Documentation
¶
Overview ¶
Package retrohunt is the Phase C retro-hunt seam (#594, C4 #678): given a trigger (a detection or incident on an asset at a time), it pivots to the SURROUNDING endpoint State Timeline — the transitions just before and after the trigger — so an analyst can see what led up to and followed a detection after the raw telemetry that produced it has expired. It reads the durable State Timeline (B7) and is stateless + tenant-scoped from the context.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Request ¶
type Request struct {
AssetID shared.ID
Around time.Time
Before time.Duration
After time.Duration
EntityID shared.ID
Limit int
}
Request selects the window to hunt around a trigger. AssetID and Around are required; Before/After set how far to look back/forward (at least one must be positive). EntityID optionally focuses the hunt on one entity's transitions (e.g. the process a detection fired on). Limit caps the entries returned.
type Result ¶
type Result struct {
AssetID shared.ID
From time.Time
To time.Time
Entries []endpoint.TimelineEntry
Truncated bool
}
Result is the surrounding-timeline window. Entries are event-time ordered. Truncated reports that the store's limit capped the window, so the caller knows the view may be partial (coverage honesty); a deeper gap/sample overlay from the telemetry coverage store is a documented follow-up.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service answers retro-hunt queries over the endpoint State Timeline.
func NewService ¶
func NewService(timeline ports.EndpointTimelineStore) (*Service, error)
NewService constructs the retro-hunt service over an endpoint-timeline store.
Source Files