sources

Documentation

Index

• Constants
• func BuildClassifier(availableLogTypes []string, src *models.SourceIntegration, ...) (classification.ClassifierAPI, error)
• func ConfirmSubscription(notification *SnsNotification) (err error)
• func LoadSource(id string) (*models.SourceIntegration, error)
• func LoadSourceS3(bucketName, objectKey string) (*models.SourceIntegration, error)
• func ReadSnsMessage(ctx context.Context, message string) (result []*common.DataStream, err error)
• type MessageForwarderReader
  • func NewMessageForwarderReader(input io.Reader) *MessageForwarderReader
  • func (r *MessageForwarderReader) Read(p []byte) (n int, err error)
• type RefreshableS3Client
  • func (r *RefreshableS3Client) GetBucketLocationWithContext(ctx aws.Context, request *s3.GetBucketLocationInput, options ...request.Option) (*s3.GetBucketLocationOutput, error)
  • func (r *RefreshableS3Client) GetObjectWithContext(ctx aws.Context, request *s3.GetObjectInput, options ...request.Option) (*s3.GetObjectOutput, error)
• type S3ObjectInfo
  • func ParseNotification(message string) ([]*S3ObjectInfo, error)
• type SQSClassifier
  • func (c *SQSClassifier) Classify(log string) (*classification.ClassifierResult, error)
  • func (c *SQSClassifier) ParserStats() map[string]*classification.ParserStats
  • func (c *SQSClassifier) Stats() *classification.ClassifierStats
• type SnsNotification

Constants

const (
	DownloadMaxPartSize = 50 * 1024 * 1024                  // the max size of in memory buffers will be 3X as this due to multiple buffers
	DownloadMinPartSize = s3manager.DefaultDownloadPartSize // the min part size for efficiency

)

Functions

func BuildClassifier

func BuildClassifier(
	availableLogTypes []string,
	src *models.SourceIntegration,
	r pantherlog.ParserResolver,
) (classification.ClassifierAPI, error)

BuildClassifier builds a classifier for a source

func ConfirmSubscription

func ConfirmSubscription(notification *SnsNotification) (err error)

ConfirmSubscription will confirm the SNS->SQS subscription

func LoadSource

func LoadSource(id string) (*models.SourceIntegration, error)

LoadSource loads the source configuration for an source id. This will update the global cache if needed. It will return error if it encountered an issue retrieving the source information or if the source is not found.

func LoadSourceS3

func LoadSourceS3(bucketName, objectKey string) (*models.SourceIntegration, error)

LoadSourceS3 loads the source configuration for an S3 object. It will update the global cache if needed It will return error if it encountered an issue retrieving the source information or if the source is not found.

func ReadSnsMessage

func ReadSnsMessage(ctx context.Context, message string) (result []*common.DataStream, err error)

ReadSnsMessage reads incoming messages containing SNS notifications and returns a slice of DataStream items

Types

type MessageForwarderReader

type MessageForwarderReader struct {
	// contains filtered or unexported fields
}

func NewMessageForwarderReader

func NewMessageForwarderReader(input io.Reader) *MessageForwarderReader

Reader for messages sent by the Message Forwarder Lambda

func (*MessageForwarderReader) Read

func (r *MessageForwarderReader) Read(p []byte) (n int, err error)

type RefreshableS3Client

type RefreshableS3Client struct {
	s3iface.S3API
	// contains filtered or unexported fields
}

Wrapper around S3 client. It will refresh credentials in case `InvalidAccessKeyId` error is encountered

func (*RefreshableS3Client) GetBucketLocationWithContext

func (r *RefreshableS3Client) GetBucketLocationWithContext(
	ctx aws.Context,
	request *s3.GetBucketLocationInput,
	options ...request.Option) (*s3.GetBucketLocationOutput, error)

func (*RefreshableS3Client) GetObjectWithContext

func (r *RefreshableS3Client) GetObjectWithContext(
	ctx aws.Context,
	request *s3.GetObjectInput,
	options ...request.Option) (*s3.GetObjectOutput, error)

type S3ObjectInfo

type S3ObjectInfo struct {
	S3Bucket    string
	S3ObjectKey string
	// In case the size is not known, this will have a negative value
	S3ObjectSize int64
}

S3ObjectInfo contains information about the S3 object

func ParseNotification

func ParseNotification(message string) ([]*S3ObjectInfo, error)

ParseNotification parses a message received

type SQSClassifier

type SQSClassifier struct {
	Resolver   pantherlog.ParserResolver
	LoadSource func(id string) (*models.SourceIntegration, error)
	// contains filtered or unexported fields
}

func (*SQSClassifier) Classify

func (c *SQSClassifier) Classify(log string) (*classification.ClassifierResult, error)

func (*SQSClassifier) ParserStats

func (c *SQSClassifier) ParserStats() map[string]*classification.ParserStats

func (*SQSClassifier) Stats

func (c *SQSClassifier) Stats() *classification.ClassifierStats

type SnsNotification

type SnsNotification struct {
	events.SNSEntity
	Token *string `json:"Token"`
}

SnsNotification struct represents an SNS message arriving to Panther SQS from a customer account. The message can either be of type 'Notification' or 'SubscriptionConfirmation' Since there is no AWS SDK-provided struct to represent both types we had to create this custom type to include fields from both types.