Documentation
¶
Index ¶
- type BaseEvent
- type BlockedEvent
- type ChildprocEvent
- type CrossprocEvent
- type DigSigResult
- type EmetEvent
- type Event
- type EventMessage
- type EventMessageWithHashes
- type FilemodEvent
- type HeaderHashes
- type ModInfoEvent
- type ModloadMessage
- type NetconEvent
- type NetworkV2Event
- type OldProtobufMessageProcessor
- func (pbmp OldProtobufMessageProcessor) ProcessProtobufBundle(routingKey string, body []byte, headers amqp.Table) ([]map[string]interface{}, error)
- func (pbmp OldProtobufMessageProcessor) ProcessProtobufMessage(routingKey string, body []byte, headers amqp.Table) (map[string]interface{}, error)
- func (pbmp OldProtobufMessageProcessor) ProcessRawZipBundle(routingKey string, body []byte, headers amqp.Table) ([]map[string]interface{}, error)
- type ParentCreateTime
- type ProcessEvent
- type ProtobufMessageProcessor
- func (pbm ProtobufMessageProcessor) GetMessageInOutputFormat(message Event) ([]byte, error)
- func (pbm *ProtobufMessageProcessor) NewBaseMessage(msg *CbEventMsg, routingKey, eventType string) *BaseEvent
- func (pbm ProtobufMessageProcessor) NewBlockedEvent(msg *CbEventMsg, routingKey string) *BlockedEvent
- func (pbm *ProtobufMessageProcessor) NewChildprocEvent(msg *CbEventMsg, routingKey string) *ChildprocEvent
- func (pbm *ProtobufMessageProcessor) NewCrossprocEvent(msg *CbEventMsg, routingKey string) *CrossprocEvent
- func (pbm *ProtobufMessageProcessor) NewEmetMessage(msg *CbEventMsg, routingKey string) *EmetEvent
- func (pbm *ProtobufMessageProcessor) NewEventMessage(msg *CbEventMsg) *EventMessage
- func (pbm *ProtobufMessageProcessor) NewEventMessageWithHashes(msg *CbEventMsg) *EventMessageWithHashes
- func (pbm *ProtobufMessageProcessor) NewFilemodEvent(msg *CbEventMsg, routingKey string) *FilemodEvent
- func (pbm ProtobufMessageProcessor) NewModLoadMessage(msg *CbEventMsg, routingKey string) *ModloadMessage
- func (pbm ProtobufMessageProcessor) NewModinfoEvent(msg *CbEventMsg, routingKey string) *ModInfoEvent
- func (pbm *ProtobufMessageProcessor) NewNetconEvent(msg *CbEventMsg, routingKey string) *NetconEvent
- func (pbm *ProtobufMessageProcessor) NewNetworkV2Event(msg *CbEventMsg, routingKey string) *NetworkV2Event
- func (pbm *ProtobufMessageProcessor) NewProcessEvent(msg *CbEventMsg, routingKey string) *ProcessEvent
- func (pbm *ProtobufMessageProcessor) NewRegmodEvent(msg *CbEventMsg, routingKey string) *RegmodEvent
- func (pbm *ProtobufMessageProcessor) NewScriptExEvent(msg *CbEventMsg, routingKey string) *ScriptExEvent
- func (pbm *ProtobufMessageProcessor) NewTamperAlert(msg *CbEventMsg, routingKey string) *TamperAlert
- func (pbm ProtobufMessageProcessor) ProcessProtobufBundle(routingKey string, body []byte, headers amqp.Table) ([][]byte, error)
- func (pbm ProtobufMessageProcessor) ProcessProtobufMessage(routingKey string, body []byte, headers amqp.Table) ([]byte, error)
- func (pbm ProtobufMessageProcessor) ProcessProtobufMessageWithEnv(routingKey string, body []byte, headers amqp.Table, env *CbEnvironmentMsg) ([]byte, error)
- func (pbm ProtobufMessageProcessor) ProcessRawZipBundle(routingKey string, body []byte, headers amqp.Table) ([][]byte, error)
- type RegmodEvent
- type ScriptExEvent
- type TamperAlert
- type UnixTimeStamp
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BaseEvent ¶
type BaseEvent struct {
UnixTimeStamp `json:",inline"`
CbServer string `json:"cb_server,omitempty,intern"`
Type string `json:"type,intern"`
SensorId int32 `json:"sensor_id"`
ComputerName string `json:"computer_name"`
EventType string `json:"event_type,intern"`
}
func (BaseEvent) MarshalEasyJSON ¶
MarshalEasyJSON supports easyjson.Marshaler interface
func (BaseEvent) MarshalJSON ¶
MarshalJSON supports json.Marshaler interface
func (*BaseEvent) UnmarshalEasyJSON ¶
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*BaseEvent) UnmarshalJSON ¶
UnmarshalJSON supports json.Unmarshaler interface
type BlockedEvent ¶
type BlockedEvent struct {
*BaseEvent
Md5 string `json:"md5"`
Path string `json:"path"`
LinkTarget string `json:"link_target,omitempty"`
ProcessGuid string `json:"process_guid,omitempty"`
ProcessCreateTime uint64 `json:"process_create_time,omitempty"`
CommandLine string `json:"command_line,omitempty"`
Pid int32 `json:"pid,omitempty"`
Uid string `json:"uid,omitempty"`
Username string `json:"username,omitempty"`
BlockedError uint32 `json:"blocked_error,omitempty"`
BlockedEvent string `json:"blocked_event,omitempty"`
BlockedReason string `json:"blocked_reason,omitempty"`
BlockedResult string `json:"blocked_result,omitempty"`
}
func (BlockedEvent) MarshalEasyJSON ¶
func (v BlockedEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (BlockedEvent) MarshalJSON ¶
func (v BlockedEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*BlockedEvent) UnmarshalEasyJSON ¶
func (v *BlockedEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*BlockedEvent) UnmarshalJSON ¶
func (v *BlockedEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ChildprocEvent ¶
type ChildprocEvent struct {
*BaseEvent
*EventMessage
ParentGuid string `json:"parent_guid,omitempty"`
LinkChild string `json:"link_child,omitempty"`
Created bool `json:"created"`
TamperSent bool `json:"tamper_sent"`
Tamper bool `json:"tamper"`
Path string `json:"path"`
Md5 string `json:"md5"`
Sha256 string `json:"sha256"`
ChildprocType string `json:"childproc_type,intern"`
ChildSuppressed bool `json:"childproc_suppressed"`
ChildCommandLine string `json:"childproc_commandline,omitempty"`
ChildUsername string `json:"childproc_username,omitempty"`
ChildPid int64 `json:"child_pid"`
}
func (ChildprocEvent) MarshalEasyJSON ¶
func (v ChildprocEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ChildprocEvent) MarshalJSON ¶
func (v ChildprocEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ChildprocEvent) UnmarshalEasyJSON ¶
func (v *ChildprocEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ChildprocEvent) UnmarshalJSON ¶
func (v *ChildprocEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type CrossprocEvent ¶
type CrossprocEvent struct {
*BaseEvent
*EventMessageWithHashes
IsTarget bool `json:"is_target"`
CrossProcessType string `json:"cross_process_type,intern"`
TargetMd5 string `json:"target_md5"`
RequestedAccess uint32 `json:"requested_access,omitempty"`
LinkTarget string `json:"link_target,omitempty"`
TargetPath string `json:"target_path"`
TargetSha256 string `json:"target_sha256"`
TargetPid uint32 `json:"target_pid"`
TargetCreateTime uint64 `json:"target_create_time"`
TargetProcessGuid string `json:"target_process_guid"`
}
func (CrossprocEvent) MarshalEasyJSON ¶
func (v CrossprocEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (CrossprocEvent) MarshalJSON ¶
func (v CrossprocEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*CrossprocEvent) UnmarshalEasyJSON ¶
func (v *CrossprocEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*CrossprocEvent) UnmarshalJSON ¶
func (v *CrossprocEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type DigSigResult ¶
type DigSigResult struct {
Result string `json:"result"`
Publisher string `json:"publisher"`
ProgramName string `json:"program_name"`
IssuerName string `json:"issuer_name"`
ResultCode string `json:"result_code"`
SubjectName string `json:"subject_name"`
SignTime string `json:"sign_time"`
}
func (DigSigResult) MarshalEasyJSON ¶
func (v DigSigResult) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (DigSigResult) MarshalJSON ¶
func (v DigSigResult) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*DigSigResult) UnmarshalEasyJSON ¶
func (v *DigSigResult) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*DigSigResult) UnmarshalJSON ¶
func (v *DigSigResult) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type EmetEvent ¶
type EmetEvent struct {
*BaseEvent
*EventMessageWithHashes
LogMessage string `json:"log_message"`
Mitigation string `json:"mitigation,intern"`
Blocked bool `json:"blocked"`
EmetTimestamp uint64 `json:"emet_timestamp"`
LogId uint64 `json:"log_id"`
}
func (EmetEvent) MarshalEasyJSON ¶
MarshalEasyJSON supports easyjson.Marshaler interface
func (EmetEvent) MarshalJSON ¶
MarshalJSON supports json.Marshaler interface
func (*EmetEvent) UnmarshalEasyJSON ¶
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*EmetEvent) UnmarshalJSON ¶
UnmarshalJSON supports json.Unmarshaler interface
type EventMessage ¶
type EventMessage struct {
ForkPid int32 `json:"fork_pid,omitempty"`
Pid int32 `json:"pid,omitempty"`
ProcessGuid string `json:"process_guid,omitempty"`
LinkProcess string `json:"link_process,omitempty"`
LinkSensor string `json:"link_sensor,omitempty"`
ProcessPath string `json:"process_path,omitempty"`
}
func (EventMessage) MarshalEasyJSON ¶
func (v EventMessage) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (EventMessage) MarshalJSON ¶
func (v EventMessage) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*EventMessage) UnmarshalEasyJSON ¶
func (v *EventMessage) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*EventMessage) UnmarshalJSON ¶
func (v *EventMessage) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type EventMessageWithHashes ¶
type EventMessageWithHashes struct {
*EventMessage
*HeaderHashes
}
func (EventMessageWithHashes) MarshalEasyJSON ¶
func (v EventMessageWithHashes) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (EventMessageWithHashes) MarshalJSON ¶
func (v EventMessageWithHashes) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*EventMessageWithHashes) UnmarshalEasyJSON ¶
func (v *EventMessageWithHashes) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*EventMessageWithHashes) UnmarshalJSON ¶
func (v *EventMessageWithHashes) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type FilemodEvent ¶
type FilemodEvent struct {
*BaseEvent
*EventMessageWithHashes
Path string `json:"path"`
TamperSent bool `json:"tamper_sent"`
Tamper bool `json:"tamper"`
FileSha256 string `json:"file_sha256,omitempty"`
FileMd5 string `json:"file_md5,omitempty"`
FileTypeName string `json:"filetype_name,omitempty"`
ActionType int32 `json:"action_type"`
Action string `json:"action,intern"`
FileType int32 `json:"file_type"`
}
func (FilemodEvent) MarshalEasyJSON ¶
func (v FilemodEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (FilemodEvent) MarshalJSON ¶
func (v FilemodEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*FilemodEvent) UnmarshalEasyJSON ¶
func (v *FilemodEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*FilemodEvent) UnmarshalJSON ¶
func (v *FilemodEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type HeaderHashes ¶
type HeaderHashes struct {
Sha256 string `json:"sha256,omitempty"`
Md5 string `json:"md5,omitempty"`
}
func NewHeaderHashes ¶
func NewHeaderHashes(msg *CbEventMsg) HeaderHashes
func (HeaderHashes) MarshalEasyJSON ¶
func (v HeaderHashes) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (HeaderHashes) MarshalJSON ¶
func (v HeaderHashes) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*HeaderHashes) UnmarshalEasyJSON ¶
func (v *HeaderHashes) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*HeaderHashes) UnmarshalJSON ¶
func (v *HeaderHashes) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ModInfoEvent ¶
type ModInfoEvent struct {
*BaseEvent
Digsig *DigSigResult `json:"digsig"`
Utf8CopiedModuleLength uint32 `json:"utf_8_copied_module_length"`
Utf8FileDescription string `json:"utf_8_file_dscription"`
Utf8CompanyName string `json:"utf_8_company_name"`
Utf8Comments string `json:"utf_8_comments"`
Utf8FileVersion string `json:"utf_8_file_version"`
Utf8LegalCopyRight string `json:"utf_8_legal_copyright"`
Utf8LegalTradeMark string `json:"utf_8_legal_trademark"`
Utf8InternalName string `json:"utf_8_internal_name"`
Utf8ProductName string `json:"utf_8_product_name"`
Utf8OriginalFileName string `json:"utf_8_original_file_name"`
Utf8ProductDescription string `json:"utf_8_product_description"`
Utf8ProductVersion string `json:"utf_8_product_version"`
Utf8SpecialBuild string `json:"utf_8_special_build"`
ImageFileHeader []byte `json:"image_file_header"`
Utf8OnDiskFileName string `json:"utf_8_on_disk_filename"`
Icon []byte `json:"icon"`
Utf8PrivateBuild string `json:"utf_8_private_build"`
Size uint64 `json:"size"`
Sha256 string `json:"sha256"`
Md5 string `json:"md5"`
}
func (ModInfoEvent) MarshalEasyJSON ¶
func (v ModInfoEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ModInfoEvent) MarshalJSON ¶
func (v ModInfoEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ModInfoEvent) UnmarshalEasyJSON ¶
func (v *ModInfoEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ModInfoEvent) UnmarshalJSON ¶
func (v *ModInfoEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ModloadMessage ¶
type ModloadMessage struct {
*BaseEvent
*EventMessage
Path string `json:"path"`
Md5 string `json:"md5"`
Sha256 string `json:"sha256"`
CommandLine string `json:"command_line"`
}
func (ModloadMessage) MarshalEasyJSON ¶
func (v ModloadMessage) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ModloadMessage) MarshalJSON ¶
func (v ModloadMessage) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ModloadMessage) UnmarshalEasyJSON ¶
func (v *ModloadMessage) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ModloadMessage) UnmarshalJSON ¶
func (v *ModloadMessage) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type NetconEvent ¶
type NetconEvent struct {
*BaseEvent
*EventMessageWithHashes
RemotePort uint16 `json:"remote_port,omitempty"`
LocalIp string `json:"local_ip,omitempty"`
LocalPort uint16 `json:"local_port,omitempty"`
Direction string `json:"direction"`
Domain string `json:"domain"`
Protocol int32 `json:"protocol"`
Port uint16 `json:"port"`
Ipv4 string `json:"ipv4"`
RemoteIp string `json:"remote_ip,omitempty"`
}
func (NetconEvent) MarshalEasyJSON ¶
func (v NetconEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (NetconEvent) MarshalJSON ¶
func (v NetconEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*NetconEvent) UnmarshalEasyJSON ¶
func (v *NetconEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*NetconEvent) UnmarshalJSON ¶
func (v *NetconEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type NetworkV2Event ¶
type NetworkV2Event struct {
*BaseEvent
*EventMessageWithHashes
Protocol int32
Domain string `json:"domain"`
Direction string `json:"direction"`
Ja3 string `json:"ja3,omitempty"`
Ja3s string `json:"ja3s,omitempty"`
LocalIP string `json:"local_ip"`
LocalPort uint16 `json:"local_port"`
RemoteIP string `json:"remote_ip"`
RemotePort uint16 `json:"remote_port"`
Proxy bool `json:"proxy"`
ProxyIP string `` /* 1127-byte string literal not displayed */
ProxyPort uint16 `json:"proxy_port,omitempty"`
ProxyDomain string `json:"proxy_domain, omit_empty"`
}
func (NetworkV2Event) MarshalEasyJSON ¶
func (v NetworkV2Event) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (NetworkV2Event) MarshalJSON ¶
func (v NetworkV2Event) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*NetworkV2Event) UnmarshalEasyJSON ¶
func (v *NetworkV2Event) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*NetworkV2Event) UnmarshalJSON ¶
func (v *NetworkV2Event) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type OldProtobufMessageProcessor ¶
type OldProtobufMessageProcessor struct {
// contains filtered or unexported fields
}
func NewOldProtobufMessageProcessor ¶
func NewOldProtobufMessageProcessor(cfg *Configuration) OldProtobufMessageProcessor
func (OldProtobufMessageProcessor) ProcessProtobufBundle ¶
func (OldProtobufMessageProcessor) ProcessProtobufMessage ¶
func (OldProtobufMessageProcessor) ProcessRawZipBundle ¶
type ParentCreateTime ¶
type ParentCreateTime struct {
ParentCreateTimestamp interface{} `json:"parent_create_time"`
}
func ParentCreateTimestampFromWindowsTime ¶
func ParentCreateTimestampFromWindowsTime(time int64, useTimeFloat bool) (unixTime ParentCreateTime)
func (ParentCreateTime) MarshalEasyJSON ¶
func (v ParentCreateTime) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ParentCreateTime) MarshalJSON ¶
func (v ParentCreateTime) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ParentCreateTime) UnmarshalEasyJSON ¶
func (v *ParentCreateTime) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ParentCreateTime) UnmarshalJSON ¶
func (v *ParentCreateTime) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ProcessEvent ¶
type ProcessEvent struct {
*BaseEvent
*EventMessage
Path string `json:"path"`
Md5 string `json:"md5"`
Sha256 string `json:"sha256"`
CommandLine string `json:"command_line"`
ParentPath string `json:"parent_path"`
ParentPid int32 `json:"parent_pid"`
ParentGuid int64 `json:"parent_guid"`
ParentCreateTime `json:",inline"`
FilteringKnownDLLS bool `json:"filtering_known_dlls"`
ParentMd5 string `json:"parent_md5,omitempty"`
ParentSha256 string `json:"parent_sha256,omitempty"`
ExpectFollowonWMd5 bool `json:"expect_followon_w_md5"`
LinkParent string `json:"link_parent,omitempty"`
Username string `json:"username,omitempty"`
Uid string `json:"uid,omitempty"`
}
func (ProcessEvent) MarshalEasyJSON ¶
func (v ProcessEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ProcessEvent) MarshalJSON ¶
func (v ProcessEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ProcessEvent) UnmarshalEasyJSON ¶
func (v *ProcessEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ProcessEvent) UnmarshalJSON ¶
func (v *ProcessEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ProtobufMessageProcessor ¶
type ProtobufMessageProcessor struct {
Config *Configuration
}
func NewProtobufMessageProcessor ¶
func NewProtobufMessageProcessor(conf *Configuration) ProtobufMessageProcessor
func (ProtobufMessageProcessor) GetMessageInOutputFormat ¶
func (pbm ProtobufMessageProcessor) GetMessageInOutputFormat(message Event) ([]byte, error)
func (*ProtobufMessageProcessor) NewBaseMessage ¶
func (pbm *ProtobufMessageProcessor) NewBaseMessage(msg *CbEventMsg, routingKey, eventType string) *BaseEvent
func (ProtobufMessageProcessor) NewBlockedEvent ¶
func (pbm ProtobufMessageProcessor) NewBlockedEvent(msg *CbEventMsg, routingKey string) *BlockedEvent
func (*ProtobufMessageProcessor) NewChildprocEvent ¶
func (pbm *ProtobufMessageProcessor) NewChildprocEvent(msg *CbEventMsg, routingKey string) *ChildprocEvent
func (*ProtobufMessageProcessor) NewCrossprocEvent ¶
func (pbm *ProtobufMessageProcessor) NewCrossprocEvent(msg *CbEventMsg, routingKey string) *CrossprocEvent
func (*ProtobufMessageProcessor) NewEmetMessage ¶
func (pbm *ProtobufMessageProcessor) NewEmetMessage(msg *CbEventMsg, routingKey string) *EmetEvent
func (*ProtobufMessageProcessor) NewEventMessage ¶
func (pbm *ProtobufMessageProcessor) NewEventMessage(msg *CbEventMsg) *EventMessage
func (*ProtobufMessageProcessor) NewEventMessageWithHashes ¶
func (pbm *ProtobufMessageProcessor) NewEventMessageWithHashes(msg *CbEventMsg) *EventMessageWithHashes
func (*ProtobufMessageProcessor) NewFilemodEvent ¶
func (pbm *ProtobufMessageProcessor) NewFilemodEvent(msg *CbEventMsg, routingKey string) *FilemodEvent
func (ProtobufMessageProcessor) NewModLoadMessage ¶
func (pbm ProtobufMessageProcessor) NewModLoadMessage(msg *CbEventMsg, routingKey string) *ModloadMessage
func (ProtobufMessageProcessor) NewModinfoEvent ¶
func (pbm ProtobufMessageProcessor) NewModinfoEvent(msg *CbEventMsg, routingKey string) *ModInfoEvent
func (*ProtobufMessageProcessor) NewNetconEvent ¶
func (pbm *ProtobufMessageProcessor) NewNetconEvent(msg *CbEventMsg, routingKey string) *NetconEvent
func (*ProtobufMessageProcessor) NewNetworkV2Event ¶
func (pbm *ProtobufMessageProcessor) NewNetworkV2Event(msg *CbEventMsg, routingKey string) *NetworkV2Event
func (*ProtobufMessageProcessor) NewProcessEvent ¶
func (pbm *ProtobufMessageProcessor) NewProcessEvent(msg *CbEventMsg, routingKey string) *ProcessEvent
func (*ProtobufMessageProcessor) NewRegmodEvent ¶
func (pbm *ProtobufMessageProcessor) NewRegmodEvent(msg *CbEventMsg, routingKey string) *RegmodEvent
func (*ProtobufMessageProcessor) NewScriptExEvent ¶
func (pbm *ProtobufMessageProcessor) NewScriptExEvent(msg *CbEventMsg, routingKey string) *ScriptExEvent
func (*ProtobufMessageProcessor) NewTamperAlert ¶
func (pbm *ProtobufMessageProcessor) NewTamperAlert(msg *CbEventMsg, routingKey string) *TamperAlert
func (ProtobufMessageProcessor) ProcessProtobufBundle ¶
func (ProtobufMessageProcessor) ProcessProtobufMessage ¶
func (ProtobufMessageProcessor) ProcessProtobufMessageWithEnv ¶
func (ProtobufMessageProcessor) ProcessRawZipBundle ¶
type RegmodEvent ¶
type RegmodEvent struct {
*BaseEvent
*EventMessageWithHashes
Path string `json:"path"`
Action string `json:"action,intern"`
ActionType int32 `json:"action_type"`
TamperSent bool `json:"tamper"`
Tamper bool `json:"tamper_sent"`
}
func (RegmodEvent) MarshalEasyJSON ¶
func (v RegmodEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (RegmodEvent) MarshalJSON ¶
func (v RegmodEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*RegmodEvent) UnmarshalEasyJSON ¶
func (v *RegmodEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*RegmodEvent) UnmarshalJSON ¶
func (v *RegmodEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type ScriptExEvent ¶
type ScriptExEvent struct {
*BaseEvent
*EventMessageWithHashes
ScriptSha256 string `json:"script_sha256"`
Script string `json:"script"`
}
func (ScriptExEvent) MarshalEasyJSON ¶
func (v ScriptExEvent) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (ScriptExEvent) MarshalJSON ¶
func (v ScriptExEvent) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*ScriptExEvent) UnmarshalEasyJSON ¶
func (v *ScriptExEvent) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*ScriptExEvent) UnmarshalJSON ¶
func (v *ScriptExEvent) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type TamperAlert ¶
func (TamperAlert) MarshalEasyJSON ¶
func (v TamperAlert) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (TamperAlert) MarshalJSON ¶
func (v TamperAlert) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*TamperAlert) UnmarshalEasyJSON ¶
func (v *TamperAlert) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*TamperAlert) UnmarshalJSON ¶
func (v *TamperAlert) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface
type UnixTimeStamp ¶
type UnixTimeStamp struct {
EventTimestamp interface{} `json:"timestamp"`
}
func UnixTimestampFromWindowsTime ¶
func UnixTimestampFromWindowsTime(time int64, useTimeFloat bool) (unixTime UnixTimeStamp)
func (UnixTimeStamp) MarshalEasyJSON ¶
func (v UnixTimeStamp) MarshalEasyJSON(w *jwriter.Writer)
MarshalEasyJSON supports easyjson.Marshaler interface
func (UnixTimeStamp) MarshalJSON ¶
func (v UnixTimeStamp) MarshalJSON() ([]byte, error)
MarshalJSON supports json.Marshaler interface
func (*UnixTimeStamp) UnmarshalEasyJSON ¶
func (v *UnixTimeStamp) UnmarshalEasyJSON(l *jlexer.Lexer)
UnmarshalEasyJSON supports easyjson.Unmarshaler interface
func (*UnixTimeStamp) UnmarshalJSON ¶
func (v *UnixTimeStamp) UnmarshalJSON(data []byte) error
UnmarshalJSON supports json.Unmarshaler interface