db

Documentation

Index

• type ActionCount
• type CommandFailureRate
• type DenialRate
• type Event
  • func (e Event) MatchedPolicy() string
• type EventStore
• type HourlyVolume
• type NeonClient
  • func NewNeonClient(ctx context.Context, connURL string) (*NeonClient, error)
  • func (c *NeonClient) Close()
  • func (c *NeonClient) GetCheckpoint(ctx context.Context, adapter string) (*ingestion.Checkpoint, error)
  • func (c *NeonClient) InsertExecutionEvents(ctx context.Context, events []ingestion.ExecutionEvent) (int, error)
  • func (c *NeonClient) QueryActionCounts(ctx context.Context, since time.Time) ([]ActionCount, error)
  • func (c *NeonClient) QueryCommandFailureRates(ctx context.Context, since time.Time) ([]CommandFailureRate, error)
  • func (c *NeonClient) QueryDenialRates(ctx context.Context, since time.Time) ([]DenialRate, error)
  • func (c *NeonClient) QueryEvents(ctx context.Context, since, until time.Time) ([]Event, error)
  • func (c *NeonClient) QueryHourlyVolumes(ctx context.Context, since time.Time) ([]HourlyVolume, error)
  • func (c *NeonClient) QuerySessionDenials(ctx context.Context, since time.Time) ([]SessionDenialCount, error)
  • func (c *NeonClient) QuerySessionSequences(ctx context.Context, since time.Time) ([]SessionSequence, error)
  • func (c *NeonClient) UpsertCheckpoint(ctx context.Context, cp ingestion.Checkpoint) error
• type SequenceEntry
• type SessionDenialCount
• type SessionSequence

Types

type ActionCount

type ActionCount struct {
	Action  string
	Outcome string
	Count   int
}

type CommandFailureRate

type CommandFailureRate struct {
	Command      string
	TotalCount   int
	FailureCount int
	FailureRate  float64
	Repos        []string
	Actors       []string
}

CommandFailureRate tracks failure rates for a command from execution_events.

type DenialRate

type DenialRate struct {
	Action      string
	TotalCount  int
	DenialCount int
	DenialRate  float64
}

type Event

type Event struct {
	ID            string
	Timestamp     time.Time
	AgentID       string
	SessionID     string
	EventType     string // e.g. "tool_call"
	Action        string // tool name: "Bash", "Edit", "Read", etc.
	Resource      string
	Outcome       string // "allow", "deny"
	RiskLevel     string // "low", "medium", "high", "critical"
	PolicyVersion string
	Metadata      map[string]any // parsed JSON metadata
}

Event mirrors a row from governance_events in Neon.

func (Event) MatchedPolicy

func (e Event) MatchedPolicy() string

MatchedPolicy extracts the policy identifier from event metadata. Returns the action name as fallback if no policy is recorded.

type EventStore

type EventStore interface {
	QueryEvents(ctx context.Context, since, until time.Time) ([]Event, error)
	QueryActionCounts(ctx context.Context, since time.Time) ([]ActionCount, error)
	QueryDenialRates(ctx context.Context, since time.Time) ([]DenialRate, error)
	QuerySessionDenials(ctx context.Context, since time.Time) ([]SessionDenialCount, error)
	QueryHourlyVolumes(ctx context.Context, since time.Time) ([]HourlyVolume, error)
	QueryCommandFailureRates(ctx context.Context, since time.Time) ([]CommandFailureRate, error)
	QuerySessionSequences(ctx context.Context, since time.Time) ([]SessionSequence, error)
	Close()
}

EventStore defines the queries Sentinel needs from the telemetry database.

type HourlyVolume

type HourlyVolume struct {
	Hour  time.Time
	Count int
}

type NeonClient

type NeonClient struct {
	// contains filtered or unexported fields
}

func NewNeonClient

func NewNeonClient(ctx context.Context, connURL string) (*NeonClient, error)

func (*NeonClient) Close

func (c *NeonClient) Close()

func (*NeonClient) GetCheckpoint

func (c *NeonClient) GetCheckpoint(ctx context.Context, adapter string) (*ingestion.Checkpoint, error)

GetCheckpoint retrieves the ingestion checkpoint for the given adapter. Returns nil (no error) when no checkpoint exists yet.

func (*NeonClient) InsertExecutionEvents

func (c *NeonClient) InsertExecutionEvents(ctx context.Context, events []ingestion.ExecutionEvent) (int, error)

InsertExecutionEvents batch-inserts execution events using a transaction. Conflicts on the primary key are silently ignored (ON CONFLICT DO NOTHING). Returns the number of rows actually inserted.

func (*NeonClient) QueryActionCounts

func (c *NeonClient) QueryActionCounts(ctx context.Context, since time.Time) ([]ActionCount, error)

func (*NeonClient) QueryCommandFailureRates

func (c *NeonClient) QueryCommandFailureRates(ctx context.Context, since time.Time) ([]CommandFailureRate, error)

QueryCommandFailureRates returns failure rates per command from execution_events since the given time, grouped by command.

func (*NeonClient) QueryDenialRates

func (c *NeonClient) QueryDenialRates(ctx context.Context, since time.Time) ([]DenialRate, error)

func (*NeonClient) QueryEvents

func (c *NeonClient) QueryEvents(ctx context.Context, since, until time.Time) ([]Event, error)

func (*NeonClient) QueryHourlyVolumes

func (c *NeonClient) QueryHourlyVolumes(ctx context.Context, since time.Time) ([]HourlyVolume, error)

func (*NeonClient) QuerySessionDenials

func (c *NeonClient) QuerySessionDenials(ctx context.Context, since time.Time) ([]SessionDenialCount, error)

func (*NeonClient) QuerySessionSequences

func (c *NeonClient) QuerySessionSequences(ctx context.Context, since time.Time) ([]SessionSequence, error)

QuerySessionSequences returns ordered command sequences per session since the given time. Each entry preserves the execution order via sequence_num.

func (*NeonClient) UpsertCheckpoint

func (c *NeonClient) UpsertCheckpoint(ctx context.Context, cp ingestion.Checkpoint) error

UpsertCheckpoint inserts or updates the checkpoint for the given adapter.

type SequenceEntry

type SequenceEntry struct {
	Command  string
	ExitCode int
	HasError bool
}

SequenceEntry is one command in a session sequence.

type SessionDenialCount

type SessionDenialCount struct {
	SessionID string
	AgentID   string
	Denials   int
	Total     int
}

type SessionSequence

type SessionSequence struct {
	SessionID string
	Events    []SequenceEntry
}

SessionSequence is an ordered list of commands within a session.