payload

Documentation

Overview

Package payload defines the JSON payload we send to the events platform.

Index

• type AdditionalFields
• type Device
• type Endpoint
• type Exporter
• type FlowPayload
  • func (p FlowPayload) MarshalJSON() ([]byte, error)
• type Interface
• type NextHop
• type ObservationPoint

Types

type AdditionalFields

type AdditionalFields = map[string]any

AdditionalFields contains additional configured fields

type Device

type Device struct {
	Namespace string `json:"namespace"`
}

Device contains device details (device sending NetFlow flows)

type Endpoint

type Endpoint struct {
	IP                 string `json:"ip"`
	Port               string `json:"port"` // Port number can be zero/positive or `*` (ephemeral port)
	Mac                string `json:"mac"`
	Mask               string `json:"mask"`
	ReverseDNSHostname string `json:"reverse_dns_hostname,omitempty"`
}

Endpoint contains source or destination endpoint details

type Exporter

type Exporter struct {
	IP string `json:"ip"`
}

Exporter contains NetFlow exporter details

type FlowPayload

type FlowPayload struct {
	FlushTimestamp   int64            `json:"flush_timestamp"`
	FlowType         string           `json:"type"`
	SamplingRate     uint64           `json:"sampling_rate"`
	Direction        string           `json:"direction"`
	Start            uint64           `json:"start"` // in seconds
	End              uint64           `json:"end"`   // in seconds
	Bytes            uint64           `json:"bytes"`
	Packets          uint64           `json:"packets"`
	EtherType        string           `json:"ether_type,omitempty"`
	IPProtocol       string           `json:"ip_protocol"`
	Device           Device           `json:"device"`
	Exporter         Exporter         `json:"exporter"`
	Source           Endpoint         `json:"source"`
	Destination      Endpoint         `json:"destination"`
	Ingress          ObservationPoint `json:"ingress"`
	Egress           ObservationPoint `json:"egress"`
	Host             string           `json:"host"`
	TCPFlags         []string         `json:"tcp_flags,omitempty"`
	NextHop          NextHop          `json:"next_hop,omitempty"`
	AdditionalFields AdditionalFields `json:"additional_fields,omitempty"`
}

FlowPayload contains network devices flows

func (FlowPayload) MarshalJSON

func (p FlowPayload) MarshalJSON() ([]byte, error)

MarshalJSON Custom marshaller that moves AdditionalFields to the root of the payload

type Interface

type Interface struct {
	Index uint32 `json:"index"`
}

Interface contains interface details

type NextHop

type NextHop struct {
	IP string `json:"ip"`
}

NextHop contains next hop details

type ObservationPoint

type ObservationPoint struct {
	Interface Interface `json:"interface"`
}

ObservationPoint contains ingress or egress observation point