processing

Dec 9, 2021

Changes in this version

type HeartbeatInjector

+ AlertTimes []string

type PDNSCollector

+ TestdataDummyDomain string

+ func (a *PDNSCollector) EnableTestdataDomain(domain string)

type UnicornAggregator

+ TestFlowDestIP string

+ TestFlowDestPort int64

+ TestFlowSrcIP string

+ func (a *UnicornAggregator) EnableTestFlow(srcip, dstip string, dstport int64)

Jun 25, 2021

Changes in this version

type ForwardHandler

+ MultiFwdChan chan types.Entry

+ type MultiForwardConfiguration struct

+ Outputs map[string]MultiForwardOutput

+ Shippers []*MultiForwardShipper

+ StatsEncoder *util.PerformanceStatsEncoder

+ func (m *MultiForwardConfiguration) Run(inChan <-chan types.Entry, reconnectTimes int)

+ func (m *MultiForwardConfiguration) SubmitStats(sc *util.PerformanceStatsEncoder)

+ type MultiForwardOutput struct

+ All bool

+ BufferLength uint64

+ Socket string

+ Types []string

+ type MultiForwardPerfStats struct

+ BufferLength uint64

+ Dropped uint64

+ Received uint64

+ type MultiForwardShipper struct

+ ForwardInChan chan types.Entry

+ Lock sync.Mutex

+ Logger *log.Entry

+ OutputConn net.Conn

+ OutputName string

+ OutputSocket string

+ PerfStats MultiForwardPerfStats

+ ReconnLock sync.Mutex

+ ReconnectNotifyChan chan bool

+ ReconnectTimes int

+ Reconnecting bool

+ Running bool

+ StatsEncoder *util.PerformanceStatsEncoder

+ StopChan chan bool

+ StopCounterChan chan bool

+ StopReconnectChan chan bool

+ StoppedChan chan bool

+ StoppedCounterChan chan bool

Dec 4, 2020

Changes in this version

+ type HeartbeatInjector struct

+ CloseChan chan bool

+ ForwardHandler Handler

+ Logger *log.Entry

+ SensorID string

+ Times []string

+ func MakeHeartbeatInjector(forwardHandler Handler, injectTimes []string) (*HeartbeatInjector, error)

+ func (a *HeartbeatInjector) Run()

+ func (a *HeartbeatInjector) Stop()

Nov 4, 2020

Changes in this version

+ type FlowProfiler struct

+ CloseChan chan bool

+ ClosedChan chan bool

+ FlushPeriod time.Duration

+ Host string

+ Logger *log.Entry

+ Profile map[string]ProtoProfile

+ ProfileMutex sync.Mutex

+ SensorID string

+ SubmitChannel chan []byte

+ SubmitChannelFull bool

+ Submitter util.StatsSubmitter

+ func MakeFlowProfiler(flushPeriod time.Duration, submitter util.StatsSubmitter) (*FlowProfiler, error)

+ func (a *FlowProfiler) Consume(e *types.Entry) error

+ func (a *FlowProfiler) GetEventTypes() []string

+ func (a *FlowProfiler) GetName() string

+ func (a *FlowProfiler) Run()

+ func (a *FlowProfiler) Stop(stopChan chan bool)

+ type ProtoProfile struct

+ BytesToClt uint64

+ BytesToSrv uint64

+ PacketsToClt uint64

+ PacketsToSrv uint64

Sep 8, 2020

Changes in this version

type BloomHandler

+ Alertifier *util.Alertifier

type ForwardHandler

+ StenosisIface string

+ type IPAlertJSONProviderDstIP struct

+ func (a IPAlertJSONProviderDstIP) GetAlertJSON(inputEvent types.Entry, prefix string, ioc string) ([]byte, error)

+ type IPAlertJSONProviderSrcIP struct

+ func (a IPAlertJSONProviderSrcIP) GetAlertJSON(inputEvent types.Entry, prefix string, ioc string) ([]byte, error)

type IPHandler

+ Alertifier *util.Alertifier

Aug 11, 2020

Changes in this version

type ForwardHandler

+ AddedFields map[string]string

+ func (fh *ForwardHandler) AddFields(fields map[string]string)

May 14, 2020

Changes in this version

type ContextCollector

+ FlowListeners []chan types.Entry

+ func (c *ContextCollector) AddFlowListener(flowChan chan types.Entry)

+ type FlowNotifier struct

+ FlowNotifyChan chan types.Entry

+ func MakeFlowNotifier(outChan chan types.Entry) *FlowNotifier

+ func (n *FlowNotifier) Consume(e *types.Entry) error

+ func (n *FlowNotifier) GetEventTypes() []string

+ func (n *FlowNotifier) GetName() string

type ForwardHandler

+ FlowNotifyChan chan types.Entry

+ StenosisConnector *StenosisConnector

+ func (fh *ForwardHandler) EnableStenosis(endpoint string, timeout, timeBracket time.Duration, ...) (err error)

+ type StenosisConnector struct

+ Cache *cache.Cache

+ Client api.StenosisServiceQueryClient

+ Endpoint string

+ ErrorCount uint64

+ FlowNotifyChan chan types.Entry

+ TimeBracket time.Duration

+ Timeout time.Duration

+ func MakeStenosisConnector(endpoint string, timeout, timeBracket time.Duration, ...) (*StenosisConnector, error)

+ func (s *StenosisConnector) Accept(e *types.Entry)

Sep 10, 2019

Changes in this version

+ const ContextQueueLength

+ const DebugOutputInterval

+ type Context []string

+ type ContextChunk struct

+ Events []interface{}

+ SensorID string

+ Timestamp time.Time

+ type ContextCollector struct

+ Cache *cache.Cache

+ Logger *log.Entry

+ MarkLock sync.Mutex

+ Marked map[string]struct{}

+ PerfStats ContextCollectorPerfStats

+ Running bool

+ Ship ContextShipper

+ StatsEncoder *util.PerformanceStatsEncoder

+ StatsLock sync.Mutex

+ StopChan chan bool

+ StopCounterChan chan bool

+ StoppedChan chan bool

+ StoppedCounterChan chan bool

+ var GlobalContextCollector *ContextCollector

+ func MakeContextCollector(shipper ContextShipper, defaultTTL time.Duration) *ContextCollector

+ func (c *ContextCollector) Consume(e *types.Entry) error

+ func (c *ContextCollector) GetEventTypes() []string

+ func (c *ContextCollector) GetName() string

+ func (c *ContextCollector) Mark(flowID string)

+ func (c *ContextCollector) Run()

+ func (c *ContextCollector) Stop(stoppedChan chan bool)

+ func (c *ContextCollector) SubmitStats(sc *util.PerformanceStatsEncoder)

+ type ContextCollectorPerfStats struct

+ Events uint64

+ Flows uint64

+ JSONBytes uint64

+ type ContextShipper func(Context, *log.Entry) error

+ type ContextShipperAMQP struct

+ InChan chan Context

+ SensorID string

+ Submitter util.StatsSubmitter

+ func (cs *ContextShipperAMQP) Start(s util.StatsSubmitter) (chan<- Context, error)

type ForwardHandler

+ ContextCollector *ContextCollector

Aug 2, 2019

Changes in this version

type BloomHandler

+ BlacklistIOCs map[string]struct{}

type ForwardHandler

+ DoRDNS bool

+ RDNSHandler *RDNSHandler

+ func (fh *ForwardHandler) EnableRDNS(expiryPeriod time.Duration)

+ type RDNSHandler struct

+ HostNamer *util.HostNamer

+ Logger *log.Entry

+ PrivateRanges cidranger.Ranger

+ PrivateRangesOnly bool

+ func MakeRDNSHandler(hn *util.HostNamer) *RDNSHandler

+ func (a *RDNSHandler) Consume(e *types.Entry) error

+ func (a *RDNSHandler) EnableOnlyPrivateIPRanges()

+ func (a *RDNSHandler) GetEventTypes() []string

+ func (a *RDNSHandler) GetName() string

Jan 25, 2019

Changes in this version

+ type DBHandler struct

+ OutChan chan types.Entry

+ func (h *DBHandler) Consume(e *types.Entry) error

+ func (h *DBHandler) GetEventTypes() []string

+ func (h *DBHandler) GetName() string

type ForwardHandler

+ StopCounterChan chan bool

+ StoppedCounterChan chan bool

type HandlerDispatcher

+ DBHandler Handler

+ type VoidHandler struct

+ Logger *log.Entry

+ func MakeVoidHandler() *VoidHandler

+ func (fh *VoidHandler) Consume(e *types.Entry) error

+ func (fh *VoidHandler) GetEventTypes() []string

+ func (fh *VoidHandler) GetName() string

Jan 11, 2019

Changes in this version

+ func MakeIPAlertEntryForHit(e types.Entry, matchedIP string, rangerEntry cidranger.RangerEntry, ...) types.Entry

+ type IPHandler struct

+ AlertPrefix string

+ DatabaseEventChan chan types.Entry

+ DoForwardAlert bool

+ EventType string

+ ForwardHandler Handler

+ IPListFilename string

+ Logger *log.Entry

+ Name string

+ Ranger cidranger.Ranger

+ func MakeIPHandler(ranger cidranger.Ranger, databaseChan chan types.Entry, forwardHandler Handler, ...) *IPHandler

+ func MakeIPHandlerFromFile(IPListFilename string, databaseChan chan types.Entry, forwardHandler Handler, ...) (*IPHandler, error)

+ func (a *IPHandler) Consume(e *types.Entry) error

+ func (a *IPHandler) GetEventTypes() []string

+ func (a *IPHandler) GetName() string

+ func (a *IPHandler) Reload() error

Dec 11, 2018

Changes in this version

type BloomHandler

+ AlertPrefix string

Nov 12, 2018

Changes in this version

+ func MakeAlertEntryForHit(e types.Entry, eType string) types.Entry

+ type AggregateDNSEvent struct

+ DNS AggregatedDNSDetails

+ DestIP []string

+ DestPort int

+ EventType string

+ SrcIP []string

+ SrcPort []int

+ Timestamp []string

+ type AggregateDNSReplyDetails struct

+ Rcode string

+ Rdata string

+ Rrtype string

+ Type string

+ type AggregateFlowEvent struct

+ DestIP string

+ DestPort int

+ EventType string

+ Flow AggregatedFlowDetails

+ SrcIP string

+ SrcPort []int

+ Timestamp []string

+ type AggregatedDNSDetails struct

+ Details []AggregateDNSReplyDetails

+ Rrname string

+ type AggregatedFlowDetails struct

+ BytesToclient int64

+ BytesToserver int64

+ PktsToclient int64

+ PktsToserver int64

+ type BloomHandler struct

+ BloomFileIsCompressed bool

+ BloomFilename string

+ DatabaseEventChan chan types.Entry

+ DoForwardAlert bool

+ EventType string

+ ForwardHandler Handler

+ IocBloom *bloom.BloomFilter

+ Logger *log.Entry

+ Name string

+ func MakeBloomHandler(iocBloom *bloom.BloomFilter, databaseChan chan types.Entry, ...) *BloomHandler

+ func MakeBloomHandlerFromFile(bloomFilename string, compressed bool, databaseChan chan types.Entry, ...) (*BloomHandler, error)

+ func (a *BloomHandler) Consume(e *types.Entry) error

+ func (a *BloomHandler) GetEventTypes() []string

+ func (a *BloomHandler) GetName() string

+ func (a *BloomHandler) Reload() error

+ type BloomNoFileErr struct

+ func (e *BloomNoFileErr) Error() string

+ type ConcurrentHandler interface

+ Run func()

+ Stop func(chan bool)

+ type DNSAggregator struct

+ AnswerSet map[string]bool

+ CloseChan chan bool

+ ClosedChan chan bool

+ Count int64

+ DNS map[string]*AggregateDNSEvent

+ DNSMutex sync.RWMutex

+ DatabaseOutChan chan types.Entry

+ DestIPSet map[string]bool

+ FlushPeriod time.Duration

+ Logger *log.Entry

+ PerfStats DNSAggregatorPerfStats

+ SensorID string

+ SrcIPSet map[string]bool

+ StatsEncoder *util.PerformanceStatsEncoder

+ StringBuf bytes.Buffer

+ func MakeDNSAggregator(flushPeriod time.Duration, outChan chan types.Entry) *DNSAggregator

+ func (a *DNSAggregator) Consume(e *types.Entry) error

+ func (a *DNSAggregator) GetEventTypes() []string

+ func (a *DNSAggregator) GetName() string

+ func (a *DNSAggregator) Run()

+ func (a *DNSAggregator) Stop(stopChan chan bool)

+ func (a *DNSAggregator) SubmitStats(sc *util.PerformanceStatsEncoder)

+ type DNSAggregatorPerfStats struct

+ DNSAggregateCount uint64

+ DNSAggregateRawCount uint64

+ type DefaultHandler struct

+ DefaultOut chan types.Entry

+ func (h *DefaultHandler) Consume(e *types.Entry) error

+ func (h *DefaultHandler) GetEventTypes() []string

+ func (h *DefaultHandler) GetName() string

+ type EventProfile struct

+ CountMap map[string]uint64

+ SizeMap map[string]uint64

+ type EventProfiler struct

+ CloseChan chan bool

+ ClosedChan chan bool

+ FlushPeriod time.Duration

+ Host string

+ Logger *log.Entry

+ Profile EventProfile

+ ProfileMutex sync.Mutex

+ SensorID string

+ SubmitChannel chan []byte

+ Submitter util.StatsSubmitter

+ func MakeEventProfiler(flushPeriod time.Duration, submitter util.StatsSubmitter) (*EventProfiler, error)

+ func (a *EventProfiler) Consume(e *types.Entry) error

+ func (a *EventProfiler) GetEventTypes() []string

+ func (a *EventProfiler) GetName() string

+ func (a *EventProfiler) Run()

+ func (a *EventProfiler) Stop(stopChan chan bool)

+ type FlowAggregator struct

+ CloseChan chan bool

+ ClosedChan chan bool

+ Count int64

+ DatabaseOutChan chan types.Entry

+ Flows map[string]*AggregateFlowEvent

+ FlowsMutex sync.RWMutex

+ FlushPeriod time.Duration

+ Logger *log.Entry

+ PerfStats FlowAggregatorPerfStats

+ SensorID string

+ StatsEncoder *util.PerformanceStatsEncoder

+ StringBuf bytes.Buffer

+ func MakeFlowAggregator(flushPeriod time.Duration, outChan chan types.Entry) *FlowAggregator

+ func (a *FlowAggregator) Consume(e *types.Entry) error

+ func (a *FlowAggregator) GetEventTypes() []string

+ func (a *FlowAggregator) GetName() string

+ func (a *FlowAggregator) Run()

+ func (a *FlowAggregator) Stop(stopChan chan bool)

+ func (a *FlowAggregator) SubmitStats(sc *util.PerformanceStatsEncoder)

+ type FlowAggregatorPerfStats struct

+ FlowAggregateCount uint64

+ FlowAggregateRawCount uint64

+ type FlowExtractor struct

+ BloomFilter *bloom.BloomFilter

+ BloomPath string

+ CloseChan chan bool

+ ClosedChan chan bool

+ Flows *bytes.Buffer

+ FlowsMutex sync.RWMutex

+ FlushCount int

+ FlushPeriod time.Duration

+ Logger *log.Entry

+ SensorID string

+ SubmitChannel chan []byte

+ Submitter util.StatsSubmitter

+ func MakeFlowExtractor(flushPeriod time.Duration, flushCount int, bloomPath string, ...) (*FlowExtractor, error)

+ func (fe *FlowExtractor) Consume(e *types.Entry) error

+ func (fe *FlowExtractor) GetEventTypes() []string

+ func (fe *FlowExtractor) GetName() string

+ func (fe *FlowExtractor) Run()

+ func (fe *FlowExtractor) Stop(stopChan chan bool)

+ type ForwardHandler struct

+ ForwardEventChan chan []byte

+ Lock sync.Mutex

+ Logger *log.Entry

+ OutputConn net.Conn

+ OutputSocket string

+ PerfStats ForwardHandlerPerfStats

+ ReconnLock sync.Mutex

+ ReconnectNotifyChan chan bool

+ ReconnectTimes int

+ Reconnecting bool

+ Running bool

+ StatsEncoder *util.PerformanceStatsEncoder

+ StopChan chan bool

+ StopReconnectChan chan bool

+ StoppedChan chan bool

+ func MakeForwardHandler(reconnectTimes int, outputSocket string) *ForwardHandler

+ func (fh *ForwardHandler) Consume(e *types.Entry) error

+ func (fh *ForwardHandler) GetEventTypes() []string

+ func (fh *ForwardHandler) GetName() string

+ func (fh *ForwardHandler) Run()

+ func (fh *ForwardHandler) Stop(stoppedChan chan bool)

+ func (fh *ForwardHandler) SubmitStats(sc *util.PerformanceStatsEncoder)

+ type ForwardHandlerPerfStats struct

+ ForwardedPerSec uint64

+ type Handler interface

+ Consume func(*types.Entry) error

+ GetEventTypes func() []string

+ GetName func() string

+ type HandlerDispatcher struct

+ DefaultHandler Handler

+ DispatchMap map[string]([]Handler)

+ Lock sync.Mutex

+ Logger *log.Entry

+ PerfStats HandlerDispatcherPerfStats

+ StatsEncoder *util.PerformanceStatsEncoder

+ StopCounterChan chan bool

+ StoppedCounterChan chan bool

+ func MakeHandlerDispatcher(databaseOut chan types.Entry) *HandlerDispatcher

+ func (ad *HandlerDispatcher) Dispatch(e *types.Entry)

+ func (ad *HandlerDispatcher) RegisterHandler(agg Handler)

+ func (ad *HandlerDispatcher) Run()

+ func (ad *HandlerDispatcher) Stop(stopChan chan bool)

+ func (ad *HandlerDispatcher) SubmitStats(sc *util.PerformanceStatsEncoder)

+ type HandlerDispatcherPerfStats struct

+ DispatchedPerSec uint64

+ type PDNSCollector struct

+ CloseChan chan bool

+ ClosedChan chan bool

+ Count int64

+ DNS pDNSEvent

+ DNSMutex sync.RWMutex

+ FlushPeriod time.Duration

+ Logger *log.Entry

+ SensorID string

+ StringBuf bytes.Buffer

+ SubmitChannel chan []byte

+ Submitter util.StatsSubmitter

+ func MakePDNSCollector(flushPeriod time.Duration, submitter util.StatsSubmitter) (*PDNSCollector, error)

+ func (a *PDNSCollector) Consume(e *types.Entry) error

+ func (a *PDNSCollector) GetEventTypes() []string

+ func (a *PDNSCollector) GetName() string

+ func (a *PDNSCollector) Run()

+ func (a *PDNSCollector) Stop(stopChan chan bool)

+ type StatsGeneratingHandler interface

+ SubmitStats func(*util.PerformanceStatsEncoder)

+ type UnicornAggregate struct

+ FlowTuples map[string](map[string]int64)

+ ProxyMap map[string](map[string]int64)

+ SensorID string

+ TimestampEnd time.Time

+ TimestampStart time.Time

+ func MakeUnicornAggregate() *UnicornAggregate

+ type UnicornAggregator struct

+ Aggregate UnicornAggregate

+ CloseChan chan bool

+ ClosedChan chan bool

+ DummyMode bool

+ EventType string

+ Logger *log.Entry

+ Name string

+ StringBuf bytes.Buffer

+ SubmitPeriod time.Duration

+ Submitter util.StatsSubmitter

+ UnicornProxyMapMutex sync.RWMutex

+ UnicornTuplesMutex sync.RWMutex

+ func MakeUnicornAggregator(statsSubmitter util.StatsSubmitter, submitPeriod time.Duration, dummyMode bool) *UnicornAggregator

+ func (a *UnicornAggregator) Consume(e *types.Entry) error

+ func (a *UnicornAggregator) CountFlowTuple(key string, bytestoclient int64, bytestoserver int64)

+ func (a *UnicornAggregator) CountHTTPHost(destip string, hostname string)

+ func (a *UnicornAggregator) GetEventTypes() []string

+ func (a *UnicornAggregator) GetName() string

+ func (a *UnicornAggregator) Run()

+ func (a *UnicornAggregator) Stop(stopChan chan bool)