output

Documentation

Index

• func TagString(tags []string) string
• func Write(w io.Writer, outputType string, results []ScanResult, r Renderer) error
• type Renderer
• type ScanResult

Functions

func TagString

func TagString(tags []string) string

TagString joins tags with a dash, matching the original output format.

func Write

func Write(w io.Writer, outputType string, results []ScanResult, r Renderer) error

Write renders results in the requested format to w. outputType must be "json", "csv", or any other value for a table.

Types

type Renderer

type Renderer struct {
	Headers []string
	Row     func(ScanResult) []string
}

Renderer defines the table/CSV columns for a specific log type. JSON output always serialises the full ScanResult struct.

type ScanResult

type ScanResult struct {
	Timestamp string   `json:"Timestamp"`
	Message   string   `json:"Message,omitempty"`
	User      string   `json:"User,omitempty"`
	Exe       string   `json:"Exe,omitempty"`
	Terminal  string   `json:"Terminal,omitempty"`
	PID       string   `json:"PID,omitempty"`
	Tags      []string `json:"Tags"`
	Author    string   `json:"Author"`
	RuleID    string   `json:"ID"`
	Title     string   `json:"Title"`
}

ScanResult is the common result produced by all log mappers after evaluating Sigma rules.