Skip to content
API Documentation
BastionGuard™
BastionGuard::RootGuard::Event Struct Reference

#include <RootGuardEvent.hpp>

Public Attributes

std::string received_at
std::string event
std::string verdict
std::uint32_t pid {}
std::uint32_t tgid {}
std::uint32_t ppid {}
std::uint32_t old_euid {}
std::uint32_t new_euid {}
std::uint32_t rule_id {}
std::uint32_t reason_flags {}
std::int32_t lsm_flags {}
std::uint32_t auxiliary {}
std::uint64_t device {}
std::uint64_t inode {}
std::uint64_t actor_device {}
std::uint64_t actor_inode {}
std::uint64_t parent_device {}
std::uint64_t parent_inode {}
std::uint64_t actor_start_boottime_ns {}
std::uint32_t old_mode {}
std::uint32_t new_mode {}
std::uint32_t old_uid {}
std::uint32_t new_uid {}
std::uint32_t old_gid {}
std::uint32_t new_gid {}
std::string comm
std::string parent_comm
std::string actor_executable
std::string parent_executable
std::string filename
std::string path_resolution {"basename-only"}
std::string raw_json

Detailed Description

Definition at line 20 of file RootGuardEvent.hpp.

Member Data Documentation

◆ actor_device

std::uint64_t BastionGuard::RootGuard::Event::actor_device {}

◆ actor_executable

std::string BastionGuard::RootGuard::Event::actor_executable

◆ actor_inode

std::uint64_t BastionGuard::RootGuard::Event::actor_inode {}

◆ actor_start_boottime_ns

std::uint64_t BastionGuard::RootGuard::Event::actor_start_boottime_ns {}

Definition at line 39 of file RootGuardEvent.hpp.

◆ auxiliary

std::uint32_t BastionGuard::RootGuard::Event::auxiliary {}

Definition at line 32 of file RootGuardEvent.hpp.

◆ comm

std::string BastionGuard::RootGuard::Event::comm

◆ device

◆ event

std::string BastionGuard::RootGuard::Event::event

◆ filename

std::string BastionGuard::RootGuard::Event::filename

◆ inode

◆ lsm_flags

std::int32_t BastionGuard::RootGuard::Event::lsm_flags {}

Definition at line 31 of file RootGuardEvent.hpp.

◆ new_euid

std::uint32_t BastionGuard::RootGuard::Event::new_euid {}

◆ new_gid

std::uint32_t BastionGuard::RootGuard::Event::new_gid {}

◆ new_mode

std::uint32_t BastionGuard::RootGuard::Event::new_mode {}

◆ new_uid

std::uint32_t BastionGuard::RootGuard::Event::new_uid {}

◆ old_euid

std::uint32_t BastionGuard::RootGuard::Event::old_euid {}

◆ old_gid

std::uint32_t BastionGuard::RootGuard::Event::old_gid {}

◆ old_mode

std::uint32_t BastionGuard::RootGuard::Event::old_mode {}

◆ old_uid

std::uint32_t BastionGuard::RootGuard::Event::old_uid {}

◆ parent_comm

std::string BastionGuard::RootGuard::Event::parent_comm

◆ parent_device

std::uint64_t BastionGuard::RootGuard::Event::parent_device {}

Definition at line 37 of file RootGuardEvent.hpp.

Referenced by BastionGuard::RootGuard::format_event().

◆ parent_executable

std::string BastionGuard::RootGuard::Event::parent_executable

◆ parent_inode

std::uint64_t BastionGuard::RootGuard::Event::parent_inode {}

Definition at line 38 of file RootGuardEvent.hpp.

Referenced by BastionGuard::RootGuard::format_event().

◆ path_resolution

std::string BastionGuard::RootGuard::Event::path_resolution {"basename-only"}

◆ pid

std::uint32_t BastionGuard::RootGuard::Event::pid {}

Definition at line 24 of file RootGuardEvent.hpp.

◆ ppid

std::uint32_t BastionGuard::RootGuard::Event::ppid {}

Definition at line 26 of file RootGuardEvent.hpp.

◆ raw_json

std::string BastionGuard::RootGuard::Event::raw_json

Definition at line 52 of file RootGuardEvent.hpp.

Referenced by BastionGuard::RootGuard::parse_event_json().

◆ reason_flags

◆ received_at

std::string BastionGuard::RootGuard::Event::received_at

Definition at line 21 of file RootGuardEvent.hpp.

Referenced by BastionGuard::RootGuard::format_event().

◆ rule_id

◆ tgid

std::uint32_t BastionGuard::RootGuard::Event::tgid {}

Definition at line 25 of file RootGuardEvent.hpp.

◆ verdict

std::string BastionGuard::RootGuard::Event::verdict

Definition at line 23 of file RootGuardEvent.hpp.


The documentation for this struct was generated from the following file: