62 lines
1.8 KiB
Go
62 lines
1.8 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
// Package schema implements the Go side of Sentinel's stable JSON contracts.
|
|
package schema
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"time"
|
|
)
|
|
|
|
const (
|
|
EventV1 = "enodia.event.v1"
|
|
AlertV1 = "enodia.alert.v1"
|
|
StatusV1 = "enodia.status.v1"
|
|
)
|
|
|
|
var eventTypes = map[string]bool{
|
|
"alert": true, "incident": true, "status": true,
|
|
}
|
|
|
|
// Status matches the required enodia.status.v1 fields. Agent-level callers use
|
|
// zero retention values; the service executable fills them from its optional
|
|
// snapshot store immediately before emitting a status envelope.
|
|
type Status struct {
|
|
Schema string `json:"schema"`
|
|
Version string `json:"version"`
|
|
Running bool `json:"running"`
|
|
TotalAlerts int `json:"total_alerts"`
|
|
Counts map[string]int `json:"counts"`
|
|
LastAlert *string `json:"last_alert"`
|
|
EBPF string `json:"ebpf"`
|
|
EBPFExec string `json:"ebpf_exec"`
|
|
EBPFSyscall string `json:"ebpf_syscall"`
|
|
Host string `json:"host"`
|
|
HeartbeatAge *float64 `json:"heartbeat_age"`
|
|
HeartbeatStale bool `json:"heartbeat_stale"`
|
|
}
|
|
|
|
// Build returns the EVE-style enodia.event.v1 envelope used by Python.
|
|
func Build(eventType string, payload any, host, timestamp string) (map[string]any, error) {
|
|
if !eventTypes[eventType] {
|
|
return nil, fmt.Errorf("unknown event_type: %q", eventType)
|
|
}
|
|
if host == "" {
|
|
var err error
|
|
host, err = os.Hostname()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
if timestamp == "" {
|
|
timestamp = time.Now().Local().Format(time.RFC3339Nano)
|
|
}
|
|
return map[string]any{
|
|
"schema": EventV1,
|
|
"event_type": eventType,
|
|
"timestamp": timestamp,
|
|
"host": host,
|
|
eventType: payload,
|
|
}, nil
|
|
}
|