endpoint

Documentation

Overview

Package endpoint loads independent operating-system telemetry — the second witness for what an agent did on a machine. Adapters turn auditd logs, Sysmon XML exports and generic process/network/file event exports (Velociraptor, osquery, evtx_dump JSON, macOS eslogger) into one Record model that the correlation engine consumes.

Inputs are hostile evidence: bounded reads, no execution, tolerant parsing that records problems instead of aborting.

Index

• type Format
  • func Sniff(path string) (Format, error)
• type LoadResult
  • func Load(path string, f Format) (*LoadResult, error)
• type Record

Types

type Format

type Format string

Format names an adapter.

const (
	FormatAuto   Format = "auto"
	FormatAuditd Format = "auditd"
	FormatSysmon Format = "sysmon-xml"
	FormatJSONL  Format = "jsonl"
	FormatCSV    Format = "csv"
	MaxLogBytes         = 2 << 30 // 2 GiB streaming bound

)

func Sniff

func Sniff(path string) (Format, error)

Sniff guesses the format from the first non-empty bytes.

type LoadResult

type LoadResult struct {
	Format   Format
	Records  []Record
	Skipped  int      // lines/events that did not parse
	Problems []string // first few parse problems, for the operator
}

LoadResult is what one file produced.

func Load

func Load(path string, f Format) (*LoadResult, error)

Load reads one endpoint log with the given (or sniffed) format.

type Record

type Record struct {
	Time      time.Time `json:"time"`
	Kind      string    `json:"kind"` // process | network | file
	PID       int       `json:"pid,omitempty"`
	PPID      int       `json:"ppid,omitempty"`
	Exe       string    `json:"exe,omitempty"`
	Cmdline   string    `json:"cmdline,omitempty"`
	ParentExe string    `json:"parent_exe,omitempty"`
	User      string    `json:"user,omitempty"`
	DestIP    string    `json:"dest_ip,omitempty"`
	DestPort  int       `json:"dest_port,omitempty"`
	DestHost  string    `json:"dest_host,omitempty"`
	FilePath  string    `json:"file_path,omitempty"`
	FileOp    string    `json:"file_op,omitempty"` // create | delete | modify | open
	Source    string    `json:"source"`            // adapter name
	Ref       string    `json:"ref"`               // file:line or event id
}

Record is one endpoint observation.