LoadPolicies loads the policies listed in the configuration and apply them to the given ruleset.

LoadPolicy loads a YAML file and returns a new policy.

NewOptsWithParams initializes a new Opts instance with Debug and Constants parameters.

NewRuleSet returns a new ruleset for the specified data model.

ErrDefinitionIDConflict is returned when mlultiple rule use the same ID.

ErrEventTypeNotEnabled is returned when an event is not enabled.

ErrInternalIDConflict is returned when a user defined rule use an internal ID.

ErrRuleWithMultipleEvents is returned when multiple event type were inferred from the rule.

ErrRuleWithoutEvent is returned when no event type was inferred from the rule.

ErrFieldTypeUnknown is returned when a field has an unknown type.

ErrMacroLoad is on macro definition error.

ErrNoApprover is returned when no approver was found for a set of rules.

ErrNoEventTypeBucket is returned when no bucket could be found for an event type.

ErrPoliciesLoad is returned on policies dir error.

ErrPolicyLoad is returned on policy file error.

ErrRuleLoad is on rule definition error.

ErrValueTypeUnknown is returned when the value of a field has an unknown type.

FieldCapability represents a field and the type of its value (scalar, pattern, bitmask, ...).

FilterValue represents a field, its value, its type and whether it's a used to compare with or against its value.

Macro describes a macro of a ruleset.

MacroDefinition holds the definition of a macro.

NullLogger is a default implementation of the Logger interface.

Opts defines rules set options.

Policy represents a policy file which is composed of a list of rules and macros.

Rule describes a rule of a ruleset.

RuleBucket groups rules with the same event type.

RuleDefinition holds the definition of a rule.

RuleSet holds a list of rules, grouped in bucket.

Logger interface used to remove the dependency of this package to the logger of the agent.

RuleSetListener describes the methods implemented by an object used to be notified of events on a rule set.

Approvers associates field names with their filter values.

FieldCapabilities holds a list of field capabilities.

FieldCombinations - array all the combinations of field.

FilterValues - list of FilterValue.

MacroID represents the ID of a macro.

RuleID represents the ID of a rule.