feat: add additional timestamps

thorlog/v3/antivirus.go

@@ -1,6 +1,8 @@
 package thorlog
 
 import (
+	"time"
+
 	"github.com/NextronSystems/jsonlog"
 )
 
@@ -11,6 +13,9 @@ type AntiVirusProduct struct {
 	Status          string `json:"status" textlog:"status"`
 	SignatureStatus string `json:"signature_status" textlog:"signature_status"`
 	Path            string `json:"path" textlog:"path"`
+	// SignatureUpdated is the time when the product's signatures were last updated.
+	// It is only available for products that report this information.
+	SignatureUpdated time.Time `json:"signature_updated,omitzero" textlog:"signature_updated,omitempty"`
 }
 
 func (AntiVirusProduct) observed() {}
@@ -33,6 +38,10 @@ type AntiVirusExclude struct {
 
 	Type      string `json:"exclusion_type" textlog:"type"`
 	Exclusion string `json:"exclusion" textlog:"exclusion"`
+	// Modified is the last write time of the registry key that holds this exclusion.
+	// Since all exclusions of the same type share that key, this is the time when any
+	// exclusion of this type was last added or removed, not necessarily this one.
+	Modified time.Time `json:"modified,omitzero" textlog:"modified,omitempty"`
 }
 
 func (AntiVirusExclude) observed() {}

thorlog/v3/auditlog.go

@@ -1,12 +1,17 @@
 package thorlog
 
 import (
+	"time"
+
 	"github.com/NextronSystems/jsonlog"
 )
 
 type AuditLogEntry struct {
 	jsonlog.ObjectHeader
 
+	// Time when the audit log entry was recorded, taken from the record's
+	// audit(<seconds>.<milliseconds>:<serial>) header.
+	Time  time.Time    `json:"time" textlog:"time"`
 	Entry KeyValueList `json:"entry" textlog:"entry"`
 }
 

thorlog/v3/groupsxml.go

@@ -1,13 +1,18 @@
 package thorlog
 
 import (
+	"time"
+
 	"github.com/NextronSystems/jsonlog"
 )
 
 type GroupsXmlUser struct {
 	jsonlog.ObjectHeader
 	User     string `json:"user" textlog:"user"`
 	Password string `json:"password" textlog:"password"`
+	// Changed is the time when this entry was last modified, taken from the
+	// "changed" attribute of the corresponding element in the groups.xml file.
+	Changed time.Time `json:"changed,omitzero" textlog:"changed,omitempty"`
 }
 
 func (GroupsXmlUser) observed() {}

thorlog/v3/logline.go

@@ -1,6 +1,8 @@
 package thorlog
 
 import (
+	"time"
+
 	"github.com/NextronSystems/jsonlog"
 )
 
@@ -9,6 +11,8 @@ type LogLine struct {
 
 	LineIndex uint64 `json:"line_index" textlog:"-"`
 	Line      string `json:"line" textlog:"line"`
+	// Time contained in the log line, if the line has a timestamp that could be parsed.
+	Time time.Time `json:"time,omitzero" textlog:"time,omitempty"`
 }
 
 func (LogLine) observed() {}

thorlog/v3/networksession.go

@@ -11,7 +11,9 @@ type NetworkSession struct {
 	ClientType string        `json:"client_type" textlog:"client_type"`
 	Active     time.Duration `json:"active" textlog:"active"`
 	Idle       time.Duration `json:"idle" textlog:"idle"`
-	NumOpens   int           `json:"num_opens" textlog:"num_opens"`
+	// Established is the absolute time when the session was opened.
+	Established time.Time `json:"established,omitzero" textlog:"established,omitempty"`
+	NumOpens    int       `json:"num_opens" textlog:"num_opens"`
 }
 
 func (NetworkSession) observed() {}

thorlog/v3/registry.go

@@ -81,6 +81,8 @@ type RegisteredDebugger struct {
 	jsonlog.ObjectHeader
 	Executable string `json:"executable" textlog:"file"`
 	Debugger   string `json:"debugger" textlog:"element"`
+	// Modified is the last write time of the Image File Execution Options key that registers the debugger.
+	Modified time.Time `json:"modified,omitzero" textlog:"modified,omitempty"`
 }
 
 func (RegisteredDebugger) observed() {}

thorlog/v3/users.go

@@ -13,6 +13,9 @@ type LoggedInUser struct {
 	Server       string `json:"server,omitempty" textlog:"server,omitempty"`
 	Domain       string `json:"domain,omitempty" textlog:"domain,omitempty"`
 	OtherDomains string `json:"other_domains,omitempty" textlog:"other_domains,omitempty"`
+
+	// LogonTime is the time when the user logged on, if it is known.
+	LogonTime time.Time `json:"logon_time,omitzero" textlog:"logon_time,omitempty"`
 }
 
 func (LoggedInUser) observed() {}
@@ -65,6 +68,9 @@ type UnixUser struct {
 	Shell       string   `json:"shell" textlog:"shell"`
 	Crontab     string   `json:"crontab" textlog:"-"`
 	AccessFiles []string `json:"access_files" textlog:"-" jsonschema:"nullable"`
+	// PasswordChanged is the day on which the user's password was last changed,
+	// taken from /etc/shadow. It has a granularity of one day.
+	PasswordChanged time.Time `json:"password_changed,omitzero" textlog:"password_changed,omitempty"`
 }
 
 func (UnixUser) observed() {}