falcon.fbs

namespace falcon.core.protocol.fbs;

union EventData {
    ProcessStart,
    ProcessEnd,
    ProcessCreate,
    ProcessJoin,
    SocketEvent,
    FSync,
}

union SocketEventData {
    SocketConnect,
    SocketAccept,
    SocketSend,
    SocketReceive,
}

/**
 * Event types
 */
table ProcessStart {}
table ProcessEnd {}
table ProcessCreate {
    child_pid:uint;
}
table ProcessJoin {
    child_pid:uint;
}

table SocketConnect {}
table SocketAccept {}
table SocketSend {
    size:uint;
}
table SocketReceive {
    size:uint;
}

table FSync {}

/**
 * Main events
 */
table SocketEvent {
    source_port:ushort;
    destination_port:ushort;
    socket_family:int;
    socket_type:int;
    socket_from:string;
    socket_to:string;
    socket_id:string;
    event:SocketEventData;
}

table FalconEvent {
    id:string;
    user_time:long;
    kernel_time:long;
    type:ubyte;
    pid:uint;
    tid:uint;
    comm:string;
    host:string;
    event:EventData;
    extra_data:string;
}

root_type FalconEvent;