discovery

type AVDiscoverer interface {
	// Filesystem paths of binaries
	Paths() []string
	// Running processes
	Procs() []Process
	// Loaded kernel modules
	KernelModules() []LoadedKernelModule
	// Name of the AV system
	Name() string
}

type Av struct {
	Paths         []string
	Procs         []Process
	KernelModules []LoadedKernelModule
	Name          string
}

type FilePerm struct {
	// contains filtered or unexported fields
}

type Host struct {
	Ip    string
	Port  int64
	Proto NetProto
}

type LoadedKernelModule struct {
	// contains filtered or unexported fields
}

type LocalLoginStalkAction func(string, NetConn) error

type NetConn struct {
	Dst, Src Host
	Pid      int // process ID of this network connection, if applicable.
	Proto    NetProto
}

type NetProto struct {
	// contains filtered or unexported fields
}

type OSSECAV struct {
	AVDiscoverer
}

type Output struct {
	Name   string
	Values []interface{}
}

type Process struct {
	// contains filtered or unexported fields
}

type RkHunterAV struct {
	AVDiscoverer
}

type SamhainAV struct {
	AVDiscoverer
}

type SophosAV struct {
	AVDiscoverer
}

type SshPrivateKey struct {
	Path      string
	Encrypted bool
}

type StalkRemoteLoginAction func(string, string) map[string][]sshLoginSuccess

type StalkRemoteLoginParams struct {
	// Function to execute when the stalked user logs into the local system.
	Action StalkRemoteLoginAction
	// Attempt to login only to hosts that match this regex.
	HostRegex string
	// Limit login attempts. If login attempt reaches this limit, stop attempting logins.
	LoginLimit uint
	// Frequency to look for the user to be logged in
	PollFrequency uint
	// Command to execute on remote host upon successful login.
	RemoteCommand string
	// Only attempt logins as this user. If user is "*", try to stalk any user.
	User string
}

type TripwireAV struct {
	AVDiscoverer
}

type Watch struct {
	// Path being watched.
	Path string
	// Action the watch is looking for, i.e. read/write/execute. For example "wa" would detect file writes or appendages.
	Action string
}

type Who struct {
	// Username, line (tty/pty), originating host that user is logging in from
	User, Line, Host string
	// User's login process ID. Typically sshd process
	Pid int32
	// Login time
	Time int32
}