func LoadNormalizationConfig()

in aucoalesce/normalize.go [191:224]


func LoadNormalizationConfig(b []byte) (syscalls map[string]*Normalization, recordTypes map[string][]*Normalization, err error) {
	c := &NormalizationConfig{}
	dec := yaml.NewDecoder(bytes.NewReader(b))
	dec.KnownFields(true)
	if err := dec.Decode(c); err != nil {
		return nil, nil, err
	}

	syscalls = map[string]*Normalization{}
	recordTypes = map[string][]*Normalization{}

	for i := range c.Normalizations {
		norm := c.Normalizations[i]
		for _, syscall := range norm.Syscalls.Values {
			if _, found := syscalls[syscall]; found {
				return nil, nil, fmt.Errorf("duplication mappings for syscall %v", syscall)
			}
			syscalls[syscall] = &norm
		}
		for _, recordType := range norm.RecordTypes.Values {
			norms, found := recordTypes[recordType]
			if found {
				for _, n := range norms {
					if len(n.HasFields.Values) == 0 {
						return nil, nil, fmt.Errorf("duplication mappings for record_type %v without has_fields qualifier", recordType)
					}
				}
			}
			recordTypes[recordType] = append(norms, &norm)
		}
	}

	return syscalls, recordTypes, nil
}