Skip to content

aucoalesce: Make warning capturing configurable #100

@andrewkroh

Description

@andrewkroh

The current interface to aucoalesce is func CoalesceMessages(msgs []*auparse.AuditMessage) (*Event, error).

Given that the warnings produced by this function are mainly for debugging and development we could change the function to accept a variable number of options like func CoalesceMessages(msgs []*auparse.AuditMessage, opts ...Option) (*Event, error). Then we could pass an option to enable the inclusion of warnings with the event. Like

    evt, err := aucoalesce.CoalesceMessages(msgs, aucoalesce.IncludeWarnings)

Future options might be to make ECS enrichment configurable.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions