Configuration Library

The project comes with a monolithic configuration library that includes functions required to build configurations. Within the library are four sub-libraries that use this tree structure: $.sub_library.component.

The sub-libraries are:

defaults: contain default values used across the application
helpers: contain functions that assist in building configurations
interfaces: contain functions that map configurations to interfaces
patterns: contain functions that implement common configuration use cases

The components are:

inspector: related to inspectors
operator: related to operators
processor: related to processors
kv_store: related to key-value stores
ip_database: related to IP database enrichment

For example, default values related to the hash processor are accessed at $.defaults.processor.hash and interfaces related to the strings inspector are accessed at $.interfaces.inspector.strings.

See these recipes for example use:

🔍

Compiling Inspectors & Operators

Open Recipe

⚙️

Compiling Processors

Open Recipe

💧

Compiling Sinks

Open Recipe