elastic / elastic/go-libaudit

aucoalesce: Make warning capturing configurable

Open
#100 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
162
Forks
74
PR merge metrics
No merged PRs in 30d

Description

The current interface to aucoalesce is `func CoalesceMessages(msgs []*auparse.AuditMessage) (*Event, error)`.

Given that the warnings produced by this function are mainly for debugging and development we could change the function to accept a variable number of options like `func CoalesceMessages(msgs []*auparse.AuditMessage, opts ...Option) (*Event, error)`. Then we could pass an option to enable the inclusion of warnings with the event. Like

```golang
evt, err := aucoalesce.CoalesceMessages(msgs, aucoalesce.IncludeWarnings)
```

Future options might be to make ECS enrichment configurable.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.