66 lines
2.6 KiB
Go
66 lines
2.6 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
// Package model contains implementation-neutral records shared by the Go
|
|
// system snapshot, detector, and event layers.
|
|
package model
|
|
|
|
// Process is the subset of /proc process state needed by the first ported
|
|
// poll detectors. Fields are added as more Python detectors move across.
|
|
type Process struct {
|
|
PID int `json:"pid"`
|
|
Comm string `json:"comm"`
|
|
Cmdline string `json:"cmdline"`
|
|
Exe string `json:"exe"`
|
|
Environ map[string]string `json:"environ"`
|
|
FDTargets map[string]string `json:"fd_targets"`
|
|
MemoryMaps []MemoryMap `json:"memory_maps"`
|
|
}
|
|
|
|
// MemoryMap is one parsed /proc/<pid>/maps row. The detector only needs the
|
|
// address range, permission bits, and optional pathname; retaining those raw
|
|
// fields keeps fixture input and alert explanations close to Python.
|
|
type MemoryMap struct {
|
|
Start uint64 `json:"start"`
|
|
End uint64 `json:"end"`
|
|
Perms string `json:"perms"`
|
|
Path string `json:"path"`
|
|
}
|
|
|
|
// State is one injectable detector sweep, equivalent to the Python
|
|
// SystemState boundary.
|
|
type State struct {
|
|
Processes []Process `json:"processes"`
|
|
Sockets []Socket `json:"sockets"`
|
|
LDPreload string `json:"ld_preload"`
|
|
ListenerBaseline []string `json:"listener_baseline"`
|
|
SUIDBaseline []string `json:"suid_baseline"`
|
|
SUIDBinaries []string `json:"suid_binaries"`
|
|
PersistSince *float64 `json:"persist_since"`
|
|
PersistenceFiles map[string]float64 `json:"persistence_files"`
|
|
FirstSeenInitialized bool `json:"first_seen_initialized"`
|
|
FirstSeenPublicDestinations map[string][]string `json:"first_seen_public_destinations"`
|
|
FirstSeenListenerPorts map[string][]string `json:"first_seen_listener_ports"`
|
|
}
|
|
|
|
// Socket matches the Python SystemState socket view. Nil inode/PID values
|
|
// preserve ss records where ownership metadata is unavailable.
|
|
type Socket struct {
|
|
State string `json:"state"`
|
|
Local string `json:"local"`
|
|
Peer string `json:"peer"`
|
|
Inode *int `json:"inode"`
|
|
Comm string `json:"comm"`
|
|
PID *int `json:"pid"`
|
|
Kind string `json:"kind"`
|
|
}
|
|
|
|
// Alert matches enodia.alert.v1.
|
|
type Alert struct {
|
|
SID int `json:"sid"`
|
|
Severity string `json:"severity"`
|
|
Signature string `json:"signature"`
|
|
Classtype string `json:"classtype"`
|
|
Key string `json:"key"`
|
|
Detail string `json:"detail"`
|
|
PIDs []int `json:"pids"`
|
|
}
|