Documentation
¶
Overview ¶
Package export writes ja4monitor connections to disk in JSON or CSV format. Used by the TUI E key and by the future `ja4monitor query` CLI.
JSON output is one object per connection, including the full fingerprint timeline. Good for SIEM ingestion and for sharing investigation context.
CSV output is one row per fingerprint event (denormalized), making it easy to pivot in a spreadsheet.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultPath ¶
DefaultPath returns a timestamped export filename in the current working directory. Uses millisecond precision so two exports in the same second (e.g., during an incident) don't collide on the O_EXCL open in Write().
Example: ./ja4monitor-export-20260409-144532-718.json
func Write ¶
func Write(path string, format Format, conns []*tracker.Connection) error
Write writes connections to the given path in the given format. Creates the file with 0644 permissions; fails if the file already exists to prevent accidental overwrite.
Returns a clear error if the directory is not writable so the TUI can surface it in the status bar instead of failing silently.
Types ¶
type Format ¶
type Format int
Format is either FormatJSON or FormatCSV.
func ParseFormat ¶
ParseFormat converts a single character ('j' or 'c') to a Format. Used by the TUI export prompt.
Source Files