feat: refactor event types to use unified Type structure across events #814

cfc4n · 2025-08-04T16:12:55Z

This pull request introduces significant refactoring and enhancements to the event processing system. The primary focus is on standardizing the event type representation, adding a Base structure to events for common metadata, and improving type consistency across the codebase. These changes aim to improve maintainability, readability, and extensibility of the code.

Standardization of Event Type Representation:

Replaced EventType with Type across all event structures for consistency. (pkg/event_processor/base_event.go, user/event/event_bash.go, user/event/event_gnutls.go, user/event/event_masterkey.go, etc.) [1] [2] [3] [4] [5] [6] [7] [8] [9]

Introduction of `Base` Structure for Common Metadata:

Added a reusable Base structure to encapsulate common metadata fields such as Timestamp, UUID, PID, and PName. This structure is now included in various event types (e.g., BashEvent, GnutlsDataEvent, MasterSecretEvent, etc.). (user/event/event_bash.go, user/event/event_gnutls.go, user/event/event_masterkey.go, etc.) [1] [2] [3] [4] [5] [6] [7] [8] [9]

Enhancements to Event Processing Logic:

Updated the BaseEvent and eventWorker logic to utilize the new Base structure, ensuring consistent handling of event metadata. (pkg/event_processor/base_event.go, pkg/event_processor/iworker.go) [1] [2] [3]

Type Consistency and Field Updates:

Updated field types for improved precision and consistency, such as changing PID from int32 to int64 in the Base structure. (user/event/event_base.go)
Added missing imports to support new functionality, such as time for timestamp handling. (user/event/event_bash.go)

Event-Specific Refactoring:

Refactored event-specific methods (e.g., Base() and EventType()) to align with the new Base structure and Type representation. This was done across multiple event types such as BashEvent, GoTLSEvent, MysqldEvent, and others. (user/event/event_bash.go, user/event/event_gotls.go, user/event/event_mysqld.go, etc.) [1] [2] [3]

These changes collectively improve the modularity and scalability of the event processing system, making it easier to add new event types or modify existing ones in the future.

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

github-actions · 2025-08-04T16:13:54Z

Failed to generate code suggestions for PR

Copilot

Pull Request Overview

This PR refactors the event type system by replacing EventType with Type across all event structures and introduces a unified Base structure for common event metadata. The changes standardize event handling and improve code consistency throughout the event processing system.

Key changes:

Renamed EventType to Type across all event structures and constants
Added a Base structure containing common metadata fields (timestamp, UUID, PID, process name, etc.)
Updated all event types to implement a new Base() method returning the unified metadata structure

Reviewed Changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
user/module/imodule.go	Updated event type constants from EventType* to Type*
user/event/ievent.go	Renamed EventType to Type and added Base() method to interface
user/event/event_*.go	Updated all event structures to use Type instead of EventType and implement Base() method
user/event/event_base.go	Changed PID field type from int32 to int64 in Base structure
pkg/event_processor/*.go	Updated event processor to use new Type naming and Base structure

Copilot · 2025-08-04T16:14:54Z

user/event/event_bash.go

-func (be *BashEvent) EventType() EventType {
+func (be *BashEvent) Base() Base {
+	be.base = Base{
+		Timestamp: time.Now().Unix(),


Using time.Now().Unix() in the Base() method creates inconsistent timestamps. Each call to Base() will return a different timestamp, which could cause issues if the method is called multiple times for the same event. Consider storing the timestamp when the event is created or use a field from the event structure.

Copilot · 2025-08-04T16:14:54Z

user/event/event_nspr.go

+		DstIP:     "127.0.0.1", // Nspr events do not have DstIP
+		DstPort:   0,           // Nspr events do not have DstPort
+		PID:       int64(ne.Pid),
+		PName:     string(ne.Comm[:]),


Converting ne.Comm[:] directly to string may include null bytes and garbage data. Use the commStr() helper function that properly handles C-style null-terminated strings, similar to other event implementations.

Suggested change

PName: string(ne.Comm[:]),

PName: commStr(ne.Comm[:]),

Copilot · 2025-08-04T16:14:54Z

user/event/event_mysqld.go

+		Timestamp: int64(me.Timestamp),
+		UUID:      me.GetUUID(),
+		PID:       int64(me.Pid),
+		PName:     string(me.Comm[:]),


Converting me.Comm[:] directly to string may include null bytes and garbage data. Use the commStr() helper function that properly handles C-style null-terminated strings, similar to other event implementations.

Suggested change

PName: string(me.Comm[:]),

PName: commStr(me.Comm[:]),

Copilot · 2025-08-04T16:14:55Z

user/event/event_bash.go

+		DstIP:     "127.0.0.1", // Bash events do not have DstIP
+		DstPort:   0,           // Bash events do not have DstPort
+		PID:       int64(be.Pid),
+		PName:     string(be.Comm[:]),


Converting be.Comm[:] directly to string may include null bytes and garbage data. Use the commStr() helper function that properly handles C-style null-terminated strings, similar to other event implementations.

Copilot · 2025-08-04T16:14:55Z

user/event/event_gnutls.go

+		DstIP:     "127.0.0.1", // Gnutls events do not have DstIP
+		DstPort:   0,           // Gnutls events do not have DstPort
+		PID:       int64(ge.Pid),
+		PName:     string(ge.Comm[:]),


Converting ge.Comm[:] directly to string may include null bytes and garbage data. Use the commStr() helper function that properly handles C-style null-terminated strings, similar to other event implementations.

Suggested change

PName: string(ge.Comm[:]),

PName: commStr(ge.Comm[:]),

Copilot · 2025-08-04T16:14:55Z

user/event/event_gotls.go

+		DstIP:         "127.0.0.1", // GoTLS events do not have DstIP
+		DstPort:       0,           // GoTLS events do not have DstPort
+		PID:           int64(ge.Pid),
+		PName:         string(ge.Comm[:]),


Converting ge.Comm[:] directly to string may include null bytes and garbage data. Use the commStr() helper function that properly handles C-style null-terminated strings, similar to other event implementations.

Suggested change

PName: string(ge.Comm[:]),

PName: commStr(ge.Comm[:]),

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

user/event/event_openssl.go

…loads Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

feat: refactor event types to use unified Type structure across events

512c24d

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

cfc4n requested a review from Copilot August 4, 2025 16:12

dosubot bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Aug 4, 2025

dosubot bot added the enhancement New feature or request label Aug 4, 2025

Copilot AI reviewed Aug 4, 2025

View reviewed changes

cfc4n added 2 commits August 6, 2025 00:26

feat: align struct field formatting for improved readability

2d21290

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

feat: align struct field formatting for consistency in event_base.go

0036ea6

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

github-advanced-security bot found potential problems Aug 5, 2025

View reviewed changes

user/event/event_openssl.go Fixed Show fixed Hide fixed

user/event/event_openssl.go Fixed Show fixed Hide fixed

feat: add GitHub Actions workflow for PR debug builds and artifact up…

acaa3c8

…loads Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

cfc4n merged commit 3d0f733 into master Aug 6, 2025
5 checks passed

cfc4n deleted the feature/event_common branch August 6, 2025 16:48

cfc4n mentioned this pull request Aug 14, 2025

Add the common info of the original event to the event_processor for easy direct printing #791

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: refactor event types to use unified Type structure across events #814

feat: refactor event types to use unified Type structure across events #814

Uh oh!

cfc4n commented Aug 4, 2025

Uh oh!

github-actions bot commented Aug 4, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Aug 4, 2025

Uh oh!

Copilot AI Aug 4, 2025

Uh oh!

Copilot AI Aug 4, 2025

Uh oh!

Copilot AI Aug 4, 2025

Uh oh!

Copilot AI Aug 4, 2025

Uh oh!

Copilot AI Aug 4, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

feat: refactor event types to use unified Type structure across events #814

feat: refactor event types to use unified Type structure across events #814

Uh oh!

Conversation

cfc4n commented Aug 4, 2025

Standardization of Event Type Representation:

Introduction of Base Structure for Common Metadata:

Enhancements to Event Processing Logic:

Type Consistency and Field Updates:

Event-Specific Refactoring:

Uh oh!

github-actions bot commented Aug 4, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Introduction of `Base` Structure for Common Metadata: