Versions in this module Expand all Collapse all v0 v0.1.0 Aug 5, 2026 Changes in this version + const EnforceAck + const RuleSetVersion + const SensorVersion + var ErrLiveKernelParked = errors.New(...) + var ErrLiveUnsupported = errors.New("runtime: live kernel event source is only available on Linux") + func SortDetections(ds []Detection) + func VerifyEvidenceBytes(data []byte) (bool, error) + type Action struct + Container string + Kind ActionKind + PID int + Reason string + RuleID string + type ActionKind string + const ActionAlert + const ActionKill + const ActionQuarantine + type Baseline struct + Version string + Workloads map[string]*WorkloadProfile + type ContainerInfo struct + AIAgent bool + ID string + ImageID string + ImageRef string + Name string + Privileged bool + Runtime string + type ContainerResolver struct + func NewContainerResolver() *ContainerResolver + func (r *ContainerResolver) ByCgroup(cgroupLine string) (ContainerInfo, bool) + type DaemonConfig struct + EmitIncidents bool + Exceptions *ExceptionSet + ForensicsDir string + Images []ImageInventory + Options Options + Policy ResponsePolicy + Responder Responder + Sink Sink + WindowSize int + func (c DaemonConfig) Run(ctx context.Context, src EventSource) (*DaemonResult, error) + type DaemonResult struct + EventsScanned int + EvidencePaths []string + Records []DetectionRecord + Suppressed int + func (r *DaemonResult) Detections() []Detection + type Detection struct + Container ContainerInfo + Message string + Metadata map[string]string + Process ProcessInfo + References []string + Remediation string + RuleID string + Seq uint64 + Severity engine.Severity + Technique Technique + TimeUnixNano int64 + Title string + Trigger *Event + func (d Detection) ToFinding(module string) engine.Finding + type DetectionRecord struct + Action Action + Detection Detection + EvidencePath string + Incident *Incident + type Detector struct + func NewDetector(opts Options, images []ImageInventory) *Detector + func (d *Detector) Baseline() *Baseline + func (d *Detector) Process(ev *Event) []Detection + func (d *Detector) RuleSet() *RuleSet + func (d *Detector) Run(ctx context.Context, src EventSource) ([]Detection, error) + type EnforcingResponder struct + Policy ResponsePolicy + Recorder *RecordingResponder + func NewEnforcingResponder(p ResponsePolicy) *EnforcingResponder + func (r *EnforcingResponder) Do(a Action) error + type Event struct + Container ContainerInfo + File *FileEvent + Kind EventKind + Labels map[string]string + Network *NetworkEvent + Process ProcessInfo + Seq uint64 + Syscall *SyscallEvent + TimeUnixNano int64 + type EventKind string + const KindFile + const KindNetwork + const KindProcess + const KindSyscall + type EventSource interface + Close func() error + Next func(ctx context.Context) (Event, error) + func NewEBPFSource(cfg LiveConfig, resolver *ContainerResolver) (EventSource, error) + func NewLiveSource(cfg LiveConfig) (EventSource, error) + type Evidence struct + Algorithm string + Bundle ForensicBundle + Digest string + func CaptureForensics(d Detection, window []Event) *Evidence + func (e *Evidence) Verify() bool + func (e *Evidence) WriteToDir(dir string) (string, error) + type Exception struct + ArgSubstr string + Container string + ImageRef string + Note string + PathPrefix string + RuleID string + type ExceptionSet struct + Rules []Exception + func LoadExceptions(path string) (*ExceptionSet, error) + func (e *ExceptionSet) Suppressed(d Detection) bool + type FileEvent struct + Flags string + Mode uint32 + Op string + Path string + TargetUID int + type FileSink struct + func NewFileSink(path string) (*FileSink, error) + func (s *FileSink) Close() error + func (s *FileSink) Emit(rec DetectionRecord) error + type ForensicBundle struct + CapturedUnixNano int64 + Container ContainerInfo + Detection Detection + ProcessTree []string + RuleSet string + Window []Event + type IOCFeed struct + Domains map[string]string + Hashes map[string]string + IPs map[string]string + Version string + func LoadIOCFeed(path string) (*IOCFeed, error) + func (f *IOCFeed) MatchFileHash(h string) (label string, hit bool) + func (f *IOCFeed) MatchNetwork(n *NetworkEvent) (label string, hit bool) + type ImageInventory struct + Binaries []string + ImageID string + ImageRef string + type Incident struct + Automatable bool + Container ContainerInfo + ID string + Playbook []PlaybookStep + References []string + RuleID string + Severity engine.Severity + Summary string + Technique Technique + Title string + func BuildIncident(d Detection) *Incident + type LiveConfig struct + Probes []string + RingBufferBytes int + type MultiSink struct + Sinks []Sink + func (m *MultiSink) Emit(rec DetectionRecord) error + type NetworkEvent struct + Direction string + Domain string + LocalAddr string + Op string + Proto string + RemoteIP string + RemotePort int + type Options struct + Baseline *Baseline + EgressAllow []string + EnableAgentRuntime bool + EnableAnomaly bool + IntelFeed *IOCFeed + type PlaybookStep struct + Action string + Automatable bool + Command string + Guardrail string + Order int + type ProcSource struct + func NewProcSource(cfg LiveConfig, resolver *ContainerResolver) (*ProcSource, error) + func (s *ProcSource) Close() error + func (s *ProcSource) Next(ctx context.Context) (Event, error) + type ProcessInfo struct + Ancestry []string + Args []string + Caps []string + CgroupID uint64 + Comm string + Exe string + GID int + PID int + PPID int + StdioSocket bool + TTY bool + UID int + type RecordingResponder struct + Actions []Action + func (r *RecordingResponder) Do(a Action) error + type ReplaySource struct + func NewReplaySource(events []Event) *ReplaySource + func (s *ReplaySource) Close() error + func (s *ReplaySource) Next(ctx context.Context) (Event, error) + type Responder interface + Do func(a Action) error + type ResponseMode string + const ResponseDetect + const ResponseEnforce + type ResponsePolicy struct + Acknowledged bool + KillSeverity engine.Severity + Mode ResponseMode + func DefaultResponsePolicy() ResponsePolicy + func (p ResponsePolicy) Plan(d Detection) Action + type Rule interface + Evaluate func(ev *Event, st *State) []Detection + ID func() string + Info func() RuleInfo + type RuleInfo struct + Default bool + Description string + References []string + Remediation string + Severity engine.Severity + Technique Technique + Title string + type RuleSet struct + Version string + func NewRuleSet(opts Options) *RuleSet + func (rs *RuleSet) Rules() []Rule + type Scenario struct + Events []Event + Images []ImageInventory + Name string + Version int + func LoadScenario(r io.Reader) (*Scenario, error) + type SeccompMeta struct + GeneratedBy string + Image string + Observed int + RuleSet string + type SeccompProfile struct + Architectures []string + DefaultAction string + Meta SeccompMeta + Syscalls []SeccompRule + func GenerateSeccompProfile(b *Baseline, workloadKey string) *SeccompProfile + type SeccompRule struct + Action string + Names []string + type ShellKillEnforcer interface + ArmShellKill func() error + type Sink interface + Emit func(rec DetectionRecord) error + type State struct + type SyscallEvent struct + Args map[string]string + Name string + Retval int + type SyslogSink struct + func NewSyslogSink(tag string) (*SyslogSink, error) + func (s *SyslogSink) Close() error + func (s *SyslogSink) Emit(rec DetectionRecord) error + type Technique struct + ID string + Name string + Tactic string + URL string + type WebhookSink struct + Client *http.Client + URL string + func (s *WebhookSink) Emit(rec DetectionRecord) error + type WorkloadProfile struct + Capabilities []string + Endpoints []string + Exes []string + FileExecs []string + FileReads []string + FileWrites []string + Image string + Network bool + Syscalls []string
Go to main page