eventproc

Documentation

Overview

Package eventproc includes components to implement a simple security event management system.

This package is a work in progress and makes no API stability promises.

Index

• func RegisterFilter(class string, f FilterBuilder)
• func RegisterPlugin(class string, f PluginBuilder)
• type Action
• type Builder
  • func NewBuilder(regsvc apiservice.Discover, opt ...BuilderOption) *Builder
  • func (b *Builder) Build(def StackDef) (*Stack, error)
  • func (b Builder) CachePath(data string) string
  • func (b Builder) CertPath(cert string) string
  • func (b Builder) DataPath(data string) string
  • func (b *Builder) Logger() yalogi.Logger
  • func (b *Builder) OnShutdown(f func() error)
  • func (b *Builder) OnStartup(f func() error)
  • func (b *Builder) Service(id string) (apiservice.Service, bool)
  • func (b *Builder) Shutdown() error
  • func (b *Builder) Stack(name string) (*Stack, bool)
  • func (b *Builder) StackNames() []string
  • func (b *Builder) Start() error
• type BuilderOption
  • func CacheDir(s string) BuilderOption
  • func CertsDir(s string) BuilderOption
  • func DataDir(s string) BuilderOption
  • func SetBuildLogger(l yalogi.Logger) BuilderOption
• type CbRequest
• type FilterBuilder
• type GUIDGenerator
• type Hooks
  • func NewHooks() *Hooks
  • func (h *Hooks) AfterModule(fn CbRequest)
  • func (h *Hooks) AfterProc(fn CbRequest)
  • func (h *Hooks) BeforeModule(fn CbRequest)
  • func (h *Hooks) BeforeProc(fn CbRequest)
  • func (h *Hooks) FinishProc(fn CbRequest)
• type ItemDef
• type Module
• type ModuleDef
• type ModuleFilter
• type ModulePlugin
• type Option
  • func SetBufferSize(n int) Option
  • func SetGUIDGen(g GUIDGenerator) Option
  • func SetLogger(l yalogi.Logger) Option
  • func Workers(n int) Option
• type PluginBuilder
• type Processor
  • func New(main *Stack, others []*Stack, db eventdb.Database, opt ...Option) *Processor
  • func (p *Processor) Close()
  • func (p *Processor) ForwardEvent(ctx context.Context, e event.Event) error
  • func (p *Processor) NotifyEvent(ctx context.Context, e event.Event) (string, error)
• type Request
• type Stack
  • func NewStack(name string) *Stack
  • func (s *Stack) Add(m *Module)
  • func (s Stack) Name() string
• type StackAction
  • func (a StackAction) MarshalJSON() ([]byte, error)
  • func (a StackAction) String() string
  • func (a *StackAction) UnmarshalJSON(data []byte) error
• type StackDef
  • func StackDefsFromFile(path string) ([]StackDef, error)

Functions

func RegisterFilter

func RegisterFilter(class string, f FilterBuilder)

RegisterFilter register a filter for the class name passed.

func RegisterPlugin

func RegisterPlugin(class string, f PluginBuilder)

RegisterPlugin register a plugin for the class name passed.

Types

type Action

type Action uint8

Action defines the behaviours.

const (
	ActionNext Action = iota
	ActionStop
	ActionFinish
	ActionJump
	ActionReturn
)

Several actions in rulechain.

type Builder

type Builder struct {
	// contains filtered or unexported fields
}

Builder helps to create stacks using definitions structs.

func NewBuilder

func NewBuilder(regsvc apiservice.Discover, opt ...BuilderOption) *Builder

NewBuilder instances a new builder.

func (*Builder) Build

func (b *Builder) Build(def StackDef) (*Stack, error)

Build construct a stack with the name passed and the modules defined by the array ModuleDef

func (Builder) CachePath

func (b Builder) CachePath(data string) string

CachePath returns path for cache.

func (Builder) CertPath

func (b Builder) CertPath(cert string) string

CertPath returns path for certificate.

func (Builder) DataPath

func (b Builder) DataPath(data string) string

DataPath returns path for data.

func (*Builder) Logger

func (b *Builder) Logger() yalogi.Logger

Logger returns logger inside builder.

func (*Builder) OnShutdown

func (b *Builder) OnShutdown(f func() error)

OnShutdown registers the functions that will be executed during shutdown.

func (*Builder) OnStartup

func (b *Builder) OnStartup(f func() error)

OnStartup registers the functions that will be executed during startup.

func (*Builder) Service

func (b *Builder) Service(id string) (apiservice.Service, bool)

Service returns apiservice with the id passed, returns false if not registered.

func (*Builder) Shutdown

func (b *Builder) Shutdown() error

Shutdown executes all registered functions.

func (*Builder) Stack

func (b *Builder) Stack(name string) (*Stack, bool)

Stack returns the stack with the name passed, it will returns false if the stack has not been built.

func (*Builder) StackNames

func (b *Builder) StackNames() []string

StackNames returns the names of the stacks created by the builder.

func (*Builder) Start

func (b *Builder) Start() error

Start executes all registered functions.

type BuilderOption

type BuilderOption func(*buildOpts)

BuilderOption is used for builder configuration.

func CacheDir

func CacheDir(s string) BuilderOption

CacheDir sets source dir.

func CertsDir

func CertsDir(s string) BuilderOption

CertsDir sets certificate dir.

func DataDir

func DataDir(s string) BuilderOption

DataDir sets data dir.

func SetBuildLogger

func SetBuildLogger(l yalogi.Logger) BuilderOption

SetBuildLogger sets a logger for the component.

type CbRequest

type CbRequest func(*Request)

CbRequest defines the format of the callbacks used by the hooks.

type FilterBuilder

type FilterBuilder func(*Builder, *ItemDef) (ModuleFilter, error)

FilterBuilder defines the signature for the constuctors of the filters.

type GUIDGenerator

type GUIDGenerator func() string

GUIDGenerator must returns a new unique Global ID for events.

type Hooks

type Hooks struct {
	// contains filtered or unexported fields
}

Hooks stores information about the hooks.

func NewHooks

func NewHooks() *Hooks

NewHooks creates a new Hooks instance.

func (*Hooks) AfterModule

func (h *Hooks) AfterModule(fn CbRequest)

AfterModule adds a callback that will be executed before a stack module starts.

func (*Hooks) AfterProc

func (h *Hooks) AfterProc(fn CbRequest)

AfterProc adds a callback that will be executed before the process end.

func (*Hooks) BeforeModule

func (h *Hooks) BeforeModule(fn CbRequest)

BeforeModule adds a callback that will be executed before a stack module starts.

func (*Hooks) BeforeProc

func (h *Hooks) BeforeProc(fn CbRequest)

BeforeProc adds a callback that will be executed before the process starts.

func (*Hooks) FinishProc

func (h *Hooks) FinishProc(fn CbRequest)

FinishProc adds a callback that will be executed if the process finished ok.

type ItemDef

type ItemDef struct {
	Class string                 `json:"class"`
	Args  []string               `json:"args,omitempty"`
	Opts  map[string]interface{} `json:"opts,omitempty"`
}

ItemDef defines a generic configuration item for filters and plugins.

type Module

type Module struct {
	// Name of the module, it must be unique in the stack
	Name string
	// Filters that will be applied before the plugins are executed. If one of
	// them returns false, then will not be executed and the module result
	// will be Next. If all of them returns true, then all plugin will be
	// executed and the OnSuccess action will be returned (if no errors).
	Filters []ModuleFilter
	// Plugins will be executed if all filters returns true (or if Filters is
	// empty). If there is an error in any of the plugins, the OnError action
	// will be returned.
	Plugins []ModulePlugin
	// OnSucess will be returned to the processor if all the filters apply and
	// the plugins execution don't returns errors.
	OnSuccess StackAction
	// OnError will be returned to the processor if there is an error in
	// plugin execution.
	OnError StackAction
}

Module defines the information that will be stacked for the processing.

type ModuleDef

type ModuleDef struct {
	Name      string      `json:"name"`
	Filters   []*ItemDef  `json:"filters,omitempty"`
	Plugins   []*ItemDef  `json:"plugins,omitempty"`
	OnSuccess StackAction `json:"onsuccess"`
	OnError   StackAction `json:"onerror"`
	Disabled  bool        `json:"disabled"`
}

ModuleDef defines configuration of the modules in the stack.

type ModuleFilter

type ModuleFilter func(e event.Event) (result bool)

ModuleFilter is a signature for functions that filters events.

type ModulePlugin

type ModulePlugin func(e *event.Event) error

ModulePlugin is a signature for functions that process events.

type Option

type Option func(*options)

Option defines Processor options.

func SetBufferSize

func SetBufferSize(n int) Option

SetBufferSize option defines the size of the event request buffer.

func SetGUIDGen

func SetGUIDGen(g GUIDGenerator) Option

SetGUIDGen option sets a custom gid event generator.

func SetLogger

func SetLogger(l yalogi.Logger) Option

SetLogger option sets a logger for the component.

func Workers

func Workers(n int) Option

Workers option defines the number of goroutines used to event processing.

type PluginBuilder

type PluginBuilder func(*Builder, *ItemDef) (ModulePlugin, error)

PluginBuilder defines the signature for the constuctors of the plugins.

type Processor

type Processor struct {
	// contains filtered or unexported fields
}

Processor is the main class of the package.

func New

func New(main *Stack, others []*Stack, db eventdb.Database, opt ...Option) *Processor

New creates a new processor with stack as the main stack.

func (*Processor) Close

func (p *Processor) Close()

Close event processor.

func (*Processor) ForwardEvent

func (p *Processor) ForwardEvent(ctx context.Context, e event.Event) error

ForwardEvent implements event.Forwarder.

func (*Processor) NotifyEvent

func (p *Processor) NotifyEvent(ctx context.Context, e event.Event) (string, error)

NotifyEvent implements event.Notifier.

type Request

type Request struct {
	Event      event.Event
	Enqueued   time.Time
	Started    time.Time
	Finished   time.Time
	StackTrace []string
	Peer       *peer.Peer
	// contains filtered or unexported fields
}

Request is used to store information of the event processing.

type Stack

type Stack struct {
	// contains filtered or unexported fields
}

Stack is the struct used by the processor and contains the the modules that will be executed.

func NewStack

func NewStack(name string) *Stack

NewStack returns a new Stack.

func (*Stack) Add

func (s *Stack) Add(m *Module)

Add appends a module to the stack.

func (Stack) Name

func (s Stack) Name() string

Name returns the name of the stack.

type StackAction

type StackAction struct {
	Action Action
	Label  string
}

StackAction defines the actions returned by the modules to define the processing flow.

func (StackAction) MarshalJSON

func (a StackAction) MarshalJSON() ([]byte, error)

MarshalJSON implements interface.

func (StackAction) String

func (a StackAction) String() string

func (*StackAction) UnmarshalJSON

func (a *StackAction) UnmarshalJSON(data []byte) error

UnmarshalJSON implements interface.

type StackDef

type StackDef struct {
	Name     string      `json:"name"`
	Disabled bool        `json:"disabled"`
	Modules  []ModuleDef `json:"modules,omitempty"`
}

StackDef defines stack configuration.

func StackDefsFromFile

func StackDefsFromFile(path string) ([]StackDef, error)

StackDefsFromFile returns all stack definitions in a file in json format.