report

Documentation

Overview

Package report renders a case into analyst-facing outputs. HTML reports are network-silent by construction (plan §24): no external resource loads, a restrictive CSP meta tag, and every evidence-derived string HTML-escaped and control/invisible-char sanitized before it reaches the document.

Index

• Variables
• func ReadCaseInfo(pkgDir string) (*casepkg.CaseInfo, error)
• func ReadManifest(pkgDir string) (*casepkg.Manifest, error)
• func WriteFindingsCSV(c *Case, path string) error
• func WriteHTML(c *Case, path string) error
• func WriteJSON(c *Case, path string) error
• func WritePDF(c *Case, custody []CustodyRecord, signature string, path string, ...) (int, error)
• func WriteTimelineCSV(c *Case, path string) error
• type Case
• type CustodyRecord
  • func ReadCustody(pkgDir string) ([]CustodyRecord, error)
• type PDFOptions
• type TimelineStats
  • func WriteL2TCSV(c *Case, path string) (TimelineStats, error)
  • func WriteTimesketchJSONL(c *Case, path string) (TimelineStats, error)

Variables

var MaxHTMLRows = 2000

MaxHTMLRows caps timeline/inventory rows in HTML (full data lives in normalized/events.jsonl and reports/timeline.csv).

Functions

func ReadCaseInfo

func ReadCaseInfo(pkgDir string) (*casepkg.CaseInfo, error)

ReadCaseInfo loads case.json from a package.

func ReadManifest

func ReadManifest(pkgDir string) (*casepkg.Manifest, error)

ReadManifest loads manifest.json from a package.

func WriteFindingsCSV

func WriteFindingsCSV(c *Case, path string) error

WriteFindingsCSV writes findings as CSV.

func WriteHTML

func WriteHTML(c *Case, path string) error

WriteHTML renders a self-contained, network-silent HTML report.

func WriteJSON

func WriteJSON(c *Case, path string) error

WriteJSON writes the full case as one JSON document.

func WritePDF

func WritePDF(c *Case, custody []CustodyRecord, signature string, path string, opts PDFOptions) (int, error)

WritePDF renders the case as a PDF report. Returns the number of non-WinAnsi runes replaced (reported to the operator, never hidden).

func WriteTimelineCSV

func WriteTimelineCSV(c *Case, path string) error

WriteTimelineCSV writes the timeline as CSV.

Types

type Case

type Case struct {
	Manifest *casepkg.Manifest
	CaseInfo *casepkg.CaseInfo
	Verify   *casepkg.VerifyResult
	Events   []schema.Event
	Entities []schema.Entity
	Findings []schema.Finding
}

Case bundles everything a report renders.

type CustodyRecord

type CustodyRecord struct {
	Seq   int
	TS    string
	Event string
	Extra string
}

CustodyRecord is one decoded chain-of-custody line.

func ReadCustody

func ReadCustody(pkgDir string) ([]CustodyRecord, error)

ReadCustody decodes chain-of-custody.jsonl for reporting.

type PDFOptions

type PDFOptions struct {
	MaxTimelineRows int // default 300
	MaxArtifactRows int // default 300
}

PDFOptions tunes the excerpt sizes.

type TimelineStats

type TimelineStats struct {
	Written int
	Undated int // events without a parsable timestamp (omitted from Timesketch; written to l2tcsv with a blank date)
}

TimelineStats reports what an export wrote.

func WriteL2TCSV

func WriteL2TCSV(c *Case, path string) (TimelineStats, error)

WriteL2TCSV writes the timeline in l2tcsv format (Plaso psort's classic output), consumable by Timesketch, Autopsy, Magnet and spreadsheet triage. Undated events are kept with blank date/time so nothing disappears; they are counted for the caller to report.

func WriteTimesketchJSONL

func WriteTimesketchJSONL(c *Case, path string) (TimelineStats, error)

WriteTimesketchJSONL writes one Timesketch-importable JSON object per line: required keys message/datetime/timestamp_desc plus flat AgentDFIR attributes that become searchable fields. Events without a parsable timestamp are omitted (Timesketch rejects them) and counted.