processor

Documentation

Index

• func PullLogs(group types.ModuleGroup, startTime time.Time) error
• func SendToLogstash(data []TransformedLog) *logger.Error
• type ApiHosts
• type EventAggregate
• type Pages
• type SophosCentralProcessor
• type TransformedLog
  • func ETLProcess(events EventAggregate, group types.ModuleGroup) []TransformedLog
• type WhoamiResponse

Functions

func PullLogs

func PullLogs(group types.ModuleGroup, startTime time.Time) error

func SendToLogstash

func SendToLogstash(data []TransformedLog) *logger.Error

Types

type ApiHosts

type ApiHosts struct {
	Global     string `json:"global"`
	DataRegion string `json:"dataRegion"`
}

type EventAggregate

type EventAggregate struct {
	Pages Pages            `json:"pages"`
	Items []map[string]any `json:"items"`
}

type Pages

type Pages struct {
	FromKey string `json:"fromKey"`
	NextKey string `json:"nextKey"`
	Size    int64  `json:"size"`
	MaxSize int64  `json:"maxSize"`
}

type SophosCentralProcessor

type SophosCentralProcessor struct {
	ClientID     string
	ClientSecret string
	TenantID     string
	DataRegion   string
	AccessToken  string
	ExpiresAt    time.Time
}

type TransformedLog

type TransformedLog struct {
	Logx struct {
		SophosCentral map[string]interface{} `json:"sophos_central"`
	} `json:"logx"`
	Global struct {
		Type string `json:"type"`
	} `json:"global"`
	Timestamp  string `json:"@timestamp"`
	DataType   string `json:"dataType"`
	DataSource string `json:"dataSource"`
}

func ETLProcess

func ETLProcess(events EventAggregate, group types.ModuleGroup) []TransformedLog

type WhoamiResponse

type WhoamiResponse struct {
	ID       string   `json:"id"`
	ApiHosts ApiHosts `json:"apiHosts"`
}