Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BaselineMatch ¶
type BaselineMatch struct {
RuleID string
Title string
Severity string
Tags []string
Description string
Pattern string // The unique pattern that was seen
Message *santapb.SantaMessage
Timestamp time.Time
InLearning bool // Whether this occurred during learning period
}
BaselineMatch represents a baseline rule match (first occurrence)
type Processor ¶
type Processor struct {
// contains filtered or unexported fields
}
Processor evaluates baseline rules and tracks first-seen patterns
func NewProcessor ¶
NewProcessor creates a new baseline processor
func (*Processor) Process ¶
func (p *Processor) Process( msg *santapb.SantaMessage, baselines []*rules.CompiledBaseline, engine *rules.Engine, ) ([]*BaselineMatch, error)
Process evaluates an event against baseline rules.
Source Files
Click to show internal directories.
Click to hide internal directories.