santa
santa copied to clipboard
ES and Logging Interfaces Redesign
This is a major refactor with the overall major goals of:
- Utilize more C++/ObjectiveC++
- Help reduce the overall number of per-event allocations and copies
- Wrap ES messages and other ES objects in C++ classes
- Add resource safety by automatically managing ES object lifetimes (e.g. retain/release messages)
-
santa_message_t
has been removed from the project.
- Create additional ES clients, and separate them by functionality
- E.g., Client to authorize executions, a client to log events, a client to provide tamper resistance, etc.
- Add new base class to manage ES client creation and ES framework communication
- Expand enrichment phase to account for enhanced logging data and prepare for planned structured logging changes
- Fine grained logging interfaces
- Break out serialization and writing
- Per-event type logging interfaces to support better logging specialization
Important Notes:
- The
EnableSysxCache
key is no longer supported. A cache will always be used. - The beta
protobuf
value for theEventLogType
configuration key is temporarily unsupported. The protobuf support was previously beta only and there are planned changes to schema. As such it was not ported in this effort.