ast

Documentation

Index

• Variables
• func DrawTree(tree *AstT, path string) error
• type AstDescriptorT
• type AstEventT
• type AstFieldT
• type AstLogMatcherT
• type AstMatchIdT
• type AstMetadataT
• type AstNegateOptsT
• type AstNodePairT
• type AstNodeT
• type AstNodeTypeT
  • func (t AstNodeTypeT) String() string
• type AstSeqMatcherT
• type AstSetMatcherT
• type AstT
  • func Build(data []byte) (*AstT, error)
  • func BuildTree(tree *parser.TreeT) (*AstT, error)

Variables

var (
	ErrInvalidEventType        = errors.New("invalid event type")
	ErrInvalidNodeType         = errors.New("invalid node type")
	ErrRootNodeWithoutEventSrc = errors.New("root node has no event src")
	ErrInvalidWindow           = errors.New("invalid window")
	ErrMissingOrigin           = errors.New("missing origin event")
	ErrInvalidAnchor           = errors.New("invalid anchor")
)

var (
	ErrUnknownField                  = errors.New("unknown source field")
	ErrUnknownSrc                    = errors.New("unknown source")
	ErrSeqPosConditions              = errors.New("sequences require two or more positive conditions")
	ErrMissingScalar                 = errors.New("missing string, jq, or regex condition")
	ErrMissingPositiveOrderCondition = errors.New("missing one or more positive condition under an order statement")
	ErrMissingPositiveMatchCondition = errors.New("missing one or more positive condition under a match statement")
)

var (
	ErrInvalidDescriptor = errors.New("invalid descriptor")
)

Functions

func DrawTree

func DrawTree(tree *AstT, path string) error

Types

type AstDescriptorT

type AstDescriptorT struct {
	Type       AstNodeTypeT
	MatchId    uint32
	Depth      int
	NegateOpts *AstNegateOptsT
}

type AstEventT

type AstEventT struct {
	Origin bool   `json:"origin"`
	Source string `json:"source"`
}

type AstFieldT

type AstFieldT struct {
	Field      string
	StrValue   string
	JsonValue  string
	RegexValue string
	TermValue  match.TermT
	NegateOpts *AstNegateOptsT
}

type AstLogMatcherT

type AstLogMatcherT struct {
	Event  AstEventT
	Match  []AstFieldT
	Negate []AstFieldT
	Window time.Duration
}

type AstMatchIdT

type AstMatchIdT uint

type AstMetadataT

type AstMetadataT struct {
	Scope         string
	Type          AstNodeTypeT
	RuleId        string
	RuleHash      string
	MatchId       uint32
	ParentMatchId uint32
	Depth         int
	NegateOpts    *AstNegateOptsT
}

type AstNegateOptsT

type AstNegateOptsT struct {
	Window   time.Duration
	Slide    time.Duration
	Anchor   uint32
	Absolute bool
}

type AstNodePairT

type AstNodePairT struct {
	Match      *AstNodeT
	Descriptor *AstNodeT
}

Each matcher node requires a corresponding descriptor node (except for the root, which is a detection)

type AstNodeT

type AstNodeT struct {
	Metadata AstMetadataT
	Object   any
	Children []*AstNodeT
	NegIdx   int
}

type AstNodeTypeT

type AstNodeTypeT string

const (
	NodeTypeUnk    AstNodeTypeT = "Unknown"
	NodeTypeSeq    AstNodeTypeT = "machine_seq"
	NodeTypeSet    AstNodeTypeT = "machine_set"
	NodeTypeLogSeq AstNodeTypeT = "log_seq"
	NodeTypeLogSet AstNodeTypeT = "log_set"
	NodeTypeDesc   AstNodeTypeT = "desc"
)

func (AstNodeTypeT) String

func (t AstNodeTypeT) String() string

type AstSeqMatcherT

type AstSeqMatcherT struct {
	Order        []*AstDescriptorT
	Negate       []*AstDescriptorT
	Correlations []string
	Window       time.Duration
}

type AstSetMatcherT

type AstSetMatcherT struct {
	Match        []*AstDescriptorT
	Negate       []*AstDescriptorT
	Correlations []string
	Window       time.Duration
}

type AstT

type AstT struct {
	Nodes []*AstNodeT
}

func Build

func Build(data []byte) (*AstT, error)

func BuildTree

func BuildTree(tree *parser.TreeT) (*AstT, error)