export

Documentation

Overview

Package export renders normalized findings and events into interoperability formats: STIX 2.1 bundles and OpenTelemetry (GenAI/agent semantic conventions). Plan §10, §24.

Index

• func OCSFEvent(e schema.Event) map[string]any
• func OCSFFinding(fd schema.Finding, caseID string, nowMillis int64) map[string]any
• func SARIF(findings []schema.Finding, caseID string) map[string]any
• func SigmaYAML(p rulepack.Pack, r rulepack.Rule) string
• func WriteOCSFEvents(events []schema.Event, path string) error
• func WriteOCSFFindings(findings []schema.Finding, caseID, path string) error
• func WriteOTel(events []schema.Event, path string) error
• func WriteSARIF(findings []schema.Finding, caseID, path string) error
• func WriteSTIX(findings []schema.Finding, caseID, path string) error
• func WriteSigmaDir(packs []rulepack.Pack, dir string) ([]string, error)

Functions

func OCSFEvent

func OCSFEvent(e schema.Event) map[string]any

OCSFEvent maps one normalized event to an OCSF object.

func OCSFFinding

func OCSFFinding(fd schema.Finding, caseID string, nowMillis int64) map[string]any

OCSFFinding maps one finding to an OCSF Detection Finding (2004). Findings carry no timestamp of their own; `time` is the export time and the evidence reference points at the timestamped events.

func SARIF

func SARIF(findings []schema.Finding, caseID string) map[string]any

SARIF builds the SARIF document.

func SigmaYAML

func SigmaYAML(p rulepack.Pack, r rulepack.Rule) string

SigmaYAML renders one rule as a Sigma document.

func WriteOCSFEvents

func WriteOCSFEvents(events []schema.Event, path string) error

WriteOCSFEvents writes normalized events as OCSF JSON lines.

func WriteOCSFFindings

func WriteOCSFFindings(findings []schema.Finding, caseID, path string) error

WriteOCSFFindings writes findings as OCSF Detection Finding JSON lines.

func WriteOTel

func WriteOTel(events []schema.Event, path string) error

WriteOTel writes events as OTLP-style log records mapped to GenAI/agent semantic conventions, with AgentDFIR-specific attributes under the agentdfir.* namespace (plan §10). One JSON document (OTLP/JSON logs).

func WriteSARIF

func WriteSARIF(findings []schema.Finding, caseID, path string) error

WriteSARIF writes findings as a SARIF 2.1.0 log.

func WriteSTIX

func WriteSTIX(findings []schema.Finding, caseID, path string) error

WriteSTIX writes findings as a STIX 2.1 bundle (indicator + observed-data objects). Deterministic IDs are derived from content so re-exports are stable.

func WriteSigmaDir

func WriteSigmaDir(packs []rulepack.Pack, dir string) ([]string, error)

WriteSigmaDir writes one YAML file per rule into dir and returns the written paths in pack/rule order.