act

package

v1.3.4 Latest Latest Go to latest Published: Jan 7, 2026 License: AGPL-3.0 Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/defended-net/malwatch

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func Validate(acters []acter.Acter, verbs []string) []string
type Cfg
- func Mock(path string) *Cfg
- func New(path string) *Cfg
type Clean
type Loadout
type Quarantine
type Skips
- func GetSkips(cfg *Cfg, paths *path.Paths) *Skips

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	// ErrInvalidChars means invalid characters.
	ErrInvalidChars = errors.New("act: invalid char input")

	// ErrUnknownVerb means unknown verb.
	ErrUnknownVerb = errors.New("act: verb not configured")

	// ErrNoActs means no acts.
	ErrNoActs = errors.New("act: none configured for")

	// ErrStarSkipNotAllowed means skip not permitted for *.
	ErrStarSkipNotAllowed = errors.New("act: skip not permitted for rule wildcard")
)

Functions ¶

func Validate ¶

func Validate(acters []acter.Acter, verbs []string) []string

Validate dedupes and validates verbs.

Types ¶

type Cfg ¶

type Cfg struct {
	Default    []string
	Signatures map[string][]string
	Paths      map[string]map[string][]string
	Skips      *Skips
	Quarantine *Quarantine
	Clean      Clean
	// contains filtered or unexported fields
}

Cfg represents acts cfg. path stores the toml filepath. Default stores the default acts initially applicable to all detections.

func Mock ¶

func Mock(path string) *Cfg

Mock mocks a cfg.

func New ¶

func New(path string) *Cfg

New returns a new cfg from given path.

func (*Cfg) AddPathVerbs ¶

func (cfg *Cfg) AddPathVerbs(acters []acter.Acter, path string, rule string, verbs []string) error

AddPathVerbs adds given path's verbs.

func (*Cfg) AddSigVerbs ¶

func (cfg *Cfg) AddSigVerbs(acters []acter.Acter, rule string, verbs []string) error

AddSigVerbs adds a given sig's verbs.

func (*Cfg) Compact ¶

func (cfg *Cfg) Compact(path string, rule string) error

Compact compacts verbs. TODO

func (*Cfg) DelPathVerbs ¶

func (cfg *Cfg) DelPathVerbs(path string) error

DelPathVerbs deletes given path's verbs.

func (*Cfg) DelSigVerbs ¶

func (cfg *Cfg) DelSigVerbs(sig string) error

DelSigVerbs deletes sig's verbs.

func (*Cfg) Get ¶

func (cfg *Cfg) Get(key string) []*Loadout

Get returns loadouts for given path.

func (*Cfg) Load ¶

func (cfg *Cfg) Load() error

Load reads the cfg from toml path.

func (*Cfg) NewVerbs ¶

func (cfg *Cfg) NewVerbs(path string, rules ...string) []string

NewVerbs returns verbs based on given path and rules. Switch is for probability, for instance a filepath:rule is more likely than dir:rule.

func (*Cfg) Path ¶

func (cfg *Cfg) Path() string

Path returns the cfg file path.

func (*Cfg) SetPathVerbs ¶

func (cfg *Cfg) SetPathVerbs(acters []acter.Acter, path string, rule string, verbs []string) error

SetPathVerbs sets given path's verbs.

func (*Cfg) SetSigVerbs ¶

func (cfg *Cfg) SetSigVerbs(acters []acter.Acter, rule string, verbs []string) error

SetSigVerbs sets given sig's verbs.

type Clean ¶

type Clean map[string][]string

Clean are sed compatible cleaning expressions. name:expressions

type Loadout ¶

type Loadout struct {
	Rule    string   `json:"rule"`
	Actions []string `json:"actions"`
}

Loadout represents rule:acts.

type Quarantine ¶

type Quarantine struct {
	Dir string
}

Quarantine represents the quarantine cfg.

type Skips ¶

type Skips struct {
	Dirs  []string
	Files map[string]struct{}
}

Skips represents dir and file path skips. Files serves as a dict.

func GetSkips ¶

func GetSkips(cfg *Cfg, paths *path.Paths) *Skips

GetSkips returns dir and file path skips from a given cfg.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL