eventOutput

package
v0.5.4 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Feb 7, 2021 License: MIT Imports: 11 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func WriteEvents

func WriteEvents(ffsEvents interface{}, query config.FFSQuery) error

func WriteInProgressQueries

func WriteInProgressQueries(query config.FFSQuery, inProgressQueries []InProgressQuery) error

func WriteLastCompletedQuery

func WriteLastCompletedQuery(query config.FFSQuery, lastCompletedQuery InProgressQuery) error

Types

type Code42 added in v0.4.0

type Code42 struct {
	Event                   *Code42Event          `json:"event,omitempty"`
	InsertionTimestamp      *time.Time            `json:"insertion_timestamp,omitempty"`
	File                    *Code42File           `json:"file,omitempty"`
	Device                  *Code42Device         `json:"device,omitempty"`
	OsHostName              string                `json:"os_host_name,omitempty"`
	DomainName              string                `json:"domain_name,omitempty"`
	PublicIpAddress         string                `json:"public_ip_address,omitempty"`
	PrivateIpAddresses      []string              `json:"private_ip_addresses,omitempty"`
	Actor                   string                `json:"actor,omitempty"`
	DirectoryId             []string              `json:"directory_id,omitempty"`
	Source                  string                `json:"source,omitempty"`
	Url                     *URL                  `json:"url,omitempty"`
	Shared                  string                `json:"shared,omitempty"`
	SharedWith              []Code42SharedWith    `json:"shared_with,omitempty"`
	SharingTypeAdded        []string              `json:"sharing_type_added,omitempty"`
	CloudDriveId            string                `json:"cloud_drive_id,omitempty"`
	DetectionSourceAlias    string                `json:"detection_source_alias,omitempty"`
	Exposure                []string              `json:"exposure,omitempty"`
	Process                 *Code42Process        `json:"process,omitempty"`
	RemovableMedia          *Code42RemovableMedia `json:"removable_media,omitempty"`
	SyncDestination         string                `json:"sync_destination,omitempty"`
	SyncDestinationUsername []string              `json:"sync_destination_username,omitempty"`
	EmailDlp                *Code42EmailDlp       `json:"email_dlp,omitempty"`
	OutsideActiveHours      *bool                 `json:"outside_active_hours,omitempty"`
	Print                   *Code42Print          `json:"print,omitempty"`
	RemoteActivity          string                `json:"remote_activity,omitempty"`
	Trusted                 *bool                 `json:"trusted,omitempty"`
	OperatingSystemUser     string                `json:"operating_system_user,omitempty"`
	Destination             *Code42Destination    `json:"destination,omitempty"`
	Tabs                    []Code42TabTab        `json:"tabs,omitempty"`
}

type Code42Destination added in v0.4.0

type Code42Destination struct {
	Category string `json:"category,omitempty"`
	Name     string `json:"name,omitempty"`
}

type Code42Device added in v0.4.0

type Code42Device struct {
	Username string `json:"username,omitempty"`
	Uid      string `json:"uid,omitempty"`
}

type Code42EmailDlp added in v0.4.0

type Code42EmailDlp struct {
	PolicyNames []string `json:"policy_names,omitempty"`
	Subject     string   `json:"subject,omitempty"`
	Sender      string   `json:"sender,omitempty"`
	From        string   `json:"from,omitempty"`
	Recipients  []string `json:"recipients,omitempty"`
}

type Code42Event added in v0.4.0

type Code42Event struct {
	Id        string     `json:"id,omitempty"`
	Type      string     `json:"type,omitempty"`
	Timestamp *time.Time `json:"timestamp,omitempty"`
}

type Code42File added in v0.4.0

type Code42File struct {
	Path                string     `json:"path,omitempty"`
	Name                string     `json:"name,omitempty"`
	Type                string     `json:"type,omitempty"`
	Category            string     `json:"category,omitempty"`
	MimeTypeByBytes     string     `json:"mime_type_by_bytes,omitempty"`
	MimeTypeByExtension string     `json:"mime_type_by_extension,omitempty"`
	Size                *int64     `json:"size,omitempty"`
	Owner               string     `json:"owner,omitempty"`
	Hash                *Hash      `json:"hash,omitempty"`
	CreateTimestamp     *time.Time `json:"create_timestamp,omitempty"`
	ModifyTimestamp     *time.Time `json:"modify_timestamp,omitempty"`
	Id                  string     `json:"id,omitempty"`
	MimeTypeMismatch    *bool      `json:"mime_type_mismatch,omitempty"`
	CategoryByBytes     string     `json:"category_by_bytes,omitempty"`
	CategoryByExtension string     `json:"category_by_extension,omitempty"`
}

type Code42Print added in v0.4.0

type Code42Print struct {
	JobName     string `json:"job_name,omitempty"`
	PrinterName string `json:"name,omitempty"`
}

type Code42Process added in v0.4.0

type Code42Process struct {
	Owner string `json:"owner,omitempty"`
	Name  string `json:"name,omitempty"`
}

type Code42RemovableMedia added in v0.4.0

type Code42RemovableMedia struct {
	Vendor       string   `json:"vendor,omitempty"`
	Name         string   `json:"name,omitempty"`
	SerialNumber string   `json:"serial_number,omitempty"`
	Capacity     *int64   `json:"capacity,omitempty"`
	BusType      string   `json:"bus_type,omitempty"`
	MediaName    string   `json:"media_name,omitempty"`
	VolumeName   []string `json:"volume_name,omitempty"`
	PartitionId  []string `json:"partition_id,omitempty"`
}

type Code42SharedWith added in v0.5.1

type Code42SharedWith struct {
	CloudUsername *string `json:"cloud_username,omitempty"`
}

type Code42Tab added in v0.4.0

type Code42Tab struct {
	WindowTitle string `json:"window_title,omitempty"`
	Url         *URL   `json:"url,omitempty"`
}

type Code42TabTab added in v0.5.0

type Code42TabTab struct {
	Title string `json:"title,omitempty"`
	Url   *URL   `json:"url,omitempty"`
}

type ElasticFileEvent added in v0.1.5

type ElasticFileEvent struct {
	Event     *Event     `json:"event,omitempty"`
	Timestamp *time.Time `json:"@timestamp,omitempty"`
	File      *File      `json:"file,omitempty"`
	Host      *Host      `json:"host,omitempty"`
	Code42    *Code42    `json:"code_42,omitempty"`
}

type Event added in v0.1.6

type Event struct {
	Action   string     `json:"action,omitempty"`
	Category string     `json:"category,omitempty"`
	Created  *time.Time `json:"created,omitempty"`
	Dataset  string     `json:"dataset,omitempty"`
	Id       string     `json:"id,omitempty"`
	Ingested *time.Time `json:"ingested,omitempty"`
	Kind     string     `json:"kind,omitempty"`
	Module   string     `json:"module,omitempty"`
	Outcome  string     `json:"outcome,omitempty"`
	Provider string     `json:"provider,omitempty"`
	Type     string     `json:"type,omitempty"`
}

type FFSEvent

type FFSEvent struct {
	ffs.JsonFileEvent
	*ip_api.Location `json:",omitempty"`
	GeoLocation      *Location `json:"geoPoint,omitempty"`
}

type File added in v0.1.6

type File struct {
	Created   *time.Time `json:"created,omitempty"`
	Directory []string   `json:"directory,omitempty"`
	Extension string     `json:"extension,omitempty"`
	MimeType  []string   `json:"mime_type,omitempty"`
	Mtime     *time.Time `json:"mtime,omitempty"`
	Name      string     `json:"name,omitempty"`
	Owner     string     `json:"owner,omitempty"`
	Path      string     `json:"path,omitempty"`
	Size      *int64     `json:"size,omitempty"`
	Type      string     `json:"type,omitempty"`
	Hash      *Hash      `json:"hash,omitempty"`
}

type Geo added in v0.2.3

type Geo struct {
	Status        string    `json:"status,omitempty"`
	Message       string    `json:"message,omitempty"`
	Continent     string    `json:"continent_name,omitempty"`
	ContinentCode string    `json:"continent_iso_code,omitempty"`
	Country       string    `json:"country_name,omitempty"`
	CountryCode   string    `json:"country_iso_code,omitempty"`
	Region        string    `json:"region_iso_code,omitempty"`
	RegionName    string    `json:"region_name,omitempty"`
	City          string    `json:"city_name,omitempty"`
	District      string    `json:"district,omitempty"`
	ZIP           string    `json:"postal_code,omitempty"`
	Lat           *float32  `json:"lat,omitempty"`
	Lon           *float32  `json:"lon,omitempty"`
	Timezone      string    `json:"timezone,omitempty"`
	Currency      string    `json:"currency,omitempty"`
	ISP           string    `json:"isp,omitempty"`
	Org           string    `json:"org,omitempty"`
	AS            string    `json:"as,omitempty"`
	ASName        string    `json:"as_name,omitempty"`
	Reverse       string    `json:"reverse,omitempty"`
	Mobile        *bool     `json:"mobile,omitempty"`
	Proxy         *bool     `json:"proxy,omitempty"`
	Hosting       *bool     `json:"hosting,omitempty"`
	Query         string    `json:"query,omitempty"`
	Location      *Location `json:"location,omitempty"`
}

type Hash added in v0.2.3

type Hash struct {
	Md5    string `json:"md5,omitempty"`
	Sha256 string `json:"sha256,omitempty"`
}

type Host added in v0.2.3

type Host struct {
	Id       string   `json:"id,omitempty"`
	Name     string   `json:"name,omitempty"`
	Hostname string   `json:"hostname,omitempty"`
	User     *User    `json:"user,omitempty"`
	IP       []string `json:"ip,omitempty"`
	Geo      *Geo     `json:"geo,omitempty"`
}

type InProgressQuery

type InProgressQuery struct {
	OnOrAfter  time.Time
	OnOrBefore time.Time
}

In progress query struct

func ReadInProgressQueries

func ReadInProgressQueries(query config.FFSQuery) ([]InProgressQuery, error)

func ReadLastCompletedQuery

func ReadLastCompletedQuery(query config.FFSQuery) (InProgressQuery, error)

type InProgressQueryString

type InProgressQueryString struct {
	OnOrAfter  string
	OnOrBefore string
}

In progress query struct using strings

type Location added in v0.2.3

type Location struct {
	Lat *float32 `json:"lat,omitempty"`
	Lon *float32 `json:"lon,omitempty"`
}

type URL added in v0.2.3

type URL struct {
	Full             string `json:"full,omitempty"`
	Domain           string `json:"domain,omitempty"`
	Extension        string `json:"extension,omitempty"`
	Fragment         string `json:"fragment,omitempty"`
	Path             string `json:"path,omitempty"`
	Port             *int   `json:"port,omitempty"`
	Query            string `json:"query,omitempty"`
	Scheme           string `json:"scheme,omitempty"`
	Username         string `json:"username,omitempty"`
	Password         string `json:"password,omitempty"`
	RegisteredDomain string `json:"registered_domain,omitempty"`
	TopLevelDomain   string `json:"top_level_domain,omitempty"`
}

type User added in v0.2.3

type User struct {
	Email  string `json:"email,omitempty"`
	Id     string `json:"id,omitempty"`
	Name   string `json:"name,omitempty"`
	Domain string `json:"domain,omitempty"`
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL