processing

type Bucket struct {
	Data any
	Time time.Time
}

type BucketsConfig struct {
	// TODO - would be more intuitive if this was actually calculated from global duration
	Count int
	Size  time.Duration
}

type CommandEvents map[string]*datamodels.SafeMap

type ConfigConsumeRedis struct {
	ConfigStreamWorkers
	ConfigStreamRedis

	Handler MapHandlerFunc
}

type ConfigStreamRedis struct {
	Client *redis.Client
	Key    string
}

type ConfigStreamWorkers struct {
	Name    string
	Workers int
	Pool    *errgroup.Group
	Ctx     context.Context
	Logger  *logrus.Logger
}

type DataMapShards struct {
	Name            string
	Channels        []chan *datamodels.SafeMap
	Ctx             context.Context
	Len             uint64
	CountMissingKey uint64
}

type EncodedEntry struct {
	Key   string
	Entry []byte
}

type ErrInvalidEvent struct {
	Key string
	Raw datamodels.Map
}

type MapHandlerFunc func(*datamodels.SafeMap)

type SafeCorrelationEventMap struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

type SuricataCorrelateConfig struct {
	ConfigStreamWorkers
	Output ConfigStreamRedis

	InputEventShards      *DataMapShards
	CorrelatedEventShards *DataMapShards
}

type SysmonCorrelateConfig struct {
	ConfigStreamWorkers

	Shards          *DataMapShards
	LogCorrelations bool
	WinlogConfig
}

type Winlog struct {
	gommunityid.CommunityID

	// SuricataHandler assigns resulting correlations to correct suricata worker
	SuricataHandler []MapHandlerFunc

	Stats winlogStats
	// contains filtered or unexported fields
}

type WinlogBucketsConfig struct {
	Command BucketsConfig
	Network BucketsConfig
}

type WinlogConfig struct {
	Commands             buckets
	Buckets              WinlogBucketsConfig
	StoreNetEvents       bool
	WorkDir              string
	ChanCorrelated       chan EncodedEntry
	ChanOnlyNetwork      chan EncodedEntry
	ForwardNetworkEvents bool
	SuricataHandler      []MapHandlerFunc
}

type WiseConfig struct {
	ConfigStreamWorkers

	ClientCorrelated  *redis.Client
	ClientOnlyNetwork *redis.Client

	ForwardNetworkEvents bool

	ChanCorrelated  <-chan EncodedEntry
	ChanOnlyNetwork <-chan EncodedEntry
}