aucoalesce

package

Go to main page

Versions in this module

v0

v0.4.0

Aug 30, 2018

v0.3.0

May 25, 2018

v0.2.1

May 3, 2018

v0.2.0

Apr 30, 2018

Changes in this version

+ func ResolveIDsFromCaches(event *Event, users UserCache, groups GroupCache)

type Normalization

+ HasFields Strings

v0.1.1

Apr 5, 2018

v0.1.0

Mar 28, 2018

v0.0.7

Jan 18, 2018

Changes in this version

+ type Actor struct

+ Primary string

+ Secondary string

+ type Address struct

+ Hostname string

+ IP string

+ Path string

+ Port string

+ type Direction uint8

+ const IncomingDir

+ const OutgoingDir

+ func (d Direction) MarshalText() ([]byte, error)

+ func (d Direction) String() string

type Event

+ Dest *Address

+ File *File

+ Net *Network

+ Process Process

+ Source *Address

+ Summary Summary

+ Tags []string

+ User User

+ type File struct

+ Device string

+ GID string

+ Group string

+ Inode string

+ Mode string

+ Owner string

+ Path string

+ SELinux map[string]string

+ UID string

+ type Network struct

+ Direction Direction

type Normalization

+ SourceIP Strings

type Object

+ Type string

+ type Process struct

+ Args []string

+ CWD string

+ Exe string

+ Name string

+ PID string

+ PPID string

+ Title string

+ func (p Process) IsEmpty() bool

+ type Summary struct

+ Action string

+ Actor Actor

+ How string

+ Object Object

+ type User struct

+ IDs map[string]string

+ Names map[string]string

+ SELinux map[string]string

v0.0.6

Sep 7, 2017

v0.0.5

Jul 24, 2017

v0.0.4

Jun 27, 2017

v0.0.3

May 1, 2017

Changes in this version

+ func LoadNormalizationConfig(b []byte) (syscalls map[string]*Normalization, recordTypes map[string]*Normalization, ...)

+ func ResolveIDs(event *Event)

+ type AuditEventType uint16

+ const EventTypeAnomoly

+ const EventTypeAnomolyResponse

+ const EventTypeAuditDaemon

+ const EventTypeAuditRule

+ const EventTypeConfig

+ const EventTypeCrypto

+ const EventTypeDACDecision

+ const EventTypeGroupChange

+ const EventTypeIntegrity

+ const EventTypeMAC

+ const EventTypeMACDecision

+ const EventTypeSystemServices

+ const EventTypeTTY

+ const EventTypeUnknown

+ const EventTypeUserAccount

+ const EventTypeUserLogin

+ const EventTypeUserspace

+ const EventTypeVirt

+ func GetAuditEventType(t AuditMessageType) AuditEventType

+ func (t AuditEventType) MarshalText() (text []byte, err error)

+ func (t AuditEventType) String() string

+ type Event struct

+ Action string

+ Category AuditEventType

+ Data map[string]string

+ How string

+ Key string

+ Object Object

+ Paths []map[string]string

+ Result string

+ Sequence uint32

+ Session string

+ Socket map[string]string

+ Subject Subject

+ Timestamp time.Time

+ Type auparse.AuditMessageType

+ Warnings []error

+ type GroupCache map[string]stringItem

+ func NewGroupCache() GroupCache

+ func (c GroupCache) LookupGID(gid string) string

+ type HowMapping struct

+ FieldName string

+ type Normalization struct

+ Action string

+ How Strings

+ Object ObjectMapping

+ RecordTypes Strings

+ Subject SubjectMapping

+ Syscalls Strings

+ type NormalizationConfig struct

+ Default Normalization

+ Normalizations []Normalization

+ type Object struct

+ Primary string

+ SELinux map[string]string

+ Secondary string

+ What string

+ type ObjectMapping struct

+ PathIndex int

+ PrimaryFieldName Strings

+ SecondaryFieldName Strings

+ What string

+ type Strings struct

+ Values []string

+ func (s *Strings) UnmarshalYAML(unmarshal func(interface{}) error) error

+ type Subject struct

+ Attributes map[string]string

+ Primary string

+ SELinux map[string]string

+ Secondary string

+ type SubjectMapping struct

+ PrimaryFieldName Strings

+ SecondaryFieldName Strings

+ type UserCache map[string]stringItem

+ func NewUserCache() UserCache

+ func (c UserCache) LookupUID(uid string) string

v0.0.2

Apr 18, 2017

Changes in this version

+ func CoalesceMessages(msgs []*auparse.AuditMessage) (map[string]interface{}, error)

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL