logtypes

type CachedResolver ¶ added in v1.15.0

type CachedResolver struct {
	// contains filtered or unexported fields
}

func NewCachedResolver(maxAge time.Duration, r Resolver) *CachedResolver

func (c *CachedResolver) Forget(name string)

func (c *CachedResolver) Resolve(ctx context.Context, name string) (Entry, error)

type Collection ¶ added in v1.12.0

type Collection interface {
	Entries() []Entry
}

Collection is a collection of log type entries

type Config ¶

type Config struct {
	Name         string
	Description  string
	ReferenceURL string
	Schema       interface{}
	NewParser    pantherlog.LogParserFactory
}

Config describes a log event type in a declarative way. To convert to an Entry instance it must be registered. The Config/LogType separation enforces mutability rules for registered log event types.

func (c Config) BuildEntry() (Entry, error)

func (c *Config) Describe() Desc

func (c *Config) Validate() error

type ConfigJSON ¶ added in v1.12.0

type ConfigJSON struct {
	Name            string
	Description     string
	ReferenceURL    string
	NewEvent        func() interface{}
	Validate        func(interface{}) error
	JSON            jsoniter.API
	NextRowID       func() string
	Now             func() time.Time
	ExtraIndicators pantherlog.FieldSet
}

ConfigJSON is a configuration that creates a log type entry for a JSON log. The parser only handles the usual case where each JSON value produces a single pantherlog.Result.

func (c ConfigJSON) BuildEntry() (Entry, error)

type Desc ¶

type Desc struct {
	Name         string
	Description  string
	ReferenceURL string
}

Desc describes a log type.

func (desc *Desc) Fill()

func (desc *Desc) Validate() error

type Entry ¶

type Entry interface {
	Describe() Desc
	pantherlog.LogParserFactory
	Schema() interface{}
	String() string
	// Entry should be usable as an EntryBuilder that returns itself with no error
	EntryBuilder
	// Entry should implement Group for a single entry
	Group
}

Entry describes a log event type. It provides a method to create a new parser and a schema struct to derive tables from.

func MustBuild(builder EntryBuilder) Entry

func MustFind(f Finder, name string) Entry

type EntryBuilder ¶ added in v1.12.0

type EntryBuilder interface {
	BuildEntry() (Entry, error)
}

EntryBuilder builds a new entry. It is used by various entry configurations (Config, ConfigJSON).

type Finder ¶ added in v1.12.0

type Finder interface {
	Find(logType string) Entry
}

Finder can find a log entry by name. It should return nil if the entry is not found.

type Group ¶ added in v1.12.0

type Group interface {
	Name() string
	Collection
	Finder
}

Group is a named collection of log type entries. The purpose of Group is to provide read-only access to a set of log types

func BuildGroup(name string, entries ...EntryBuilder) (Group, error)

func Merge(name string, groups ...Group) (Group, error)

func Must(name string, entries ...EntryBuilder) Group

func MustMerge(name string, groups ...Group) Group

type Resolver ¶ added in v1.11.0

type Resolver interface {
	Resolve(ctx context.Context, name string) (Entry, error)
}

Resolver resolves a log type name to it's entry. Implementations should use the context argument if they require to make network requests to resolve the entry. If an error occurred while trying to resolve the entry it should be returned (nil, err). If an entry could not be resolved but no errors occurred the implementations should return `nil, nil`.

func ChainResolvers(resolvers ...Resolver) Resolver

func LocalResolver(finders ...Finder) Resolver

type ResolverFunc ¶ added in v1.15.0

type ResolverFunc func(ctx context.Context, name string) (Entry, error)

func (f ResolverFunc) Resolve(ctx context.Context, name string) (Entry, error)