ecs

Documentation

Overview

ECS event mapping functions.

ECS history mapping functions.

ECS jumplist mapping functions.

ECS shellbag mapping functions.

ECS specification.

Index

• Constants
• func Hash(s string) string
• type Agent
• type Base
• type Ecs
• type Evt
• type File
• type Host
• type Log
  • func MapEvent(s, src string) (log *Log, err error)
  • func MapHistory(fu *flog.Url, src string) (log *Log, err error)
  • func MapJumpList(s, src string) (log *Log, err error)
  • func MapShellBag(s, src string) (log *Log, err error)
  • func NewLog(s, src string, base *Base) *Log
• type Process
• type Registry
• type Thread
• type Url
• type User

Constants

const (
	Version = "8.11"
)

Functions

func Hash

func Hash(s string) string

Types

type Agent

type Agent struct {
	Type    string `json:"type"`
	Version string `json:"version"`
}

type Base

type Base struct {
	Timestamp time.Time              `json:"@timestamp"`
	Message   string                 `json:"message"`
	Tags      string                 `json:"tags,omitempty"`
	Labels    map[string]interface{} `json:"labels,omitempty"`
}

type Ecs

type Ecs struct {
	Version string `json:"version"`
}

type Evt

type Evt struct {
	Kind     string    `json:"kind,omitempty"`
	Module   string    `json:"module,omitempty"`
	Dataset  string    `json:"dataset,omitempty"`
	Severity int64     `json:"severity,omitempty"`
	ID       string    `json:"id,omitempty"`
	Code     string    `json:"code,omitempty"`
	Provider string    `json:"provider,omitempty"`
	Ingested time.Time `json:"ingested,omitempty"`
	Original string    `json:"original,omitempty"`
	Hash     string    `json:"hash,omitempty"`
}

type File

type File struct {
	Type        string `json:"type,omitempty"`
	Name        string `json:"name,omitempty"`
	Extension   string `json:"extension,omitempty"`
	Directory   string `json:"directory,omitempty"`
	DriveLetter string `json:"drive_letter,omitempty"`
	Path        string `json:"path,omitempty"`
}

type Host

type Host struct {
	Hostname string `json:"hostname,omitempty"`
	MAC      string `json:"mac,omitempty"`
}

type Log

type Log struct {
	Base

	Ecs      *Ecs      `json:"ecs"`
	Agent    *Agent    `json:"agent"`
	Event    *Evt      `json:"event"`
	File     *File     `json:"file"`
	Url      *Url      `json:"url,omitempty"`
	Host     *Host     `json:"host,omitempty"`
	User     *User     `json:"user,omitempty"`
	Process  *Process  `json:"process,omitempty"`
	Registry *Registry `json:"registry,omitempty"`
}

func MapEvent

func MapEvent(s, src string) (log *Log, err error)

func MapHistory

func MapHistory(fu *flog.Url, src string) (log *Log, err error)

func MapJumpList

func MapJumpList(s, src string) (log *Log, err error)

func MapShellBag

func MapShellBag(s, src string) (log *Log, err error)

func NewLog

func NewLog(s, src string, base *Base) *Log

type Process

type Process struct {
	PID              int64    `json:"pid,omitempty"`
	Thread           *Thread  `json:"thread,omitempty"`
	EntityID         string   `json:"entity_id,omitempty"`
	Name             string   `json:"name,omitempty"`
	Title            string   `json:"title,omitempty"`
	Args             []string `json:"args,omitempty"`
	ArgsCount        int64    `json:"args_count,omitempty"`
	Executable       string   `json:"executable,omitempty"`
	CommandLine      string   `json:"command_line,omitempty"`
	WorkingDirectory string   `json:"working_directory,omitempty"`
}

type Registry

type Registry struct {
	Path  string `json:"path,omitempty"`
	Hive  string `json:"hive,omitempty"`
	Key   string `json:"key,omitempty"`
	Value string `json:"value,omitempty"`
}

type Thread

type Thread struct {
	ID int64 `json:"id,omitempty"`
}

type Url

type Url struct {
	Original string `json:"original,omitempty"`
	Full     string `json:"full,omitempty"`
	Scheme   string `json:"scheme,omitempty"`
	Domain   string `json:"domain,omitempty"`
	Port     int64  `json:"port,omitempty"`
	Path     string `json:"path,omitempty"`
	Query    string `json:"query,omitempty"`
	Fragment string `json:"fragment,omitempty"`
	Username string `json:"username,omitempty"`
	Password string `json:"password,omitempty"`
}

type User

type User struct {
	ID string `json:"id,omitempty"`
}