gofalcon unmarshals events with missing timestamp fields as default value in struct

Expected behavior

In the streaming_models.EventItem model struct returned from gofalcon client, the client should represent optional/missing fields in the REST endpoint response as nil by using a pointer type in the field.

Observed behavior

EventItem treats some fields as always present in the response, when they are actually optional. I am not sure this is a complete list but the following appear to fall under this condition:

UTCTimestamp
ProcessStartTime
ProcessEndTime
StartTimestamp
EndTimestamp
Several fields in nested structs contain a Timestamp

These fields may or may not appear in a response JSON, depending on the type of event returned.

Problem

An application using gofalcon receives the data from the stream.Events channel as an unmarshaled streaming_models.Event (which contains a streaming_models.EventItem). Timestamp fields that are missing are unmarshalled as the default value (0). At that point, it is not possible to tell whether the timestamp field set to 0 was actually present in the REST endpoint response, or whether it was missing.

Proposed Change

The client returned EventItem struct should accurately reflect the contents of the JSON response. This can be achieved by changing the field types to a pointer. E.g.:

type EventItem Struct {
    ...
    UTCTimestamp *uint64 `json:"UTCTimestamp,omitempty"`
    ...

For example, the "RemoteResponseSessionStartEvent" event type does not return a UTCTimestamp in the JSON response so having this field set to nil in that case would more accurately reflect the API response.

CrowdStrike / gofalcon