95 lines
4.7 KiB
Go
95 lines
4.7 KiB
Go
package contracts
|
|
|
|
import "time"
|
|
|
|
type EventMetadataPayload struct {
|
|
Computer string `json:"computer,omitempty"`
|
|
ProviderName string `json:"provider,omitempty"`
|
|
TargetUser string `json:"target_user,omitempty"`
|
|
TargetDomain string `json:"target_domain,omitempty"`
|
|
SubjectUser string `json:"subject_user,omitempty"`
|
|
SubjectDomain string `json:"subject_domain,omitempty"`
|
|
Workstation string `json:"workstation,omitempty"`
|
|
Device string `json:"device,omitempty"`
|
|
SrcIP string `json:"src_ip,omitempty"`
|
|
SrcPort string `json:"src_port,omitempty"`
|
|
DstIP string `json:"dst_ip,omitempty"`
|
|
DstPort string `json:"dst_port,omitempty"`
|
|
LogonType string `json:"logon_type,omitempty"`
|
|
ProcessName string `json:"process_name,omitempty"`
|
|
ParentProcessName string `json:"parent_process_name,omitempty"`
|
|
CommandLine string `json:"command_line,omitempty"`
|
|
AuthenticationPackage string `json:"authentication_package,omitempty"`
|
|
LogonProcess string `json:"logon_process,omitempty"`
|
|
StatusText string `json:"status,omitempty"`
|
|
SubStatusText string `json:"sub_status,omitempty"`
|
|
FailureReason string `json:"failure_reason,omitempty"`
|
|
}
|
|
|
|
type LogPayload struct {
|
|
Hostname string `json:"host"`
|
|
Channel string `json:"channel"`
|
|
EventID uint32 `json:"id"`
|
|
Source string `json:"source"`
|
|
Time time.Time `json:"ts"`
|
|
Message string `json:"msg,omitempty"`
|
|
Metadata *EventMetadataPayload `json:"meta,omitempty"`
|
|
}
|
|
|
|
type IngestEnvelope struct {
|
|
Version int `json:"version"`
|
|
TenantID string `json:"tenant_id"`
|
|
AgentID string `json:"agent_id"`
|
|
BatchUID string `json:"batch_uid"`
|
|
RemoteIP string `json:"remote_ip"`
|
|
ReceivedAt time.Time `json:"received_at"`
|
|
Events []LogPayload `json:"events"`
|
|
}
|
|
|
|
type CanonicalEvent struct {
|
|
EventUID string `json:"event_uid"`
|
|
QueuePartition int32 `json:"queue_partition"`
|
|
QueueOffset int64 `json:"queue_offset"`
|
|
TenantID string `json:"tenant_id"`
|
|
EventTime string `json:"event_time"`
|
|
IngestTime string `json:"ingest_time"`
|
|
AgentID string `json:"agent_id"`
|
|
HostName string `json:"host_name"`
|
|
SourceType string `json:"source_type"`
|
|
Channel string `json:"channel"`
|
|
Provider string `json:"provider"`
|
|
EventCode uint32 `json:"event_code"`
|
|
Category string `json:"category"`
|
|
Action string `json:"action"`
|
|
Outcome string `json:"outcome"`
|
|
Severity uint8 `json:"severity"`
|
|
UserName string `json:"user_name"`
|
|
UserDomain string `json:"user_domain"`
|
|
SubjectUser string `json:"subject_user"`
|
|
SubjectDomain string `json:"subject_domain"`
|
|
TargetUser string `json:"target_user"`
|
|
TargetDomain string `json:"target_domain"`
|
|
SourceIP string `json:"source_ip"`
|
|
SourcePort uint16 `json:"source_port"`
|
|
DestinationIP string `json:"destination_ip"`
|
|
DestinationPort uint16 `json:"destination_port"`
|
|
Workstation string `json:"workstation"`
|
|
LogonType string `json:"logon_type"`
|
|
AuthenticationPackage string `json:"authentication_package"`
|
|
LogonProcess string `json:"logon_process"`
|
|
StatusCode string `json:"status_code"`
|
|
SubStatusCode string `json:"sub_status_code"`
|
|
FailureReason string `json:"failure_reason"`
|
|
ProcessPath string `json:"process_path"`
|
|
ParentProcessPath string `json:"parent_process_path"`
|
|
CommandLine string `json:"command_line"`
|
|
Message string `json:"message"`
|
|
Attributes map[string]string `json:"attributes"`
|
|
RawObjectKey string `json:"raw_object_key"`
|
|
RawIndex uint32 `json:"raw_index"`
|
|
PayloadHash string `json:"payload_hash"`
|
|
SchemaVersion uint16 `json:"schema_version"`
|
|
ParserVersion uint16 `json:"parser_version"`
|
|
IngestDelayMS int64 `json:"ingest_delay_ms"`
|
|
}
|