From a60b1ac48849b00f4016bba5f44d313d2ecd594f Mon Sep 17 00:00:00 2001 From: Max Altgelt Date: Tue, 11 Aug 2026 11:46:50 +0000 Subject: [PATCH] feat: add additional timestamps --- thorlog/v3/antivirus.go | 9 +++++++++ thorlog/v3/auditlog.go | 5 +++++ thorlog/v3/groupsxml.go | 5 +++++ thorlog/v3/logline.go | 4 ++++ thorlog/v3/networksession.go | 4 +++- thorlog/v3/registry.go | 2 ++ thorlog/v3/users.go | 6 ++++++ 7 files changed, 34 insertions(+), 1 deletion(-) diff --git a/thorlog/v3/antivirus.go b/thorlog/v3/antivirus.go index 109d0d0..90877c7 100644 --- a/thorlog/v3/antivirus.go +++ b/thorlog/v3/antivirus.go @@ -1,6 +1,8 @@ package thorlog import ( + "time" + "github.com/NextronSystems/jsonlog" ) @@ -11,6 +13,9 @@ type AntiVirusProduct struct { Status string `json:"status" textlog:"status"` SignatureStatus string `json:"signature_status" textlog:"signature_status"` Path string `json:"path" textlog:"path"` + // SignatureUpdated is the time when the product's signatures were last updated. + // It is only available for products that report this information. + SignatureUpdated time.Time `json:"signature_updated,omitzero" textlog:"signature_updated,omitempty"` } func (AntiVirusProduct) observed() {} @@ -33,6 +38,10 @@ type AntiVirusExclude struct { Type string `json:"exclusion_type" textlog:"type"` Exclusion string `json:"exclusion" textlog:"exclusion"` + // Modified is the last write time of the registry key that holds this exclusion. + // Since all exclusions of the same type share that key, this is the time when any + // exclusion of this type was last added or removed, not necessarily this one. + Modified time.Time `json:"modified,omitzero" textlog:"modified,omitempty"` } func (AntiVirusExclude) observed() {} diff --git a/thorlog/v3/auditlog.go b/thorlog/v3/auditlog.go index 4390e47..1ca5fb4 100644 --- a/thorlog/v3/auditlog.go +++ b/thorlog/v3/auditlog.go @@ -1,12 +1,17 @@ package thorlog import ( + "time" + "github.com/NextronSystems/jsonlog" ) type AuditLogEntry struct { jsonlog.ObjectHeader + // Time when the audit log entry was recorded, taken from the record's + // audit(.:) header. + Time time.Time `json:"time" textlog:"time"` Entry KeyValueList `json:"entry" textlog:"entry"` } diff --git a/thorlog/v3/groupsxml.go b/thorlog/v3/groupsxml.go index 254677d..49f9496 100644 --- a/thorlog/v3/groupsxml.go +++ b/thorlog/v3/groupsxml.go @@ -1,6 +1,8 @@ package thorlog import ( + "time" + "github.com/NextronSystems/jsonlog" ) @@ -8,6 +10,9 @@ type GroupsXmlUser struct { jsonlog.ObjectHeader User string `json:"user" textlog:"user"` Password string `json:"password" textlog:"password"` + // Changed is the time when this entry was last modified, taken from the + // "changed" attribute of the corresponding element in the groups.xml file. + Changed time.Time `json:"changed,omitzero" textlog:"changed,omitempty"` } func (GroupsXmlUser) observed() {} diff --git a/thorlog/v3/logline.go b/thorlog/v3/logline.go index f98e394..600dbcf 100644 --- a/thorlog/v3/logline.go +++ b/thorlog/v3/logline.go @@ -1,6 +1,8 @@ package thorlog import ( + "time" + "github.com/NextronSystems/jsonlog" ) @@ -9,6 +11,8 @@ type LogLine struct { LineIndex uint64 `json:"line_index" textlog:"-"` Line string `json:"line" textlog:"line"` + // Time contained in the log line, if the line has a timestamp that could be parsed. + Time time.Time `json:"time,omitzero" textlog:"time,omitempty"` } func (LogLine) observed() {} diff --git a/thorlog/v3/networksession.go b/thorlog/v3/networksession.go index 54e98ba..f1dcd49 100644 --- a/thorlog/v3/networksession.go +++ b/thorlog/v3/networksession.go @@ -11,7 +11,9 @@ type NetworkSession struct { ClientType string `json:"client_type" textlog:"client_type"` Active time.Duration `json:"active" textlog:"active"` Idle time.Duration `json:"idle" textlog:"idle"` - NumOpens int `json:"num_opens" textlog:"num_opens"` + // Established is the absolute time when the session was opened. + Established time.Time `json:"established,omitzero" textlog:"established,omitempty"` + NumOpens int `json:"num_opens" textlog:"num_opens"` } func (NetworkSession) observed() {} diff --git a/thorlog/v3/registry.go b/thorlog/v3/registry.go index d1fe5c6..ec7c52a 100644 --- a/thorlog/v3/registry.go +++ b/thorlog/v3/registry.go @@ -81,6 +81,8 @@ type RegisteredDebugger struct { jsonlog.ObjectHeader Executable string `json:"executable" textlog:"file"` Debugger string `json:"debugger" textlog:"element"` + // Modified is the last write time of the Image File Execution Options key that registers the debugger. + Modified time.Time `json:"modified,omitzero" textlog:"modified,omitempty"` } func (RegisteredDebugger) observed() {} diff --git a/thorlog/v3/users.go b/thorlog/v3/users.go index 3321b1a..9ff2ff4 100644 --- a/thorlog/v3/users.go +++ b/thorlog/v3/users.go @@ -13,6 +13,9 @@ type LoggedInUser struct { Server string `json:"server,omitempty" textlog:"server,omitempty"` Domain string `json:"domain,omitempty" textlog:"domain,omitempty"` OtherDomains string `json:"other_domains,omitempty" textlog:"other_domains,omitempty"` + + // LogonTime is the time when the user logged on, if it is known. + LogonTime time.Time `json:"logon_time,omitzero" textlog:"logon_time,omitempty"` } func (LoggedInUser) observed() {} @@ -65,6 +68,9 @@ type UnixUser struct { Shell string `json:"shell" textlog:"shell"` Crontab string `json:"crontab" textlog:"-"` AccessFiles []string `json:"access_files" textlog:"-" jsonschema:"nullable"` + // PasswordChanged is the day on which the user's password was last changed, + // taken from /etc/shadow. It has a granularity of one day. + PasswordChanged time.Time `json:"password_changed,omitzero" textlog:"password_changed,omitempty"` } func (UnixUser) observed() {}