export

Documentation

Overview

Package export renders normalized findings and events into interoperability formats: STIX 2.1 bundles and OpenTelemetry (GenAI/agent semantic conventions). Plan §10, §24.

Index

• func WriteOTel(events []schema.Event, path string) error
• func WriteSTIX(findings []schema.Finding, caseID, path string) error

Functions

func WriteOTel

func WriteOTel(events []schema.Event, path string) error

WriteOTel writes events as OTLP-style log records mapped to GenAI/agent semantic conventions, with AgentDFIR-specific attributes under the agentdfir.* namespace (plan §10). One JSON document (OTLP/JSON logs).

func WriteSTIX

func WriteSTIX(findings []schema.Finding, caseID, path string) error

WriteSTIX writes findings as a STIX 2.1 bundle (indicator + observed-data objects). Deterministic IDs are derived from content so re-exports are stable.