converter

Documentation

Index

• type Converter
  • func New(l zerolog.Logger) Converter
• type EventScope
• type Mapping
• type ObjectScope

Types

type Converter

type Converter interface {
	Convert(e *event.Event) []*sigma.Rule
}

func New

func New(l zerolog.Logger) Converter

type EventScope

type EventScope struct {
	Search     search.Search
	Detections []sigma.Detection
}

type Mapping

type Mapping struct {
	// A search is propagated to the parent
	Search search.Search
	// Selections are kept as independent but the condition is then propagated to the parent
	Selections search.Selections
}

Mapping represents the different possible field.Field mappings.

type ObjectScope

type ObjectScope struct {
	Search    search.Search
	Detection sigma.Detection
}