SYMBOL INDEX (414 symbols across 100 files)

FILE: unit_tests/engine/test_add_source.cpp
  class test_ruleset_factory (line 30) | class test_ruleset_factory : public evttype_index_ruleset_factory {
    method test_ruleset_factory (line 32) | explicit test_ruleset_factory(std::shared_ptr<sinsp_filter_factory> fa...
    method new_ruleset (line 39) | inline std::shared_ptr<filter_ruleset> new_ruleset() override { return...
  function TEST (line 45) | TEST(AddSource, basic) {

FILE: unit_tests/engine/test_alt_rule_loader.cpp
  type test_object_info (line 38) | struct test_object_info {
  type test_compile_output (line 43) | struct test_compile_output : public rule_loader::compile_output {
    method test_compile_output (line 44) | test_compile_output() = default;
    method clone (line 46) | virtual std::unique_ptr<compile_output> clone() const override {
  class test_compiler (line 53) | class test_compiler : public rule_loader::compiler {
    method test_compiler (line 55) | test_compiler() = default;
    method new_compile_output (line 58) | std::unique_ptr<rule_loader::compile_output> new_compile_output() over...
  class test_collector (line 67) | class test_collector : public rule_loader::collector {
    method test_collector (line 69) | test_collector() = default;
  class test_reader (line 75) | class test_reader : public rule_loader::reader {
    method test_reader (line 77) | test_reader() = default;
    method create_context (line 81) | rule_loader::context create_context(const YAML::Node& item,
    method read_item (line 89) | void read_item(rule_loader::configuration& cfg,
  class test_ruleset (line 114) | class test_ruleset : public evttype_index_ruleset {
    method test_ruleset (line 116) | explicit test_ruleset(std::shared_ptr<sinsp_filter_factory> factory):
    method add_compile_output (line 120) | void add_compile_output(const rule_loader::compile_output& compile_out...
  class test_ruleset_factory (line 138) | class test_ruleset_factory : public filter_ruleset_factory {
    method test_ruleset_factory (line 140) | explicit test_ruleset_factory(std::shared_ptr<sinsp_filter_factory> fa...
    method new_ruleset (line 145) | inline std::shared_ptr<filter_ruleset> new_ruleset() override {
  function create_configuration (line 208) | static std::shared_ptr<rule_loader::configuration> create_configuration(
  function load_rules (line 229) | static void load_rules(sinsp& inspector,
  function TEST (line 247) | TEST(engine_loader_alt_loader, load_rules) {
  function TEST (line 268) | TEST(engine_loader_alt_loader, pass_compile_output_to_ruleset) {
  function TEST (line 291) | TEST(engine_loader_alt_loader, falco_engine_alternate_loader) {
  function TEST (line 328) | TEST(engine_loader_alt_loader, clone_compile_output) {

FILE: unit_tests/engine/test_enable_rule.cpp
  function TEST_F (line 83) | TEST_F(test_falco_engine, enable_rule_name) {
  function TEST_F (line 119) | TEST_F(test_falco_engine, enable_rule_tags) {
  function TEST_F (line 146) | TEST_F(test_falco_engine, enable_disabled_rule_by_tag) {
  function TEST_F (line 161) | TEST_F(test_falco_engine, enable_rule_id) {
  function TEST_F (line 201) | TEST_F(test_falco_engine, enable_rule_name_exact) {
  function TEST_F (line 243) | TEST_F(test_falco_engine, enable_rule_name_wildcard) {

FILE: unit_tests/engine/test_extra_output.cpp
  function TEST_F (line 22) | TEST_F(test_falco_engine, extra_format_all) {
  function TEST_F (line 38) | TEST_F(test_falco_engine, extra_format_by_rule) {
  function TEST_F (line 60) | TEST_F(test_falco_engine, extra_format_by_tag_rule) {
  function TEST_F (line 95) | TEST_F(test_falco_engine, extra_format_empty_container_info) {
  function TEST_F (line 111) | TEST_F(test_falco_engine, extra_fields_all) {

FILE: unit_tests/engine/test_falco_utils.cpp
  function TEST (line 21) | TEST(FalcoUtils, is_unix_scheme) {
  function TEST (line 40) | TEST(FalcoUtils, parse_prometheus_interval) {
  function TEST (line 77) | TEST(FalcoUtils, sanitize_rule_name) {
  function TEST (line 86) | TEST(FalcoUtils, matches_wildcard) {

FILE: unit_tests/engine/test_filter_details_resolver.cpp
  function TEST (line 21) | TEST(DetailsResolver, resolve_ast) {

FILE: unit_tests/engine/test_filter_macro_resolver.cpp
  function find_value (line 23) | static std::vector<filter_macro_resolver::value_info>::const_iterator fi...
  function TEST (line 36) | TEST(MacroResolver, should_resolve_macros_on_a_filter_AST) {
  function TEST (line 76) | TEST(MacroResolver, should_resolve_macros_on_a_filter_AST_single_node) {
  function TEST (line 108) | TEST(MacroResolver, should_resolve_macros_on_a_filter_AST_multiple_macro...
  function TEST (line 155) | TEST(MacroResolver, should_resolve_macros_on_a_filter_AST_nested_macros) {
  function TEST (line 210) | TEST(MacroResolver, should_find_unknown_macros) {
  function TEST (line 229) | TEST(MacroResolver, should_find_unknown_nested_macros) {
  function TEST (line 257) | TEST(MacroResolver, should_undefine_macro) {
  function TEST (line 287) | TEST(MacroResolver, should_clone_macro_AST) {

FILE: unit_tests/engine/test_filter_warning_resolver.cpp
  function warns (line 22) | static bool warns(const std::string& condition) {
  function TEST (line 30) | TEST(WarningResolver, warnings_in_filtering_conditions) {

FILE: unit_tests/engine/test_plugin_requirements.cpp
  function check_requirements (line 22) | static bool check_requirements(std::string& err,
  function TEST (line 35) | TEST(PluginRequirements, check_plugin_requirements_success) {
  function TEST (line 128) | TEST(PluginRequirements, check_plugin_requirements_reject) {

FILE: unit_tests/engine/test_rule_loader.cpp
  function TEST_F (line 12) | TEST_F(test_falco_engine, list_append) {
  function TEST_F (line 36) | TEST_F(test_falco_engine, condition_append) {
  function TEST_F (line 62) | TEST_F(test_falco_engine, rule_override_append) {
  function TEST_F (line 98) | TEST_F(test_falco_engine, rule_append) {
  function TEST_F (line 120) | TEST_F(test_falco_engine, rule_override_replace) {
  function TEST_F (line 151) | TEST_F(test_falco_engine, rule_override_append_replace) {
  function TEST_F (line 187) | TEST_F(test_falco_engine, rule_incorrect_override_type) {
  function TEST_F (line 212) | TEST_F(test_falco_engine, rule_incorrect_append_override) {
  function TEST_F (line 238) | TEST_F(test_falco_engine, macro_override_append_before_macro_definition) {
  function TEST_F (line 263) | TEST_F(test_falco_engine, macro_override_replace_before_macro_definition) {
  function TEST_F (line 288) | TEST_F(test_falco_engine, macro_append_before_macro_definition) {
  function TEST_F (line 312) | TEST_F(test_falco_engine, macro_override_append_after_macro_definition) {
  function TEST_F (line 338) | TEST_F(test_falco_engine, macro_append_after_macro_definition) {
  function TEST_F (line 363) | TEST_F(test_falco_engine, rule_override_append_before_rule_definition) {
  function TEST_F (line 383) | TEST_F(test_falco_engine, rule_override_replace_before_rule_definition) {
  function TEST_F (line 403) | TEST_F(test_falco_engine, rule_append_before_rule_definition) {
  function TEST_F (line 422) | TEST_F(test_falco_engine, rule_override_append_after_rule_definition) {
  function TEST_F (line 442) | TEST_F(test_falco_engine, rule_append_after_rule_definition) {
  function TEST_F (line 461) | TEST_F(test_falco_engine, list_override_append_wrong_key) {
  function TEST_F (line 490) | TEST_F(test_falco_engine, list_override_append_before_list_definition) {
  function TEST_F (line 514) | TEST_F(test_falco_engine, list_override_replace_before_list_definition) {
  function TEST_F (line 539) | TEST_F(test_falco_engine, list_append_before_list_definition) {
  function TEST_F (line 562) | TEST_F(test_falco_engine, list_override_append_after_list_definition) {
  function TEST_F (line 586) | TEST_F(test_falco_engine, list_append_after_list_definition) {
  function TEST_F (line 608) | TEST_F(test_falco_engine, rule_override_without_field) {
  function TEST_F (line 629) | TEST_F(test_falco_engine, rule_override_extra_field) {
  function TEST_F (line 651) | TEST_F(test_falco_engine, missing_enabled_key_with_override) {
  function TEST_F (line 675) | TEST_F(test_falco_engine, rule_override_with_enabled) {
  function TEST_F (line 701) | TEST_F(test_falco_engine, rule_override_exceptions_required_fields) {
  function TEST_F (line 738) | TEST_F(test_falco_engine, rule_not_enabled) {
  function TEST_F (line 754) | TEST_F(test_falco_engine, rule_enabled_warning) {
  function TEST_F (line 775) | TEST_F(test_falco_engine, rule_enabled_is_ignored_by_append) {
  function TEST_F (line 798) | TEST_F(test_falco_engine, rewrite_rule) {
  function TEST_F (line 824) | TEST_F(test_falco_engine, required_engine_version_semver) {
  function TEST_F (line 842) | TEST_F(test_falco_engine, required_engine_version_not_semver) {
  function TEST_F (line 860) | TEST_F(test_falco_engine, required_engine_version_invalid) {
  function TEST_F (line 879) | TEST_F(test_falco_engine, list_value_with_escaping) {
  function TEST_F (line 909) | TEST_F(test_falco_engine, exceptions_condition) {
  function TEST_F (line 931) | TEST_F(test_falco_engine, macro_name_invalid) {
  function TEST_F (line 943) | TEST_F(test_falco_engine, list_name_invalid) {
  function TEST_F (line 965) | TEST_F(test_falco_engine, exceptions_append_no_values) {
  function TEST_F (line 991) | TEST_F(test_falco_engine, exceptions_override_no_values) {
  function TEST_F (line 1018) | TEST_F(test_falco_engine, exceptions_names_not_unique) {
  function TEST_F (line 1051) | TEST_F(test_falco_engine, exceptions_values_rhs_field_ambiguous) {
  function TEST_F (line 1069) | TEST_F(test_falco_engine, exceptions_values_rhs_field_ambiguous_quoted) {
  function TEST_F (line 1087) | TEST_F(test_falco_engine, exceptions_values_rhs_field_ambiguous_space_qu...
  function TEST_F (line 1105) | TEST_F(test_falco_engine, exceptions_values_rhs_transformer) {
  function TEST_F (line 1121) | TEST_F(test_falco_engine, exceptions_values_transformer_value_quoted) {
  function TEST_F (line 1137) | TEST_F(test_falco_engine, exceptions_values_transformer_space) {
  function TEST_F (line 1156) | TEST_F(test_falco_engine, exceptions_values_transformer_space_quoted) {
  function TEST_F (line 1175) | TEST_F(test_falco_engine, exceptions_fields_transformer) {
  function TEST_F (line 1192) | TEST_F(test_falco_engine, exceptions_fields_transformer_quoted) {
  function TEST_F (line 1209) | TEST_F(test_falco_engine, exceptions_fields_transformer_space_quoted) {
  function TEST_F (line 1226) | TEST_F(test_falco_engine, redefine_rule_different_source) {
  function TEST_F (line 1247) | TEST_F(test_falco_engine, append_across_sources) {
  function TEST_F (line 1269) | TEST_F(test_falco_engine, selective_replace_across_sources) {
  function TEST_F (line 1289) | TEST_F(test_falco_engine, empty_source_addl_rule) {
  function TEST_F (line 1310) | TEST_F(test_falco_engine, empty_string_source_addl_rule) {
  function TEST_F (line 1333) | TEST_F(test_falco_engine, rule_with_warn_evttypes) {
  function TEST_F (line 1347) | TEST_F(test_falco_engine, rule_with_skip_if_unknown_filter) {
  function TEST_F (line 1361) | TEST_F(test_falco_engine, override_replace_warn_evttypes) {
  function TEST_F (line 1380) | TEST_F(test_falco_engine, override_replace_capture) {
  function TEST_F (line 1398) | TEST_F(test_falco_engine, override_replace_tags) {
  function TEST_F (line 1419) | TEST_F(test_falco_engine, rule_unknown_key) {
  function TEST_F (line 1433) | TEST_F(test_falco_engine, list_unknown_key) {
  function TEST_F (line 1450) | TEST_F(test_falco_engine, macro_unknown_key) {
  function TEST_F (line 1467) | TEST_F(test_falco_engine, list_cross_type_key_priority) {
  function TEST_F (line 1487) | TEST_F(test_falco_engine, deprecated_field_in_output) {
  function TEST_F (line 1505) | TEST_F(test_falco_engine, no_deprecated_field_warning_in_output) {

FILE: unit_tests/engine/test_rulesets.cpp
  function create_factory (line 26) | static std::shared_ptr<sinsp_filter_factory> create_factory(sinsp* inspe...
  function create_ruleset (line 31) | static std::shared_ptr<filter_ruleset> create_ruleset(std::shared_ptr<si...
  function create_ast (line 35) | static std::shared_ptr<libsinsp::filter::ast::expr> create_ast(
  function create_filter (line 41) | static std::shared_ptr<sinsp_filter> create_filter(std::shared_ptr<sinsp...
  function TEST (line 47) | TEST(Ruleset, enable_disable_rules_using_names) {
  function TEST (line 139) | TEST(Ruleset, enable_disable_rules_using_tags) {

FILE: unit_tests/falco/app/actions/test_configure_interesting_sets.cpp
  function _order (line 40) | static std::set<std::string> _order(const strset_t& s) {
  function ruleset_from_filters (line 58) | static std::string ruleset_from_filters(const strset_t& filters) {
  function TEST_F (line 73) | TEST_F(test_falco_engine, engine_codes_syscalls_set) {
  function TEST_F (line 112) | TEST_F(test_falco_engine, preconditions_postconditions) {
  function TEST_F (line 141) | TEST_F(test_falco_engine, engine_codes_nonsyscalls_set) {
  function TEST_F (line 195) | TEST_F(test_falco_engine, selection_not_allevents) {
  function TEST_F (line 251) | TEST_F(test_falco_engine, selection_allevents) {
  function TEST_F (line 299) | TEST_F(test_falco_engine, selection_generic_evts) {
  function TEST_F (line 345) | TEST_F(test_falco_engine, selection_custom_base_set) {
  function TEST_F (line 450) | TEST_F(test_falco_engine, selection_custom_base_set_repair) {
  function TEST_F (line 491) | TEST_F(test_falco_engine, selection_empty_custom_base_set_repair) {
  function TEST_F (line 529) | TEST_F(test_falco_engine, selection_base_syscalls_all) {
  function TEST (line 566) | TEST(ConfigureInterestingSets, ignored_set_expected_size) {

FILE: unit_tests/falco/app/actions/test_configure_syscall_buffer_num.cpp
  function TEST (line 20) | TEST(ActionConfigureSyscallBufferNum, variable_number_of_CPUs) {

FILE: unit_tests/falco/app/actions/test_load_config.cpp
  function TEST (line 22) | TEST(ActionLoadConfig, check_kmod_engine_config) {
  function TEST (line 41) | TEST(ActionLoadConfig, check_modern_engine_config) {

FILE: unit_tests/falco/app/actions/test_select_event_sources.cpp
  function TEST (line 20) | TEST(ActionSelectEventSources, pre_post_conditions) {

FILE: unit_tests/falco/test_atomic_signal_handler.cpp
  function TEST (line 29) | TEST(AtomicSignalHandler, lock_free_implementation) {
  function TEST (line 33) | TEST(AtomicSignalHandler, handle_once_wait_consistency) {
  function TEST (line 88) | TEST(AtomicSignalHandler, handle_and_reset) {

FILE: unit_tests/falco/test_capture.cpp
  function TEST (line 22) | TEST(Capture, generate_scap_file_path_realistic_scenario) {
  function TEST (line 36) | TEST(Capture, generate_scap_file_path_lexicographic_ordering) {
  function TEST (line 57) | TEST(Capture, generate_scap_file_path_empty_prefix) {
  function TEST (line 68) | TEST(Capture, capture_config_disabled_by_default) {
  function TEST (line 84) | TEST(Capture, capture_config_enabled_rules_mode) {
  function TEST (line 103) | TEST(Capture, capture_config_enabled_all_rules_mode) {
  function TEST (line 122) | TEST(Capture, capture_config_invalid_mode) {

FILE: unit_tests/falco/test_configuration.cpp
  function TEST (line 34) | TEST(Configuration, configuration_exceptions) {
  function TEST (line 45) | TEST(Configuration, configuration_reload) {
  function TEST (line 57) | TEST(Configuration, read_yaml_fields) {
  function TEST (line 88) | TEST(Configuration, modify_yaml_fields) {
  function TEST (line 105) | TEST(Configuration, configuration_webserver_ip) {

FILE: unit_tests/falco/test_configuration_config_files.cpp
  function TEST (line 21) | TEST(Configuration, configuration_config_files_secondary_fail) {
  function TEST (line 55) | TEST(Configuration, configuration_config_files_ok) {
  function TEST (line 126) | TEST(Configuration, configuration_config_files_relative_main) {
  function TEST (line 192) | TEST(Configuration, configuration_config_files_override) {
  function TEST (line 247) | TEST(Configuration, configuration_config_files_sequence_strategy_default) {
  function TEST (line 307) | TEST(Configuration, configuration_config_files_sequence_strategy_append) {
  function TEST (line 368) | TEST(Configuration, configuration_config_files_sequence_strategy_overrid...
  function TEST (line 429) | TEST(Configuration, configuration_config_files_sequence_strategy_addonly) {
  function TEST (line 492) | TEST(Configuration, configuration_config_files_sequence_wrong_strategy) {
  function TEST (line 557) | TEST(Configuration, configuration_config_files_unexistent) {
  function TEST (line 586) | TEST(Configuration, configuration_config_files_scalar_config_files) {
  function TEST (line 631) | TEST(Configuration, configuration_config_files_empty_config_files) {
  function TEST (line 662) | TEST(Configuration, configuration_config_files_self) {
  function TEST (line 682) | TEST(Configuration, configuration_config_files_directory) {
  function TEST (line 754) | TEST(Configuration, configuration_config_files_cmdline) {

FILE: unit_tests/falco/test_configuration_env_vars.cpp
  function TEST (line 27) | TEST(Configuration, configuration_environment_variables) {

FILE: unit_tests/falco/test_configuration_output_options.cpp
  function TEST (line 21) | TEST(ConfigurationRuleOutputOptions, parse_yaml) {
  function TEST (line 82) | TEST(ConfigurationRuleOutputOptions, cli_options) {

FILE: unit_tests/falco/test_configuration_rule_selection.cpp
  function TEST (line 21) | TEST(ConfigurationRuleSelection, parse_yaml) {
  function TEST (line 51) | TEST(ConfigurationRuleSelection, cli_options) {
  function TEST (line 69) | TEST(ConfigurationRuleSelection, cli_options_object) {

FILE: unit_tests/falco/test_configuration_schema.cpp
  function TEST (line 32) | TEST(Configuration, schema_validate_config) {
  function TEST (line 43) | TEST(Configuration, schema_ok) {
  function TEST (line 56) | TEST(Configuration, schema_wrong_key) {
  function TEST (line 69) | TEST(Configuration, schema_wrong_type) {
  function TEST (line 80) | TEST(Configuration, schema_wrong_embedded_key) {
  function TEST (line 93) | TEST(Configuration, plugin_init_config) {
  function TEST (line 149) | TEST(Configuration, schema_yaml_helper_validator) {

FILE: unit_tests/test_falco_engine.h
  function class (line 11) | class test_falco_engine : public testing::Test {

FILE: userspace/engine/evttype_index_ruleset.h
  function tags (line 31) | struct evttype_index_wrapper {
  function libsinsp (line 34) | const libsinsp::events::set<ppm_sc_code> &sc_codes() { return m_sc_codes; }
  function libsinsp (line 35) | const libsinsp::events::set<ppm_event_code> &event_codes() { return m_ev...
  function class (line 43) | class evttype_index_ruleset : public indexable_ruleset<evttype_index_wra...

FILE: userspace/engine/falco_common.h
  function runtime_error (line 41) | struct falco_exception : std::runtime_error {
  function namespace (line 45) | namespace falco_common {
  type std (line 71) | typedef std::unordered_map<std::string, std::pair<std::string, bool>> ex...

FILE: userspace/engine/falco_engine.cpp
  function sinsp_version (line 84) | sinsp_version falco_engine::engine_version() {
  function fieldclass_key (line 114) | static std::string fieldclass_key(const sinsp_filter_factory::filter_fie...
  function sequence_to_json_array (line 465) | inline nlohmann::json sequence_to_json_array(const T &seq) {
  function stats_manager (line 847) | const stats_manager &falco_engine::get_rule_stats_manager() const {
  function check_plugin_requirement_alternatives (line 897) | static bool check_plugin_requirement_alternatives(

FILE: userspace/engine/falco_engine.h
  function class (line 45) | class falco_engine {

FILE: userspace/engine/falco_load_result.h
  type error_code (line 29) | enum error_code {
  function warning_code (line 51) | enum class warning_code {

FILE: userspace/engine/falco_rule.h
  type falco_list (line 30) | struct falco_list {
  type falco_macro (line 53) | struct falco_macro {
  type falco_rule (line 79) | struct falco_rule {

FILE: userspace/engine/falco_source.h
  type falco_source (line 28) | struct falco_source {
  function is_valid_lhs_field (line 57) | inline bool is_valid_lhs_field(const std::string& field) const {

FILE: userspace/engine/falco_utils.cpp
  type falco (line 59) | namespace falco {
    type utils (line 61) | namespace utils {
      function parse_prometheus_interval (line 63) | uint64_t parse_prometheus_interval(std::string interval_str) {
      function calculate_file_sha256sum (line 140) | std::string calculate_file_sha256sum(const std::string& filename) {
      function sanitize_rule_name (line 167) | std::string sanitize_rule_name(const std::string& name) {
      function wrap_text (line 177) | std::string wrap_text(const std::string& in, uint32_t indent, uint32...
      function hardware_concurrency (line 195) | uint32_t hardware_concurrency() {
      function readfile (line 200) | void readfile(const std::string& filename, std::string& data) {
      function matches_wildcard (line 215) | bool matches_wildcard(const std::string& pattern, const std::string&...
      type network (line 251) | namespace network {
        function is_unix_scheme (line 252) | bool is_unix_scheme(const std::string& url) {

FILE: userspace/engine/falco_utils.h
  function namespace (line 26) | namespace falco::utils {

FILE: userspace/engine/field_formatter.h
  type class (line 27) | enum class
  function class (line 32) | class FieldFormatter {
  function begin (line 73) | void begin() override;

FILE: userspace/engine/filter_details_resolver.cpp
  function get_field_name (line 24) | static inline std::string get_field_name(const std::string& name, const ...

FILE: userspace/engine/filter_details_resolver.h
  type filter_details (line 25) | struct filter_details {
  function class (line 44) | class filter_details_resolver {

FILE: userspace/engine/filter_macro_resolver.h
  function class (line 30) | class filter_macro_resolver {

FILE: userspace/engine/filter_ruleset.h
  function class (line 32) | class filter_ruleset {
  function class (line 215) | class filter_ruleset_factory {

FILE: userspace/engine/filter_warning_resolver.cpp
  function is_unsafe_field (line 26) | static inline bool is_unsafe_field(const std::string& f) {
  function is_equality_operator (line 31) | static inline bool is_equality_operator(const std::string& op) {

FILE: userspace/engine/filter_warning_resolver.h
  function class (line 32) | class filter_warning_resolver {

FILE: userspace/engine/formats.h
  function class (line 24) | class falco_formats {

FILE: userspace/engine/indexable_ruleset.h
  function clear (line 52) | void clear() override {
  function enabled_count (line 59) | uint64_t enabled_count(uint16_t ruleset_id) override {
  function enabled_evttypes (line 67) | void enabled_evttypes(std::set<uint16_t> &evttypes, uint16_t ruleset_id)...
  function virtual (line 88) | virtual void enable(const std::string &pattern,
  function virtual (line 94) | virtual void disable(const std::string &pattern,
  function enable_tags (line 100) | void enable_tags(const std::set<std::string> &tags, uint16_t ruleset_id)...
  function disable_tags (line 104) | void disable_tags(const std::set<std::string> &tags, uint16_t ruleset_id...
  function run (line 110) | bool run(sinsp_evt *evt, falco_rule &match, uint16_t ruleset_id) override {
  function run (line 118) | bool run(sinsp_evt *evt, std::vector<falco_rule> &matches, uint16_t rule...
  type std (line 126) | typedef std::list<std::shared_ptr<filter_wrapper>> filter_wrapper_list;
  function add_wrapper (line 130) | void add_wrapper(std::shared_ptr<filter_wrapper> wrap) { m_filters.inser...
  type std (line 135) | typedef std::function<void(const std::shared_ptr<filter_wrapper> &wrap)>...
  function iterate (line 136) | uint64_t iterate(filter_wrapper_func func) {
  function enable_disable_tags (line 205) | void enable_disable_tags(const std::set<std::string> &tags, bool enabled...
  function class (line 230) | class ruleset_filters {

FILE: userspace/engine/indexed_vector.h
  function virtual (line 54) | virtual inline void clear() {
  function virtual (line 72) | virtual inline size_t insert(const T& entry, const std::string& index) {
  function virtual (line 90) | virtual inline T* at(size_t id) const {
  function virtual (line 101) | virtual inline T* at(const std::string& index) const {

FILE: userspace/engine/logger.cpp
  function decode_sinsp_severity (line 26) | static sinsp_logger::severity decode_sinsp_severity(const std::string& s) {
  type tm (line 125) | struct tm
  type tm (line 130) | struct tm

FILE: userspace/engine/logger.h
  function class (line 25) | class falco_logger {

FILE: userspace/engine/output_format.h
  function output_format (line 20) | enum class output_format { TEXT, MARKDOWN, JSON }

FILE: userspace/engine/rule_loader.cpp
  type item_type (line 47) | enum item_type

FILE: userspace/engine/rule_loader.h
  function namespace (line 31) | namespace rule_loader {
  function warning (line 209) | struct deprecated_field_warning : warning {
  type error (line 233) | struct error {
  function class (line 249) | class rule_load_exception : public std::exception {
  function class (line 266) | class result : public falco::load_result {
  type plugin_version_info (line 370) | struct plugin_version_info {
  type list_info (line 403) | struct list_info {
  type macro_info (line 421) | struct macro_info {
  type rule_exception_info (line 440) | struct rule_exception_info {
  type rule_info (line 482) | struct rule_info {
  type rule_update_info (line 515) | struct rule_update_info {

FILE: userspace/engine/rule_loader_collector.cpp
  function is_operator_defined (line 34) | static inline bool is_operator_defined(const std::string& op) {
  function define_info (line 40) | static inline void define_info(indexed_vector<T>& infos, T& info, uint32...
  function append_info (line 54) | static inline void append_info(T* prev, U& info, uint32_t id) {
  function replace_info (line 59) | static inline void replace_info(T* prev, U& info, uint32_t id) {
  function validate_exception_info (line 63) | static void validate_exception_info(const falco_source* source,

FILE: userspace/engine/rule_loader_collector.h
  function namespace (line 24) | namespace rule_loader {

FILE: userspace/engine/rule_loader_compile_output.h
  function namespace (line 25) | namespace rule_loader {

FILE: userspace/engine/rule_loader_compiler.cpp
  function quote_item (line 47) | static void quote_item(std::string& e) {
  function paren_item (line 53) | static void paren_item(std::string& e) {
  function is_operator_for_list (line 59) | static inline bool is_operator_for_list(const std::string& op) {
  function is_format_valid (line 64) | static bool is_format_valid(const falco_source& source, std::string fmt,...
  function check_deprecated_fields_in_output (line 75) | static void check_deprecated_fields_in_output(const std::string& fmt,
  function build_rule_exception_infos (line 93) | static void build_rule_exception_infos(
  function resolve_list (line 175) | static bool resolve_list(std::string& cnd, const falco_list& list) {
  function resolve_macros (line 233) | static inline void resolve_macros(filter_macro_resolver& macro_resolver,
  function parse_condition (line 269) | static std::shared_ptr<ast::expr> parse_condition(std::string condition,
  function err_is_unknown_type_or_field (line 346) | static bool err_is_unknown_type_or_field(const std::string& err) {

FILE: userspace/engine/rule_loader_compiler.h
  function namespace (line 27) | namespace rule_loader {

FILE: userspace/engine/rule_loader_reader.cpp
  function decode_val_generic (line 52) | static void decode_val_generic(const YAML::Node& item,
  function decode_val_generic (line 84) | static void decode_val_generic(const YAML::Node& item,
  function decode_seq (line 146) | static void decode_seq(const YAML::Node& item,
  function decode_items (line 172) | static void decode_items(const YAML::Node& item,
  function decode_tags (line 183) | static void decode_tags(const YAML::Node& item, std::set<T>& out, const ...
  function decode_tags (line 192) | static void decode_tags(const YAML::Node& item,
  function decode_overrides (line 200) | static void decode_overrides(const YAML::Node& item,
  function decode_exception_info_entry (line 265) | static void decode_exception_info_entry(const YAML::Node& item,
  function decode_exception_fields (line 304) | static void decode_exception_fields(const YAML::Node& item,
  function decode_exception_comps (line 311) | static void decode_exception_comps(const YAML::Node& item,
  function decode_exception_values (line 319) | static void decode_exception_values(const YAML::Node& item,
  function read_rule_exceptions (line 327) | static void read_rule_exceptions(rule_loader::configuration& cfg,
  function read_rule_exceptions (line 396) | static void read_rule_exceptions(
  function warn_unknown_keys (line 407) | static void warn_unknown_keys(const YAML::Node& item,
  function check_update_expected (line 424) | inline static bool check_update_expected(std::set<std::string>& expected...

FILE: userspace/engine/rule_loader_reader.h
  function namespace (line 26) | namespace rule_loader {

FILE: userspace/engine/stats_manager.h
  function class (line 33) | class stats_manager {

FILE: userspace/engine/yaml_helper.h
  function class (line 46) | class yaml_visitor {
  function descend (line 66) | void descend(YAML::Node& target) {
  function class (line 81) | class yaml_helper {
  type config_files_strategy (line 167) | enum config_files_strategy
  function else (line 447) | else if(node.IsScalar()) {
  function namespace (line 455) | namespace YAML {

FILE: userspace/falco/app/actions/actions.h
  function namespace (line 23) | namespace falco {

FILE: userspace/falco/app/actions/configure_interesting_sets.cpp
  function extract_base_syscalls_names (line 26) | static void extract_base_syscalls_names(const std::unordered_set<std::st...
  function check_for_rules_unsupported_events (line 40) | static void check_for_rules_unsupported_events(
  function select_event_set (line 67) | static void select_event_set(falco::app::state& s,

FILE: userspace/falco/app/actions/create_signal_handlers.cpp
  function terminate_signal_handler (line 33) | static void terminate_signal_handler(int signal) {
  function reopen_outputs_signal_handler (line 37) | static void reopen_outputs_signal_handler(int signal) {
  function restart_signal_handler (line 41) | static void restart_signal_handler(int signal) {
  function create_handler (line 47) | bool create_handler(int sig, void (*func)(int), run_result& ret) {

FILE: userspace/falco/app/actions/event_formatter.cpp
  function is_flag_type (line 25) | static bool is_flag_type(ppm_param_type type) {
  type ppm_param_info (line 77) | struct ppm_param_info
  type ppm_param_info (line 131) | struct ppm_param_info

FILE: userspace/falco/app/actions/event_formatter.h
  type ppm_param_info (line 28) | struct ppm_param_info
  type ppm_event_info (line 29) | struct ppm_event_info
  function namespace (line 31) | namespace falco {

FILE: userspace/falco/app/actions/helpers.h
  function namespace (line 26) | namespace falco {

FILE: userspace/falco/app/actions/helpers_generic.cpp
  function format_two_columns (line 114) | static void format_two_columns(std::ostream& os, const std::string& l, c...

FILE: userspace/falco/app/actions/init_falco_engine.cpp
  function format_suggested_field (line 26) | static inline std::string format_suggested_field(const filtercheck_field...
  function add_suggested_output (line 38) | static void add_suggested_output(const falco::app::state& s,
  function configure_output_format (line 61) | void configure_output_format(falco::app::state& s) {
  function add_source_to_engine (line 106) | void add_source_to_engine(falco::app::state& s, const std::string& src) {

FILE: userspace/falco/app/actions/init_inspectors.cpp
  function init_syscall_inspector (line 29) | static void init_syscall_inspector(falco::app::state& s, std::shared_ptr...
  function populate_filterchecks (line 53) | static bool populate_filterchecks(const std::shared_ptr<sinsp>& inspector,

FILE: userspace/falco/app/actions/load_config.cpp
  function apply_deprecated_options (line 25) | static falco::app::run_result apply_deprecated_options(const falco::app:...

FILE: userspace/falco/app/actions/print_support.cpp
  function read_file (line 31) | static std::string read_file(const std::string& filename) {
  function get_sysinfo (line 39) | static int get_sysinfo(nlohmann::json& support) {
  function get_sysinfo (line 53) | static int get_sysinfo(nlohmann::json& support) {

FILE: userspace/falco/app/actions/print_syscall_events.cpp
  type events_by_category (line 27) | struct events_by_category {
    method add_event (line 33) | void add_event(ppm_event_code e, bool available, const std::string& na...
    method print_all (line 67) | void print_all(EventFormatter& formatter) {
  function get_event_entries_by_category (line 94) | static struct events_by_category get_event_entries_by_category(
  type events_by_category (line 131) | struct events_by_category
    method add_event (line 33) | void add_event(ppm_event_code e, bool available, const std::string& na...
    method print_all (line 67) | void print_all(EventFormatter& formatter) {

FILE: userspace/falco/app/actions/process_events.cpp
  class source_sync_context (line 45) | class source_sync_context {
    method source_sync_context (line 47) | explicit source_sync_context(falco::semaphore& s):
    method finish (line 52) | inline void finish() {
    method join (line 65) | inline void join() {
    method joined (line 77) | inline bool joined() { return m_joined.load(std::memory_order_seq_cst); }
    method finished (line 79) | inline bool finished() { return m_finished.load(std::memory_order_seq_...
  type live_context (line 90) | struct live_context {
  function do_inspect (line 104) | static falco::app::run_result do_inspect(
  function process_inspector_events (line 367) | static void process_inspector_events(
  function init_stats_writer (line 433) | static falco::app::run_result init_stats_writer(

FILE: userspace/falco/app/app.h
  function namespace (line 24) | namespace falco {

FILE: userspace/falco/app/options.cpp
  type falco (line 30) | namespace falco {
    type app (line 31) | namespace app {
      function parse_output_format (line 33) | static bool parse_output_format(const std::string &format_str,

FILE: userspace/falco/app/options.h
  function namespace (line 28) | namespace cxxopts {
  function namespace (line 32) | namespace falco {

FILE: userspace/falco/app/restart_handler.cpp
  type timeval (line 113) | struct timeval
  type inotify_event (line 114) | struct inotify_event

FILE: userspace/falco/app/restart_handler.h
  function namespace (line 26) | namespace falco {

FILE: userspace/falco/app/run_result.h
  function namespace (line 22) | namespace falco {

FILE: userspace/falco/app/signals.h
  function namespace (line 22) | namespace falco {

FILE: userspace/falco/app/state.h
  function namespace (line 37) | namespace falco {

FILE: userspace/falco/atomic_signal_handler.h
  function namespace (line 24) | namespace falco {

FILE: userspace/falco/configuration.cpp
  function config_loaded_res (line 107) | config_loaded_res falco_configuration::init_from_content(
  function config_loaded_res (line 124) | config_loaded_res falco_configuration::init_from_file(
  type stat (line 313) | struct stat
  function split (line 739) | static bool split(const std::string &str, char delim, std::pair<std::str...

FILE: userspace/falco/configuration.h
  type class (line 43) | enum class
  type class (line 45) | enum class
  type std (line 48) | typedef std::map<std::string, std::string> config_loaded_res;
  function class (line 50) | class falco_configuration {

FILE: userspace/falco/event_drops.h
  function syscall_evt_drop_action (line 30) | enum class syscall_evt_drop_action : uint8_t { DISREGARD = 0, LOG, ALERT...

FILE: userspace/falco/falco.cpp
  function display_fatal_err (line 26) | static void display_fatal_err(const std::string &&msg) {
  function falco_run (line 40) | int falco_run(int argc, char **argv, bool &restart) {
  function main (line 59) | int main(int argc, char **argv) {

FILE: userspace/falco/falco_metrics.cpp
  function convert_metric_to_text_prometheus_with_deprecation_notice (line 76) | static std::string convert_metric_to_text_prometheus_with_deprecation_no...

FILE: userspace/falco/falco_metrics.h
  function namespace (line 23) | namespace falco::app {
  function class (line 27) | class falco_metrics {

FILE: userspace/falco/falco_outputs.h
  function class (line 41) | class falco_outputs {

FILE: userspace/falco/falco_semaphore.h
  function namespace (line 22) | namespace falco {

FILE: userspace/falco/outputs.h
  function namespace (line 26) | namespace falco {

FILE: userspace/falco/outputs_file.h
  function namespace (line 24) | namespace falco {

FILE: userspace/falco/outputs_http.cpp
  function noop_write_callback (line 23) | static size_t noop_write_callback(void * /*contents*/,

FILE: userspace/falco/outputs_http.h
  function namespace (line 24) | namespace falco {

FILE: userspace/falco/outputs_program.h
  function namespace (line 22) | namespace falco {

FILE: userspace/falco/outputs_stdout.h
  function namespace (line 22) | namespace falco {

FILE: userspace/falco/outputs_syslog.h
  function namespace (line 22) | namespace falco {

FILE: userspace/falco/stats_writer.cpp
  function timer_handler (line 57) | static void timer_handler(int signum) {
  type sigaction (line 69) | struct sigaction
  type sigevent (line 78) | struct sigevent
  type itimerspec (line 90) | struct itimerspec
  type sigaction (line 91) | struct sigaction
  type sigevent (line 100) | struct sigevent
  type itimerspec (line 116) | struct itimerspec
  type sigaction (line 117) | struct sigaction
  type sigevent (line 126) | struct sigevent
  function add_netinfo_metrics_output_fields (line 279) | void add_netinfo_metrics_output_fields(nlohmann::json& output_fields,

FILE: userspace/falco/stats_writer.h
  function class (line 38) | class stats_writer {

FILE: userspace/falco/versions_info.cpp
  function get_driver_api_version (line 23) | static std::string get_driver_api_version(const std::shared_ptr<sinsp>& ...
  function get_driver_schema_version (line 40) | static inline std::string get_driver_schema_version(const std::shared_pt...

FILE: userspace/falco/versions_info.h
  function namespace (line 29) | namespace falco {

FILE: userspace/falco/watchdog.h
  function no_deadline (line 35) | const auto no_deadline = time_point{}
  function stop (line 53) | void stop() {
  function set_timeout (line 63) | inline void set_timeout(std::chrono::milliseconds timeout, _T payload) n...

FILE: userspace/falco/webserver.h
  function namespace (line 28) | namespace falco::app {
  function class (line 32) | class falco_webserver {