31 lines
928 B
Go
31 lines
928 B
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
// Package model contains implementation-neutral records shared by the Go
|
|
// system snapshot, detector, and event layers.
|
|
package model
|
|
|
|
// Process is the subset of /proc process state needed by the first ported
|
|
// poll detectors. Fields are added as more Python detectors move across.
|
|
type Process struct {
|
|
PID int `json:"pid"`
|
|
Comm string `json:"comm"`
|
|
Cmdline string `json:"cmdline"`
|
|
Exe string `json:"exe"`
|
|
}
|
|
|
|
// State is one injectable detector sweep, equivalent to the Python
|
|
// SystemState boundary.
|
|
type State struct {
|
|
Processes []Process `json:"processes"`
|
|
}
|
|
|
|
// Alert matches enodia.alert.v1.
|
|
type Alert struct {
|
|
SID int `json:"sid"`
|
|
Severity string `json:"severity"`
|
|
Signature string `json:"signature"`
|
|
Classtype string `json:"classtype"`
|
|
Key string `json:"key"`
|
|
Detail string `json:"detail"`
|
|
PIDs []int `json:"pids"`
|
|
}
|