summaryrefslogtreecommitdiff
path: root/readme.md
diff options
context:
space:
mode:
authorliuwentan <[email protected]>2023-07-05 10:16:32 +0800
committerliuwentan <[email protected]>2023-07-05 10:16:32 +0800
commit69ea78debb2c75010a95d95d5e99bdf5ea525793 (patch)
tree03fa8ac93b2ef93659a7b6190e0b7ac57236036d /readme.md
parente5c020453e64bd6c212519a888b9fe936eadfb99 (diff)
unfinished work
Diffstat (limited to 'readme.md')
-rw-r--r--readme.md23
1 files changed, 9 insertions, 14 deletions
diff --git a/readme.md b/readme.md
index ba92dfd..0b72b2d 100644
--- a/readme.md
+++ b/readme.md
@@ -2,7 +2,6 @@
<img src="./docs/imgs/maat_logo.png" height="40px" alt="swarmkv logo"/>
</h1>
-
**Unified description framework for network flow processing configuration**
## Origin
@@ -13,15 +12,14 @@ The Maat framework abstracts the configuration in network flow processing. It su
Maat supports three configuration loading modes.
-* Redis mode(for production): the data source is usually a relational database, such as Oracle, MySQL.
-* JSON File mode(for production and debugging)
-* IRIS File mode(for troubleshooting)
+* **Redis mode**(for production): the data source is usually a relational database, such as Oracle, MySQL.
+* **JSON File mode**(for production and debugging)
+* **IRIS File mode**(for troubleshooting)
-Note: Redis mode and JSON File mode support configuration dynamic loading
+**Note**: Redis mode and JSON File mode support configuration dynamic loading
Maat is used as a dynamic library by applications and it's API is defined in the header file(maat.h).
-
## Building
```shell
mkdir build && cd build
@@ -30,15 +28,11 @@ make
make install
```
-dynamic lib `./build/src/libmaat4.so`
-
-static lib `./build/src/libmaat4.a`
-
## Sample
A complete use case consists of three parts
-* table schema: define how to parse rule in different table, that is specify what each column in a table represents.
-* rule: different types of rules are stored in tables of the corresponding type.
-* scanning API: used by application to find whether scan data has hit loaded rules.
+* **table schema**: define how to parse rule in different table, that is specify what each column in a table represents.
+* **rule**: different types of rules are stored in tables of the corresponding type.
+* **scanning API**: used by application to find whether scan data has hit loaded rules.
### 1. table schema
@@ -138,6 +132,7 @@ Rules are stored in a json file(such as maat_json.json), which is loaded when ma
}
```
+### 3. scanning API
Given an example for how to use maat API (JSON File mode)
```C
#include <assert.h>
@@ -175,7 +170,7 @@ int main()
const char *scan_data = "Hello Maat, nice to meet you";
/**
- * Becase maat instance has loaded rule in table_inf.conf which keywords is "Hello Maat",
+ * Becase maat instance has loaded rule in table_info.conf which keywords is "Hello Maat",
so maat_scan_string should return hit flag and rule's compile_id stored in results array.
*/
int ret = maat_scan_string(maat_instance, table_id, scan_data, strlen(scan_data),