being opened
	Target *FileInfo `protobuf:"bytes,2,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// Bitmask of flags used to open the file
	// Note: Represents the mask applied by the kernel, not the typical `open(2)`
	// flags (e.g. FREAD, FWRITE instead of O_RDONLY, O_RDWR, etc...)
	Flags *int32 `protobuf:"varint,3,opt,name=flags,proto3,oneof" json:"flags,omitempty"`
	// contains filtered or unexported fields
}

Information about an open event

func (*Open) ClearFlags 

func (x *Open) ClearFlags()

func (*Open) ClearInstigator 

func (x *Open) ClearInstigator()

func (*Open) ClearTarget 

func (x *Open) ClearTarget()

func (*Open) GetFlags 

func (x *Open) GetFlags() int32

func (*Open) GetInstigator 

func (x *Open) GetInstigator() *ProcessInfoLight

func (*Open) GetTarget 

func (x *Open) GetTarget() *FileInfo

func (*Open) HasFlags 

func (x *Open) HasFlags() bool

func (*Open) HasInstigator 

func (x *Open) HasInstigator() bool

func (*Open) HasTarget 

func (x *Open) HasTarget() bool

func (*Open) ProtoMessage 

func (*Open) ProtoMessage()

func (*Open) ProtoReflect 

func (x *Open) ProtoReflect() protoreflect.Message

func (*Open) Reset 

func (x *Open) Reset()

func (*Open) SetFlags 

func (x *Open) SetFlags(v int32)

func (*Open) SetInstigator 

func (x *Open) SetInstigator(v *ProcessInfoLight)

func (*Open) SetTarget 

func (x *Open) SetTarget(v *FileInfo)

func (*Open) String 

func (x *Open) String() string

type OpenSSH 

type OpenSSH struct {

	// Types that are valid to be assigned to Event:
	//
	//	*OpenSSH_Login
	//	*OpenSSH_Logout
	Event isOpenSSH_Event `protobuf_oneof:"event"`
	// contains filtered or unexported fields
}

Information about login/logout events from the macOS OpenSSH implementation

func (*OpenSSH) ClearEvent 

func (x *OpenSSH) ClearEvent()

func (*OpenSSH) ClearLogin 

func (x *OpenSSH) ClearLogin()

func (*OpenSSH) ClearLogout 

func (x *OpenSSH) ClearLogout()

func (*OpenSSH) GetEvent 

func (x *OpenSSH) GetEvent() isOpenSSH_Event

func (*OpenSSH) GetLogin 

func (x *OpenSSH) GetLogin() *OpenSSHLogin

func (*OpenSSH) GetLogout 

func (x *OpenSSH) GetLogout() *OpenSSHLogout

func (*OpenSSH) HasEvent 

func (x *OpenSSH) HasEvent() bool

func (*OpenSSH) HasLogin 

func (x *OpenSSH) HasLogin() bool

func (*OpenSSH) HasLogout 

func (x *OpenSSH) HasLogout() bool

func (*OpenSSH) ProtoMessage 

func (*OpenSSH) ProtoMessage()

func (*OpenSSH) ProtoReflect 

func (x *OpenSSH) ProtoReflect() protoreflect.Message

func (*OpenSSH) Reset 

func (x *OpenSSH) Reset()

func (*OpenSSH) SetLogin 

func (x *OpenSSH) SetLogin(v *OpenSSHLogin)

func (*OpenSSH) SetLogout 

func (x *OpenSSH) SetLogout(v *OpenSSHLogout)

func (*OpenSSH) String 

func (x *OpenSSH) String() string

func (*OpenSSH) WhichEvent 

func (x *OpenSSH) WhichEvent() case_OpenSSH_Event

type OpenSSHLogin 

type OpenSSHLogin struct {

	// The process that emitted the login event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The result of the login attempt
	// Note: Successful if type == `RESULT_AUTH_SUCCESS`
	Result *OpenSSHLogin_Result `protobuf:"varint,2,opt,name=result,proto3,enum=santa.telemetry.v1.OpenSSHLogin_Result,oneof" json:"result,omitempty"`
	// Source address of the connection
	Source *SocketAddress `protobuf:"bytes,3,opt,name=source,proto3,oneof" json:"source,omitempty"`
	// Name of the user that attempted to login
	// Note: `uid` data may not always exist on failed attempts
	User *UserInfo `protobuf:"bytes,4,opt,name=user,proto3,oneof" json:"user,omitempty"`
	// contains filtered or unexported fields
}

Information about SSH login events from the macOS OpenSSH implementation

func (*OpenSSHLogin) ClearInstigator 

func (x *OpenSSHLogin) ClearInstigator()

func (*OpenSSHLogin) ClearResult 

func (x *OpenSSHLogin) ClearResult()

func (*OpenSSHLogin) ClearSource 

func (x *OpenSSHLogin) ClearSource()

func (*OpenSSHLogin) ClearUser 

func (x *OpenSSHLogin) ClearUser()

func (*OpenSSHLogin) GetInstigator 

func (x *OpenSSHLogin) GetInstigator() *ProcessInfoLight

func (*OpenSSHLogin) GetResult 

func (x *OpenSSHLogin) GetResult() OpenSSHLogin_Result

func (*OpenSSHLogin) GetSource 

func (x *OpenSSHLogin) GetSource() *SocketAddress

func (*OpenSSHLogin) GetUser 

func (x *OpenSSHLogin) GetUser() *UserInfo

func (*OpenSSHLogin) HasInstigator 

func (x *OpenSSHLogin) HasInstigator() bool

func (*OpenSSHLogin) HasResult 

func (x *OpenSSHLogin) HasResult() bool

func (*OpenSSHLogin) HasSource 

func (x *OpenSSHLogin) HasSource() bool

func (*OpenSSHLogin) HasUser 

func (x *OpenSSHLogin) HasUser() bool

func (*OpenSSHLogin) ProtoMessage 

func (*OpenSSHLogin) ProtoMessage()

func (*OpenSSHLogin) ProtoReflect 

func (x *OpenSSHLogin) ProtoReflect() protoreflect.Message

func (*OpenSSHLogin) Reset 

func (x *OpenSSHLogin) Reset()

func (*OpenSSHLogin) SetInstigator 

func (x *OpenSSHLogin) SetInstigator(v *ProcessInfoLight)

func (*OpenSSHLogin) SetResult 

func (x *OpenSSHLogin) SetResult(v OpenSSHLogin_Result)

func (*OpenSSHLogin) SetSource 

func (x *OpenSSHLogin) SetSource(v *SocketAddress)

func (*OpenSSHLogin) SetUser 

func (x *OpenSSHLogin) SetUser(v *UserInfo)

func (*OpenSSHLogin) String 

func (x *OpenSSHLogin) String() string

type OpenSSHLogin_Result 

type OpenSSHLogin_Result int32
const (
	OpenSSHLogin_RESULT_UNKNOWN               OpenSSHLogin_Result = 0
	OpenSSHLogin_RESULT_LOGIN_EXCEED_MAXTRIES OpenSSHLogin_Result = 1
	OpenSSHLogin_RESULT_LOGIN_ROOT_DENIED     OpenSSHLogin_Result = 2
	OpenSSHLogin_RESULT_AUTH_SUCCESS          OpenSSHLogin_Result = 3
	OpenSSHLogin_RESULT_AUTH_FAIL_NONE        OpenSSHLogin_Result = 4
	OpenSSHLogin_RESULT_AUTH_FAIL_PASSWD      OpenSSHLogin_Result = 5
	OpenSSHLogin_RESULT_AUTH_FAIL_KBDINT      OpenSSHLogin_Result = 6
	OpenSSHLogin_RESULT_AUTH_FAIL_PUBKEY      OpenSSHLogin_Result = 7
	OpenSSHLogin_RESULT_AUTH_FAIL_HOSTBASED   OpenSSHLogin_Result = 8
	OpenSSHLogin_RESULT_AUTH_FAIL_GSSAPI      OpenSSHLogin_Result = 9
	OpenSSHLogin_RESULT_INVALID_USER          OpenSSHLogin_Result = 10
)

func (OpenSSHLogin_Result) Descriptor 

func (OpenSSHLogin_Result) Descriptor() protoreflect.EnumDescriptor

func (OpenSSHLogin_Result) Enum 

func (x OpenSSHLogin_Result) Enum() *OpenSSHLogin_Result

func (OpenSSHLogin_Result) Number 

func (x OpenSSHLogin_Result) Number() protoreflect.EnumNumber

func (OpenSSHLogin_Result) String 

func (x OpenSSHLogin_Result) String() string

func (OpenSSHLogin_Result) Type 

func (OpenSSHLogin_Result) Type() protoreflect.EnumType

type OpenSSHLogin_builder 

type OpenSSHLogin_builder struct {

	// The process that emitted the login event
	Instigator *ProcessInfoLight
	// The result of the login attempt
	// Note: Successful if type == `RESULT_AUTH_SUCCESS`
	Result *OpenSSHLogin_Result
	// Source address of the connection
	Source *SocketAddress
	// Name of the user that attempted to login
	// Note: `uid` data may not always exist on failed attempts
	User *UserInfo
	// contains filtered or unexported fields
}

func (OpenSSHLogin_builder) Build 

func (b0 OpenSSHLogin_builder) Build() *OpenSSHLogin

type OpenSSHLogout 

type OpenSSHLogout struct {

	// The process that emitted the logout event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Source address of the connection
	Source *SocketAddress `protobuf:"bytes,2,opt,name=source,proto3,oneof" json:"source,omitempty"`
	// Information about the user that logged out
	User *UserInfo `protobuf:"bytes,3,opt,name=user,proto3,oneof" json:"user,omitempty"`
	// contains filtered or unexported fields
}

Information about SSH logout events from the macOS OpenSSH implementation

func (*OpenSSHLogout) ClearInstigator 

func (x *OpenSSHLogout) ClearInstigator()

func (*OpenSSHLogout) ClearSource 

func (x *OpenSSHLogout) ClearSource()

func (*OpenSSHLogout) ClearUser 

func (x *OpenSSHLogout) ClearUser()

func (*OpenSSHLogout) GetInstigator 

func (x *OpenSSHLogout) GetInstigator() *ProcessInfoLight

func (*OpenSSHLogout) GetSource 

func (x *OpenSSHLogout) GetSource() *SocketAddress

func (*OpenSSHLogout) GetUser 

func (x *OpenSSHLogout) GetUser() *UserInfo

func (*OpenSSHLogout) HasInstigator 

func (x *OpenSSHLogout) HasInstigator() bool

func (*OpenSSHLogout) HasSource 

func (x *OpenSSHLogout) HasSource() bool

func (*OpenSSHLogout) HasUser 

func (x *OpenSSHLogout) HasUser() bool

func (*OpenSSHLogout) ProtoMessage 

func (*OpenSSHLogout) ProtoMessage()

func (*OpenSSHLogout) ProtoReflect 

func (x *OpenSSHLogout) ProtoReflect() protoreflect.Message

func (*OpenSSHLogout) Reset 

func (x *OpenSSHLogout) Reset()

func (*OpenSSHLogout) SetInstigator 

func (x *OpenSSHLogout) SetInstigator(v *ProcessInfoLight)

func (*OpenSSHLogout) SetSource 

func (x *OpenSSHLogout) SetSource(v *SocketAddress)

func (*OpenSSHLogout) SetUser 

func (x *OpenSSHLogout) SetUser(v *UserInfo)

func (*OpenSSHLogout) String 

func (x *OpenSSHLogout) String() string

type OpenSSHLogout_builder 

type OpenSSHLogout_builder struct {

	// The process that emitted the logout event
	Instigator *ProcessInfoLight
	// Source address of the connection
	Source *SocketAddress
	// Information about the user that logged out
	User *UserInfo
	// contains filtered or unexported fields
}

func (OpenSSHLogout_builder) Build 

func (b0 OpenSSHLogout_builder) Build() *OpenSSHLogout

type OpenSSH_Login 

type OpenSSH_Login struct {
	Login *OpenSSHLogin `protobuf:"bytes,1,opt,name=login,proto3,oneof"`
}

type OpenSSH_Logout 

type OpenSSH_Logout struct {
	Logout *OpenSSHLogout `protobuf:"bytes,2,opt,name=logout,proto3,oneof"`
}

type OpenSSH_builder 

type OpenSSH_builder struct {

	// Fields of oneof Event:
	Login  *OpenSSHLogin
	Logout *OpenSSHLogout
	// contains filtered or unexported fields
}

func (OpenSSH_builder) Build 

func (b0 OpenSSH_builder) Build() *OpenSSH

type Open_builder 

type Open_builder struct {

	// The process that is opening the file
	Instigator *ProcessInfoLight
	// The file being opened
	Target *FileInfo
	// Bitmask of flags used to open the file
	// Note: Represents the mask applied by the kernel, not the typical `open(2)`
	// flags (e.g. FREAD, FWRITE instead of O_RDONLY, O_RDWR, etc...)
	Flags *int32
	// contains filtered or unexported fields
}

func (Open_builder) Build 

func (b0 Open_builder) Build() *Open

type ProcSuspendResume 

type ProcSuspendResume struct {

	// The process initiating the suspend/resume
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The target process being suspended/resumed
	Target *ProcessInfo            `protobuf:"bytes,2,opt,name=target,proto3,oneof" json:"target,omitempty"`
	Type   *ProcSuspendResume_Type `protobuf:"varint,3,opt,name=type,proto3,enum=santa.telemetry.v1.ProcSuspendResume_Type,oneof" json:"type,omitempty"`
	// contains filtered or unexported fields
}

Information about a process suspend/resume event

func (*ProcSuspendResume) ClearInstigator 

func (x *ProcSuspendResume) ClearInstigator()

func (*ProcSuspendResume) ClearTarget 

func (x *ProcSuspendResume) ClearTarget()

func (*ProcSuspendResume) ClearType 

func (x *ProcSuspendResume) ClearType()

func (*ProcSuspendResume) GetInstigator 

func (x *ProcSuspendResume) GetInstigator() *ProcessInfoLight

func (*ProcSuspendResume) GetTarget 

func (x *ProcSuspendResume) GetTarget() *ProcessInfo

func (*ProcSuspendResume) GetType 

func (x *ProcSuspendResume) GetType() ProcSuspendResume_Type

func (*ProcSuspendResume) HasInstigator 

func (x *ProcSuspendResume) HasInstigator() bool

func (*ProcSuspendResume) HasTarget 

func (x *ProcSuspendResume) HasTarget() bool

func (*ProcSuspendResume) HasType 

func (x *ProcSuspendResume) HasType() bool

func (*ProcSuspendResume) ProtoMessage 

func (*ProcSuspendResume) ProtoMessage()

func (*ProcSuspendResume) ProtoReflect 

func (x *ProcSuspendResume) ProtoReflect() protoreflect.Message

func (*ProcSuspendResume) Reset 

func (x *ProcSuspendResume) Reset()

func (*ProcSuspendResume) SetInstigator 

func (x *ProcSuspendResume) SetInstigator(v *ProcessInfoLight)

func (*ProcSuspendResume) SetTarget 

func (x *ProcSuspendResume) SetTarget(v *ProcessInfo)

func (*ProcSuspendResume) SetType 

func (x *ProcSuspendResume) SetType(v ProcSuspendResume_Type)

func (*ProcSuspendResume) String 

func (x *ProcSuspendResume) String() string

type ProcSuspendResume_Type 

type ProcSuspendResume_Type int32

The type of suspend/resume action 

const (
	ProcSuspendResume_TYPE_UNKNOWN          ProcSuspendResume_Type = 0
	ProcSuspendResume_TYPE_SUSPEND          ProcSuspendResume_Type = 1
	ProcSuspendResume_TYPE_RESUME           ProcSuspendResume_Type = 2
	ProcSuspendResume_TYPE_SHUTDOWN_SOCKETS ProcSuspendResume_Type = 3
)

func (ProcSuspendResume_Type) Descriptor 

func (ProcSuspendResume_Type) Descriptor() protoreflect.EnumDescriptor

func (ProcSuspendResume_Type) Enum 

func (x ProcSuspendResume_Type) Enum() *ProcSuspendResume_Type

func (ProcSuspendResume_Type) Number 

func (x ProcSuspendResume_Type) Number() protoreflect.EnumNumber

func (ProcSuspendResume_Type) String 

func (x ProcSuspendResume_Type) String() string

func (ProcSuspendResume_Type) Type 

func (ProcSuspendResume_Type) Type() protoreflect.EnumType

type ProcSuspendResume_builder 

type ProcSuspendResume_builder struct {

	// The process initiating the suspend/resume
	Instigator *ProcessInfoLight
	// The target process being suspended/resumed
	Target *ProcessInfo
	Type   *ProcSuspendResume_Type
	// contains filtered or unexported fields
}

func (ProcSuspendResume_builder) Build 

func (b0 ProcSuspendResume_builder) Build() *ProcSuspendResume

type ProcessID 

type ProcessID struct {
	Pid        *int32 `protobuf:"varint,1,opt,name=pid,proto3,oneof" json:"pid,omitempty"`
	Pidversion *int32 `protobuf:"varint,2,opt,name=pidversion,proto3,oneof" json:"pidversion,omitempty"`
	// contains filtered or unexported fields
}

A macOS process is identified by its pid and pidversion.

This identifier is unique during the runtime of the operating system, but not unique across restarts.

func (*ProcessID) ClearPid 

func (x *ProcessID) ClearPid()

func (*ProcessID) ClearPidversion 

func (x *ProcessID) ClearPidversion()

func (*ProcessID) GetPid 

func (x *ProcessID) GetPid() int32

func (*ProcessID) GetPidversion 

func (x *ProcessID) GetPidversion() int32

func (*ProcessID) HasPid 

func (x *ProcessID) HasPid() bool

func (*ProcessID) HasPidversion 

func (x *ProcessID) HasPidversion() bool

func (*ProcessID) ProtoMessage 

func (*ProcessID) ProtoMessage()

func (*ProcessID) ProtoReflect 

func (x *ProcessID) ProtoReflect() protoreflect.Message

func (*ProcessID) Reset 

func (x *ProcessID) Reset()

func (*ProcessID) SetPid 

func (x *ProcessID) SetPid(v int32)

func (*ProcessID) SetPidversion 

func (x *ProcessID) SetPidversion(v int32)

func (*ProcessID) String 

func (x *ProcessID) String() string

type ProcessID_builder 

type ProcessID_builder struct {
	Pid        *int32
	Pidversion *int32
	// contains filtered or unexported fields
}

func (ProcessID_builder) Build 

func (b0 ProcessID_builder) Build() *ProcessID

type ProcessInfo 

type ProcessInfo struct {

	// Process ID of the process
	Id *ProcessID `protobuf:"bytes,1,opt,name=id,proto3,oneof" json:"id,omitempty"`
	// Process ID of the parent process
	ParentId *ProcessID `protobuf:"bytes,2,opt,name=parent_id,json=parentId,proto3,oneof" json:"parent_id,omitempty"`
	// Process ID of the process responsible for this one
	ResponsibleId *ProcessID `protobuf:"bytes,3,opt,name=responsible_id,json=responsibleId,proto3,oneof" json:"responsible_id,omitempty"`
	// Original parent ID, remains stable in the event a process is reparented
	OriginalParentPid *int32 `protobuf:"varint,4,opt,name=original_parent_pid,json=originalParentPid,proto3,oneof" json:"original_parent_pid,omitempty"`
	// Process group id the process belongs to
	GroupId *int32 `protobuf:"varint,5,opt,name=group_id,json=groupId,proto3,oneof" json:"group_id,omitempty"`
	// Session id the process belongs to
	SessionId *int32 `protobuf:"varint,6,opt,name=session_id,json=sessionId,proto3,oneof" json:"session_id,omitempty"`
	// Effective user/group info
	EffectiveUser  *UserInfo  `protobuf:"bytes,7,opt,name=effective_user,json=effectiveUser,proto3,oneof" json:"effective_user,omitempty"`
	EffectiveGroup *GroupInfo `protobuf:"bytes,8,opt,name=effective_group,json=effectiveGroup,proto3,oneof" json:"effective_group,omitempty"`
	// Real user/group info
	RealUser  *UserInfo  `protobuf:"bytes,9,opt,name=real_user,json=realUser,proto3,oneof" json:"real_user,omitempty"`
	RealGroup *GroupInfo `protobuf:"bytes,10,opt,name=real_group,json=realGroup,proto3,oneof" json:"real_group,omitempty"`
	// Whether or not the process was signed with Apple certificates
	IsPlatformBinary *bool `protobuf:"varint,11,opt,name=is_platform_binary,json=isPlatformBinary,proto3,oneof" json:"is_platform_binary,omitempty"`
	// Whether or not the process is an ES client
	IsEsClient *bool `protobuf:"varint,12,opt,name=is_es_client,json=isEsClient,proto3,oneof" json:"is_es_client,omitempty"`
	// Code signature information for the process
	CodeSignature *CodeSignature `protobuf:"bytes,13,opt,name=code_signature,json=codeSignature,proto3,oneof" json:"code_signature,omitempty"`
	// Codesigning flags for the process (from `<Kernel/kern/cs_blobs.h>`)
	CsFlags *uint32 `protobuf:"varint,14,opt,name=cs_flags,json=csFlags,proto3,oneof" json:"cs_flags,omitempty"`
	// File information for the executable backing this process
	Executable *FileInfo `protobuf:"bytes,15,opt,name=executable,proto3,oneof" json:"executable,omitempty"`
	// File information for the associated TTY
	Tty *FileInfoLight `protobuf:"bytes,16,opt,name=tty,proto3,oneof" json:"tty,omitempty"`
	// Time the process was started
	StartTime *timestamppb.Timestamp `protobuf:"bytes,17,opt,name=start_time,json=startTime,proto3,oneof" json:"start_time,omitempty"`
	// contains filtered or unexported fields
}

Process information

func (*ProcessInfo) ClearCodeSignature 

func (x *ProcessInfo) ClearCodeSignature()

func (*ProcessInfo) ClearCsFlags 

func (x *ProcessInfo) ClearCsFlags()

func (*ProcessInfo) ClearEffectiveGroup 

func (x *ProcessInfo) ClearEffectiveGroup()

func (*ProcessInfo) ClearEffectiveUser 

func (x *ProcessInfo) ClearEffectiveUser()

func (*ProcessInfo) ClearExecutable 

func (x *ProcessInfo) ClearExecutable()

func (*ProcessInfo) ClearGroupId 

func (x *ProcessInfo) ClearGroupId()

func (*ProcessInfo) ClearId 

func (x *ProcessInfo) ClearId()

func (*ProcessInfo) ClearIsEsClient 

func (x *ProcessInfo) ClearIsEsClient()

func (*ProcessInfo) ClearIsPlatformBinary 

func (x *ProcessInfo) ClearIsPlatformBinary()

func (*ProcessInfo) ClearOriginalParentPid 

func (x *ProcessInfo) ClearOriginalParentPid()

func (*ProcessInfo) ClearParentId 

func (x *ProcessInfo) ClearParentId()

func (*ProcessInfo) ClearRealGroup 

func (x *ProcessInfo) ClearRealGroup()

func (*ProcessInfo) ClearRealUser 

func (x *ProcessInfo) ClearRealUser()

func (*ProcessInfo) ClearResponsibleId 

func (x *ProcessInfo) ClearResponsibleId()

func (*ProcessInfo) ClearSessionId 

func (x *ProcessInfo) ClearSessionId()

func (*ProcessInfo) ClearStartTime 

func (x *ProcessInfo) ClearStartTime()

func (*ProcessInfo) ClearTty 

func (x *ProcessInfo) ClearTty()

func (*ProcessInfo) GetCodeSignature 

func (x *ProcessInfo) GetCodeSignature() *CodeSignature

func (*ProcessInfo) GetCsFlags 

func (x *ProcessInfo) GetCsFlags() uint32

func (*ProcessInfo) GetEffectiveGroup 

func (x *ProcessInfo) GetEffectiveGroup() *GroupInfo

func (*ProcessInfo) GetEffectiveUser 

func (x *ProcessInfo) GetEffectiveUser() *UserInfo

func (*ProcessInfo) GetExecutable 

func (x *ProcessInfo) GetExecutable() *FileInfo

func (*ProcessInfo) GetGroupId 

func (x *ProcessInfo) GetGroupId() int32

func (*ProcessInfo) GetId 

func (x *ProcessInfo) GetId() *ProcessID

func (*ProcessInfo) GetIsEsClient 

func (x *ProcessInfo) GetIsEsClient() bool

func (*ProcessInfo) GetIsPlatformBinary 

func (x *ProcessInfo) GetIsPlatformBinary() bool

func (*ProcessInfo) GetOriginalParentPid 

func (x *ProcessInfo) GetOriginalParentPid() int32

func (*ProcessInfo) GetParentId 

func (x *ProcessInfo) GetParentId() *ProcessID

func (*ProcessInfo) GetRealGroup 

func (x *ProcessInfo) GetRealGroup() *GroupInfo

func (*ProcessInfo) GetRealUser 

func (x *ProcessInfo) GetRealUser() *UserInfo

func (*ProcessInfo) GetResponsibleId 

func (x *ProcessInfo) GetResponsibleId() *ProcessID

func (*ProcessInfo) GetSessionId 

func (x *ProcessInfo) GetSessionId() int32

func (*ProcessInfo) GetStartTime 

func (x *ProcessInfo) GetStartTime() *timestamppb.Timestamp

func (*ProcessInfo) GetTty 

func (x *ProcessInfo) GetTty() *FileInfoLight

func (*ProcessInfo) HasCodeSignature 

func (x *ProcessInfo) HasCodeSignature() bool

func (*ProcessInfo) HasCsFlags 

func (x *ProcessInfo) HasCsFlags() bool

func (*ProcessInfo) HasEffectiveGroup 

func (x *ProcessInfo) HasEffectiveGroup() bool

func (*ProcessInfo) HasEffectiveUser 

func (x *ProcessInfo) HasEffectiveUser() bool

func (*ProcessInfo) HasExecutable 

func (x *ProcessInfo) HasExecutable() bool

func (*ProcessInfo) HasGroupId 

func (x *ProcessInfo) HasGroupId() bool

func (*ProcessInfo) HasId 

func (x *ProcessInfo) HasId() bool

func (*ProcessInfo) HasIsEsClient 

func (x *ProcessInfo) HasIsEsClient() bool

func (*ProcessInfo) HasIsPlatformBinary 

func (x *ProcessInfo) HasIsPlatformBinary() bool

func (*ProcessInfo) HasOriginalParentPid 

func (x *ProcessInfo) HasOriginalParentPid() bool

func (*ProcessInfo) HasParentId 

func (x *ProcessInfo) HasParentId() bool

func (*ProcessInfo) HasRealGroup 

func (x *ProcessInfo) HasRealGroup() bool

func (*ProcessInfo) HasRealUser 

func (x *ProcessInfo) HasRealUser() bool

func (*ProcessInfo) HasResponsibleId 

func (x *ProcessInfo) HasResponsibleId() bool

func (*ProcessInfo) HasSessionId 

func (x *ProcessInfo) HasSessionId() bool

func (*ProcessInfo) HasStartTime 

func (x *ProcessInfo) HasStartTime() bool

func (*ProcessInfo) HasTty 

func (x *ProcessInfo) HasTty() bool

func (*ProcessInfo) ProtoMessage 

func (*ProcessInfo) ProtoMessage()

func (*ProcessInfo) ProtoReflect 

func (x *ProcessInfo) ProtoReflect() protoreflect.Message

func (*ProcessInfo) Reset 

func (x *ProcessInfo) Reset()

func (*ProcessInfo) SetCodeSignature 

func (x *ProcessInfo) SetCodeSignature(v *CodeSignature)

func (*ProcessInfo) SetCsFlags 

func (x *ProcessInfo) SetCsFlags(v uint32)

func (*ProcessInfo) SetEffectiveGroup 

func (x *ProcessInfo) SetEffectiveGroup(v *GroupInfo)

func (*ProcessInfo) SetEffectiveUser 

func (x *ProcessInfo) SetEffectiveUser(v *UserInfo)

func (*ProcessInfo) SetExecutable 

func (x *ProcessInfo) SetExecutable(v *FileInfo)

func (*ProcessInfo) SetGroupId 

func (x *ProcessInfo) SetGroupId(v int32)

func (*ProcessInfo) SetId 

func (x *ProcessInfo) SetId(v *ProcessID)

func (*ProcessInfo) SetIsEsClient 

func (x *ProcessInfo) SetIsEsClient(v bool)

func (*ProcessInfo) SetIsPlatformBinary 

func (x *ProcessInfo) SetIsPlatformBinary(v bool)

func (*ProcessInfo) SetOriginalParentPid 

func (x *ProcessInfo) SetOriginalParentPid(v int32)

func (*ProcessInfo) SetParentId 

func (x *ProcessInfo) SetParentId(v *ProcessID)

func (*ProcessInfo) SetRealGroup 

func (x *ProcessInfo) SetRealGroup(v *GroupInfo)

func (*ProcessInfo) SetRealUser 

func (x *ProcessInfo) SetRealUser(v *UserInfo)

func (*ProcessInfo) SetResponsibleId 

func (x *ProcessInfo) SetResponsibleId(v *ProcessID)

func (*ProcessInfo) SetSessionId 

func (x *ProcessInfo) SetSessionId(v int32)

func (*ProcessInfo) SetStartTime 

func (x *ProcessInfo) SetStartTime(v *timestamppb.Timestamp)

func (*ProcessInfo) SetTty 

func (x *ProcessInfo) SetTty(v *FileInfoLight)

func (*ProcessInfo) String 

func (x *ProcessInfo) String() string

type ProcessInfoLight 

type ProcessInfoLight struct {

	// Process ID of the process
	Id *ProcessID `protobuf:"bytes,1,opt,name=id,proto3,oneof" json:"id,omitempty"`
	// Process ID of the parent process
	ParentId *ProcessID `protobuf:"bytes,2,opt,name=parent_id,json=parentId,proto3,oneof" json:"parent_id,omitempty"`
	// Original parent ID, remains stable in the event a process is reparented
	OriginalParentPid *int32 `protobuf:"varint,3,opt,name=original_parent_pid,json=originalParentPid,proto3,oneof" json:"original_parent_pid,omitempty"`
	// Process group id the process belongs to
	GroupId *int32 `protobuf:"varint,4,opt,name=group_id,json=groupId,proto3,oneof" json:"group_id,omitempty"`
	// Session id the process belongs to
	SessionId *int32 `protobuf:"varint,5,opt,name=session_id,json=sessionId,proto3,oneof" json:"session_id,omitempty"`
	// Effective user/group info
	EffectiveUser  *UserInfo  `protobuf:"bytes,6,opt,name=effective_user,json=effectiveUser,proto3,oneof" json:"effective_user,omitempty"`
	EffectiveGroup *GroupInfo `protobuf:"bytes,7,opt,name=effective_group,json=effectiveGroup,proto3,oneof" json:"effective_group,omitempty"`
	// Real user/group info
	RealUser  *UserInfo  `protobuf:"bytes,8,opt,name=real_user,json=realUser,proto3,oneof" json:"real_user,omitempty"`
	RealGroup *GroupInfo `protobuf:"bytes,9,opt,name=real_group,json=realGroup,proto3,oneof" json:"real_group,omitempty"`
	// File information for the executable backing this process
	Executable *FileInfoLight `protobuf:"bytes,10,opt,name=executable,proto3,oneof" json:"executable,omitempty"`
	// contains filtered or unexported fields
}

Light variant of ProcessInfo message to help minimize on-disk/on-wire sizes

func (*ProcessInfoLight) ClearEffectiveGroup 

func (x *ProcessInfoLight) ClearEffectiveGroup()

func (*ProcessInfoLight) ClearEffectiveUser 

func (x *ProcessInfoLight) ClearEffectiveUser()

func (*ProcessInfoLight) ClearExecutable 

func (x *ProcessInfoLight) ClearExecutable()

func (*ProcessInfoLight) ClearGroupId 

func (x *ProcessInfoLight) ClearGroupId()

func (*ProcessInfoLight) ClearId 

func (x *ProcessInfoLight) ClearId()

func (*ProcessInfoLight) ClearOriginalParentPid 

func (x *ProcessInfoLight) ClearOriginalParentPid()

func (*ProcessInfoLight) ClearParentId 

func (x *ProcessInfoLight) ClearParentId()

func (*ProcessInfoLight) ClearRealGroup 

func (x *ProcessInfoLight) ClearRealGroup()

func (*ProcessInfoLight) ClearRealUser 

func (x *ProcessInfoLight) ClearRealUser()

func (*ProcessInfoLight) ClearSessionId 

func (x *ProcessInfoLight) ClearSessionId()

func (*ProcessInfoLight) GetEffectiveGroup 

func (x *ProcessInfoLight) GetEffectiveGroup() *GroupInfo

func (*ProcessInfoLight) GetEffectiveUser 

func (x *ProcessInfoLight) GetEffectiveUser() *UserInfo

func (*ProcessInfoLight) GetExecutable 

func (x *ProcessInfoLight) GetExecutable() *FileInfoLight

func (*ProcessInfoLight) GetGroupId 

func (x *ProcessInfoLight) GetGroupId() int32

func (*ProcessInfoLight) GetId 

func (x *ProcessInfoLight) GetId() *ProcessID

func (*ProcessInfoLight) GetOriginalParentPid 

func (x *ProcessInfoLight) GetOriginalParentPid() int32

func (*ProcessInfoLight) GetParentId 

func (x *ProcessInfoLight) GetParentId() *ProcessID

func (*ProcessInfoLight) GetRealGroup 

func (x *ProcessInfoLight) GetRealGroup() *GroupInfo

func (*ProcessInfoLight) GetRealUser 

func (x *ProcessInfoLight) GetRealUser() *UserInfo

func (*ProcessInfoLight) GetSessionId 

func (x *ProcessInfoLight) GetSessionId() int32

func (*ProcessInfoLight) HasEffectiveGroup 

func (x *ProcessInfoLight) HasEffectiveGroup() bool

func (*ProcessInfoLight) HasEffectiveUser 

func (x *ProcessInfoLight) HasEffectiveUser() bool

func (*ProcessInfoLight) HasExecutable 

func (x *ProcessInfoLight) HasExecutable() bool

func (*ProcessInfoLight) HasGroupId 

func (x *ProcessInfoLight) HasGroupId() bool

func (*ProcessInfoLight) HasId 

func (x *ProcessInfoLight) HasId() bool

func (*ProcessInfoLight) HasOriginalParentPid 

func (x *ProcessInfoLight) HasOriginalParentPid() bool

func (*ProcessInfoLight) HasParentId 

func (x *ProcessInfoLight) HasParentId() bool

func (*ProcessInfoLight) HasRealGroup 

func (x *ProcessInfoLight) HasRealGroup() bool

func (*ProcessInfoLight) HasRealUser 

func (x *ProcessInfoLight) HasRealUser() bool

func (*ProcessInfoLight) HasSessionId 

func (x *ProcessInfoLight) HasSessionId() bool

func (*ProcessInfoLight) ProtoMessage 

func (*ProcessInfoLight) ProtoMessage()

func (*ProcessInfoLight) ProtoReflect 

func (x *ProcessInfoLight) ProtoReflect() protoreflect.Message

func (*ProcessInfoLight) Reset 

func (x *ProcessInfoLight) Reset()

func (*ProcessInfoLight) SetEffectiveGroup 

func (x *ProcessInfoLight) SetEffectiveGroup(v *GroupInfo)

func (*ProcessInfoLight) SetEffectiveUser 

func (x *ProcessInfoLight) SetEffectiveUser(v *UserInfo)

func (*ProcessInfoLight) SetExecutable 

func (x *ProcessInfoLight) SetExecutable(v *FileInfoLight)

func (*ProcessInfoLight) SetGroupId 

func (x *ProcessInfoLight) SetGroupId(v int32)

func (*ProcessInfoLight) SetId 

func (x *ProcessInfoLight) SetId(v *ProcessID)

func (*ProcessInfoLight) SetOriginalParentPid 

func (x *ProcessInfoLight) SetOriginalParentPid(v int32)

func (*ProcessInfoLight) SetParentId 

func (x *ProcessInfoLight) SetParentId(v *ProcessID)

func (*ProcessInfoLight) SetRealGroup 

func (x *ProcessInfoLight) SetRealGroup(v *GroupInfo)

func (*ProcessInfoLight) SetRealUser 

func (x *ProcessInfoLight) SetRealUser(v *UserInfo)

func (*ProcessInfoLight) SetSessionId 

func (x *ProcessInfoLight) SetSessionId(v int32)

func (*ProcessInfoLight) String 

func (x *ProcessInfoLight) String() string

type ProcessInfoLight_builder 

type ProcessInfoLight_builder struct {

	// Process ID of the process
	Id *ProcessID
	// Process ID of the parent process
	ParentId *ProcessID
	// Original parent ID, remains stable in the event a process is reparented
	OriginalParentPid *int32
	// Process group id the process belongs to
	GroupId *int32
	// Session id the process belongs to
	SessionId *int32
	// Effective user/group info
	EffectiveUser  *UserInfo
	EffectiveGroup *GroupInfo
	// Real user/group info
	RealUser  *UserInfo
	RealGroup *GroupInfo
	// File information for the executable backing this process
	Executable *FileInfoLight
	// contains filtered or unexported fields
}

func (ProcessInfoLight_builder) Build 

func (b0 ProcessInfoLight_builder) Build() *ProcessInfoLight

type ProcessInfo_builder 

type ProcessInfo_builder struct {

	// Process ID of the process
	Id *ProcessID
	// Process ID of the parent process
	ParentId *ProcessID
	// Process ID of the process responsible for this one
	ResponsibleId *ProcessID
	// Original parent ID, remains stable in the event a process is reparented
	OriginalParentPid *int32
	// Process group id the process belongs to
	GroupId *int32
	// Session id the process belongs to
	SessionId *int32
	// Effective user/group info
	EffectiveUser  *UserInfo
	EffectiveGroup *GroupInfo
	// Real user/group info
	RealUser  *UserInfo
	RealGroup *GroupInfo
	// Whether or not the process was signed with Apple certificates
	IsPlatformBinary *bool
	// Whether or not the process is an ES client
	IsEsClient *bool
	// Code signature information for the process
	CodeSignature *CodeSignature
	// Codesigning flags for the process (from `<Kernel/kern/cs_blobs.h>`)
	CsFlags *uint32
	// File information for the executable backing this process
	Executable *FileInfo
	// File information for the associated TTY
	Tty *FileInfoLight
	// Time the process was started
	StartTime *timestamppb.Timestamp
	// contains filtered or unexported fields
}

func (ProcessInfo_builder) Build 

func (b0 ProcessInfo_builder) Build() *ProcessInfo

type Rename 

type Rename struct {

	// The process renaming the file
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The source file being renamed
	Source *FileInfo `protobuf:"bytes,2,opt,name=source,proto3,oneof" json:"source,omitempty"`
	// The target path when the rename is complete
	Target *string `protobuf:"bytes,3,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// Whether or not the target path previously existed
	TargetExisted *bool `protobuf:"varint,4,opt,name=target_existed,json=targetExisted,proto3,oneof" json:"target_existed,omitempty"`
	// contains filtered or unexported fields
}

Information about a rename event

func (*Rename) ClearInstigator 

func (x *Rename) ClearInstigator()

func (*Rename) ClearSource 

func (x *Rename) ClearSource()

func (*Rename) ClearTarget 

func (x *Rename) ClearTarget()

func (*Rename) ClearTargetExisted 

func (x *Rename) ClearTargetExisted()

func (*Rename) GetInstigator 

func (x *Rename) GetInstigator() *ProcessInfoLight

func (*Rename) GetSource 

func (x *Rename) GetSource() *FileInfo

func (*Rename) GetTarget 

func (x *Rename) GetTarget() string

func (*Rename) GetTargetExisted 

func (x *Rename) GetTargetExisted() bool

func (*Rename) HasInstigator 

func (x *Rename) HasInstigator() bool

func (*Rename) HasSource 

func (x *Rename) HasSource() bool

func (*Rename) HasTarget 

func (x *Rename) HasTarget() bool

func (*Rename) HasTargetExisted 

func (x *Rename) HasTargetExisted() bool

func (*Rename) ProtoMessage 

func (*Rename) ProtoMessage()

func (*Rename) ProtoReflect 

func (x *Rename) ProtoReflect() protoreflect.Message

func (*Rename) Reset 

func (x *Rename) Reset()

func (*Rename) SetInstigator 

func (x *Rename) SetInstigator(v *ProcessInfoLight)

func (*Rename) SetSource 

func (x *Rename) SetSource(v *FileInfo)

func (*Rename) SetTarget 

func (x *Rename) SetTarget(v string)

func (*Rename) SetTargetExisted 

func (x *Rename) SetTargetExisted(v bool)

func (*Rename) String 

func (x *Rename) String() string

type Rename_builder 

type Rename_builder struct {

	// The process renaming the file
	Instigator *ProcessInfoLight
	// The source file being renamed
	Source *FileInfo
	// The target path when the rename is complete
	Target *string
	// Whether or not the target path previously existed
	TargetExisted *bool
	// contains filtered or unexported fields
}

func (Rename_builder) Build 

func (b0 Rename_builder) Build() *Rename

type SantaMessage 

type SantaMessage struct {

	// Machine ID of the host emitting this log
	// Only valid when EnableMachineIDDecoration configuration option is set
	MachineId *string `protobuf:"bytes,1,opt,name=machine_id,json=machineId,proto3,oneof" json:"machine_id,omitempty"`
	// Timestamp when the event occurred
	EventTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=event_time,json=eventTime,proto3,oneof" json:"event_time,omitempty"`
	// Timestamp when Santa finished processing the event
	ProcessedTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=processed_time,json=processedTime,proto3,oneof" json:"processed_time,omitempty"`
	// The boot session UUID uniquely identifies a boot cycle. The value
	// will remain the same across sleep/wake/hibernate cycles.
	BootSessionUuid *string `protobuf:"bytes,4,opt,name=boot_session_uuid,json=bootSessionUuid,proto3,oneof" json:"boot_session_uuid,omitempty"`
	// Event ID is an opaque unique identifier for this event.
	EventId *string `protobuf:"bytes,5,opt,name=event_id,json=eventId,proto3,oneof" json:"event_id,omitempty"`
	// Event type being described by this message
	//
	// Types that are valid to be assigned to Event:
	//
	//	*SantaMessage_Execution
	//	*SantaMessage_Fork
	//	*SantaMessage_Exit
	//	*SantaMessage_Close
	//	*SantaMessage_Rename
	//	*SantaMessage_Unlink
	//	*SantaMessage_Link
	//	*SantaMessage_Exchangedata
	//	*SantaMessage_Disk
	//	*SantaMessage_Bundle
	//	*SantaMessage_Allowlist
	//	*SantaMessage_FileAccess
	//	*SantaMessage_CodesigningInvalidated
	//	*SantaMessage_LoginWindowSession
	//	*SantaMessage_LoginLogout
	//	*SantaMessage_ScreenSharing
	//	*SantaMessage_OpenSsh
	//	*SantaMessage_Authentication
	//	*SantaMessage_Clone
	//	*SantaMessage_Copyfile
	//	*SantaMessage_GatekeeperOverride
	//	*SantaMessage_LaunchItem
	//	*SantaMessage_TccModification
	//	*SantaMessage_Xprotect
	//	*SantaMessage_NetworkActivity
	//	*SantaMessage_ProcSuspendResume
	Event isSantaMessage_Event `protobuf_oneof:"event"`
	// contains filtered or unexported fields
}

A message encapsulating a single event

func (*SantaMessage) ClearAllowlist 

func (x *SantaMessage) ClearAllowlist()

func (*SantaMessage) ClearAuthentication 

func (x *SantaMessage) ClearAuthentication()

func (*SantaMessage) ClearBootSessionUuid 

func (x *SantaMessage) ClearBootSessionUuid()

func (*SantaMessage) ClearBundle 

func (x *SantaMessage) ClearBundle()

func (*SantaMessage) ClearClone 

func (x *SantaMessage) ClearClone()

func (*SantaMessage) ClearClose 

func (x *SantaMessage) ClearClose()

func (*SantaMessage) ClearCodesigningInvalidated 

func (x *SantaMessage) ClearCodesigningInvalidated()

func (*SantaMessage) ClearCopyfile 

func (x *SantaMessage) ClearCopyfile()

func (*SantaMessage) ClearDisk 

func (x *SantaMessage) ClearDisk()

func (*SantaMessage) ClearEvent 

func (x *SantaMessage) ClearEvent()

func (*SantaMessage) ClearEventId 

func (x *SantaMessage) ClearEventId()

func (*SantaMessage) ClearEventTime 

func (x *SantaMessage) ClearEventTime()

func (*SantaMessage) ClearExchangedata 

func (x *SantaMessage) ClearExchangedata()

func (*SantaMessage) ClearExecution 

func (x *SantaMessage) ClearExecution()

func (*SantaMessage) ClearExit 

func (x *SantaMessage) ClearExit()

func (*SantaMessage) ClearFileAccess 

func (x *SantaMessage) ClearFileAccess()

func (*SantaMessage) ClearFork 

func (x *SantaMessage) ClearFork()

func (*SantaMessage) ClearGatekeeperOverride 

func (x *SantaMessage) ClearGatekeeperOverride()

func (*SantaMessage) ClearLaunchItem 

func (x *SantaMessage) ClearLaunchItem()
func (x *SantaMessage) ClearLink()

func (*SantaMessage) ClearLoginLogout 

func (x *SantaMessage) ClearLoginLogout()

func (*SantaMessage) ClearLoginWindowSession 

func (x *SantaMessage) ClearLoginWindowSession()

func (*SantaMessage) ClearMachineId 

func (x *SantaMessage) ClearMachineId()

func (*SantaMessage) ClearNetworkActivity 

func (x *SantaMessage) ClearNetworkActivity()

func (*SantaMessage) ClearOpenSsh 

func (x *SantaMessage) ClearOpenSsh()

func (*SantaMessage) ClearProcSuspendResume 

func (x *SantaMessage) ClearProcSuspendResume()

func (*SantaMessage) ClearProcessedTime 

func (x *SantaMessage) ClearProcessedTime()

func (*SantaMessage) ClearRename 

func (x *SantaMessage) ClearRename()

func (*SantaMessage) ClearScreenSharing 

func (x *SantaMessage) ClearScreenSharing()

func (*SantaMessage) ClearTccModification 

func (x *SantaMessage) ClearTccModification()
func (x *SantaMessage) ClearUnlink()

func (*SantaMessage) ClearXprotect 

func (x *SantaMessage) ClearXprotect()

func (*SantaMessage) GetAllowlist 

func (x *SantaMessage) GetAllowlist() *Allowlist

func (*SantaMessage) GetAuthentication 

func (x *SantaMessage) GetAuthentication() *Authentication

func (*SantaMessage) GetBootSessionUuid 

func (x *SantaMessage) GetBootSessionUuid() string

func (*SantaMessage) GetBundle 

func (x *SantaMessage) GetBundle() *Bundle

func (*SantaMessage) GetClone 

func (x *SantaMessage) GetClone() *Clone

func (*SantaMessage) GetClose 

func (x *SantaMessage) GetClose() *Close

func (*SantaMessage) GetCodesigningInvalidated 

func (x *SantaMessage) GetCodesigningInvalidated() *CodesigningInvalidated

func (*SantaMessage) GetCopyfile 

func (x *SantaMessage) GetCopyfile() *Copyfile

func (*SantaMessage) GetDisk 

func (x *SantaMessage) GetDisk() *Disk

func (*SantaMessage) GetEvent 

func (x *SantaMessage) GetEvent() isSantaMessage_Event

func (*SantaMessage) GetEventId 

func (x *SantaMessage) GetEventId() string

func (*SantaMessage) GetEventTime 

func (x *SantaMessage) GetEventTime() *timestamppb.Timestamp

func (*SantaMessage) GetExchangedata 

func (x *SantaMessage) GetExchangedata() *Exchangedata

func (*SantaMessage) GetExecution 

func (x *SantaMessage) GetExecution() *Execution

func (*SantaMessage) GetExit 

func (x *SantaMessage) GetExit() *Exit

func (*SantaMessage) GetFileAccess 

func (x *SantaMessage) GetFileAccess() *FileAccess

func (*SantaMessage) GetFork 

func (x *SantaMessage) GetFork() *Fork

func (*SantaMessage) GetGatekeeperOverride 

func (x *SantaMessage) GetGatekeeperOverride() *GatekeeperOverride

func (*SantaMessage) GetLaunchItem 

func (x *SantaMessage) GetLaunchItem() *LaunchItem
func (x *SantaMessage) GetLink() *Link

func (*SantaMessage) GetLoginLogout 

func (x *SantaMessage) GetLoginLogout() *LoginLogout

func (*SantaMessage) GetLoginWindowSession 

func (x *SantaMessage) GetLoginWindowSession() *LoginWindowSession

func (*SantaMessage) GetMachineId 

func (x *SantaMessage) GetMachineId() string

func (*SantaMessage) GetNetworkActivity 

func (x *SantaMessage) GetNetworkActivity() *NetworkActivity

func (*SantaMessage) GetOpenSsh 

func (x *SantaMessage) GetOpenSsh() *OpenSSH

func (*SantaMessage) GetProcSuspendResume 

func (x *SantaMessage) GetProcSuspendResume() *ProcSuspendResume

func (*SantaMessage) GetProcessedTime 

func (x *SantaMessage) GetProcessedTime() *timestamppb.Timestamp

func (*SantaMessage) GetRename 

func (x *SantaMessage) GetRename() *Rename

func (*SantaMessage) GetScreenSharing 

func (x *SantaMessage) GetScreenSharing() *ScreenSharing

func (*SantaMessage) GetTccModification 

func (x *SantaMessage) GetTccModification() *TCCModification
func (x *SantaMessage) GetUnlink() *Unlink

func (*SantaMessage) GetXprotect 

func (x *SantaMessage) GetXprotect() *XProtect

func (*SantaMessage) HasAllowlist 

func (x *SantaMessage) HasAllowlist() bool

func (*SantaMessage) HasAuthentication 

func (x *SantaMessage) HasAuthentication() bool

func (*SantaMessage) HasBootSessionUuid 

func (x *SantaMessage) HasBootSessionUuid() bool

func (*SantaMessage) HasBundle 

func (x *SantaMessage) HasBundle() bool

func (*SantaMessage) HasClone 

func (x *SantaMessage) HasClone() bool

func (*SantaMessage) HasClose 

func (x *SantaMessage) HasClose() bool

func (*SantaMessage) HasCodesigningInvalidated 

func (x *SantaMessage) HasCodesigningInvalidated() bool

func (*SantaMessage) HasCopyfile 

func (x *SantaMessage) HasCopyfile() bool

func (*SantaMessage) HasDisk 

func (x *SantaMessage) HasDisk() bool

func (*SantaMessage) HasEvent 

func (x *SantaMessage) HasEvent() bool

func (*SantaMessage) HasEventId 

func (x *SantaMessage) HasEventId() bool

func (*SantaMessage) HasEventTime 

func (x *SantaMessage) HasEventTime() bool

func (*SantaMessage) HasExchangedata 

func (x *SantaMessage) HasExchangedata() bool

func (*SantaMessage) HasExecution 

func (x *SantaMessage) HasExecution() bool

func (*SantaMessage) HasExit 

func (x *SantaMessage) HasExit() bool

func (*SantaMessage) HasFileAccess 

func (x *SantaMessage) HasFileAccess() bool

func (*SantaMessage) HasFork 

func (x *SantaMessage) HasFork() bool

func (*SantaMessage) HasGatekeeperOverride 

func (x *SantaMessage) HasGatekeeperOverride() bool

func (*SantaMessage) HasLaunchItem 

func (x *SantaMessage) HasLaunchItem() bool
func (x *SantaMessage) HasLink() bool

func (*SantaMessage) HasLoginLogout 

func (x *SantaMessage) HasLoginLogout() bool

func (*SantaMessage) HasLoginWindowSession 

func (x *SantaMessage) HasLoginWindowSession() bool

func (*SantaMessage) HasMachineId 

func (x *SantaMessage) HasMachineId() bool

func (*SantaMessage) HasNetworkActivity 

func (x *SantaMessage) HasNetworkActivity() bool

func (*SantaMessage) HasOpenSsh 

func (x *SantaMessage) HasOpenSsh() bool

func (*SantaMessage) HasProcSuspendResume 

func (x *SantaMessage) HasProcSuspendResume() bool

func (*SantaMessage) HasProcessedTime 

func (x *SantaMessage) HasProcessedTime() bool

func (*SantaMessage) HasRename 

func (x *SantaMessage) HasRename() bool

func (*SantaMessage) HasScreenSharing 

func (x *SantaMessage) HasScreenSharing() bool

func (*SantaMessage) HasTccModification 

func (x *SantaMessage) HasTccModification() bool
func (x *SantaMessage) HasUnlink() bool

func (*SantaMessage) HasXprotect 

func (x *SantaMessage) HasXprotect() bool

func (*SantaMessage) ProtoMessage 

func (*SantaMessage) ProtoMessage()

func (*SantaMessage) ProtoReflect 

func (x *SantaMessage) ProtoReflect() protoreflect.Message

func (*SantaMessage) Reset 

func (x *SantaMessage) Reset()

func (*SantaMessage) SetAllowlist 

func (x *SantaMessage) SetAllowlist(v *Allowlist)

func (*SantaMessage) SetAuthentication 

func (x *SantaMessage) SetAuthentication(v *Authentication)

func (*SantaMessage) SetBootSessionUuid 

func (x *SantaMessage) SetBootSessionUuid(v string)

func (*SantaMessage) SetBundle 

func (x *SantaMessage) SetBundle(v *Bundle)

func (*SantaMessage) SetClone 

func (x *SantaMessage) SetClone(v *Clone)

func (*SantaMessage) SetClose 

func (x *SantaMessage) SetClose(v *Close)

func (*SantaMessage) SetCodesigningInvalidated 

func (x *SantaMessage) SetCodesigningInvalidated(v *CodesigningInvalidated)

func (*SantaMessage) SetCopyfile 

func (x *SantaMessage) SetCopyfile(v *Copyfile)

func (*SantaMessage) SetDisk 

func (x *SantaMessage) SetDisk(v *Disk)

func (*SantaMessage) SetEventId 

func (x *SantaMessage) SetEventId(v string)

func (*SantaMessage) SetEventTime 

func (x *SantaMessage) SetEventTime(v *timestamppb.Timestamp)

func (*SantaMessage) SetExchangedata 

func (x *SantaMessage) SetExchangedata(v *Exchangedata)

func (*SantaMessage) SetExecution 

func (x *SantaMessage) SetExecution(v *Execution)

func (*SantaMessage) SetExit 

func (x *SantaMessage) SetExit(v *Exit)

func (*SantaMessage) SetFileAccess 

func (x *SantaMessage) SetFileAccess(v *FileAccess)

func (*SantaMessage) SetFork 

func (x *SantaMessage) SetFork(v *Fork)

func (*SantaMessage) SetGatekeeperOverride 

func (x *SantaMessage) SetGatekeeperOverride(v *GatekeeperOverride)

func (*SantaMessage) SetLaunchItem 

func (x *SantaMessage) SetLaunchItem(v *LaunchItem)
func (x *SantaMessage) SetLink(v *Link)

func (*SantaMessage) SetLoginLogout 

func (x *SantaMessage) SetLoginLogout(v *LoginLogout)

func (*SantaMessage) SetLoginWindowSession 

func (x *SantaMessage) SetLoginWindowSession(v *LoginWindowSession)

func (*SantaMessage) SetMachineId 

func (x *SantaMessage) SetMachineId(v string)

func (*SantaMessage) SetNetworkActivity 

func (x *SantaMessage) SetNetworkActivity(v *NetworkActivity)

func (*SantaMessage) SetOpenSsh 

func (x *SantaMessage) SetOpenSsh(v *OpenSSH)

func (*SantaMessage) SetProcSuspendResume 

func (x *SantaMessage) SetProcSuspendResume(v *ProcSuspendResume)

func (*SantaMessage) SetProcessedTime 

func (x *SantaMessage) SetProcessedTime(v *timestamppb.Timestamp)

func (*SantaMessage) SetRename 

func (x *SantaMessage) SetRename(v *Rename)

func (*SantaMessage) SetScreenSharing 

func (x *SantaMessage) SetScreenSharing(v *ScreenSharing)

func (*SantaMessage) SetTccModification 

func (x *SantaMessage) SetTccModification(v *TCCModification)
func (x *SantaMessage) SetUnlink(v *Unlink)

func (*SantaMessage) SetXprotect 

func (x *SantaMessage) SetXprotect(v *XProtect)

func (*SantaMessage) String 

func (x *SantaMessage) String() string

func (*SantaMessage) WhichEvent 

func (x *SantaMessage) WhichEvent() case_SantaMessage_Event

type SantaMessageBatch 

type SantaMessageBatch struct {
	Messages []*SantaMessage `protobuf:"bytes,1,rep,name=messages,proto3" json:"messages,omitempty"`
	// contains filtered or unexported fields
}

func (*SantaMessageBatch) GetMessages 

func (x *SantaMessageBatch) GetMessages() []*SantaMessage

func (*SantaMessageBatch) ProtoMessage 

func (*SantaMessageBatch) ProtoMessage()

func (*SantaMessageBatch) ProtoReflect 

func (x *SantaMessageBatch) ProtoReflect() protoreflect.Message

func (*SantaMessageBatch) Reset 

func (x *SantaMessageBatch) Reset()

func (*SantaMessageBatch) SetMessages 

func (x *SantaMessageBatch) SetMessages(v []*SantaMessage)

func (*SantaMessageBatch) String 

func (x *SantaMessageBatch) String() string

type SantaMessageBatch_builder 

type SantaMessageBatch_builder struct {
	Messages []*SantaMessage
	// contains filtered or unexported fields
}

func (SantaMessageBatch_builder) Build 

func (b0 SantaMessageBatch_builder) Build() *SantaMessageBatch

type SantaMessage_Allowlist 

type SantaMessage_Allowlist struct {
	Allowlist *Allowlist `protobuf:"bytes,20,opt,name=allowlist,proto3,oneof"`
}

type SantaMessage_Authentication 

type SantaMessage_Authentication struct {
	Authentication *Authentication `protobuf:"bytes,27,opt,name=authentication,proto3,oneof"`
}

type SantaMessage_Bundle 

type SantaMessage_Bundle struct {
	Bundle *Bundle `protobuf:"bytes,19,opt,name=bundle,proto3,oneof"`
}

type SantaMessage_Clone 

type SantaMessage_Clone struct {
	Clone *Clone `protobuf:"bytes,28,opt,name=clone,proto3,oneof"`
}

type SantaMessage_Close 

type SantaMessage_Close struct {
	Close *Close `protobuf:"bytes,13,opt,name=close,proto3,oneof"`
}

type SantaMessage_CodesigningInvalidated 

type SantaMessage_CodesigningInvalidated struct {
	CodesigningInvalidated *CodesigningInvalidated `protobuf:"bytes,22,opt,name=codesigning_invalidated,json=codesigningInvalidated,proto3,oneof"`
}

type SantaMessage_Copyfile 

type SantaMessage_Copyfile struct {
	Copyfile *Copyfile `protobuf:"bytes,29,opt,name=copyfile,proto3,oneof"`
}

type SantaMessage_Disk 

type SantaMessage_Disk struct {
	Disk *Disk `protobuf:"bytes,18,opt,name=disk,proto3,oneof"`
}

type SantaMessage_Exchangedata 

type SantaMessage_Exchangedata struct {
	Exchangedata *Exchangedata `protobuf:"bytes,17,opt,name=exchangedata,proto3,oneof"`
}

type SantaMessage_Execution 

type SantaMessage_Execution struct {
	Execution *Execution `protobuf:"bytes,10,opt,name=execution,proto3,oneof"`
}

type SantaMessage_Exit 

type SantaMessage_Exit struct {
	Exit *Exit `protobuf:"bytes,12,opt,name=exit,proto3,oneof"`
}

type SantaMessage_FileAccess 

type SantaMessage_FileAccess struct {
	FileAccess *FileAccess `protobuf:"bytes,21,opt,name=file_access,json=fileAccess,proto3,oneof"`
}

type SantaMessage_Fork 

type SantaMessage_Fork struct {
	Fork *Fork `protobuf:"bytes,11,opt,name=fork,proto3,oneof"`
}

type SantaMessage_GatekeeperOverride 

type SantaMessage_GatekeeperOverride struct {
	GatekeeperOverride *GatekeeperOverride `protobuf:"bytes,30,opt,name=gatekeeper_override,json=gatekeeperOverride,proto3,oneof"`
}

type SantaMessage_LaunchItem 

type SantaMessage_LaunchItem struct {
	LaunchItem *LaunchItem `protobuf:"bytes,31,opt,name=launch_item,json=launchItem,proto3,oneof"`
}
type SantaMessage_Link struct {
	Link *Link `protobuf:"bytes,16,opt,name=link,proto3,oneof"`
}

type SantaMessage_LoginLogout 

type SantaMessage_LoginLogout struct {
	LoginLogout *LoginLogout `protobuf:"bytes,24,opt,name=login_logout,json=loginLogout,proto3,oneof"`
}

type SantaMessage_LoginWindowSession 

type SantaMessage_LoginWindowSession struct {
	LoginWindowSession *LoginWindowSession `protobuf:"bytes,23,opt,name=login_window_session,json=loginWindowSession,proto3,oneof"`
}

type SantaMessage_NetworkActivity 

type SantaMessage_NetworkActivity struct {
	NetworkActivity *NetworkActivity `protobuf:"bytes,34,opt,name=network_activity,json=networkActivity,proto3,oneof"`
}

type SantaMessage_OpenSsh 

type SantaMessage_OpenSsh struct {
	OpenSsh *OpenSSH `protobuf:"bytes,26,opt,name=open_ssh,json=openSsh,proto3,oneof"`
}

type SantaMessage_ProcSuspendResume 

type SantaMessage_ProcSuspendResume struct {
	ProcSuspendResume *ProcSuspendResume `protobuf:"bytes,35,opt,name=proc_suspend_resume,json=procSuspendResume,proto3,oneof"`
}

type SantaMessage_Rename 

type SantaMessage_Rename struct {
	Rename *Rename `protobuf:"bytes,14,opt,name=rename,proto3,oneof"`
}

type SantaMessage_ScreenSharing 

type SantaMessage_ScreenSharing struct {
	ScreenSharing *ScreenSharing `protobuf:"bytes,25,opt,name=screen_sharing,json=screenSharing,proto3,oneof"`
}

type SantaMessage_TccModification 

type SantaMessage_TccModification struct {
	TccModification *TCCModification `protobuf:"bytes,32,opt,name=tcc_modification,json=tccModification,proto3,oneof"`
}
type SantaMessage_Unlink struct {
	Unlink *Unlink `protobuf:"bytes,15,opt,name=unlink,proto3,oneof"`
}

type SantaMessage_Xprotect 

type SantaMessage_Xprotect struct {
	Xprotect *XProtect `protobuf:"bytes,33,opt,name=xprotect,proto3,oneof"`
}

type SantaMessage_builder 

type SantaMessage_builder struct {

	// Machine ID of the host emitting this log
	// Only valid when EnableMachineIDDecoration configuration option is set
	MachineId *string
	// Timestamp when the event occurred
	EventTime *timestamppb.Timestamp
	// Timestamp when Santa finished processing the event
	ProcessedTime *timestamppb.Timestamp
	// The boot session UUID uniquely identifies a boot cycle. The value
	// will remain the same across sleep/wake/hibernate cycles.
	BootSessionUuid *string
	// Event ID is an opaque unique identifier for this event.
	EventId *string

	// Fields of oneof Event:
	Execution              *Execution
	Fork                   *Fork
	Exit                   *Exit
	Close                  *Close
	Rename                 *Rename
	Unlink                 *Unlink
	Link                   *Link
	Exchangedata           *Exchangedata
	Disk                   *Disk
	Bundle                 *Bundle
	Allowlist              *Allowlist
	FileAccess             *FileAccess
	CodesigningInvalidated *CodesigningInvalidated
	LoginWindowSession     *LoginWindowSession
	LoginLogout            *LoginLogout
	ScreenSharing          *ScreenSharing
	OpenSsh                *OpenSSH
	Authentication         *Authentication
	Clone                  *Clone
	Copyfile               *Copyfile
	GatekeeperOverride     *GatekeeperOverride
	LaunchItem             *LaunchItem
	TccModification        *TCCModification
	Xprotect               *XProtect
	NetworkActivity        *NetworkActivity
	ProcSuspendResume      *ProcSuspendResume
	// contains filtered or unexported fields
}

func (SantaMessage_builder) Build 

func (b0 SantaMessage_builder) Build() *SantaMessage

type ScreenSharing 

type ScreenSharing struct {

	// Types that are valid to be assigned to Event:
	//
	//	*ScreenSharing_Attach
	//	*ScreenSharing_Detach
	Event isScreenSharing_Event `protobuf_oneof:"event"`
	// contains filtered or unexported fields
}

Information about Screen Sharing attach and detach events

func (*ScreenSharing) ClearAttach 

func (x *ScreenSharing) ClearAttach()

func (*ScreenSharing) ClearDetach 

func (x *ScreenSharing) ClearDetach()

func (*ScreenSharing) ClearEvent 

func (x *ScreenSharing) ClearEvent()

func (*ScreenSharing) GetAttach 

func (x *ScreenSharing) GetAttach() *ScreenSharingAttach

func (*ScreenSharing) GetDetach 

func (x *ScreenSharing) GetDetach() *ScreenSharingDetach

func (*ScreenSharing) GetEvent 

func (x *ScreenSharing) GetEvent() isScreenSharing_Event

func (*ScreenSharing) HasAttach 

func (x *ScreenSharing) HasAttach() bool

func (*ScreenSharing) HasDetach 

func (x *ScreenSharing) HasDetach() bool

func (*ScreenSharing) HasEvent 

func (x *ScreenSharing) HasEvent() bool

func (*ScreenSharing) ProtoMessage 

func (*ScreenSharing) ProtoMessage()

func (*ScreenSharing) ProtoReflect 

func (x *ScreenSharing) ProtoReflect() protoreflect.Message

func (*ScreenSharing) Reset 

func (x *ScreenSharing) Reset()

func (*ScreenSharing) SetAttach 

func (x *ScreenSharing) SetAttach(v *ScreenSharingAttach)

func (*ScreenSharing) SetDetach 

func (x *ScreenSharing) SetDetach(v *ScreenSharingDetach)

func (*ScreenSharing) String 

func (x *ScreenSharing) String() string

func (*ScreenSharing) WhichEvent 

func (x *ScreenSharing) WhichEvent() case_ScreenSharing_Event

type ScreenSharingAttach 

type ScreenSharingAttach struct {

	// The process that emitted the attach event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Whether or not the attach was successful
	Success *bool `protobuf:"varint,2,opt,name=success,proto3,oneof" json:"success,omitempty"`
	// Source address information
	Source *SocketAddress `protobuf:"bytes,3,opt,name=source,proto3,oneof" json:"source,omitempty"`
	// Apple ID of the viewer
	Viewer []byte `protobuf:"bytes,4,opt,name=viewer,proto3,oneof" json:"viewer,omitempty"`
	// Type of authentication used
	AuthenticationType []byte `protobuf:"bytes,5,opt,name=authentication_type,json=authenticationType,proto3,oneof" json:"authentication_type,omitempty"`
	// User that attempted authentication, if applicable
	AuthenticationUser *UserInfo `protobuf:"bytes,6,opt,name=authentication_user,json=authenticationUser,proto3,oneof" json:"authentication_user,omitempty"`
	// Username of the loginwindow session, if available
	SessionUser *UserInfo `protobuf:"bytes,7,opt,name=session_user,json=sessionUser,proto3,oneof" json:"session_user,omitempty"`
	// Whether or not there was an existing session
	ExistingSession *bool `protobuf:"varint,8,opt,name=existing_session,json=existingSession,proto3,oneof" json:"existing_session,omitempty"`
	// Graphical session information for this session
	GraphicalSession *GraphicalSession `protobuf:"bytes,9,opt,name=graphical_session,json=graphicalSession,proto3,oneof" json:"graphical_session,omitempty"`
	// contains filtered or unexported fields
}

Information related to Screen Sharing attaching to a graphical session

func (*ScreenSharingAttach) ClearAuthenticationType 

func (x *ScreenSharingAttach) ClearAuthenticationType()

func (*ScreenSharingAttach) ClearAuthenticationUser 

func (x *ScreenSharingAttach) ClearAuthenticationUser()

func (*ScreenSharingAttach) ClearExistingSession 

func (x *ScreenSharingAttach) ClearExistingSession()

func (*ScreenSharingAttach) ClearGraphicalSession 

func (x *ScreenSharingAttach) ClearGraphicalSession()

func (*ScreenSharingAttach) ClearInstigator 

func (x *ScreenSharingAttach) ClearInstigator()

func (*ScreenSharingAttach) ClearSessionUser 

func (x *ScreenSharingAttach) ClearSessionUser()

func (*ScreenSharingAttach) ClearSource 

func (x *ScreenSharingAttach) ClearSource()

func (*ScreenSharingAttach) ClearSuccess 

func (x *ScreenSharingAttach) ClearSuccess()

func (*ScreenSharingAttach) ClearViewer 

func (x *ScreenSharingAttach) ClearViewer()

func (*ScreenSharingAttach) GetAuthenticationType 

func (x *ScreenSharingAttach) GetAuthenticationType() []byte

func (*ScreenSharingAttach) GetAuthenticationUser 

func (x *ScreenSharingAttach) GetAuthenticationUser() *UserInfo

func (*ScreenSharingAttach) GetExistingSession 

func (x *ScreenSharingAttach) GetExistingSession() bool

func (*ScreenSharingAttach) GetGraphicalSession 

func (x *ScreenSharingAttach) GetGraphicalSession() *GraphicalSession

func (*ScreenSharingAttach) GetInstigator 

func (x *ScreenSharingAttach) GetInstigator() *ProcessInfoLight

func (*ScreenSharingAttach) GetSessionUser 

func (x *ScreenSharingAttach) GetSessionUser() *UserInfo

func (*ScreenSharingAttach) GetSource 

func (x *ScreenSharingAttach) GetSource() *SocketAddress

func (*ScreenSharingAttach) GetSuccess 

func (x *ScreenSharingAttach) GetSuccess() bool

func (*ScreenSharingAttach) GetViewer 

func (x *ScreenSharingAttach) GetViewer() []byte

func (*ScreenSharingAttach) HasAuthenticationType 

func (x *ScreenSharingAttach) HasAuthenticationType() bool

func (*ScreenSharingAttach) HasAuthenticationUser 

func (x *ScreenSharingAttach) HasAuthenticationUser() bool

func (*ScreenSharingAttach) HasExistingSession 

func (x *ScreenSharingAttach) HasExistingSession() bool

func (*ScreenSharingAttach) HasGraphicalSession 

func (x *ScreenSharingAttach) HasGraphicalSession() bool

func (*ScreenSharingAttach) HasInstigator 

func (x *ScreenSharingAttach) HasInstigator() bool

func (*ScreenSharingAttach) HasSessionUser 

func (x *ScreenSharingAttach) HasSessionUser() bool

func (*ScreenSharingAttach) HasSource 

func (x *ScreenSharingAttach) HasSource() bool

func (*ScreenSharingAttach) HasSuccess 

func (x *ScreenSharingAttach) HasSuccess() bool

func (*ScreenSharingAttach) HasViewer 

func (x *ScreenSharingAttach) HasViewer() bool

func (*ScreenSharingAttach) ProtoMessage 

func (*ScreenSharingAttach) ProtoMessage()

func (*ScreenSharingAttach) ProtoReflect 

func (x *ScreenSharingAttach) ProtoReflect() protoreflect.Message

func (*ScreenSharingAttach) Reset 

func (x *ScreenSharingAttach) Reset()

func (*ScreenSharingAttach) SetAuthenticationType 

func (x *ScreenSharingAttach) SetAuthenticationType(v []byte)

func (*ScreenSharingAttach) SetAuthenticationUser 

func (x *ScreenSharingAttach) SetAuthenticationUser(v *UserInfo)

func (*ScreenSharingAttach) SetExistingSession 

func (x *ScreenSharingAttach) SetExistingSession(v bool)

func (*ScreenSharingAttach) SetGraphicalSession 

func (x *ScreenSharingAttach) SetGraphicalSession(v *GraphicalSession)

func (*ScreenSharingAttach) SetInstigator 

func (x *ScreenSharingAttach) SetInstigator(v *ProcessInfoLight)

func (*ScreenSharingAttach) SetSessionUser 

func (x *ScreenSharingAttach) SetSessionUser(v *UserInfo)

func (*ScreenSharingAttach) SetSource 

func (x *ScreenSharingAttach) SetSource(v *SocketAddress)

func (*ScreenSharingAttach) SetSuccess 

func (x *ScreenSharingAttach) SetSuccess(v bool)

func (*ScreenSharingAttach) SetViewer 

func (x *ScreenSharingAttach) SetViewer(v []byte)

func (*ScreenSharingAttach) String 

func (x *ScreenSharingAttach) String() string

type ScreenSharingAttach_builder 

type ScreenSharingAttach_builder struct {

	// The process that emitted the attach event
	Instigator *ProcessInfoLight
	// Whether or not the attach was successful
	Success *bool
	// Source address information
	Source *SocketAddress
	// Apple ID of the viewer
	Viewer []byte
	// Type of authentication used
	AuthenticationType []byte
	// User that attempted authentication, if applicable
	AuthenticationUser *UserInfo
	// Username of the loginwindow session, if available
	SessionUser *UserInfo
	// Whether or not there was an existing session
	ExistingSession *bool
	// Graphical session information for this session
	GraphicalSession *GraphicalSession
	// contains filtered or unexported fields
}

func (ScreenSharingAttach_builder) Build 

func (b0 ScreenSharingAttach_builder) Build() *ScreenSharingAttach

type ScreenSharingDetach 

type ScreenSharingDetach struct {

	// The process that emitted the detach event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Source address information
	Source *SocketAddress `protobuf:"bytes,2,opt,name=source,proto3,oneof" json:"source,omitempty"`
	// Apple ID of the viewer
	Viewer []byte `protobuf:"bytes,3,opt,name=viewer,proto3,oneof" json:"viewer,omitempty"`
	// Graphical session information for this session
	GraphicalSession *GraphicalSession `protobuf:"bytes,4,opt,name=graphical_session,json=graphicalSession,proto3,oneof" json:"graphical_session,omitempty"`
	// contains filtered or unexported fields
}

Information related to Screen Sharing detaching from a graphical session

func (*ScreenSharingDetach) ClearGraphicalSession 

func (x *ScreenSharingDetach) ClearGraphicalSession()

func (*ScreenSharingDetach) ClearInstigator 

func (x *ScreenSharingDetach) ClearInstigator()

func (*ScreenSharingDetach) ClearSource 

func (x *ScreenSharingDetach) ClearSource()

func (*ScreenSharingDetach) ClearViewer 

func (x *ScreenSharingDetach) ClearViewer()

func (*ScreenSharingDetach) GetGraphicalSession 

func (x *ScreenSharingDetach) GetGraphicalSession() *GraphicalSession

func (*ScreenSharingDetach) GetInstigator 

func (x *ScreenSharingDetach) GetInstigator() *ProcessInfoLight

func (*ScreenSharingDetach) GetSource 

func (x *ScreenSharingDetach) GetSource() *SocketAddress

func (*ScreenSharingDetach) GetViewer 

func (x *ScreenSharingDetach) GetViewer() []byte

func (*ScreenSharingDetach) HasGraphicalSession 

func (x *ScreenSharingDetach) HasGraphicalSession() bool

func (*ScreenSharingDetach) HasInstigator 

func (x *ScreenSharingDetach) HasInstigator() bool

func (*ScreenSharingDetach) HasSource 

func (x *ScreenSharingDetach) HasSource() bool

func (*ScreenSharingDetach) HasViewer 

func (x *ScreenSharingDetach) HasViewer() bool

func (*ScreenSharingDetach) ProtoMessage 

func (*ScreenSharingDetach) ProtoMessage()

func (*ScreenSharingDetach) ProtoReflect 

func (x *ScreenSharingDetach) ProtoReflect() protoreflect.Message

func (*ScreenSharingDetach) Reset 

func (x *ScreenSharingDetach) Reset()

func (*ScreenSharingDetach) SetGraphicalSession 

func (x *ScreenSharingDetach) SetGraphicalSession(v *GraphicalSession)

func (*ScreenSharingDetach) SetInstigator 

func (x *ScreenSharingDetach) SetInstigator(v *ProcessInfoLight)

func (*ScreenSharingDetach) SetSource 

func (x *ScreenSharingDetach) SetSource(v *SocketAddress)

func (*ScreenSharingDetach) SetViewer 

func (x *ScreenSharingDetach) SetViewer(v []byte)

func (*ScreenSharingDetach) String 

func (x *ScreenSharingDetach) String() string

type ScreenSharingDetach_builder 

type ScreenSharingDetach_builder struct {

	// The process that emitted the detach event
	Instigator *ProcessInfoLight
	// Source address information
	Source *SocketAddress
	// Apple ID of the viewer
	Viewer []byte
	// Graphical session information for this session
	GraphicalSession *GraphicalSession
	// contains filtered or unexported fields
}

func (ScreenSharingDetach_builder) Build 

func (b0 ScreenSharingDetach_builder) Build() *ScreenSharingDetach

type ScreenSharing_Attach 

type ScreenSharing_Attach struct {
	Attach *ScreenSharingAttach `protobuf:"bytes,1,opt,name=attach,proto3,oneof"`
}

type ScreenSharing_Detach 

type ScreenSharing_Detach struct {
	Detach *ScreenSharingDetach `protobuf:"bytes,2,opt,name=detach,proto3,oneof"`
}

type ScreenSharing_builder 

type ScreenSharing_builder struct {

	// Fields of oneof Event:
	Attach *ScreenSharingAttach
	Detach *ScreenSharingDetach
	// contains filtered or unexported fields
}

func (ScreenSharing_builder) Build 

func (b0 ScreenSharing_builder) Build() *ScreenSharing

type SignedPost 

type SignedPost struct {

	// POST URL to send the signed form values and desired data. Use content type
	// multipart/form-data when making the request.
	Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
	// Signed values which authorize the POST request. Append the desired object
	// name to the "key" field.
	FormValues map[string]string `` /* 165-byte string literal not displayed */
	// contains filtered or unexported fields
}

SignedPost maps to the same message in syncv2. It's a separate message to allow the messages to be changed independently.

func (*SignedPost) GetFormValues 

func (x *SignedPost) GetFormValues() map[string]string

func (*SignedPost) GetUrl 

func (x *SignedPost) GetUrl() string

func (*SignedPost) ProtoMessage 

func (*SignedPost) ProtoMessage()

func (*SignedPost) ProtoReflect 

func (x *SignedPost) ProtoReflect() protoreflect.Message

func (*SignedPost) Reset 

func (x *SignedPost) Reset()

func (*SignedPost) SetFormValues 

func (x *SignedPost) SetFormValues(v map[string]string)

func (*SignedPost) SetUrl 

func (x *SignedPost) SetUrl(v string)

func (*SignedPost) String 

func (x *SignedPost) String() string

type SignedPost_builder 

type SignedPost_builder struct {

	// POST URL to send the signed form values and desired data. Use content type
	// multipart/form-data when making the request.
	Url string
	// Signed values which authorize the POST request. Append the desired object
	// name to the "key" field.
	FormValues map[string]string
	// contains filtered or unexported fields
}

func (SignedPost_builder) Build 

func (b0 SignedPost_builder) Build() *SignedPost

type SleighBinaryUpload 

type SleighBinaryUpload struct {

	// The mach-o file to upload, passed as an already-open file descriptor.
	InputFd int32 `protobuf:"varint,1,opt,name=input_fd,json=inputFd,proto3" json:"input_fd,omitempty"`
	// Presigned POST minted by workshop. The object key is baked into
	// form_values["key"]; sleigh uses the form values verbatim and never renames.
	SignedPost *SignedPost `protobuf:"bytes,2,opt,name=signed_post,json=signedPost,proto3" json:"signed_post,omitempty"`
	// Optional expected hash (from BinaryUploadRequest.sha256). When set, sleigh
	// verifies its computed hash against this value and aborts the upload before
	// the object commits on a mismatch.
	ExpectedSha256 *string `protobuf:"bytes,3,opt,name=expected_sha256,json=expectedSha256,proto3,oneof" json:"expected_sha256,omitempty"`
	// Binary metadata computed by santa for the CEL filter to evaluate against.
	Metadata *BinaryMetadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// CEL expressions evaluated against `metadata`; if an expression returns true
	// the binary is dropped (not uploaded). Sourced by santa from the
	// BinaryUploadFilterExpressions config (MDM + sync state), so it is identical
	// for every invocation.
	FilterExpressions []string `protobuf:"bytes,5,rep,name=filter_expressions,json=filterExpressions,proto3" json:"filter_expressions,omitempty"`
	// contains filtered or unexported fields
}

SleighBinaryUpload streams a single mach-o binary to a workshop-minted presigned POST. sleigh evaluates the CEL filter (against `metadata`) and the mach-o gate itself; a binary that matches a filter expression is dropped and not uploaded.

func (*SleighBinaryUpload) ClearExpectedSha256 

func (x *SleighBinaryUpload) ClearExpectedSha256()

func (*SleighBinaryUpload) ClearMetadata 

func (x *SleighBinaryUpload) ClearMetadata()

func (*SleighBinaryUpload) ClearSignedPost 

func (x *SleighBinaryUpload) ClearSignedPost()

func (*SleighBinaryUpload) GetExpectedSha256 

func (x *SleighBinaryUpload) GetExpectedSha256() string

func (*SleighBinaryUpload) GetFilterExpressions 

func (x *SleighBinaryUpload) GetFilterExpressions() []string

func (*SleighBinaryUpload) GetInputFd 

func (x *SleighBinaryUpload) GetInputFd() int32

func (*SleighBinaryUpload) GetMetadata 

func (x *SleighBinaryUpload) GetMetadata() *BinaryMetadata

func (*SleighBinaryUpload) GetSignedPost 

func (x *SleighBinaryUpload) GetSignedPost() *SignedPost

func (*SleighBinaryUpload) HasExpectedSha256 

func (x *SleighBinaryUpload) HasExpectedSha256() bool

func (*SleighBinaryUpload) HasMetadata 

func (x *SleighBinaryUpload) HasMetadata() bool

func (*SleighBinaryUpload) HasSignedPost 

func (x *SleighBinaryUpload) HasSignedPost() bool

func (*SleighBinaryUpload) ProtoMessage 

func (*SleighBinaryUpload) ProtoMessage()

func (*SleighBinaryUpload) ProtoReflect 

func (x *SleighBinaryUpload) ProtoReflect() protoreflect.Message

func (*SleighBinaryUpload) Reset 

func (x *SleighBinaryUpload) Reset()

func (*SleighBinaryUpload) SetExpectedSha256 

func (x *SleighBinaryUpload) SetExpectedSha256(v string)

func (*SleighBinaryUpload) SetFilterExpressions 

func (x *SleighBinaryUpload) SetFilterExpressions(v []string)

func (*SleighBinaryUpload) SetInputFd 

func (x *SleighBinaryUpload) SetInputFd(v int32)

func (*SleighBinaryUpload) SetMetadata 

func (x *SleighBinaryUpload) SetMetadata(v *BinaryMetadata)

func (*SleighBinaryUpload) SetSignedPost 

func (x *SleighBinaryUpload) SetSignedPost(v *SignedPost)

func (*SleighBinaryUpload) String 

func (x *SleighBinaryUpload) String() string

type SleighBinaryUpload_builder 

type SleighBinaryUpload_builder struct {

	// The mach-o file to upload, passed as an already-open file descriptor.
	InputFd int32
	// Presigned POST minted by workshop. The object key is baked into
	// form_values["key"]; sleigh uses the form values verbatim and never renames.
	SignedPost *SignedPost
	// Optional expected hash (from BinaryUploadRequest.sha256). When set, sleigh
	// verifies its computed hash against this value and aborts the upload before
	// the object commits on a mismatch.
	ExpectedSha256 *string
	// Binary metadata computed by santa for the CEL filter to evaluate against.
	Metadata *BinaryMetadata
	// CEL expressions evaluated against `metadata`; if an expression returns true
	// the binary is dropped (not uploaded). Sourced by santa from the
	// BinaryUploadFilterExpressions config (MDM + sync state), so it is identical
	// for every invocation.
	FilterExpressions []string
	// contains filtered or unexported fields
}

func (SleighBinaryUpload_builder) Build 

func (b0 SleighBinaryUpload_builder) Build() *SleighBinaryUpload

type SleighConfig 

type SleighConfig struct {

	// The host_id for this host as sent up to Workshop.
	HostId string `protobuf:"bytes,1,opt,name=host_id,json=hostId,proto3" json:"host_id,omitempty"`
	// The host_name for this host as sent up to Workshop.
	HostName string `protobuf:"bytes,2,opt,name=host_name,json=hostName,proto3" json:"host_name,omitempty"`
	// Types that are valid to be assigned to Command:
	//
	//	*SleighConfig_ExportTelemetry
	//	*SleighConfig_BinaryUpload
	//	*SleighConfig_PackageInventoryScan
	//	*SleighConfig_SignalScan
	Command isSleighConfig_Command `protobuf_oneof:"command"`
	// contains filtered or unexported fields
}

SleighConfig contains the configuration data to be passed to Sleigh when Sleigh is started.

func (*SleighConfig) ClearBinaryUpload 

func (x *SleighConfig) ClearBinaryUpload()

func (*SleighConfig) ClearCommand 

func (x *SleighConfig) ClearCommand()

func (*SleighConfig) ClearExportTelemetry 

func (x *SleighConfig) ClearExportTelemetry()

func (*SleighConfig) ClearPackageInventoryScan 

func (x *SleighConfig) ClearPackageInventoryScan()

func (*SleighConfig) ClearSignalScan 

func (x *SleighConfig) ClearSignalScan()

func (*SleighConfig) GetBinaryUpload 

func (x *SleighConfig) GetBinaryUpload() *SleighBinaryUpload

func (*SleighConfig) GetCommand 

func (x *SleighConfig) GetCommand() isSleighConfig_Command

func (*SleighConfig) GetExportTelemetry 

func (x *SleighConfig) GetExportTelemetry() *SleighExportTelemetry

func (*SleighConfig) GetHostId 

func (x *SleighConfig) GetHostId() string

func (*SleighConfig) GetHostName 

func (x *SleighConfig) GetHostName() string

func (*SleighConfig) GetPackageInventoryScan 

func (x *SleighConfig) GetPackageInventoryScan() *SleighPackageInventoryScan

func (*SleighConfig) GetSignalScan 

func (x *SleighConfig) GetSignalScan() *SleighSignalScan

func (*SleighConfig) HasBinaryUpload 

func (x *SleighConfig) HasBinaryUpload() bool

func (*SleighConfig) HasCommand 

func (x *SleighConfig) HasCommand() bool

func (*SleighConfig) HasExportTelemetry 

func (x *SleighConfig) HasExportTelemetry() bool

func (*SleighConfig) HasPackageInventoryScan 

func (x *SleighConfig) HasPackageInventoryScan() bool

func (*SleighConfig) HasSignalScan 

func (x *SleighConfig) HasSignalScan() bool

func (*SleighConfig) ProtoMessage 

func (*SleighConfig) ProtoMessage()

func (*SleighConfig) ProtoReflect 

func (x *SleighConfig) ProtoReflect() protoreflect.Message

func (*SleighConfig) Reset 

func (x *SleighConfig) Reset()

func (*SleighConfig) SetBinaryUpload 

func (x *SleighConfig) SetBinaryUpload(v *SleighBinaryUpload)

func (*SleighConfig) SetExportTelemetry 

func (x *SleighConfig) SetExportTelemetry(v *SleighExportTelemetry)

func (*SleighConfig) SetHostId 

func (x *SleighConfig) SetHostId(v string)

func (*SleighConfig) SetHostName 

func (x *SleighConfig) SetHostName(v string)

func (*SleighConfig) SetPackageInventoryScan 

func (x *SleighConfig) SetPackageInventoryScan(v *SleighPackageInventoryScan)

func (*SleighConfig) SetSignalScan 

func (x *SleighConfig) SetSignalScan(v *SleighSignalScan)

func (*SleighConfig) String 

func (x *SleighConfig) String() string

func (*SleighConfig) WhichCommand 

func (x *SleighConfig) WhichCommand() case_SleighConfig_Command

type SleighConfig_BinaryUpload 

type SleighConfig_BinaryUpload struct {
	BinaryUpload *SleighBinaryUpload `protobuf:"bytes,4,opt,name=binary_upload,json=binaryUpload,proto3,oneof"`
}

type SleighConfig_ExportTelemetry 

type SleighConfig_ExportTelemetry struct {
	ExportTelemetry *SleighExportTelemetry `protobuf:"bytes,3,opt,name=export_telemetry,json=exportTelemetry,proto3,oneof"`
}

type SleighConfig_PackageInventoryScan 

type SleighConfig_PackageInventoryScan struct {
	PackageInventoryScan *SleighPackageInventoryScan `protobuf:"bytes,5,opt,name=package_inventory_scan,json=packageInventoryScan,proto3,oneof"`
}

type SleighConfig_SignalScan 

type SleighConfig_SignalScan struct {
	SignalScan *SleighSignalScan `protobuf:"bytes,6,opt,name=signal_scan,json=signalScan,proto3,oneof"`
}

type SleighConfig_builder 

type SleighConfig_builder struct {

	// The host_id for this host as sent up to Workshop.
	HostId string
	// The host_name for this host as sent up to Workshop.
	HostName string
	// Fields of oneof Command:
	ExportTelemetry      *SleighExportTelemetry
	BinaryUpload         *SleighBinaryUpload
	PackageInventoryScan *SleighPackageInventoryScan
	SignalScan           *SleighSignalScan
	// contains filtered or unexported fields
}

func (SleighConfig_builder) Build 

func (b0 SleighConfig_builder) Build() *SleighConfig

type SleighExportTelemetry 

type SleighExportTelemetry struct {

	// The files to be exported, passed as a set of already open file descriptors.
	InputFds []int32 `protobuf:"varint,3,rep,packed,name=input_fds,json=inputFds,proto3" json:"input_fds,omitempty"`
	// Types that are valid to be assigned to ExportConfig:
	//
	//	*SleighExportTelemetry_SignedPost
	ExportConfig isSleighExportTelemetry_ExportConfig `protobuf_oneof:"export_config"`
	// A set of CEL expressions to use to filter events as they are processed.
	// If an expression returns true the event is dropped. Expressions can also
	// redact fields instead of dropping.
	FilterExpressions []string `protobuf:"bytes,5,rep,name=filter_expressions,json=filterExpressions,proto3" json:"filter_expressions,omitempty"`
	// contains filtered or unexported fields
}

func (*SleighExportTelemetry) ClearExportConfig 

func (x *SleighExportTelemetry) ClearExportConfig()

func (*SleighExportTelemetry) ClearSignedPost 

func (x *SleighExportTelemetry) ClearSignedPost()

func (*SleighExportTelemetry) GetExportConfig 

func (x *SleighExportTelemetry) GetExportConfig() isSleighExportTelemetry_ExportConfig

func (*SleighExportTelemetry) GetFilterExpressions 

func (x *SleighExportTelemetry) GetFilterExpressions() []string

func (*SleighExportTelemetry) GetInputFds 

func (x *SleighExportTelemetry) GetInputFds() []int32

func (*SleighExportTelemetry) GetSignedPost 

func (x *SleighExportTelemetry) GetSignedPost() *SignedPost

func (*SleighExportTelemetry) HasExportConfig 

func (x *SleighExportTelemetry) HasExportConfig() bool

func (*SleighExportTelemetry) HasSignedPost 

func (x *SleighExportTelemetry) HasSignedPost() bool

func (*SleighExportTelemetry) ProtoMessage 

func (*SleighExportTelemetry) ProtoMessage()

func (*SleighExportTelemetry) ProtoReflect 

func (x *SleighExportTelemetry) ProtoReflect() protoreflect.Message

func (*SleighExportTelemetry) Reset 

func (x *SleighExportTelemetry) Reset()

func (*SleighExportTelemetry) SetFilterExpressions 

func (x *SleighExportTelemetry) SetFilterExpressions(v []string)

func (*SleighExportTelemetry) SetInputFds 

func (x *SleighExportTelemetry) SetInputFds(v []int32)

func (*SleighExportTelemetry) SetSignedPost 

func (x *SleighExportTelemetry) SetSignedPost(v *SignedPost)

func (*SleighExportTelemetry) String 

func (x *SleighExportTelemetry) String() string

func (*SleighExportTelemetry) WhichExportConfig 

func (x *SleighExportTelemetry) WhichExportConfig() case_SleighExportTelemetry_ExportConfig

type SleighExportTelemetry_SignedPost 

type SleighExportTelemetry_SignedPost struct {
	SignedPost *SignedPost `protobuf:"bytes,4,opt,name=signed_post,json=signedPost,proto3,oneof"`
}

type SleighExportTelemetry_builder 

type SleighExportTelemetry_builder struct {

	// The files to be exported, passed as a set of already open file descriptors.
	InputFds []int32
	// Fields of oneof ExportConfig:
	SignedPost *SignedPost
	// -- end of ExportConfig
	// A set of CEL expressions to use to filter events as they are processed.
	// If an expression returns true the event is dropped. Expressions can also
	// redact fields instead of dropping.
	FilterExpressions []string
	// contains filtered or unexported fields
}

func (SleighExportTelemetry_builder) Build 

func (b0 SleighExportTelemetry_builder) Build() *SleighExportTelemetry

type SleighPackageInventoryScan 

type SleighPackageInventoryScan struct {

	// Scan tuning parameters (profile, roots, ecosystems, limits, ...). Shared
	// with the workshop-issued host command
	// (santa.commands.v1.PackageInventoryRequest).
	Scan *common.PackageInventoryScan `protobuf:"bytes,1,opt,name=scan,proto3" json:"scan,omitempty"`
	// Presigned POST minted by workshop. The object key is built from
	// form_values["key"] suffixed by the run's generated filename.
	SignedPost *SignedPost `protobuf:"bytes,2,opt,name=signed_post,json=signedPost,proto3" json:"signed_post,omitempty"`
	// contains filtered or unexported fields
}

SleighPackageInventoryScan runs a read-only package-inventory discovery sweep on the host and uploads per-ecosystem Parquet files inside a zip to a workshop-minted presigned POST. No package managers are executed and no resolution-time network requests are made; sleigh only reads on-disk lockfiles and install metadata. host_id / host_name come from the SleighConfig wrapper and are stamped on every emitted row.

func (*SleighPackageInventoryScan) ClearScan 

func (x *SleighPackageInventoryScan) ClearScan()

func (*SleighPackageInventoryScan) ClearSignedPost 

func (x *SleighPackageInventoryScan) ClearSignedPost()

func (*SleighPackageInventoryScan) GetScan 

func (x *SleighPackageInventoryScan) GetScan() *common.PackageInventoryScan

func (*SleighPackageInventoryScan) GetSignedPost 

func (x *SleighPackageInventoryScan) GetSignedPost() *SignedPost

func (*SleighPackageInventoryScan) HasScan 

func (x *SleighPackageInventoryScan) HasScan() bool

func (*SleighPackageInventoryScan) HasSignedPost 

func (x *SleighPackageInventoryScan) HasSignedPost() bool

func (*SleighPackageInventoryScan) ProtoMessage 

func (*SleighPackageInventoryScan) ProtoMessage()

func (*SleighPackageInventoryScan) ProtoReflect 

func (x *SleighPackageInventoryScan) ProtoReflect() protoreflect.Message

func (*SleighPackageInventoryScan) Reset 

func (x *SleighPackageInventoryScan) Reset()

func (*SleighPackageInventoryScan) SetScan 

func (x *SleighPackageInventoryScan) SetScan(v *common.PackageInventoryScan)

func (*SleighPackageInventoryScan) SetSignedPost 

func (x *SleighPackageInventoryScan) SetSignedPost(v *SignedPost)

func (*SleighPackageInventoryScan) String 

func (x *SleighPackageInventoryScan) String() string

type SleighPackageInventoryScan_builder 

type SleighPackageInventoryScan_builder struct {

	// Scan tuning parameters (profile, roots, ecosystems, limits, ...). Shared
	// with the workshop-issued host command
	// (santa.commands.v1.PackageInventoryRequest).
	Scan *common.PackageInventoryScan
	// Presigned POST minted by workshop. The object key is built from
	// form_values["key"] suffixed by the run's generated filename.
	SignedPost *SignedPost
	// contains filtered or unexported fields
}

func (SleighPackageInventoryScan_builder) Build 

func (b0 SleighPackageInventoryScan_builder) Build() *SleighPackageInventoryScan

type SleighResponse 

type SleighResponse struct {

	// Types that are valid to be assigned to Response:
	//
	//	*SleighResponse_SignalScan
	//	*SleighResponse_BinaryUpload
	Response isSleighResponse_Response `protobuf_oneof:"response"`
	// contains filtered or unexported fields
}

SleighResponse is written (serialized) to stdout by sleigh and read by santad. The populated field mirrors the SleighConfig.command that was run.

func (*SleighResponse) ClearBinaryUpload 

func (x *SleighResponse) ClearBinaryUpload()

func (*SleighResponse) ClearResponse 

func (x *SleighResponse) ClearResponse()

func (*SleighResponse) ClearSignalScan 

func (x *SleighResponse) ClearSignalScan()

func (*SleighResponse) GetBinaryUpload 

func (x *SleighResponse) GetBinaryUpload() *commands.BinaryUploadResponse

func (*SleighResponse) GetResponse 

func (x *SleighResponse) GetResponse() isSleighResponse_Response

func (*SleighResponse) GetSignalScan 

func (x *SleighResponse) GetSignalScan() *SleighSignalScanResponse

func (*SleighResponse) HasBinaryUpload 

func (x *SleighResponse) HasBinaryUpload() bool

func (*SleighResponse) HasResponse 

func (x *SleighResponse) HasResponse() bool

func (*SleighResponse) HasSignalScan 

func (x *SleighResponse) HasSignalScan() bool

func (*SleighResponse) ProtoMessage 

func (*SleighResponse) ProtoMessage()

func (*SleighResponse) ProtoReflect 

func (x *SleighResponse) ProtoReflect() protoreflect.Message

func (*SleighResponse) Reset 

func (x *SleighResponse) Reset()

func (*SleighResponse) SetBinaryUpload 

func (x *SleighResponse) SetBinaryUpload(v *commands.BinaryUploadResponse)

func (*SleighResponse) SetSignalScan 

func (x *SleighResponse) SetSignalScan(v *SleighSignalScanResponse)

func (*SleighResponse) String 

func (x *SleighResponse) String() string

func (*SleighResponse) WhichResponse 

func (x *SleighResponse) WhichResponse() case_SleighResponse_Response

type SleighResponse_BinaryUpload 

type SleighResponse_BinaryUpload struct {
	BinaryUpload *commands.BinaryUploadResponse `protobuf:"bytes,2,opt,name=binary_upload,json=binaryUpload,proto3,oneof"`
}

type SleighResponse_SignalScan 

type SleighResponse_SignalScan struct {
	SignalScan *SleighSignalScanResponse `protobuf:"bytes,1,opt,name=signal_scan,json=signalScan,proto3,oneof"`
}

type SleighResponse_builder 

type SleighResponse_builder struct {

	// Fields of oneof Response:
	SignalScan   *SleighSignalScanResponse
	BinaryUpload *commands.BinaryUploadResponse
	// contains filtered or unexported fields
}

func (SleighResponse_builder) Build 

func (b0 SleighResponse_builder) Build() *SleighResponse

type SleighSignalScan 

type SleighSignalScan struct {

	// The telemetry files to evaluate, passed as a set of already open file
	// descriptors.
	InputFds []int32 `protobuf:"varint,1,rep,packed,name=input_fds,json=inputFds,proto3" json:"input_fds,omitempty"`
	// Detection signals evaluated against every converted event. Signals are
	// non-destructive (they never drop or redact); each one that matches at least
	// one event is summarized in the SleighResponse signal report. Sourced by
	// santa from the synced telemetry_signals config.
	Signals []*common.Signal `protobuf:"bytes,2,rep,name=signals,proto3" json:"signals,omitempty"`
	// Sleigh's persistent scan-state database, passed as an already-open
	// read-write file descriptor. Santa opens it as root (the file lives under
	// root-owned /var/db/santa) and hands the fd to sleigh, which runs with
	// dropped privileges but keeps the inherited descriptor.
	StateDbFd int32 `protobuf:"varint,3,opt,name=state_db_fd,json=stateDbFd,proto3" json:"state_db_fd,omitempty"`
	// A set of CEL expressions to use to filter events as they are processed.
	// If an expression returns true a matched process will not upload envs/args.
	// Expressions can also redact fields instead of dropping.
	FilterExpressions []string `protobuf:"bytes,5,rep,name=filter_expressions,json=filterExpressions,proto3" json:"filter_expressions,omitempty"`
	// contains filtered or unexported fields
}

SleighSignalScan evaluates non-destructive detection signals against converted telemetry events. Unlike SleighExportTelemetry it uploads nothing; it only reports which signals matched. Santa triggers it on demand (separately from the export pass) when it wants signals evaluated over a set of telemetry files.

func (*SleighSignalScan) GetFilterExpressions 

func (x *SleighSignalScan) GetFilterExpressions() []string

func (*SleighSignalScan) GetInputFds 

func (x *SleighSignalScan) GetInputFds() []int32

func (*SleighSignalScan) GetSignals 

func (x *SleighSignalScan) GetSignals() []*common.Signal

func (*SleighSignalScan) GetStateDbFd 

func (x *SleighSignalScan) GetStateDbFd() int32

func (*SleighSignalScan) ProtoMessage 

func (*SleighSignalScan) ProtoMessage()

func (*SleighSignalScan) ProtoReflect 

func (x *SleighSignalScan) ProtoReflect() protoreflect.Message

func (*SleighSignalScan) Reset 

func (x *SleighSignalScan) Reset()

func (*SleighSignalScan) SetFilterExpressions 

func (x *SleighSignalScan) SetFilterExpressions(v []string)

func (*SleighSignalScan) SetInputFds 

func (x *SleighSignalScan) SetInputFds(v []int32)

func (*SleighSignalScan) SetSignals 

func (x *SleighSignalScan) SetSignals(v []*common.Signal)

func (*SleighSignalScan) SetStateDbFd 

func (x *SleighSignalScan) SetStateDbFd(v int32)

func (*SleighSignalScan) String 

func (x *SleighSignalScan) String() string

type SleighSignalScanResponse 

type SleighSignalScanResponse struct {

	// One entry per detection signal that fired at least once, sorted by name.
	// SignalReport lives in santa.common.v1 so this and the sync upload share it.
	SignalReports []*common.SignalReport `protobuf:"bytes,1,rep,name=signal_reports,json=signalReports,proto3" json:"signal_reports,omitempty"`
	// contains filtered or unexported fields
}

SleighSignalScanResponse is the result of a signal_scan command.

func (*SleighSignalScanResponse) GetSignalReports 

func (x *SleighSignalScanResponse) GetSignalReports() []*common.SignalReport

func (*SleighSignalScanResponse) ProtoMessage 

func (*SleighSignalScanResponse) ProtoMessage()

func (*SleighSignalScanResponse) ProtoReflect 

func (x *SleighSignalScanResponse) ProtoReflect() protoreflect.Message

func (*SleighSignalScanResponse) Reset 

func (x *SleighSignalScanResponse) Reset()

func (*SleighSignalScanResponse) SetSignalReports 

func (x *SleighSignalScanResponse) SetSignalReports(v []*common.SignalReport)

func (*SleighSignalScanResponse) String 

func (x *SleighSignalScanResponse) String() string

type SleighSignalScanResponse_builder 

type SleighSignalScanResponse_builder struct {

	// One entry per detection signal that fired at least once, sorted by name.
	// SignalReport lives in santa.common.v1 so this and the sync upload share it.
	SignalReports []*common.SignalReport
	// contains filtered or unexported fields
}

func (SleighSignalScanResponse_builder) Build 

func (b0 SleighSignalScanResponse_builder) Build() *SleighSignalScanResponse

type SleighSignalScan_builder 

type SleighSignalScan_builder struct {

	// The telemetry files to evaluate, passed as a set of already open file
	// descriptors.
	InputFds []int32
	// Detection signals evaluated against every converted event. Signals are
	// non-destructive (they never drop or redact); each one that matches at least
	// one event is summarized in the SleighResponse signal report. Sourced by
	// santa from the synced telemetry_signals config.
	Signals []*common.Signal
	// Sleigh's persistent scan-state database, passed as an already-open
	// read-write file descriptor. Santa opens it as root (the file lives under
	// root-owned /var/db/santa) and hands the fd to sleigh, which runs with
	// dropped privileges but keeps the inherited descriptor.
	StateDbFd int32
	// A set of CEL expressions to use to filter events as they are processed.
	// If an expression returns true a matched process will not upload envs/args.
	// Expressions can also redact fields instead of dropping.
	FilterExpressions []string
	// contains filtered or unexported fields
}

func (SleighSignalScan_builder) Build 

func (b0 SleighSignalScan_builder) Build() *SleighSignalScan

type SocketAddress 

type SocketAddress struct {

	// The socket address
	Address []byte `protobuf:"bytes,1,opt,name=address,proto3,oneof" json:"address,omitempty"`
	// The type of the socket address
	Type *SocketAddress_Type `protobuf:"varint,2,opt,name=type,proto3,enum=santa.telemetry.v1.SocketAddress_Type,oneof" json:"type,omitempty"`
	// contains filtered or unexported fields
}

Information about a socket address and its type

func (*SocketAddress) ClearAddress 

func (x *SocketAddress) ClearAddress()

func (*SocketAddress) ClearType 

func (x *SocketAddress) ClearType()

func (*SocketAddress) GetAddress 

func (x *SocketAddress) GetAddress() []byte

func (*SocketAddress) GetType 

func (x *SocketAddress) GetType() SocketAddress_Type

func (*SocketAddress) HasAddress 

func (x *SocketAddress) HasAddress() bool

func (*SocketAddress) HasType 

func (x *SocketAddress) HasType() bool

func (*SocketAddress) ProtoMessage 

func (*SocketAddress) ProtoMessage()

func (*SocketAddress) ProtoReflect 

func (x *SocketAddress) ProtoReflect() protoreflect.Message

func (*SocketAddress) Reset 

func (x *SocketAddress) Reset()

func (*SocketAddress) SetAddress 

func (x *SocketAddress) SetAddress(v []byte)

func (*SocketAddress) SetType 

func (x *SocketAddress) SetType(v SocketAddress_Type)

func (*SocketAddress) String 

func (x *SocketAddress) String() string

type SocketAddress_Type 

type SocketAddress_Type int32
const (
	SocketAddress_TYPE_UNKNOWN      SocketAddress_Type = 0
	SocketAddress_TYPE_NONE         SocketAddress_Type = 1
	SocketAddress_TYPE_IPV4         SocketAddress_Type = 2
	SocketAddress_TYPE_IPV6         SocketAddress_Type = 3
	SocketAddress_TYPE_NAMED_SOCKET SocketAddress_Type = 4
)

func (SocketAddress_Type) Descriptor 

func (SocketAddress_Type) Descriptor() protoreflect.EnumDescriptor

func (SocketAddress_Type) Enum 

func (x SocketAddress_Type) Enum() *SocketAddress_Type

func (SocketAddress_Type) Number 

func (x SocketAddress_Type) Number() protoreflect.EnumNumber

func (SocketAddress_Type) String 

func (x SocketAddress_Type) String() string

func (SocketAddress_Type) Type 

func (SocketAddress_Type) Type() protoreflect.EnumType

type SocketAddress_builder 

type SocketAddress_builder struct {

	// The socket address
	Address []byte
	// The type of the socket address
	Type *SocketAddress_Type
	// contains filtered or unexported fields
}

func (SocketAddress_builder) Build 

func (b0 SocketAddress_builder) Build() *SocketAddress

type Stat 

type Stat struct {
	Dev              *int32                 `protobuf:"varint,1,opt,name=dev,proto3,oneof" json:"dev,omitempty"`
	Mode             *uint32                `protobuf:"varint,2,opt,name=mode,proto3,oneof" json:"mode,omitempty"`
	Nlink            *uint32                `protobuf:"varint,3,opt,name=nlink,proto3,oneof" json:"nlink,omitempty"`
	Ino              *uint64                `protobuf:"varint,4,opt,name=ino,proto3,oneof" json:"ino,omitempty"`
	User             *UserInfo              `protobuf:"bytes,5,opt,name=user,proto3,oneof" json:"user,omitempty"`
	Group            *GroupInfo             `protobuf:"bytes,6,opt,name=group,proto3,oneof" json:"group,omitempty"`
	Rdev             *int32                 `protobuf:"varint,7,opt,name=rdev,proto3,oneof" json:"rdev,omitempty"`
	AccessTime       *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=access_time,json=accessTime,proto3,oneof" json:"access_time,omitempty"`
	ModificationTime *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=modification_time,json=modificationTime,proto3,oneof" json:"modification_time,omitempty"`
	ChangeTime       *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=change_time,json=changeTime,proto3,oneof" json:"change_time,omitempty"`
	BirthTime        *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=birth_time,json=birthTime,proto3,oneof" json:"birth_time,omitempty"`
	Size             *int64                 `protobuf:"varint,12,opt,name=size,proto3,oneof" json:"size,omitempty"`
	Blocks           *int64                 `protobuf:"varint,13,opt,name=blocks,proto3,oneof" json:"blocks,omitempty"`
	Blksize          *int32                 `protobuf:"varint,14,opt,name=blksize,proto3,oneof" json:"blksize,omitempty"`
	Flags            *uint32                `protobuf:"varint,15,opt,name=flags,proto3,oneof" json:"flags,omitempty"`
	Gen              *int32                 `protobuf:"varint,16,opt,name=gen,proto3,oneof" json:"gen,omitempty"`
	// contains filtered or unexported fields
}

Stat information for a file Mimics data from `stat(2)`

func (*Stat) ClearAccessTime 

func (x *Stat) ClearAccessTime()

func (*Stat) ClearBirthTime 

func (x *Stat) ClearBirthTime()

func (*Stat) ClearBlksize 

func (x *Stat) ClearBlksize()

func (*Stat) ClearBlocks 

func (x *Stat) ClearBlocks()

func (*Stat) ClearChangeTime 

func (x *Stat) ClearChangeTime()

func (*Stat) ClearDev 

func (x *Stat) ClearDev()

func (*Stat) ClearFlags 

func (x *Stat) ClearFlags()

func (*Stat) ClearGen 

func (x *Stat) ClearGen()

func (*Stat) ClearGroup 

func (x *Stat) ClearGroup()

func (*Stat) ClearIno 

func (x *Stat) ClearIno()

func (*Stat) ClearMode 

func (x *Stat) ClearMode()

func (*Stat) ClearModificationTime 

func (x *Stat) ClearModificationTime()
func (x *Stat) ClearNlink()

func (*Stat) ClearRdev 

func (x *Stat) ClearRdev()

func (*Stat) ClearSize 

func (x *Stat) ClearSize()

func (*Stat) ClearUser 

func (x *Stat) ClearUser()

func (*Stat) GetAccessTime 

func (x *Stat) GetAccessTime() *timestamppb.Timestamp

func (*Stat) GetBirthTime 

func (x *Stat) GetBirthTime() *timestamppb.Timestamp

func (*Stat) GetBlksize 

func (x *Stat) GetBlksize() int32

func (*Stat) GetBlocks 

func (x *Stat) GetBlocks() int64

func (*Stat) GetChangeTime 

func (x *Stat) GetChangeTime() *timestamppb.Timestamp

func (*Stat) GetDev 

func (x *Stat) GetDev() int32

func (*Stat) GetFlags 

func (x *Stat) GetFlags() uint32

func (*Stat) GetGen 

func (x *Stat) GetGen() int32

func (*Stat) GetGroup 

func (x *Stat) GetGroup() *GroupInfo

func (*Stat) GetIno 

func (x *Stat) GetIno() uint64

func (*Stat) GetMode 

func (x *Stat) GetMode() uint32

func (*Stat) GetModificationTime 

func (x *Stat) GetModificationTime() *timestamppb.Timestamp
func (x *Stat) GetNlink() uint32

func (*Stat) GetRdev 

func (x *Stat) GetRdev() int32

func (*Stat) GetSize 

func (x *Stat) GetSize() int64

func (*Stat) GetUser 

func (x *Stat) GetUser() *UserInfo

func (*Stat) HasAccessTime 

func (x *Stat) HasAccessTime() bool

func (*Stat) HasBirthTime 

func (x *Stat) HasBirthTime() bool

func (*Stat) HasBlksize 

func (x *Stat) HasBlksize() bool

func (*Stat) HasBlocks 

func (x *Stat) HasBlocks() bool

func (*Stat) HasChangeTime 

func (x *Stat) HasChangeTime() bool

func (*Stat) HasDev 

func (x *Stat) HasDev() bool

func (*Stat) HasFlags 

func (x *Stat) HasFlags() bool

func (*Stat) HasGen 

func (x *Stat) HasGen() bool

func (*Stat) HasGroup 

func (x *Stat) HasGroup() bool

func (*Stat) HasIno 

func (x *Stat) HasIno() bool

func (*Stat) HasMode 

func (x *Stat) HasMode() bool

func (*Stat) HasModificationTime 

func (x *Stat) HasModificationTime() bool
func (x *Stat) HasNlink() bool

func (*Stat) HasRdev 

func (x *Stat) HasRdev() bool

func (*Stat) HasSize 

func (x *Stat) HasSize() bool

func (*Stat) HasUser 

func (x *Stat) HasUser() bool

func (*Stat) ProtoMessage 

func (*Stat) ProtoMessage()

func (*Stat) ProtoReflect 

func (x *Stat) ProtoReflect() protoreflect.Message

func (*Stat) Reset 

func (x *Stat) Reset()

func (*Stat) SetAccessTime 

func (x *Stat) SetAccessTime(v *timestamppb.Timestamp)

func (*Stat) SetBirthTime 

func (x *Stat) SetBirthTime(v *timestamppb.Timestamp)

func (*Stat) SetBlksize 

func (x *Stat) SetBlksize(v int32)

func (*Stat) SetBlocks 

func (x *Stat) SetBlocks(v int64)

func (*Stat) SetChangeTime 

func (x *Stat) SetChangeTime(v *timestamppb.Timestamp)

func (*Stat) SetDev 

func (x *Stat) SetDev(v int32)

func (*Stat) SetFlags 

func (x *Stat) SetFlags(v uint32)

func (*Stat) SetGen 

func (x *Stat) SetGen(v int32)

func (*Stat) SetGroup 

func (x *Stat) SetGroup(v *GroupInfo)

func (*Stat) SetIno 

func (x *Stat) SetIno(v uint64)

func (*Stat) SetMode 

func (x *Stat) SetMode(v uint32)

func (*Stat) SetModificationTime 

func (x *Stat) SetModificationTime(v *timestamppb.Timestamp)
func (x *Stat) SetNlink(v uint32)

func (*Stat) SetRdev 

func (x *Stat) SetRdev(v int32)

func (*Stat) SetSize 

func (x *Stat) SetSize(v int64)

func (*Stat) SetUser 

func (x *Stat) SetUser(v *UserInfo)

func (*Stat) String 

func (x *Stat) String() string

type Stat_builder 

type Stat_builder struct {
	Dev              *int32
	Mode             *uint32
	Nlink            *uint32
	Ino              *uint64
	User             *UserInfo
	Group            *GroupInfo
	Rdev             *int32
	AccessTime       *timestamppb.Timestamp
	ModificationTime *timestamppb.Timestamp
	ChangeTime       *timestamppb.Timestamp
	BirthTime        *timestamppb.Timestamp
	Size             *int64
	Blocks           *int64
	Blksize          *int32
	Flags            *uint32
	Gen              *int32
	// contains filtered or unexported fields
}

func (Stat_builder) Build 

func (b0 Stat_builder) Build() *Stat

type TCCModification 

type TCCModification struct {

	// The process that emitted the event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The TCC service for which permissions are being modified.
	Service *string `protobuf:"bytes,2,opt,name=service,proto3,oneof" json:"service,omitempty"`
	// The identity of the application that is the subject of the permission.
	Identity            *string                              `protobuf:"bytes,3,opt,name=identity,proto3,oneof" json:"identity,omitempty"`
	IdentityType        *TCCModification_IdentityType        `` /* 157-byte string literal not displayed */
	EventType           *TCCModification_EventType           `` /* 145-byte string literal not displayed */
	AuthorizationRight  *TCCModification_AuthorizationRight  `` /* 181-byte string literal not displayed */
	AuthorizationReason *TCCModification_AuthorizationReason `` /* 185-byte string literal not displayed */
	// The process that triggered the TCC event.
	// Note: Due to macOS system limitations, the process that triggered the
	// event may have already exited before the event could be generated. This
	// results in only a small subset of the information from the triggering
	// process to be reported.
	//
	// Types that are valid to be assigned to TccInstigator:
	//
	//	*TCCModification_TriggerProcess
	//	*TCCModification_TriggerId
	TccInstigator isTCCModification_TccInstigator `protobuf_oneof:"tcc_instigator"`
	// The responsible process for the process that triggered the TCC event.
	// This field is completely optional and it's possible neither field is set.
	//
	// Types that are valid to be assigned to ResponsibleInstigator:
	//
	//	*TCCModification_ResponsibleProcess
	//	*TCCModification_ResponsibleId
	ResponsibleInstigator isTCCModification_ResponsibleInstigator `protobuf_oneof:"responsible_instigator"`
	// contains filtered or unexported fields
}

Information captured when a TCC permission is granted or revoked.

func (*TCCModification) ClearAuthorizationReason 

func (x *TCCModification) ClearAuthorizationReason()

func (*TCCModification) ClearAuthorizationRight 

func (x *TCCModification) ClearAuthorizationRight()

func (*TCCModification) ClearEventType 

func (x *TCCModification) ClearEventType()

func (*TCCModification) ClearIdentity 

func (x *TCCModification) ClearIdentity()

func (*TCCModification) ClearIdentityType 

func (x *TCCModification) ClearIdentityType()

func (*TCCModification) ClearInstigator 

func (x *TCCModification) ClearInstigator()

func (*TCCModification) ClearResponsibleId 

func (x *TCCModification) ClearResponsibleId()

func (*TCCModification) ClearResponsibleInstigator 

func (x *TCCModification) ClearResponsibleInstigator()

func (*TCCModification) ClearResponsibleProcess 

func (x *TCCModification) ClearResponsibleProcess()

func (*TCCModification) ClearService 

func (x *TCCModification) ClearService()

func (*TCCModification) ClearTccInstigator 

func (x *TCCModification) ClearTccInstigator()

func (*TCCModification) ClearTriggerId 

func (x *TCCModification) ClearTriggerId()

func (*TCCModification) ClearTriggerProcess 

func (x *TCCModification) ClearTriggerProcess()

func (*TCCModification) GetAuthorizationReason 

func (x *TCCModification) GetAuthorizationReason() TCCModification_AuthorizationReason

func (*TCCModification) GetAuthorizationRight 

func (x *TCCModification) GetAuthorizationRight() TCCModification_AuthorizationRight

func (*TCCModification) GetEventType 

func (x *TCCModification) GetEventType() TCCModification_EventType

func (*TCCModification) GetIdentity 

func (x *TCCModification) GetIdentity() string

func (*TCCModification) GetIdentityType 

func (x *TCCModification) GetIdentityType() TCCModification_IdentityType

func (*TCCModification) GetInstigator 

func (x *TCCModification) GetInstigator() *ProcessInfoLight

func (*TCCModification) GetResponsibleId 

func (x *TCCModification) GetResponsibleId() *ProcessID

func (*TCCModification) GetResponsibleInstigator 

func (x *TCCModification) GetResponsibleInstigator() isTCCModification_ResponsibleInstigator

func (*TCCModification) GetResponsibleProcess 

func (x *TCCModification) GetResponsibleProcess() *ProcessInfoLight

func (*TCCModification) GetService 

func (x *TCCModification) GetService() string

func (*TCCModification) GetTccInstigator 

func (x *TCCModification) GetTccInstigator() isTCCModification_TccInstigator

func (*TCCModification) GetTriggerId 

func (x *TCCModification) GetTriggerId() *ProcessID

func (*TCCModification) GetTriggerProcess 

func (x *TCCModification) GetTriggerProcess() *ProcessInfoLight

func (*TCCModification) HasAuthorizationReason 

func (x *TCCModification) HasAuthorizationReason() bool

func (*TCCModification) HasAuthorizationRight 

func (x *TCCModification) HasAuthorizationRight() bool

func (*TCCModification) HasEventType 

func (x *TCCModification) HasEventType() bool

func (*TCCModification) HasIdentity 

func (x *TCCModification) HasIdentity() bool

func (*TCCModification) HasIdentityType 

func (x *TCCModification) HasIdentityType() bool

func (*TCCModification) HasInstigator 

func (x *TCCModification) HasInstigator() bool

func (*TCCModification) HasResponsibleId 

func (x *TCCModification) HasResponsibleId() bool

func (*TCCModification) HasResponsibleInstigator 

func (x *TCCModification) HasResponsibleInstigator() bool

func (*TCCModification) HasResponsibleProcess 

func (x *TCCModification) HasResponsibleProcess() bool

func (*TCCModification) HasService 

func (x *TCCModification) HasService() bool

func (*TCCModification) HasTccInstigator 

func (x *TCCModification) HasTccInstigator() bool

func (*TCCModification) HasTriggerId 

func (x *TCCModification) HasTriggerId() bool

func (*TCCModification) HasTriggerProcess 

func (x *TCCModification) HasTriggerProcess() bool

func (*TCCModification) ProtoMessage 

func (*TCCModification) ProtoMessage()

func (*TCCModification) ProtoReflect 

func (x *TCCModification) ProtoReflect() protoreflect.Message

func (*TCCModification) Reset 

func (x *TCCModification) Reset()

func (*TCCModification) SetAuthorizationReason 

func (x *TCCModification) SetAuthorizationReason(v TCCModification_AuthorizationReason)

func (*TCCModification) SetAuthorizationRight 

func (x *TCCModification) SetAuthorizationRight(v TCCModification_AuthorizationRight)

func (*TCCModification) SetEventType 

func (x *TCCModification) SetEventType(v TCCModification_EventType)

func (*TCCModification) SetIdentity 

func (x *TCCModification) SetIdentity(v string)

func (*TCCModification) SetIdentityType 

func (x *TCCModification) SetIdentityType(v TCCModification_IdentityType)

func (*TCCModification) SetInstigator 

func (x *TCCModification) SetInstigator(v *ProcessInfoLight)

func (*TCCModification) SetResponsibleId 

func (x *TCCModification) SetResponsibleId(v *ProcessID)

func (*TCCModification) SetResponsibleProcess 

func (x *TCCModification) SetResponsibleProcess(v *ProcessInfoLight)

func (*TCCModification) SetService 

func (x *TCCModification) SetService(v string)

func (*TCCModification) SetTriggerId 

func (x *TCCModification) SetTriggerId(v *ProcessID)

func (*TCCModification) SetTriggerProcess 

func (x *TCCModification) SetTriggerProcess(v *ProcessInfoLight)

func (*TCCModification) String 

func (x *TCCModification) String() string

func (*TCCModification) WhichResponsibleInstigator 

func (x *TCCModification) WhichResponsibleInstigator() case_TCCModification_ResponsibleInstigator

func (*TCCModification) WhichTccInstigator 

func (x *TCCModification) WhichTccInstigator() case_TCCModification_TccInstigator

type TCCModification_AuthorizationReason 

type TCCModification_AuthorizationReason int32

The reason a TCC permission was updated. 

const (
	TCCModification_AUTHORIZATION_REASON_UNKNOWN                 TCCModification_AuthorizationReason = 0
	TCCModification_AUTHORIZATION_REASON_NONE                    TCCModification_AuthorizationReason = 1
	TCCModification_AUTHORIZATION_REASON_ERROR                   TCCModification_AuthorizationReason = 2
	TCCModification_AUTHORIZATION_REASON_USER_CONSENT            TCCModification_AuthorizationReason = 3
	TCCModification_AUTHORIZATION_REASON_USER_SET                TCCModification_AuthorizationReason = 4
	TCCModification_AUTHORIZATION_REASON_SYSTEM_SET              TCCModification_AuthorizationReason = 5
	TCCModification_AUTHORIZATION_REASON_SERVICE_POLICY          TCCModification_AuthorizationReason = 6
	TCCModification_AUTHORIZATION_REASON_MDM_POLICY              TCCModification_AuthorizationReason = 7
	TCCModification_AUTHORIZATION_REASON_SERVICE_OVERRIDE_POLICY TCCModification_AuthorizationReason = 8
	TCCModification_AUTHORIZATION_REASON_MISSING_USAGE_STRING    TCCModification_AuthorizationReason = 9
	TCCModification_AUTHORIZATION_REASON_PROMPT_TIMEOUT          TCCModification_AuthorizationReason = 10
	TCCModification_AUTHORIZATION_REASON_PREFLIGHT_UNKNOWN       TCCModification_AuthorizationReason = 11
	TCCModification_AUTHORIZATION_REASON_ENTITLED                TCCModification_AuthorizationReason = 12
	TCCModification_AUTHORIZATION_REASON_APP_TYPE_POLICY         TCCModification_AuthorizationReason = 13
	TCCModification_AUTHORIZATION_REASON_PROMPT_CANCEL           TCCModification_AuthorizationReason = 14
)

func (TCCModification_AuthorizationReason) Descriptor 

func (TCCModification_AuthorizationReason) Descriptor() protoreflect.EnumDescriptor

func (TCCModification_AuthorizationReason) Enum 

func (x TCCModification_AuthorizationReason) Enum() *TCCModification_AuthorizationReason

func (TCCModification_AuthorizationReason) Number 

func (x TCCModification_AuthorizationReason) Number() protoreflect.EnumNumber

func (TCCModification_AuthorizationReason) String 

func (x TCCModification_AuthorizationReason) String() string

func (TCCModification_AuthorizationReason) Type 

func (TCCModification_AuthorizationReason) Type() protoreflect.EnumType

type TCCModification_AuthorizationRight 

type TCCModification_AuthorizationRight int32

The type of authorization permission an application has to a TCC Service. 

const (
	TCCModification_AUTHORIZATION_RIGHT_UNKNOWN          TCCModification_AuthorizationRight = 0
	TCCModification_AUTHORIZATION_RIGHT_DENIED           TCCModification_AuthorizationRight = 1
	TCCModification_AUTHORIZATION_RIGHT_ALLOWED          TCCModification_AuthorizationRight = 2
	TCCModification_AUTHORIZATION_RIGHT_LIMITED          TCCModification_AuthorizationRight = 3
	TCCModification_AUTHORIZATION_RIGHT_ADD_MODIFY_ADDED TCCModification_AuthorizationRight = 4
	TCCModification_AUTHORIZATION_RIGHT_SESSION_PID      TCCModification_AuthorizationRight = 5
	TCCModification_AUTHORIZATION_RIGHT_LEARN_MORE       TCCModification_AuthorizationRight = 6
)

func (TCCModification_AuthorizationRight) Descriptor 

func (TCCModification_AuthorizationRight) Descriptor() protoreflect.EnumDescriptor

func (TCCModification_AuthorizationRight) Enum 

func (x TCCModification_AuthorizationRight) Enum() *TCCModification_AuthorizationRight

func (TCCModification_AuthorizationRight) Number 

func (x TCCModification_AuthorizationRight) Number() protoreflect.EnumNumber

func (TCCModification_AuthorizationRight) String 

func (x TCCModification_AuthorizationRight) String() string

func (TCCModification_AuthorizationRight) Type 

func (TCCModification_AuthorizationRight) Type() protoreflect.EnumType

type TCCModification_EventType 

type TCCModification_EventType int32

The type of TCC modification event. 

const (
	// Unknown prior state.
	TCCModification_EVENT_TYPE_UNKNOWN TCCModification_EventType = 0
	// A new TCC authorization record was created.
	TCCModification_EVENT_TYPE_CREATE TCCModification_EventType = 1
	// An existing TCC authorization record was modified.
	TCCModification_EVENT_TYPE_MODIFY TCCModification_EventType = 2
	// An existing TCC authorization record was deleted.
	TCCModification_EVENT_TYPE_DELETE TCCModification_EventType = 3
)

func (TCCModification_EventType) Descriptor 

func (TCCModification_EventType) Descriptor() protoreflect.EnumDescriptor

func (TCCModification_EventType) Enum 

func (x TCCModification_EventType) Enum() *TCCModification_EventType

func (TCCModification_EventType) Number 

func (x TCCModification_EventType) Number() protoreflect.EnumNumber

func (TCCModification_EventType) String 

func (x TCCModification_EventType) String() string

func (TCCModification_EventType) Type 

func (TCCModification_EventType) Type() protoreflect.EnumType

type TCCModification_IdentityType 

type TCCModification_IdentityType int32

The identity type of an application which has access to a TCC service. 

const (
	TCCModification_IDENTITY_TYPE_UNKNOWN                 TCCModification_IdentityType = 0
	TCCModification_IDENTITY_TYPE_BUNDLE_ID               TCCModification_IdentityType = 1
	TCCModification_IDENTITY_TYPE_EXECUTABLE_PATH         TCCModification_IdentityType = 2
	TCCModification_IDENTITY_TYPE_POLICY_ID               TCCModification_IdentityType = 3
	TCCModification_IDENTITY_TYPE_FILE_PROVIDER_DOMAIN_ID TCCModification_IdentityType = 4
)

func (TCCModification_IdentityType) Descriptor 

func (TCCModification_IdentityType) Descriptor() protoreflect.EnumDescriptor

func (TCCModification_IdentityType) Enum 

func (x TCCModification_IdentityType) Enum() *TCCModification_IdentityType

func (TCCModification_IdentityType) Number 

func (x TCCModification_IdentityType) Number() protoreflect.EnumNumber

func (TCCModification_IdentityType) String 

func (x TCCModification_IdentityType) String() string

func (TCCModification_IdentityType) Type 

func (TCCModification_IdentityType) Type() protoreflect.EnumType

type TCCModification_ResponsibleId 

type TCCModification_ResponsibleId struct {
	ResponsibleId *ProcessID `protobuf:"bytes,11,opt,name=responsible_id,json=responsibleId,proto3,oneof"`
}

type TCCModification_ResponsibleProcess 

type TCCModification_ResponsibleProcess struct {
	ResponsibleProcess *ProcessInfoLight `protobuf:"bytes,10,opt,name=responsible_process,json=responsibleProcess,proto3,oneof"`
}

type TCCModification_TriggerId 

type TCCModification_TriggerId struct {
	TriggerId *ProcessID `protobuf:"bytes,9,opt,name=trigger_id,json=triggerId,proto3,oneof"`
}

type TCCModification_TriggerProcess 

type TCCModification_TriggerProcess struct {
	TriggerProcess *ProcessInfoLight `protobuf:"bytes,8,opt,name=trigger_process,json=triggerProcess,proto3,oneof"`
}

type TCCModification_builder 

type TCCModification_builder struct {

	// The process that emitted the event
	Instigator *ProcessInfoLight
	// The TCC service for which permissions are being modified.
	Service *string
	// The identity of the application that is the subject of the permission.
	Identity            *string
	IdentityType        *TCCModification_IdentityType
	EventType           *TCCModification_EventType
	AuthorizationRight  *TCCModification_AuthorizationRight
	AuthorizationReason *TCCModification_AuthorizationReason

	// Fields of oneof TccInstigator:
	TriggerProcess *ProcessInfoLight
	TriggerId      *ProcessID

	// Fields of oneof ResponsibleInstigator:
	ResponsibleProcess *ProcessInfoLight
	ResponsibleId      *ProcessID
	// contains filtered or unexported fields
}

func (TCCModification_builder) Build 

func (b0 TCCModification_builder) Build() *TCCModification
type Unlink struct {

	// The process deleting the file
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// The file being deleted
	Target *FileInfo `protobuf:"bytes,2,opt,name=target,proto3,oneof" json:"target,omitempty"`
	// contains filtered or unexported fields
}

Information about an unlink event

func (*Unlink) ClearInstigator 

func (x *Unlink) ClearInstigator()

func (*Unlink) ClearTarget 

func (x *Unlink) ClearTarget()

func (*Unlink) GetInstigator 

func (x *Unlink) GetInstigator() *ProcessInfoLight

func (*Unlink) GetTarget 

func (x *Unlink) GetTarget() *FileInfo

func (*Unlink) HasInstigator 

func (x *Unlink) HasInstigator() bool

func (*Unlink) HasTarget 

func (x *Unlink) HasTarget() bool

func (*Unlink) ProtoMessage 

func (*Unlink) ProtoMessage()

func (*Unlink) ProtoReflect 

func (x *Unlink) ProtoReflect() protoreflect.Message

func (*Unlink) Reset 

func (x *Unlink) Reset()

func (*Unlink) SetInstigator 

func (x *Unlink) SetInstigator(v *ProcessInfoLight)

func (*Unlink) SetTarget 

func (x *Unlink) SetTarget(v *FileInfo)

func (*Unlink) String 

func (x *Unlink) String() string
type Unlink_builder struct {

	// The process deleting the file
	Instigator *ProcessInfoLight
	// The file being deleted
	Target *FileInfo
	// contains filtered or unexported fields
}
func (b0 Unlink_builder) Build() *Unlink

type UserInfo 

type UserInfo struct {
	Uid  *int32  `protobuf:"varint,1,opt,name=uid,proto3,oneof" json:"uid,omitempty"`
	Name *string `protobuf:"bytes,2,opt,name=name,proto3,oneof" json:"name,omitempty"`
	// contains filtered or unexported fields
}

User ID and associated username

func (*UserInfo) ClearName 

func (x *UserInfo) ClearName()

func (*UserInfo) ClearUid 

func (x *UserInfo) ClearUid()

func (*UserInfo) GetName 

func (x *UserInfo) GetName() string

func (*UserInfo) GetUid 

func (x *UserInfo) GetUid() int32

func (*UserInfo) HasName 

func (x *UserInfo) HasName() bool

func (*UserInfo) HasUid 

func (x *UserInfo) HasUid() bool

func (*UserInfo) ProtoMessage 

func (*UserInfo) ProtoMessage()

func (*UserInfo) ProtoReflect 

func (x *UserInfo) ProtoReflect() protoreflect.Message

func (*UserInfo) Reset 

func (x *UserInfo) Reset()

func (*UserInfo) SetName 

func (x *UserInfo) SetName(v string)

func (*UserInfo) SetUid 

func (x *UserInfo) SetUid(v int32)

func (*UserInfo) String 

func (x *UserInfo) String() string

type UserInfo_builder 

type UserInfo_builder struct {
	Uid  *int32
	Name *string
	// contains filtered or unexported fields
}

func (UserInfo_builder) Build 

func (b0 UserInfo_builder) Build() *UserInfo

type XProtect 

type XProtect struct {

	// Types that are valid to be assigned to Event:
	//
	//	*XProtect_Detected
	//	*XProtect_Remediated
	Event isXProtect_Event `protobuf_oneof:"event"`
	// contains filtered or unexported fields
}

Information about XProtect detected and remediated events

func (*XProtect) ClearDetected 

func (x *XProtect) ClearDetected()

func (*XProtect) ClearEvent 

func (x *XProtect) ClearEvent()

func (*XProtect) ClearRemediated 

func (x *XProtect) ClearRemediated()

func (*XProtect) GetDetected 

func (x *XProtect) GetDetected() *XProtectDetected

func (*XProtect) GetEvent 

func (x *XProtect) GetEvent() isXProtect_Event

func (*XProtect) GetRemediated 

func (x *XProtect) GetRemediated() *XProtectRemediated

func (*XProtect) HasDetected 

func (x *XProtect) HasDetected() bool

func (*XProtect) HasEvent 

func (x *XProtect) HasEvent() bool

func (*XProtect) HasRemediated 

func (x *XProtect) HasRemediated() bool

func (*XProtect) ProtoMessage 

func (*XProtect) ProtoMessage()

func (*XProtect) ProtoReflect 

func (x *XProtect) ProtoReflect() protoreflect.Message

func (*XProtect) Reset 

func (x *XProtect) Reset()

func (*XProtect) SetDetected 

func (x *XProtect) SetDetected(v *XProtectDetected)

func (*XProtect) SetRemediated 

func (x *XProtect) SetRemediated(v *XProtectRemediated)

func (*XProtect) String 

func (x *XProtect) String() string

func (*XProtect) WhichEvent 

func (x *XProtect) WhichEvent() case_XProtect_Event

type XProtectDetected 

type XProtectDetected struct {

	// The process that emitted the event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Version of the signatures used for detection
	SignatureVersion *string `protobuf:"bytes,2,opt,name=signature_version,json=signatureVersion,proto3,oneof" json:"signature_version,omitempty"`
	// The malware that was detected
	MalwareIdentifier *string `protobuf:"bytes,3,opt,name=malware_identifier,json=malwareIdentifier,proto3,oneof" json:"malware_identifier,omitempty"`
	// Identifier intended for linking multiple malware detected
	// and remediated events
	IncidentIdentifier *string `protobuf:"bytes,4,opt,name=incident_identifier,json=incidentIdentifier,proto3,oneof" json:"incident_identifier,omitempty"`
	// Path where malware was detected.  This path is not necessarily a
	// malicious binary, it can also be a legitimate file containing a
	// malicious portion.
	DetectedPath *string `protobuf:"bytes,5,opt,name=detected_path,json=detectedPath,proto3,oneof" json:"detected_path,omitempty"`
	// contains filtered or unexported fields
}

Information when XProtect detected malware

func (*XProtectDetected) ClearDetectedPath 

func (x *XProtectDetected) ClearDetectedPath()

func (*XProtectDetected) ClearIncidentIdentifier 

func (x *XProtectDetected) ClearIncidentIdentifier()

func (*XProtectDetected) ClearInstigator 

func (x *XProtectDetected) ClearInstigator()

func (*XProtectDetected) ClearMalwareIdentifier 

func (x *XProtectDetected) ClearMalwareIdentifier()

func (*XProtectDetected) ClearSignatureVersion 

func (x *XProtectDetected) ClearSignatureVersion()

func (*XProtectDetected) GetDetectedPath 

func (x *XProtectDetected) GetDetectedPath() string

func (*XProtectDetected) GetIncidentIdentifier 

func (x *XProtectDetected) GetIncidentIdentifier() string

func (*XProtectDetected) GetInstigator 

func (x *XProtectDetected) GetInstigator() *ProcessInfoLight

func (*XProtectDetected) GetMalwareIdentifier 

func (x *XProtectDetected) GetMalwareIdentifier() string

func (*XProtectDetected) GetSignatureVersion 

func (x *XProtectDetected) GetSignatureVersion() string

func (*XProtectDetected) HasDetectedPath 

func (x *XProtectDetected) HasDetectedPath() bool

func (*XProtectDetected) HasIncidentIdentifier 

func (x *XProtectDetected) HasIncidentIdentifier() bool

func (*XProtectDetected) HasInstigator 

func (x *XProtectDetected) HasInstigator() bool

func (*XProtectDetected) HasMalwareIdentifier 

func (x *XProtectDetected) HasMalwareIdentifier() bool

func (*XProtectDetected) HasSignatureVersion 

func (x *XProtectDetected) HasSignatureVersion() bool

func (*XProtectDetected) ProtoMessage 

func (*XProtectDetected) ProtoMessage()

func (*XProtectDetected) ProtoReflect 

func (x *XProtectDetected) ProtoReflect() protoreflect.Message

func (*XProtectDetected) Reset 

func (x *XProtectDetected) Reset()

func (*XProtectDetected) SetDetectedPath 

func (x *XProtectDetected) SetDetectedPath(v string)

func (*XProtectDetected) SetIncidentIdentifier 

func (x *XProtectDetected) SetIncidentIdentifier(v string)

func (*XProtectDetected) SetInstigator 

func (x *XProtectDetected) SetInstigator(v *ProcessInfoLight)

func (*XProtectDetected) SetMalwareIdentifier 

func (x *XProtectDetected) SetMalwareIdentifier(v string)

func (*XProtectDetected) SetSignatureVersion 

func (x *XProtectDetected) SetSignatureVersion(v string)

func (*XProtectDetected) String 

func (x *XProtectDetected) String() string

type XProtectDetected_builder 

type XProtectDetected_builder struct {

	// The process that emitted the event
	Instigator *ProcessInfoLight
	// Version of the signatures used for detection
	SignatureVersion *string
	// The malware that was detected
	MalwareIdentifier *string
	// Identifier intended for linking multiple malware detected
	// and remediated events
	IncidentIdentifier *string
	// Path where malware was detected.  This path is not necessarily a
	// malicious binary, it can also be a legitimate file containing a
	// malicious portion.
	DetectedPath *string
	// contains filtered or unexported fields
}

func (XProtectDetected_builder) Build 

func (b0 XProtectDetected_builder) Build() *XProtectDetected

type XProtectRemediated 

type XProtectRemediated struct {

	// The process that emitted the event
	Instigator *ProcessInfoLight `protobuf:"bytes,1,opt,name=instigator,proto3,oneof" json:"instigator,omitempty"`
	// Version of the signatures used for detection
	SignatureVersion *string `protobuf:"bytes,2,opt,name=signature_version,json=signatureVersion,proto3,oneof" json:"signature_version,omitempty"`
	// The malware that was detected
	MalwareIdentifier *string `protobuf:"bytes,3,opt,name=malware_identifier,json=malwareIdentifier,proto3,oneof" json:"malware_identifier,omitempty"`
	// Identifier intended for linking multiple malware detected
	// and remediated events
	IncidentIdentifier *string `protobuf:"bytes,4,opt,name=incident_identifier,json=incidentIdentifier,proto3,oneof" json:"incident_identifier,omitempty"`
	// Type of action that was taken (e.g. "path_delete")
	ActionType *string `protobuf:"bytes,5,opt,name=action_type,json=actionType,proto3,oneof" json:"action_type,omitempty"`
	// Whether or not remediation was successful
	Success *bool `protobuf:"varint,6,opt,name=success,proto3,oneof" json:"success,omitempty"`
	// Specific reasons for failure or success
	ResultDescription *string `protobuf:"bytes,7,opt,name=result_description,json=resultDescription,proto3,oneof" json:"result_description,omitempty"`
	// Path that was subject to remediation, if any. This path is not necessarily
	// a malicious binary, it can also be a legitimate file containing a
	// malicious portion. Specifically, the file at this path may still exist
	// after successful remediation.
	RemediatedPath *string `protobuf:"bytes,8,opt,name=remediated_path,json=remediatedPath,proto3,oneof" json:"remediated_path,omitempty"`
	// Audit token of process that was subject to remediation, if any
	RemediatedProcessId *ProcessID `` /* 126-byte string literal not displayed */
	// contains filtered or unexported fields
}

Information when XProtect remediated malware

func (*XProtectRemediated) ClearActionType 

func (x *XProtectRemediated) ClearActionType()

func (*XProtectRemediated) ClearIncidentIdentifier 

func (x *XProtectRemediated) ClearIncidentIdentifier()

func (*XProtectRemediated) ClearInstigator 

func (x *XProtectRemediated) ClearInstigator()

func (*XProtectRemediated) ClearMalwareIdentifier 

func (x *XProtectRemediated) ClearMalwareIdentifier()

func (*XProtectRemediated) ClearRemediatedPath 

func (x *XProtectRemediated) ClearRemediatedPath()

func (*XProtectRemediated) ClearRemediatedProcessId 

func (x *XProtectRemediated) ClearRemediatedProcessId()

func (*XProtectRemediated) ClearResultDescription 

func (x *XProtectRemediated) ClearResultDescription()

func (*XProtectRemediated) ClearSignatureVersion 

func (x *XProtectRemediated) ClearSignatureVersion()

func (*XProtectRemediated) ClearSuccess 

func (x *XProtectRemediated) ClearSuccess()

func (*XProtectRemediated) GetActionType 

func (x *XProtectRemediated) GetActionType() string

func (*XProtectRemediated) GetIncidentIdentifier 

func (x *XProtectRemediated) GetIncidentIdentifier() string

func (*XProtectRemediated) GetInstigator 

func (x *XProtectRemediated) GetInstigator() *ProcessInfoLight

func (*XProtectRemediated) GetMalwareIdentifier 

func (x *XProtectRemediated) GetMalwareIdentifier() string

func (*XProtectRemediated) GetRemediatedPath 

func (x *XProtectRemediated) GetRemediatedPath() string

func (*XProtectRemediated) GetRemediatedProcessId 

func (x *XProtectRemediated) GetRemediatedProcessId() *ProcessID

func (*XProtectRemediated) GetResultDescription 

func (x *XProtectRemediated) GetResultDescription() string

func (*XProtectRemediated) GetSignatureVersion 

func (x *XProtectRemediated) GetSignatureVersion() string

func (*XProtectRemediated) GetSuccess 

func (x *XProtectRemediated) GetSuccess() bool

func (*XProtectRemediated) HasActionType 

func (x *XProtectRemediated) HasActionType() bool

func (*XProtectRemediated) HasIncidentIdentifier 

func (x *XProtectRemediated) HasIncidentIdentifier() bool

func (*XProtectRemediated) HasInstigator 

func (x *XProtectRemediated) HasInstigator() bool

func (*XProtectRemediated) HasMalwareIdentifier 

func (x *XProtectRemediated) HasMalwareIdentifier() bool

func (*XProtectRemediated) HasRemediatedPath 

func (x *XProtectRemediated) HasRemediatedPath() bool

func (*XProtectRemediated) HasRemediatedProcessId 

func (x *XProtectRemediated) HasRemediatedProcessId() bool

func (*XProtectRemediated) HasResultDescription 

func (x *XProtectRemediated) HasResultDescription() bool

func (*XProtectRemediated) HasSignatureVersion 

func (x *XProtectRemediated) HasSignatureVersion() bool

func (*XProtectRemediated) HasSuccess 

func (x *XProtectRemediated) HasSuccess() bool

func (*XProtectRemediated) ProtoMessage 

func (*XProtectRemediated) ProtoMessage()

func (*XProtectRemediated) ProtoReflect 

func (x *XProtectRemediated) ProtoReflect() protoreflect.Message

func (*XProtectRemediated) Reset 

func (x *XProtectRemediated) Reset()

func (*XProtectRemediated) SetActionType 

func (x *XProtectRemediated) SetActionType(v string)

func (*XProtectRemediated) SetIncidentIdentifier 

func (x *XProtectRemediated) SetIncidentIdentifier(v string)

func (*XProtectRemediated) SetInstigator 

func (x *XProtectRemediated) SetInstigator(v *ProcessInfoLight)

func (*XProtectRemediated) SetMalwareIdentifier 

func (x *XProtectRemediated) SetMalwareIdentifier(v string)

func (*XProtectRemediated) SetRemediatedPath 

func (x *XProtectRemediated) SetRemediatedPath(v string)

func (*XProtectRemediated) SetRemediatedProcessId 

func (x *XProtectRemediated) SetRemediatedProcessId(v *ProcessID)

func (*XProtectRemediated) SetResultDescription 

func (x *XProtectRemediated) SetResultDescription(v string)

func (*XProtectRemediated) SetSignatureVersion 

func (x *XProtectRemediated) SetSignatureVersion(v string)

func (*XProtectRemediated) SetSuccess 

func (x *XProtectRemediated) SetSuccess(v bool)

func (*XProtectRemediated) String 

func (x *XProtectRemediated) String() string

type XProtectRemediated_builder 

type XProtectRemediated_builder struct {

	// The process that emitted the event
	Instigator *ProcessInfoLight
	// Version of the signatures used for detection
	SignatureVersion *string
	// The malware that was detected
	MalwareIdentifier *string
	// Identifier intended for linking multiple malware detected
	// and remediated events
	IncidentIdentifier *string
	// Type of action that was taken (e.g. "path_delete")
	ActionType *string
	// Whether or not remediation was successful
	Success *bool
	// Specific reasons for failure or success
	ResultDescription *string
	// Path that was subject to remediation, if any. This path is not necessarily
	// a malicious binary, it can also be a legitimate file containing a
	// malicious portion. Specifically, the file at this path may still exist
	// after successful remediation.
	RemediatedPath *string
	// Audit token of process that was subject to remediation, if any
	RemediatedProcessId *ProcessID
	// contains filtered or unexported fields
}

func (XProtectRemediated_builder) Build 

func (b0 XProtectRemediated_builder) Build() *XProtectRemediated

type XProtect_Detected 

type XProtect_Detected struct {
	Detected *XProtectDetected `protobuf:"bytes,1,opt,name=detected,proto3,oneof"`
}

type XProtect_Remediated 

type XProtect_Remediated struct {
	Remediated *XProtectRemediated `protobuf:"bytes,2,opt,name=remediated,proto3,oneof"`
}

type XProtect_builder 

type XProtect_builder struct {

	// Fields of oneof Event:
	Detected   *XProtectDetected
	Remediated *XProtectRemediated
	// contains filtered or unexported fields
}

func (XProtect_builder) Build 

func (b0 XProtect_builder) Build() *XProtect

Source Files

  • sleighconfig.pb.go
  • v1.pb.go

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.