Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security Policy
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

engine

package

Go to main page

Versions in this module

v2

v2.3.0

Jun 2, 2022

Changes in this version

type XPath

+ Flags struct{ ... }

+ Path []string

+ func (p *XPath) Get(i int) string

+ func (p *XPath) Len() int

v2.2.0

Jan 3, 2022

Changes in this version

type Engine

+ func (e *Engine) LoadBytes(data []byte) error

+ func (e *Engine) LoadFile(rulefile string) error

+ func (e *Engine) LoadRule(rule *Rule) error

+ func (e *Engine) LoadString(data string) error

v2.1.2

Nov 18, 2021

v2.1.1

Nov 18, 2021

v2.1.0

Nov 18, 2021

v2.0.4

Sep 26, 2021

v2.0.3

Aug 19, 2021

v2.0.2

Aug 11, 2021

Changes in this version

+ const CriticalityBound

+ const TypeNegate

+ const TypeOperand

+ const TypeOperator

+ var DefaultRuleExtensions = datastructs.NewInitSyncedSet(".gen", ".gene")

+ var DefaultTplExtensions = datastructs.NewInitSyncedSet(".toml")

+ var EngineMinimalRuleSchemaVersion = ParseVersion("2.0.0")

+ var ErrContainerAlreadyExists = fmt.Errorf("Already existing container")

+ var ErrEOT = fmt.Errorf("End of tokens")

+ var ErrEmptyToken = fmt.Errorf("Empty token")

+ var ErrUnexpectedToken = fmt.Errorf("Unexpected tokens")

+ var ErrUnkOperator = fmt.Errorf("Unknown operator")

+ var GeneInfoPath = Path("/Event/GeneInfo")

+ func Compute(ce *ConditionElement, operands OperandReader) bool

+ func EventGetString(evt Event, p XPath) (string, bool)

+ func GetOperands(ce *ConditionElement) []string

+ func IsContainerMatch(s string) bool

+ func IsFieldMatch(s string) bool

+ func Pretty(c *ConditionElement, group bool) string

+ func PrettySplit(split []*ConditionElement) string

+ type Attack struct

+ Description string

+ ID string

+ Reference string

+ Tactic string

+ type CompiledRule struct

+ Actions []string

+ AtomMap *datastructs.SyncedMap

+ Attack []Attack

+ Computers *datastructs.SyncedSet

+ Conditions *ConditionElement

+ Criticality int

+ Disabled bool

+ EventFilter EventFilter

+ Filter bool

+ Name string

+ Schema Version

+ Tags *datastructs.SyncedSet

+ func Load(b []byte, containers *ContainerDB) (*CompiledRule, error)

+ func NewCompiledRule(schema Version) (er CompiledRule)

+ func (er *CompiledRule) AddMatcher(m Matcher)

+ func (er *CompiledRule) Match(evt Event) bool

+ func (er *CompiledRule) SetContainers(containers *ContainerDB)

+ type ConditionElement struct

+ Group int

+ Level int

+ Negate bool

+ Next *ConditionElement

+ Operand string

+ Operator rune

+ Prev *ConditionElement

+ Type int

+ func (c *ConditionElement) DebugString() string

+ func (c *ConditionElement) Pretty(group bool) string

+ func (c *ConditionElement) String() string

+ func (ce *ConditionElement) GetGroup() []*ConditionElement

+ func (ce *ConditionElement) GetLevels(lvl int) [][]*ConditionElement

+ func (ce *ConditionElement) Prioritize()

+ func (ce *ConditionElement) Simplify()

+ type ContainerDB map[string]*datastructs.SyncedSet

+ func NewContainers() *ContainerDB

+ func (c *ContainerDB) AddContainer(name string, container *datastructs.SyncedSet) error

+ func (c *ContainerDB) AddNewContainer(name string) error

+ func (c *ContainerDB) AddStringToContainer(name string, values ...string)

+ func (c *ContainerDB) AddToContainer(name string, values ...interface{})

+ func (c *ContainerDB) Contains(name string, value string) bool

+ func (c *ContainerDB) ContainsString(name string, value string) bool

+ func (c *ContainerDB) Get(name string) (*datastructs.SyncedSet, bool)

+ func (c *ContainerDB) Has(name string) bool

+ func (c *ContainerDB) Len(name string) int

+ func (c *ContainerDB) String() string

+ type ContainerMatch struct

+ Container string

+ Name string

+ Operand string

+ Regexp string

+ RexName string

+ func NewContainerMatch() *ContainerMatch

+ func ParseContainerMatch(extract string) (ae *ContainerMatch, err error)

+ func (c *ContainerMatch) Compile() (err error)

+ func (c *ContainerMatch) Extract(evt Event) (string, bool)

+ func (c *ContainerMatch) ExtractFromString(s string) (string, bool)

+ func (c *ContainerMatch) GetName() string

+ func (c *ContainerMatch) Match(evt Event) bool

+ func (c *ContainerMatch) SetContainerDB(db *ContainerDB)

+ func (c *ContainerMatch) String() string

+ type Detection struct

+ ATTACK []Attack

+ Actions *datastructs.Set

+ Criticality int

+ Signature *datastructs.Set

+ func NewDetection(attack, action bool) *Detection

+ func (d *Detection) AlsoMatchedFilter() bool

+ func (d *Detection) Count() int

+ func (d *Detection) IsAlert() bool

+ func (d *Detection) Names() []string

+ func (d *Detection) OnlyMatchedFilters() bool

+ func (d *Detection) Update(r *CompiledRule)

+ type Engine struct

+ ShowActions bool

+ ShowAttack bool

+ Stats Stats

+ func NewEngine(trace bool) (e *Engine)

+ func (e *Engine) AddRule(r *CompiledRule) error

+ func (e *Engine) AddToContainer(container, value string)

+ func (e *Engine) Blacklist(value string)

+ func (e *Engine) BlacklistLen() int

+ func (e *Engine) Count() int

+ func (e *Engine) GetCRuleByName(name string) (r *CompiledRule)

+ func (e *Engine) GetRawRule(regex string) (cs chan string)

+ func (e *Engine) GetRawRuleByName(name string) string

+ func (e *Engine) GetRuleNames() (names []string)

+ func (e *Engine) Load(rulefile string) error

+ func (e *Engine) LoadContainer(container string, reader io.Reader)

+ func (e *Engine) LoadDirectory(rulesDir string) error

+ func (e *Engine) LoadReader(reader io.ReadSeeker) error

+ func (e *Engine) LoadTemplate(templatefile string) error

+ func (e *Engine) MatchOrFilter(evt Event) (names []string, criticality int, filtered bool)

+ func (e *Engine) SetDefaultActions(low, high int, actions []string)

+ func (e *Engine) SetDumpRaw(value bool)

+ func (e *Engine) SetFilters(names, tags []string)

+ func (e *Engine) SetShowAttck(value bool)

+ func (e *Engine) Tags() []string

+ func (e *Engine) Whitelist(value string)

+ func (e *Engine) WhitelistLen() int

+ type ErrItemNotFound struct

+ func (e *ErrItemNotFound) Error() string

+ type ErrRuleExist struct

+ func (e ErrRuleExist) Error() string

+ type Event interface

+ Channel func() string

+ Computer func() string

+ EventID func() int64

+ Get func(XPath) (interface{}, bool)

+ GetDetection func() *Detection

+ Set func(XPath, interface{}) error

+ SetDetection func(d *Detection)

+ Timestamp func() time.Time

+ type EventFilter map[string]*datastructs.Set

+ func NewEventFilter(m map[string][]int64) EventFilter

+ func (f EventFilter) Match(e Event) bool

+ type EventOpReader struct

+ func (oe *EventOpReader) Read(operand string) (value bool, ok bool)

+ type FieldMatch struct

+ Name string

+ Operand string

+ Operator string

+ Value string

+ func NewFieldMatch(name, operand, operator, value string) *FieldMatch

+ func ParseFieldMatch(rule string) (ar FieldMatch, err error)

+ func (f *FieldMatch) Compile() error

+ func (f *FieldMatch) GetName() string

+ func (f *FieldMatch) Match(se Event) bool

+ func (f *FieldMatch) String() string

+ type GenericEvent map[string]interface

+ func (e GenericEvent) Get(p XPath) (interface{}, bool)

+ func (g GenericEvent) Channel() string

+ func (g GenericEvent) Computer() string

+ func (g GenericEvent) EventID() (id int64)

+ func (g GenericEvent) GetDetection() *Detection

+ func (g GenericEvent) Set(p XPath, new interface{}) error

+ func (g GenericEvent) SetDetection(d *Detection)

+ func (g GenericEvent) Timestamp() time.Time

+ type Matcher interface

+ GetName func() string

+ Match func(Event) bool

+ type MetaSection struct

+ Attack []Attack

+ Computers []string

+ Criticality int

+ Disable bool

+ Events map[string][]int64

+ Filter bool

+ Schema Version

+ type OperandMap map[string]bool

+ func (om OperandMap) Read(operand string) (value, ok bool)

+ type OperandReader interface

+ Read func(string) (bool, bool)

+ type Rule struct

+ Actions []string

+ Condition string

+ Matches []string

+ Meta MetaSection

+ Name string

+ Tags []string

+ func NewRule() Rule

+ func (jr *Rule) Compile(containers *ContainerDB) (*CompiledRule, error)

+ func (jr *Rule) IsDisabled() bool

+ func (jr *Rule) JSON() (string, error)

+ func (jr *Rule) ReplaceTemplate(tm *TemplateMap)

+ type Stats struct

+ Positives uint64

+ Scanned uint64

+ type Template struct

+ Name string

+ Value string

+ func (t *Template) Replace(s string) (new string)

+ type TemplateMap struct

+ func NewTemplateMap() *TemplateMap

+ func (tm *TemplateMap) AddTemplate(t *Template)

+ func (tm *TemplateMap) GetTemplate(name string) (ok bool, tpl *Template)

+ func (tm *TemplateMap) LoadReader(r io.Reader) (err error)

+ func (tm *TemplateMap) ReplaceAll(s string) (new string)

+ type Tokenizer struct

+ func NewTokenizer(condition string) (c Tokenizer)

+ func (t *Tokenizer) NextExpectedToken(expects ...string) (token string, err error)

+ func (t *Tokenizer) NextToken() (token string, err error)

+ func (t *Tokenizer) ParseCondition(group, level int) (*ConditionElement, error)

+ type Version struct

+ Major int

+ Minor int

+ Patch int

+ func ParseVersion(s string) (v Version)

+ func (v *Version) UnmarshalJSON(b []byte) error

+ func (v Version) Above(other Version) bool

+ func (v Version) Below(other Version) bool

+ func (v Version) Equals(other Version) bool

+ func (v Version) IsZero() bool

+ func (v Version) MarshalJSON() ([]byte, error)

+ func (v Version) String() string

+ type XPath []string

+ func Path(p string) XPath

+ func (p XPath) Equal(other XPath) bool

+ func (p XPath) Last() string

+ func (p XPath) StartsWith(start XPath) bool

+ func (p XPath) String() string

Other modules containing this package

github.com/0xrawsec/gene