normalize

Documentation

Overview

Package normalize runs every registered parser over a sealed package and merges their output into one schema.Normalized result. Adding a product parser means adding one entry to the registry — nothing in the analysis pipeline changes.

Index

• func ParsePackage(pkgDir string) (*schema.Normalized, error)
• type StreamResult
  • func ParseStream(pkgDir string, sink func(schema.Event) error) (*StreamResult, error)

Functions

func ParsePackage

func ParsePackage(pkgDir string) (*schema.Normalized, error)

ParsePackage runs all parsers and merges results. Artifacts no parser claims remain preserved-but-unparsed evidence (never dropped).

Types

type StreamResult

type StreamResult struct {
	Entities      []schema.Entity
	Relationships []schema.Relationship
	EventCount    int
}

StreamResult carries the bounded (non-event) part of normalization plus the event count, when events were streamed to a sink instead of retained in memory.

func ParseStream

func ParseStream(pkgDir string, sink func(schema.Event) error) (*StreamResult, error)

ParseStream runs all parsers and calls sink for every normalized event as it is produced, retaining only entities/relationships in memory. This bounds analysis memory by entity/relationship count rather than event count. Enrichment (network_destination) is applied per event.