santa icon indicating copy to clipboard operation
santa copied to clipboard

ES and Logging Interfaces Redesign

Open mlw opened this issue 1 year ago • 0 comments

This is a major refactor with the overall major goals of:

  1. Utilize more C++/ObjectiveC++
    • Help reduce the overall number of per-event allocations and copies
  2. Wrap ES messages and other ES objects in C++ classes
    • Add resource safety by automatically managing ES object lifetimes (e.g. retain/release messages)
    • santa_message_t has been removed from the project.
  3. Create additional ES clients, and separate them by functionality
    • E.g., Client to authorize executions, a client to log events, a client to provide tamper resistance, etc.
    • Add new base class to manage ES client creation and ES framework communication
  4. Expand enrichment phase to account for enhanced logging data and prepare for planned structured logging changes
  5. Fine grained logging interfaces
    • Break out serialization and writing
    • Per-event type logging interfaces to support better logging specialization

Important Notes:

  1. The EnableSysxCache key is no longer supported. A cache will always be used.
  2. The beta protobuf value for the EventLogType configuration key is temporarily unsupported. The protobuf support was previously beta only and there are planned changes to schema. As such it was not ported in this effort.

mlw avatar Sep 06 '22 13:09 mlw