model

package

Go to main page

Versions in this module

v0

v0.62.0-devel

Nov 29, 2024

v0.61.0-rc.8

Dec 20, 2024

v0.61.0-rc.7

Dec 17, 2024

v0.61.0-rc.6

Dec 16, 2024

v0.61.0-rc.5

Dec 12, 2024

v0.61.0-rc.4

Dec 9, 2024

v0.61.0-rc.3

Dec 6, 2024

v0.61.0-rc.2

Dec 4, 2024

v0.61.0-rc.1

Nov 29, 2024

v0.61.0-devel

Nov 1, 2024

v0.60.1

Dec 18, 2024

v0.60.1-rc.1

Dec 17, 2024

v0.60.0

Dec 13, 2024

Changes in this version

+ var PacketFilterMatching = &eval.OpOverrides

+ type ConnectEvent struct — darwin/amd64, linux/amd64

+ Addr IPPortContext

+ AddrFamily uint16

+ func (e *ConnectEvent) UnmarshalBinary(data []byte) (int, error)

type Event — darwin/amd64, linux/amd64

+ Connect ConnectEvent

+ RawPacket RawPacketEvent

+ func (ev *Event) GetConnectAddrFamily() uint16

+ func (ev *Event) GetConnectAddrIp() net.IPNet

+ func (ev *Event) GetConnectAddrPort() uint16

+ func (ev *Event) GetConnectRetval() int64

+ func (ev *Event) GetConnectServerAddrFamily() uint16

+ func (ev *Event) GetConnectServerAddrIp() net.IPNet

+ func (ev *Event) GetConnectServerAddrPort() uint16

+ func (ev *Event) GetExecIsExec() bool

+ func (ev *Event) GetExitIsExec() bool

+ func (ev *Event) GetPacketDestinationIp() net.IPNet

+ func (ev *Event) GetPacketDestinationPort() uint16

+ func (ev *Event) GetPacketDeviceIfname() string

+ func (ev *Event) GetPacketFilter() string

+ func (ev *Event) GetPacketL3Protocol() uint16

+ func (ev *Event) GetPacketL4Protocol() uint16

+ func (ev *Event) GetPacketSize() uint32

+ func (ev *Event) GetPacketSourceIp() net.IPNet

+ func (ev *Event) GetPacketSourcePort() uint16

+ func (ev *Event) GetPacketTlsVersion() uint16

+ func (ev *Event) GetProcessAncestorsIsExec() []bool

+ func (ev *Event) GetProcessAncestorsLength() int

+ func (ev *Event) GetProcessIsExec() bool

+ func (ev *Event) GetProcessParentIsExec() bool

+ func (ev *Event) GetPtraceTraceeAncestorsIsExec() []bool

+ func (ev *Event) GetPtraceTraceeAncestorsLength() int

+ func (ev *Event) GetPtraceTraceeIsExec() bool

+ func (ev *Event) GetPtraceTraceeParentIsExec() bool

+ func (ev *Event) GetSignalTargetAncestorsIsExec() []bool

+ func (ev *Event) GetSignalTargetAncestorsLength() int

+ func (ev *Event) GetSignalTargetIsExec() bool

+ func (ev *Event) GetSignalTargetParentIsExec() bool

type EventType

+ const ConnectEventType

+ const RawPacketEventType

type FakeFieldHandlers — darwin/amd64, linux/amd64

+ func (dfh *FakeFieldHandlers) ResolveProcessIsThread(ev *Event, e *Process) bool

type FieldHandlers — darwin/amd64, linux/amd64

+ ResolveProcessIsThread func(ev *Event, e *Process) bool

type Process — darwin/amd64, linux/amd64

+ IsExec bool

type ProcessAncestorsIterator

+ func (it *ProcessAncestorsIterator) At(ctx *eval.Context, regID eval.RegisterID, pos int) *ProcessCacheEntry

+ func (it *ProcessAncestorsIterator) Len(ctx *eval.Context) int

type ProcessCacheEntry — darwin/amd64, linux/amd64

+ func (pc *ProcessCacheEntry) SetExecParent(parent *ProcessCacheEntry)

+ func (pc *ProcessCacheEntry) SetForkParent(parent *ProcessCacheEntry)

+ type RawPacketEvent struct — darwin/amd64, linux/amd64

+ CaptureInfo gopacket.CaptureInfo

+ Data []byte

+ Filter string

+ TLSContext TLSContext

+ func (e *RawPacketEvent) UnmarshalBinary(data []byte) (int, error)

+ type TLSContext struct

+ Version uint16

+ type TLSVersion uint16

+ func (tls TLSVersion) String() string

v0.60.0-rc.9

Dec 9, 2024

v0.60.0-rc.8

Dec 6, 2024

v0.60.0-rc.6

Nov 27, 2024

v0.60.0-rc.5

Nov 20, 2024

v0.60.0-rc.4

Nov 12, 2024

v0.60.0-rc.3

Nov 6, 2024

v0.60.0-rc.2

Nov 4, 2024

v0.60.0-rc.1

Nov 1, 2024

v0.60.0-devel

Oct 7, 2024

v0.59.1

Dec 2, 2024

v0.59.1-rc.1

Nov 27, 2024

v0.59.0

Nov 6, 2024

Changes in this version

type ActionReport

+ IsResolved func() bool

type CgroupWriteEvent — darwin/amd64, linux/amd64

+ CGroupFlags uint32

+ Pid uint32

type NetworkContext

+ func (nc *NetworkContext) IsZero() bool

type PIDContext — darwin/amd64, linux/amd64

+ NSID uint64

v0.59.0-rc.7

Oct 30, 2024

v0.59.0-rc.6

Oct 25, 2024

v0.59.0-rc.5

Oct 21, 2024

v0.59.0-rc.4

Oct 16, 2024

v0.59.0-rc.3

Oct 14, 2024

v0.59.0-rc.2

Oct 11, 2024

v0.59.0-rc.1

Oct 7, 2024

v0.59.0-devel

Sep 9, 2024

v0.58.2

Oct 31, 2024

v0.58.2-rc.1

Oct 29, 2024

v0.58.1

Oct 24, 2024

v0.58.1-rc.1

Oct 24, 2024

v0.58.0

Oct 15, 2024

v0.58.0-rc.10

Oct 8, 2024

v0.58.0-rc.9

Oct 8, 2024

v0.58.0-rc.8

Oct 5, 2024

v0.58.0-rc.7

Oct 4, 2024

v0.58.0-rc.6

Oct 1, 2024

v0.58.0-rc.5

Sep 23, 2024

v0.58.0-rc.4

Sep 17, 2024

v0.58.0-rc.3

Sep 13, 2024

v0.58.0-rc.2

Sep 11, 2024

v0.58.0-rc.1

Sep 10, 2024

v0.58.0-devel

Aug 12, 2024

v0.57.2-rc.2

Sep 23, 2024

v0.57.2-rc.1

Sep 18, 2024

v0.57.1

Sep 17, 2024

v0.57.1-rc.2

Sep 16, 2024

v0.57.1-rc.1

Sep 12, 2024

v0.57.0

Sep 9, 2024

Changes in this version

+ const AuditUIDUnset — linux/amd64

type ActionReport

+ IsMatchingRule func(ruleID eval.RuleID) bool

+ type CGroupContext struct — darwin/amd64, linux/amd64

+ CGroupFile PathKey

+ CGroupFlags containerutils.CGroupFlags

+ CGroupID containerutils.CGroupID

+ CGroupManager string

+ func (e *CGroupContext) UnmarshalBinary(data []byte) (int, error)

type CgroupTracingEvent — darwin/amd64, linux/amd64

+ CGroupContext CGroupContext

+ type CgroupWriteEvent struct — darwin/amd64, linux/amd64

+ File FileEvent

+ func (e *CgroupWriteEvent) UnmarshalBinary(data []byte) (int, error)

type ContainerContext

+ ContainerID containerutils.ContainerID

+ Runtime string

type Credentials — darwin/amd64, linux/amd64

+ AUID uint32

type Event — darwin/amd64, linux/amd64

+ CGroupContext CGroupContext

+ CgroupWrite CgroupWriteEvent

+ LoginUIDWrite LoginUIDWriteEvent

+ func (ev *Event) GetCgroupFileInode() uint64

+ func (ev *Event) GetCgroupFileMountId() uint32

+ func (ev *Event) GetCgroupId() string

+ func (ev *Event) GetCgroupManager() string

+ func (ev *Event) GetContainerRuntime() string

+ func (ev *Event) GetExecAuid() uint32

+ func (ev *Event) GetExecCgroupFileInode() uint64

+ func (ev *Event) GetExecCgroupFileMountId() uint32

+ func (ev *Event) GetExecCgroupId() string

+ func (ev *Event) GetExecCgroupManager() string

+ func (ev *Event) GetExitAuid() uint32

+ func (ev *Event) GetExitCgroupFileInode() uint64

+ func (ev *Event) GetExitCgroupFileMountId() uint32

+ func (ev *Event) GetExitCgroupId() string

+ func (ev *Event) GetExitCgroupManager() string

+ func (ev *Event) GetProcessAncestorsAuid() []uint32

+ func (ev *Event) GetProcessAncestorsCgroupFileInode() []uint64

+ func (ev *Event) GetProcessAncestorsCgroupFileMountId() []uint32

+ func (ev *Event) GetProcessAncestorsCgroupId() []string

+ func (ev *Event) GetProcessAncestorsCgroupManager() []string

+ func (ev *Event) GetProcessAuid() uint32

+ func (ev *Event) GetProcessCgroupFileInode() uint64

+ func (ev *Event) GetProcessCgroupFileMountId() uint32

+ func (ev *Event) GetProcessCgroupId() string

+ func (ev *Event) GetProcessCgroupManager() string

+ func (ev *Event) GetProcessParentAuid() uint32

+ func (ev *Event) GetProcessParentCgroupFileInode() uint64

+ func (ev *Event) GetProcessParentCgroupFileMountId() uint32

+ func (ev *Event) GetProcessParentCgroupId() string

+ func (ev *Event) GetProcessParentCgroupManager() string

+ func (ev *Event) GetPtraceTraceeAncestorsAuid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsCgroupFileInode() []uint64

+ func (ev *Event) GetPtraceTraceeAncestorsCgroupFileMountId() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsCgroupId() []string

+ func (ev *Event) GetPtraceTraceeAncestorsCgroupManager() []string

+ func (ev *Event) GetPtraceTraceeAuid() uint32

+ func (ev *Event) GetPtraceTraceeCgroupFileInode() uint64

+ func (ev *Event) GetPtraceTraceeCgroupFileMountId() uint32

+ func (ev *Event) GetPtraceTraceeCgroupId() string

+ func (ev *Event) GetPtraceTraceeCgroupManager() string

+ func (ev *Event) GetPtraceTraceeParentAuid() uint32

+ func (ev *Event) GetPtraceTraceeParentCgroupFileInode() uint64

+ func (ev *Event) GetPtraceTraceeParentCgroupFileMountId() uint32

+ func (ev *Event) GetPtraceTraceeParentCgroupId() string

+ func (ev *Event) GetPtraceTraceeParentCgroupManager() string

+ func (ev *Event) GetSignalTargetAncestorsAuid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsCgroupFileInode() []uint64

+ func (ev *Event) GetSignalTargetAncestorsCgroupFileMountId() []uint32

+ func (ev *Event) GetSignalTargetAncestorsCgroupId() []string

+ func (ev *Event) GetSignalTargetAncestorsCgroupManager() []string

+ func (ev *Event) GetSignalTargetAuid() uint32

+ func (ev *Event) GetSignalTargetCgroupFileInode() uint64

+ func (ev *Event) GetSignalTargetCgroupFileMountId() uint32

+ func (ev *Event) GetSignalTargetCgroupId() string

+ func (ev *Event) GetSignalTargetCgroupManager() string

+ func (ev *Event) GetSignalTargetParentAuid() uint32

+ func (ev *Event) GetSignalTargetParentCgroupFileInode() uint64

+ func (ev *Event) GetSignalTargetParentCgroupFileMountId() uint32

+ func (ev *Event) GetSignalTargetParentCgroupId() string

+ func (ev *Event) GetSignalTargetParentCgroupManager() string

type EventType

+ const CgroupWriteEventType

+ const LoginUIDWriteEventType

type FakeFieldHandlers — darwin/amd64, linux/amd64, windows/amd64

+ func (dfh *FakeFieldHandlers) ResolveCGroupID(ev *Event, e *CGroupContext) string

+ func (dfh *FakeFieldHandlers) ResolveCGroupManager(ev *Event, e *CGroupContext) string

+ func (dfh *FakeFieldHandlers) ResolveContainerRuntime(ev *Event, e *ContainerContext) string

+ func (dfh *FakeFieldHandlers) ResolveProcessContainerID(ev *Event, e *Process) string

type FieldHandlers — darwin/amd64, linux/amd64

+ ResolveCGroupID func(ev *Event, e *CGroupContext) string

+ ResolveCGroupManager func(ev *Event, e *CGroupContext) string

+ ResolveContainerRuntime func(ev *Event, e *ContainerContext) string

+ ResolveProcessContainerID func(ev *Event, e *Process) string

+ type LoginUIDWriteEvent struct — darwin/amd64, linux/amd64

+ AUID uint32

+ func (e *LoginUIDWriteEvent) UnmarshalBinary(data []byte) (int, error)

type Model — darwin/amd64, linux/amd64, windows/amd64

+ func (m *Model) GetFieldRestrictions(field eval.Field) []eval.EventType

type Process — darwin/amd64, linux/amd64

+ CGroup CGroupContext

+ type SyscallDriftEventReason uint64

+ const ExecveReason

+ const ExitReason

+ const SyscallMonitorPeriodReason

+ func (r SyscallDriftEventReason) String() string

type SyscallsEvent — darwin/amd64, linux/amd64

+ EventReason SyscallDriftEventReason

v0.57.0-rc.7

Sep 5, 2024

v0.57.0-rc.6

Sep 3, 2024

v0.57.0-rc.5

Aug 28, 2024

v0.57.0-rc.4

Aug 22, 2024

v0.57.0-rc.3

Aug 20, 2024

v0.57.0-rc.2

Aug 14, 2024

v0.57.0-rc.1

Aug 12, 2024

v0.57.0-devel

Jul 15, 2024

v0.56.2

Sep 2, 2024

v0.56.2-rc.1

Aug 30, 2024

v0.56.1

Aug 29, 2024

v0.56.1-rc.1

Aug 23, 2024

v0.56.0

Aug 16, 2024

Changes in this version

type BaseEvent

+ Hostname string

type ChownEvent — darwin/amd64, linux/amd64

+ SyscallGID int64

+ SyscallPath string

+ SyscallUID int64

type Event — darwin/amd64, linux/amd64

+ OnDemand OnDemandEvent

+ func (ev *Event) GetChownSyscallGid() int

+ func (ev *Event) GetChownSyscallInt1() int

+ func (ev *Event) GetChownSyscallInt2() int

+ func (ev *Event) GetChownSyscallInt3() int

+ func (ev *Event) GetChownSyscallPath() string

+ func (ev *Event) GetChownSyscallStr1() string

+ func (ev *Event) GetChownSyscallStr2() string

+ func (ev *Event) GetChownSyscallStr3() string

+ func (ev *Event) GetChownSyscallUid() int

+ func (ev *Event) GetEventHostname() string

+ func (ev *Event) GetLinkSyscallDestinationPath() string

+ func (ev *Event) GetLinkSyscallInt1() int

+ func (ev *Event) GetLinkSyscallInt2() int

+ func (ev *Event) GetLinkSyscallInt3() int

+ func (ev *Event) GetLinkSyscallPath() string

+ func (ev *Event) GetLinkSyscallStr1() string

+ func (ev *Event) GetLinkSyscallStr2() string

+ func (ev *Event) GetLinkSyscallStr3() string

+ func (ev *Event) GetMountSyscallFsType() string

+ func (ev *Event) GetMountSyscallInt1() int

+ func (ev *Event) GetMountSyscallInt2() int

+ func (ev *Event) GetMountSyscallInt3() int

+ func (ev *Event) GetMountSyscallMountpointPath() string

+ func (ev *Event) GetMountSyscallSourcePath() string

+ func (ev *Event) GetMountSyscallStr1() string

+ func (ev *Event) GetMountSyscallStr2() string

+ func (ev *Event) GetMountSyscallStr3() string

+ func (ev *Event) GetOndemandArg1Str() string

+ func (ev *Event) GetOndemandArg1Uint() int

+ func (ev *Event) GetOndemandArg2Str() string

+ func (ev *Event) GetOndemandArg2Uint() int

+ func (ev *Event) GetOndemandArg3Str() string

+ func (ev *Event) GetOndemandArg3Uint() int

+ func (ev *Event) GetOndemandArg4Str() string

+ func (ev *Event) GetOndemandArg4Uint() int

+ func (ev *Event) GetOndemandName() string

+ func (ev *Event) GetOpenSyscallFlags() int

+ func (ev *Event) GetOpenSyscallInt1() int

+ func (ev *Event) GetOpenSyscallInt2() int

+ func (ev *Event) GetOpenSyscallInt3() int

+ func (ev *Event) GetOpenSyscallMode() int

+ func (ev *Event) GetOpenSyscallPath() string

+ func (ev *Event) GetOpenSyscallStr1() string

+ func (ev *Event) GetOpenSyscallStr2() string

+ func (ev *Event) GetOpenSyscallStr3() string

+ func (ev *Event) GetRenameSyscallDestinationPath() string

+ func (ev *Event) GetRenameSyscallInt1() int

+ func (ev *Event) GetRenameSyscallInt2() int

+ func (ev *Event) GetRenameSyscallInt3() int

+ func (ev *Event) GetRenameSyscallPath() string

+ func (ev *Event) GetRenameSyscallStr1() string

+ func (ev *Event) GetRenameSyscallStr2() string

+ func (ev *Event) GetRenameSyscallStr3() string

+ func (ev *Event) GetUnlinkSyscallDirfd() int

+ func (ev *Event) GetUnlinkSyscallFlags() int

+ func (ev *Event) GetUnlinkSyscallInt1() int

+ func (ev *Event) GetUnlinkSyscallInt2() int

+ func (ev *Event) GetUnlinkSyscallInt3() int

+ func (ev *Event) GetUnlinkSyscallPath() string

+ func (ev *Event) GetUnlinkSyscallStr1() string

+ func (ev *Event) GetUnlinkSyscallStr2() string

+ func (ev *Event) GetUnlinkSyscallStr3() string

+ func (ev *Event) GetUtimesSyscallInt1() int

+ func (ev *Event) GetUtimesSyscallInt2() int

+ func (ev *Event) GetUtimesSyscallInt3() int

+ func (ev *Event) GetUtimesSyscallPath() string

+ func (ev *Event) GetUtimesSyscallStr1() string

+ func (ev *Event) GetUtimesSyscallStr2() string

+ func (ev *Event) GetUtimesSyscallStr3() string

type EventType

+ const OnDemandEventType

type FakeFieldHandlers — darwin/amd64, linux/amd64

+ func (dfh *FakeFieldHandlers) ResolveHostname(ev *Event, e *BaseEvent) string

+ func (dfh *FakeFieldHandlers) ResolveOnDemandArg1Str(ev *Event, e *OnDemandEvent) string

+ func (dfh *FakeFieldHandlers) ResolveOnDemandArg1Uint(ev *Event, e *OnDemandEvent) int

+ func (dfh *FakeFieldHandlers) ResolveOnDemandArg2Str(ev *Event, e *OnDemandEvent) string

+ func (dfh *FakeFieldHandlers) ResolveOnDemandArg2Uint(ev *Event, e *OnDemandEvent) int

+ func (dfh *FakeFieldHandlers) ResolveOnDemandArg3Str(ev *Event, e *OnDemandEvent) string

+ func (dfh *FakeFieldHandlers) ResolveOnDemandArg3Uint(ev *Event, e *OnDemandEvent) int

+ func (dfh *FakeFieldHandlers) ResolveOnDemandArg4Str(ev *Event, e *OnDemandEvent) string

+ func (dfh *FakeFieldHandlers) ResolveOnDemandArg4Uint(ev *Event, e *OnDemandEvent) int

+ func (dfh *FakeFieldHandlers) ResolveOnDemandName(ev *Event, e *OnDemandEvent) string

type FieldHandlers — darwin/amd64, linux/amd64

+ ResolveHostname func(ev *Event, e *BaseEvent) string

+ ResolveOnDemandArg1Str func(ev *Event, e *OnDemandEvent) string

+ ResolveOnDemandArg1Uint func(ev *Event, e *OnDemandEvent) int

+ ResolveOnDemandArg2Str func(ev *Event, e *OnDemandEvent) string

+ ResolveOnDemandArg2Uint func(ev *Event, e *OnDemandEvent) int

+ ResolveOnDemandArg3Str func(ev *Event, e *OnDemandEvent) string

+ ResolveOnDemandArg3Uint func(ev *Event, e *OnDemandEvent) int

+ ResolveOnDemandArg4Str func(ev *Event, e *OnDemandEvent) string

+ ResolveOnDemandArg4Uint func(ev *Event, e *OnDemandEvent) int

+ ResolveOnDemandName func(ev *Event, e *OnDemandEvent) string

type LinkEvent — darwin/amd64, linux/amd64

+ SyscallDestinationPath string

+ SyscallPath string

type MountEvent — darwin/amd64, linux/amd64

+ SyscallFSType string

+ SyscallMountpointPath string

+ SyscallSourcePath string

+ type OnDemandEvent struct — darwin/amd64, linux/amd64

+ Arg1Str string

+ Arg1Uint uint64

+ Arg2Str string

+ Arg2Uint uint64

+ Arg3Str string

+ Arg3Uint uint64

+ Arg4Str string

+ Arg4Uint uint64

+ Data [256]byte

+ ID uint32

+ Name string

+ func (e *OnDemandEvent) UnmarshalBinary(data []byte) (int, error)

type OpenEvent — darwin/amd64, linux/amd64

+ SyscallFlags uint32

+ SyscallMode uint32

+ SyscallPath string

type ProcessCacheEntry

+ func (pc *ProcessCacheEntry) AppendReleaseCallback(callback func())

type Releasable

+ func (r *Releasable) AppendReleaseCallback(callback func())

type RenameEvent — darwin/amd64, linux/amd64

+ SyscallDestinationPath string

+ SyscallPath string

type UnlinkEvent — darwin/amd64, linux/amd64

+ SyscallDirFd uint64

+ SyscallFlags uint64

+ SyscallPath string

type UtimesEvent — darwin/amd64, linux/amd64

+ SyscallPath string

v0.56.0-rc.12

Aug 14, 2024

v0.56.0-rc.11

Aug 11, 2024

v0.56.0-rc.10

Aug 7, 2024

v0.56.0-rc.9

Aug 2, 2024

v0.56.0-rc.8

Jul 31, 2024

v0.56.0-rc.7

Jul 25, 2024

v0.56.0-rc.6

Jul 19, 2024

v0.56.0-rc.5

Jul 17, 2024

v0.56.0-rc.4

Jul 15, 2024

v0.56.0-rc.3

Jul 12, 2024

v0.56.0-rc.2

Jul 10, 2024

v0.56.0-rc.1

Jul 8, 2024

v0.56.0-devel

Jun 10, 2024

v0.55.3

Aug 1, 2024

v0.55.3-rc.1

Aug 1, 2024

v0.55.2

Jul 25, 2024

v0.55.2-rc.1

Jul 24, 2024

v0.55.1-rc.1

Jul 12, 2024

v0.55.0

Jul 11, 2024

Changes in this version

+ const IMDSAWSCloudProvider

+ const IMDSAzureCloudProvider

+ const IMDSGCPCloudProvider

+ const IMDSIBMCloudProvider

+ const IMDSOracleCloudProvider

+ const IMDSRequestType

+ const IMDSResponseType

+ const SIGKILL — windows/amd64

+ var AllEventFilteringProfileState = []EventFilteringProfileState

+ var MountOrigins = [...]string — darwin/amd64, linux/amd64

+ var MountSources = [...]string — darwin/amd64, linux/amd64

+ func MountOriginToString(origin MountOrigin) string — darwin/amd64, linux/amd64

+ func MountSourceToString(source MountSource) string — darwin/amd64, linux/amd64

+ type AWSIMDSEvent struct

+ IsIMDSv2 bool

+ SecurityCredentials AWSSecurityCredentials

+ type AWSSecurityCredentials struct

+ AccessKeyID string

+ Code string

+ Expiration time.Time

+ ExpirationRaw string

+ LastUpdated string

+ Type string

+ func (creds *AWSSecurityCredentials) UnmarshalBinary(body []byte) error

+ type ChangePermissionEvent struct — windows/amd64

+ NewSd string

+ ObjectName string

+ ObjectType string

+ OldSd string

+ UserDomain string

+ UserName string

type ChdirEvent — darwin/amd64, linux/amd64

+ SyscallPath string

type ChmodEvent — darwin/amd64, linux/amd64

+ SyscallMode int64

+ SyscallPath string

type Event — darwin/amd64, linux/amd64

+ IMDS IMDSEvent

+ func (ev *Event) GetChdirSyscallInt1() int

+ func (ev *Event) GetChdirSyscallInt2() int

+ func (ev *Event) GetChdirSyscallInt3() int

+ func (ev *Event) GetChdirSyscallPath() string

+ func (ev *Event) GetChdirSyscallStr1() string

+ func (ev *Event) GetChdirSyscallStr2() string

+ func (ev *Event) GetChdirSyscallStr3() string

+ func (ev *Event) GetChmodSyscallInt1() int

+ func (ev *Event) GetChmodSyscallInt2() int

+ func (ev *Event) GetChmodSyscallInt3() int

+ func (ev *Event) GetChmodSyscallMode() int

+ func (ev *Event) GetChmodSyscallPath() string

+ func (ev *Event) GetChmodSyscallStr1() string

+ func (ev *Event) GetChmodSyscallStr2() string

+ func (ev *Event) GetChmodSyscallStr3() string

+ func (ev *Event) GetExecCmdargv() []string

+ func (ev *Event) GetExecSyscallInt1() int

+ func (ev *Event) GetExecSyscallInt2() int

+ func (ev *Event) GetExecSyscallInt3() int

+ func (ev *Event) GetExecSyscallPath() string

+ func (ev *Event) GetExecSyscallStr1() string

+ func (ev *Event) GetExecSyscallStr2() string

+ func (ev *Event) GetExecSyscallStr3() string

+ func (ev *Event) GetExitCmdargv() []string

+ func (ev *Event) GetImdsAwsIsImdsV2() bool

+ func (ev *Event) GetImdsAwsSecurityCredentialsType() string

+ func (ev *Event) GetImdsCloudProvider() string

+ func (ev *Event) GetImdsHost() string

+ func (ev *Event) GetImdsServer() string

+ func (ev *Event) GetImdsType() string

+ func (ev *Event) GetImdsUrl() string

+ func (ev *Event) GetImdsUserAgent() string

+ func (ev *Event) GetProcessAncestorsCmdargv() []string

+ func (ev *Event) GetProcessCmdargv() []string

+ func (ev *Event) GetProcessParentCmdargv() []string

+ func (ev *Event) GetPtraceTraceeAncestorsCmdargv() []string

+ func (ev *Event) GetPtraceTraceeCmdargv() []string

+ func (ev *Event) GetPtraceTraceeParentCmdargv() []string

+ func (ev *Event) GetSignalTargetAncestorsCmdargv() []string

+ func (ev *Event) GetSignalTargetCmdargv() []string

+ func (ev *Event) GetSignalTargetParentCmdargv() []string

type Event — windows/amd64

+ ChangePermission ChangePermissionEvent

+ func (ev *Event) GetChangePermissionNewSd() string

+ func (ev *Event) GetChangePermissionOldSd() string

+ func (ev *Event) GetChangePermissionPath() string

+ func (ev *Event) GetChangePermissionType() string

+ func (ev *Event) GetChangePermissionUserDomain() string

+ func (ev *Event) GetChangePermissionUsername() string

+ func (ev *Event) GetDeleteFilePath() string

+ func (ev *Event) GetDeleteFilePathLength() int

+ func (ev *Event) GetRenameFileDestinationPath() string

+ func (ev *Event) GetRenameFileDestinationPathLength() int

+ func (ev *Event) GetRenameFilePath() string

+ func (ev *Event) GetRenameFilePathLength() int

+ func (ev *Event) GetWriteFilePath() string

+ func (ev *Event) GetWriteFilePathLength() int

+ type EventFilteringProfileState uint8

+ const AutoLearning

+ const NoProfile

+ const ProfileAtMaxSize

+ const StableEventType

+ const UnstableEventType

+ const WorkloadWarmup

+ func (efr EventFilteringProfileState) String() string

+ func (efr EventFilteringProfileState) ToTag() string

type EventType

+ const ChangePermissionEventType

+ const IMDSEventType

type ExecEvent — darwin/amd64, linux/amd64

+ SyscallPath string

type ExtraFieldHandlers — darwin/amd64, linux/amd64

+ ResolveAWSSecurityCredentials func(event *Event) []AWSSecurityCredentials

+ ResolveSyscallCtxArgs func(ev *Event, e *SyscallContext)

type FakeFieldHandlers — darwin/amd64, linux/amd64

+ func (dfh *FakeFieldHandlers) ResolveAWSSecurityCredentials(_ *Event) []AWSSecurityCredentials

+ func (dfh *FakeFieldHandlers) ResolveProcessCmdArgv(ev *Event, e *Process) []string

+ func (dfh *FakeFieldHandlers) ResolveSyscallCtxArgs(_ *Event, _ *SyscallContext)

+ func (dfh *FakeFieldHandlers) ResolveSyscallCtxArgsInt1(ev *Event, e *SyscallContext) int

+ func (dfh *FakeFieldHandlers) ResolveSyscallCtxArgsInt2(ev *Event, e *SyscallContext) int

+ func (dfh *FakeFieldHandlers) ResolveSyscallCtxArgsInt3(ev *Event, e *SyscallContext) int

+ func (dfh *FakeFieldHandlers) ResolveSyscallCtxArgsStr1(ev *Event, e *SyscallContext) string

+ func (dfh *FakeFieldHandlers) ResolveSyscallCtxArgsStr2(ev *Event, e *SyscallContext) string

+ func (dfh *FakeFieldHandlers) ResolveSyscallCtxArgsStr3(ev *Event, e *SyscallContext) string

type FakeFieldHandlers — windows/amd64

+ func (dfh *FakeFieldHandlers) ResolveFileUserPath(ev *Event, e *FimFileEvent) string

+ func (dfh *FakeFieldHandlers) ResolveNewSecurityDescriptor(ev *Event, e *ChangePermissionEvent) string

+ func (dfh *FakeFieldHandlers) ResolveOldSecurityDescriptor(ev *Event, e *ChangePermissionEvent) string

type FieldHandlers — darwin/amd64, linux/amd64

+ ResolveProcessCmdArgv func(ev *Event, e *Process) []string

+ ResolveSyscallCtxArgsInt1 func(ev *Event, e *SyscallContext) int

+ ResolveSyscallCtxArgsInt2 func(ev *Event, e *SyscallContext) int

+ ResolveSyscallCtxArgsInt3 func(ev *Event, e *SyscallContext) int

+ ResolveSyscallCtxArgsStr1 func(ev *Event, e *SyscallContext) string

+ ResolveSyscallCtxArgsStr2 func(ev *Event, e *SyscallContext) string

+ ResolveSyscallCtxArgsStr3 func(ev *Event, e *SyscallContext) string

type FieldHandlers — windows/amd64

+ ResolveFileUserPath func(ev *Event, e *FimFileEvent) string

+ ResolveNewSecurityDescriptor func(ev *Event, e *ChangePermissionEvent) string

+ ResolveOldSecurityDescriptor func(ev *Event, e *ChangePermissionEvent) string

type FileEvent — darwin/amd64, linux/amd64

+ MountOrigin uint32

+ MountPath string

+ MountSource uint32

type FimFileEvent — windows/amd64

+ UserPathnameStr string

+ type IMDSEvent struct

+ AWS AWSIMDSEvent

+ CloudProvider string

+ Host string

+ Server string

+ Type string

+ URL string

+ UserAgent string

+ func (e *IMDSEvent) UnmarshalBinary(data []byte) (int, error)

type Mount — darwin/amd64, linux/amd64

+ Origin uint32

+ type MountOrigin = uint32 — darwin/amd64, linux/amd64

+ const MountOriginEvent

+ const MountOriginProcfs

+ const MountOriginUnknown

+ const MountOriginUnshare

+ type MountSource = uint32 — darwin/amd64, linux/amd64

+ const MountSourceDevice

+ const MountSourceMountID

+ const MountSourceSnapshot

+ const MountSourceUnknown

type Process — darwin/amd64, linux/amd64

+ AWSSecurityCredentials []AWSSecurityCredentials

type SecurityProfileContext

+ EventTypeState EventFilteringProfileState

+ type SyscallContext struct — darwin/amd64, linux/amd64

+ ID uint32

+ IntArg1 int64

+ IntArg2 int64

+ IntArg3 int64

+ Resolved bool

+ StrArg1 string

+ StrArg2 string

+ StrArg3 string

+ func (e *SyscallContext) UnmarshalBinary(data []byte) (int, error)

v0.55.0-rc.11

Jul 5, 2024

v0.55.0-rc.10

Jul 3, 2024

v0.55.0-rc.9

Jun 26, 2024

v0.55.0-rc.8

Jun 19, 2024

v0.55.0-rc.7

Jun 18, 2024

v0.55.0-rc.6

Jun 14, 2024

v0.55.0-rc.5

Jun 12, 2024

v0.55.0-rc.4

Jun 11, 2024

v0.55.0-rc.3

Jun 7, 2024

v0.55.0-rc.2

Jun 5, 2024

v0.55.0-rc.1

Jun 3, 2024

v0.55.0-devel

May 6, 2024

v0.54.1-rc.2

Jun 14, 2024

v0.54.1-rc.1

Jun 11, 2024

v0.54.0

May 16, 2024

Changes in this version

+ const DeleteFileEventType

+ const WriteFileEventType

+ type DeleteFileEvent struct — windows/amd64

+ File FimFileEvent

type Event — windows/amd64

+ DeleteFile DeleteFileEvent

+ RenameFile RenameFileEvent

+ WriteFile WriteFileEvent

+ func (ev *Event) GetCreateFileDevicePath() string

+ func (ev *Event) GetCreateFileDevicePathLength() int

+ func (ev *Event) GetDeleteFileDevicePath() string

+ func (ev *Event) GetDeleteFileDevicePathLength() int

+ func (ev *Event) GetDeleteFileName() string

+ func (ev *Event) GetDeleteFileNameLength() int

+ func (ev *Event) GetRenameFileDestinationDevicePath() string

+ func (ev *Event) GetRenameFileDestinationDevicePathLength() int

+ func (ev *Event) GetRenameFileDestinationName() string

+ func (ev *Event) GetRenameFileDestinationNameLength() int

+ func (ev *Event) GetRenameFileDevicePath() string

+ func (ev *Event) GetRenameFileDevicePathLength() int

+ func (ev *Event) GetRenameFileName() string

+ func (ev *Event) GetRenameFileNameLength() int

+ func (ev *Event) GetWriteFileDevicePath() string

+ func (ev *Event) GetWriteFileDevicePathLength() int

+ func (ev *Event) GetWriteFileName() string

+ func (ev *Event) GetWriteFileNameLength() int

type FakeFieldHandlers — windows/amd64

+ func (dfh *FakeFieldHandlers) ResolveFimFileBasename(ev *Event, e *FimFileEvent) string

+ func (dfh *FakeFieldHandlers) ResolveFimFilePath(ev *Event, e *FimFileEvent) string

type FieldHandlers — windows/amd64

+ ResolveFimFileBasename func(ev *Event, e *FimFileEvent) string

+ ResolveFimFilePath func(ev *Event, e *FimFileEvent) string

type FileEvent — windows/amd64

+ FileObject uint64

+ type FimFileEvent struct — windows/amd64

+ BasenameStr string

+ FileObject uint64

+ PathnameStr string

+ type RenameFileEvent struct — windows/amd64

+ New FimFileEvent

+ Old FimFileEvent

+ type WriteFileEvent struct — windows/amd64

+ File FimFileEvent

v0.54.0-rc.5

May 16, 2024

v0.54.0-rc.4

May 14, 2024

v0.54.0-rc.3

May 8, 2024

v0.54.0-rc.2

May 2, 2024

v0.54.0-rc.1

Apr 29, 2024

v0.54.0-devel

Apr 1, 2024

v0.53.1-rc.3

Dec 12, 2024

v0.53.1-rc.2

Dec 3, 2024

v0.53.1-rc.1

Nov 27, 2024

v0.53.0

May 29, 2024

Changes in this version

+ const EventFlagsHasActiveActivityDump

type BaseEvent

+ Os string

type DNSEvent

+ func (de *DNSEvent) Matches(new *DNSEvent) bool

type Event — darwin/amd64, linux/amd64, windows/amd64

+ func (e *Event) HasActiveActivityDump() bool

+ func (ev *Event) GetEventOrigin() string

+ func (ev *Event) GetEventOs() string

type Syscall — linux/amd64

+ const SysCachestat

+ const SysFchmodat2

+ const SysFutexRequeue

+ const SysFutexWait

+ const SysFutexWake

+ const SysListmount

+ const SysLsmGetSelfAttr

+ const SysLsmListModules

+ const SysLsmSetSelfAttr

+ const SysMapShadowStack

+ const SysStatmount

v0.53.0-rc.8

Apr 26, 2024

v0.53.0-rc.7

Apr 24, 2024

v0.53.0-rc.6

Apr 18, 2024

v0.53.0-rc.5

Apr 17, 2024

v0.53.0-rc.4

Apr 8, 2024

v0.53.0-rc.3

Apr 2, 2024

v0.53.0-rc.2

Mar 28, 2024

v0.53.0-rc.1

Mar 25, 2024

v0.53.0-devel

Feb 23, 2024

v0.52.1

Apr 3, 2024

v0.52.1-rc.2

Apr 3, 2024

v0.52.1-rc.1

Mar 29, 2024

v0.52.0

Mar 20, 2024

Changes in this version

+ const CreateNewFileEventType

+ const CreateRegistryKeyEventType

+ const DeleteRegistryKeyEventType

+ const EventFlagsAnomalyDetectionEvent

+ const OpenRegistryKeyEventType

+ const SetRegistryKeyValueEventType

+ type ActionReport interface

+ ToJSON func() ([]byte, error)

type BaseEvent

+ ActionReports []ActionReport

+ Service string

+ type CreateNewFileEvent struct — windows/amd64

+ File FileEvent

+ type CreateRegistryKeyEvent struct — windows/amd64

+ Registry RegistryEvent

+ type DeleteRegistryKeyEvent struct — windows/amd64

+ Registry RegistryEvent

type Event — windows/amd64

+ CreateNewFile CreateNewFileEvent

+ CreateRegistryKey CreateRegistryKeyEvent

+ DeleteRegistryKey DeleteRegistryKeyEvent

+ OpenRegistryKey OpenRegistryKeyEvent

+ SetRegistryKeyValue SetRegistryKeyValueEvent

+ func NewFakeEvent() *Event

+ func (e *Event) GetActionReports() []ActionReport

+ func (e *Event) ResolveService() string

+ func (ev *Event) GetCreateFileName() string

+ func (ev *Event) GetCreateFileNameLength() int

+ func (ev *Event) GetCreateFilePath() string

+ func (ev *Event) GetCreateFilePathLength() int

+ func (ev *Event) GetCreateKeyRegistryKeyName() string

+ func (ev *Event) GetCreateKeyRegistryKeyNameLength() int

+ func (ev *Event) GetCreateKeyRegistryKeyPath() string

+ func (ev *Event) GetCreateKeyRegistryKeyPathLength() int

+ func (ev *Event) GetCreateRegistryKeyName() string

+ func (ev *Event) GetCreateRegistryKeyNameLength() int

+ func (ev *Event) GetCreateRegistryKeyPath() string

+ func (ev *Event) GetCreateRegistryKeyPathLength() int

+ func (ev *Event) GetDeleteKeyRegistryKeyName() string

+ func (ev *Event) GetDeleteKeyRegistryKeyNameLength() int

+ func (ev *Event) GetDeleteKeyRegistryKeyPath() string

+ func (ev *Event) GetDeleteKeyRegistryKeyPathLength() int

+ func (ev *Event) GetDeleteRegistryKeyName() string

+ func (ev *Event) GetDeleteRegistryKeyNameLength() int

+ func (ev *Event) GetDeleteRegistryKeyPath() string

+ func (ev *Event) GetDeleteRegistryKeyPathLength() int

+ func (ev *Event) GetEventService() string

+ func (ev *Event) GetExecUser() string

+ func (ev *Event) GetExecUserSid() string

+ func (ev *Event) GetExitUser() string

+ func (ev *Event) GetExitUserSid() string

+ func (ev *Event) GetOpenKeyRegistryKeyName() string

+ func (ev *Event) GetOpenKeyRegistryKeyNameLength() int

+ func (ev *Event) GetOpenKeyRegistryKeyPath() string

+ func (ev *Event) GetOpenKeyRegistryKeyPathLength() int

+ func (ev *Event) GetOpenRegistryKeyName() string

+ func (ev *Event) GetOpenRegistryKeyNameLength() int

+ func (ev *Event) GetOpenRegistryKeyPath() string

+ func (ev *Event) GetOpenRegistryKeyPathLength() int

+ func (ev *Event) GetProcessAncestorsUser() []string

+ func (ev *Event) GetProcessAncestorsUserSid() []string

+ func (ev *Event) GetProcessParentUser() string

+ func (ev *Event) GetProcessParentUserSid() string

+ func (ev *Event) GetProcessUser() string

+ func (ev *Event) GetProcessUserSid() string

+ func (ev *Event) GetSetKeyValueRegistryKeyName() string

+ func (ev *Event) GetSetKeyValueRegistryKeyNameLength() int

+ func (ev *Event) GetSetKeyValueRegistryKeyPath() string

+ func (ev *Event) GetSetKeyValueRegistryKeyPathLength() int

+ func (ev *Event) GetSetKeyValueRegistryValueName() string

+ func (ev *Event) GetSetKeyValueRegistryValueNameLength() int

+ func (ev *Event) GetSetKeyValueValueName() string

+ func (ev *Event) GetSetRegistryKeyName() string

+ func (ev *Event) GetSetRegistryKeyNameLength() int

+ func (ev *Event) GetSetRegistryKeyPath() string

+ func (ev *Event) GetSetRegistryKeyPathLength() int

+ func (ev *Event) GetSetRegistryValueName() string

+ func (ev *Event) GetSetRegistryValueNameLength() int

+ func (ev *Event) GetSetValueName() string

+ type FakeFieldHandlers struct — darwin/amd64, linux/amd64, windows/amd64

+ func (dfh *FakeFieldHandlers) ResolveAsync(ev *Event) bool

+ func (dfh *FakeFieldHandlers) ResolveChownGID(ev *Event, e *ChownEvent) string

+ func (dfh *FakeFieldHandlers) ResolveChownUID(ev *Event, e *ChownEvent) string

+ func (dfh *FakeFieldHandlers) ResolveContainerContext(_ *Event) (*ContainerContext, bool)

+ func (dfh *FakeFieldHandlers) ResolveContainerCreatedAt(ev *Event, e *ContainerContext) int

+ func (dfh *FakeFieldHandlers) ResolveContainerID(ev *Event, e *ContainerContext) string

+ func (dfh *FakeFieldHandlers) ResolveContainerTags(ev *Event, e *ContainerContext) []string

+ func (dfh *FakeFieldHandlers) ResolveEventTime(ev *Event, e *BaseEvent) time.Time

+ func (dfh *FakeFieldHandlers) ResolveEventTimestamp(ev *Event, e *BaseEvent) int

+ func (dfh *FakeFieldHandlers) ResolveFileBasename(ev *Event, e *FileEvent) string

+ func (dfh *FakeFieldHandlers) ResolveFileFieldsGroup(ev *Event, e *FileFields) string

+ func (dfh *FakeFieldHandlers) ResolveFileFieldsInUpperLayer(ev *Event, e *FileFields) bool

+ func (dfh *FakeFieldHandlers) ResolveFileFieldsUser(ev *Event, e *FileFields) string

+ func (dfh *FakeFieldHandlers) ResolveFileFilesystem(ev *Event, e *FileEvent) string

+ func (dfh *FakeFieldHandlers) ResolveFilePath(ev *Event, e *FileEvent) string

+ func (dfh *FakeFieldHandlers) ResolveHashes(_ EventType, _ *Process, _ *FileEvent) []string

+ func (dfh *FakeFieldHandlers) ResolveHashesFromEvent(ev *Event, e *FileEvent) []string

+ func (dfh *FakeFieldHandlers) ResolveK8SGroups(ev *Event, e *UserSessionContext) []string

+ func (dfh *FakeFieldHandlers) ResolveK8SUID(ev *Event, e *UserSessionContext) string

+ func (dfh *FakeFieldHandlers) ResolveK8SUsername(ev *Event, e *UserSessionContext) string

+ func (dfh *FakeFieldHandlers) ResolveModuleArgs(ev *Event, e *LoadModuleEvent) string

+ func (dfh *FakeFieldHandlers) ResolveModuleArgv(ev *Event, e *LoadModuleEvent) []string

+ func (dfh *FakeFieldHandlers) ResolveMountPointPath(ev *Event, e *MountEvent) string

+ func (dfh *FakeFieldHandlers) ResolveMountRootPath(ev *Event, e *MountEvent) string

+ func (dfh *FakeFieldHandlers) ResolveMountSourcePath(ev *Event, e *MountEvent) string

+ func (dfh *FakeFieldHandlers) ResolveNetworkDeviceIfName(ev *Event, e *NetworkDeviceContext) string

+ func (dfh *FakeFieldHandlers) ResolvePackageName(ev *Event, e *FileEvent) string

+ func (dfh *FakeFieldHandlers) ResolvePackageSourceVersion(ev *Event, e *FileEvent) string

+ func (dfh *FakeFieldHandlers) ResolvePackageVersion(ev *Event, e *FileEvent) string

+ func (dfh *FakeFieldHandlers) ResolveProcessArgs(ev *Event, e *Process) string

+ func (dfh *FakeFieldHandlers) ResolveProcessArgsFlags(ev *Event, e *Process) []string

+ func (dfh *FakeFieldHandlers) ResolveProcessArgsOptions(ev *Event, e *Process) []string

+ func (dfh *FakeFieldHandlers) ResolveProcessArgsScrubbed(ev *Event, e *Process) string

+ func (dfh *FakeFieldHandlers) ResolveProcessArgsTruncated(ev *Event, e *Process) bool

+ func (dfh *FakeFieldHandlers) ResolveProcessArgv(ev *Event, e *Process) []string

+ func (dfh *FakeFieldHandlers) ResolveProcessArgv0(ev *Event, e *Process) string

+ func (dfh *FakeFieldHandlers) ResolveProcessArgvScrubbed(ev *Event, e *Process) []string

+ func (dfh *FakeFieldHandlers) ResolveProcessCacheEntry(_ *Event) (*ProcessCacheEntry, bool)

+ func (dfh *FakeFieldHandlers) ResolveProcessCmdLine(ev *Event, e *Process) string

+ func (dfh *FakeFieldHandlers) ResolveProcessCmdLineScrubbed(ev *Event, e *Process) string

+ func (dfh *FakeFieldHandlers) ResolveProcessCreatedAt(ev *Event, e *Process) int

+ func (dfh *FakeFieldHandlers) ResolveProcessEnvp(ev *Event, e *Process) []string

+ func (dfh *FakeFieldHandlers) ResolveProcessEnvs(ev *Event, e *Process) []string

+ func (dfh *FakeFieldHandlers) ResolveProcessEnvsTruncated(ev *Event, e *Process) bool

+ func (dfh *FakeFieldHandlers) ResolveRights(ev *Event, e *FileFields) int

+ func (dfh *FakeFieldHandlers) ResolveSELinuxBoolName(ev *Event, e *SELinuxEvent) string

+ func (dfh *FakeFieldHandlers) ResolveService(ev *Event, e *BaseEvent) string

+ func (dfh *FakeFieldHandlers) ResolveSetgidEGroup(ev *Event, e *SetgidEvent) string

+ func (dfh *FakeFieldHandlers) ResolveSetgidFSGroup(ev *Event, e *SetgidEvent) string

+ func (dfh *FakeFieldHandlers) ResolveSetgidGroup(ev *Event, e *SetgidEvent) string

+ func (dfh *FakeFieldHandlers) ResolveSetuidEUser(ev *Event, e *SetuidEvent) string

+ func (dfh *FakeFieldHandlers) ResolveSetuidFSUser(ev *Event, e *SetuidEvent) string

+ func (dfh *FakeFieldHandlers) ResolveSetuidUser(ev *Event, e *SetuidEvent) string

+ func (dfh *FakeFieldHandlers) ResolveUser(ev *Event, e *Process) string

+ func (dfh *FakeFieldHandlers) ResolveUserSessionContext(_ *UserSessionContext)

+ func (dfh *FakeFieldHandlers) ResolveXAttrName(ev *Event, e *SetXAttrEvent) string

+ func (dfh *FakeFieldHandlers) ResolveXAttrNamespace(ev *Event, e *SetXAttrEvent) string

type FieldHandlers — windows/amd64

+ ResolveService func(ev *Event, e *BaseEvent) string

+ ResolveUser func(ev *Event, e *Process) string

+ type OpenRegistryKeyEvent struct — windows/amd64

+ Registry RegistryEvent

type Process — darwin/amd64, linux/amd64

+ IsExecExec bool

type Process — windows/amd64

+ OwnerSidString string

+ User string

+ type RegistryEvent struct — windows/amd64

+ KeyName string

+ KeyPath string

type SecurityProfileContext

+ EventTypes []EventType

+ type SetRegistryKeyValueEvent struct — windows/amd64

+ Registry RegistryEvent

+ ValueName string

v0.52.0-rc.7

Mar 12, 2024

v0.52.0-rc.6

Mar 9, 2024

v0.52.0-rc.5

Mar 6, 2024

v0.52.0-rc.4

Feb 27, 2024

v0.52.0-rc.3

Feb 23, 2024

v0.52.0-rc.2

Feb 21, 2024

v0.52.0-rc.1

Feb 19, 2024

v0.52.0-devel

Jan 15, 2024

v0.51.2-rc.2

Mar 13, 2024

v0.51.2-rc.1

Mar 13, 2024

v0.51.1

Feb 29, 2024

Changes in this version

+ type ChdirEvent struct — darwin/amd64, linux/amd64

+ File FileEvent

+ func (e *ChdirEvent) UnmarshalBinary(data []byte) (int, error)

type Event — darwin/amd64, linux/amd64

+ Chdir ChdirEvent

+ func (ev *Event) GetChdirFileChangeTime() uint64

+ func (ev *Event) GetChdirFileFilesystem() string

+ func (ev *Event) GetChdirFileGid() uint32

+ func (ev *Event) GetChdirFileGroup() string

+ func (ev *Event) GetChdirFileHashes() []string

+ func (ev *Event) GetChdirFileInUpperLayer() bool

+ func (ev *Event) GetChdirFileInode() uint64

+ func (ev *Event) GetChdirFileMode() uint16

+ func (ev *Event) GetChdirFileModificationTime() uint64

+ func (ev *Event) GetChdirFileMountId() uint32

+ func (ev *Event) GetChdirFileName() string

+ func (ev *Event) GetChdirFileNameLength() int

+ func (ev *Event) GetChdirFilePackageName() string

+ func (ev *Event) GetChdirFilePackageSourceVersion() string

+ func (ev *Event) GetChdirFilePackageVersion() string

+ func (ev *Event) GetChdirFilePath() string

+ func (ev *Event) GetChdirFilePathLength() int

+ func (ev *Event) GetChdirFileRights() int

+ func (ev *Event) GetChdirFileUid() uint32

+ func (ev *Event) GetChdirFileUser() string

+ func (ev *Event) GetChdirRetval() int64

type EventType

+ const FileChdirEventType

v0.51.1-rc.1

Feb 28, 2024

v0.51.0

Feb 14, 2024

Changes in this version

+ const MaxArgsEnvsSize

+ func FilterEnvs(allEnvVars []string, desiredKeys map[string]bool) []string

+ type ActionTriggered struct

+ Name string

+ Value string

type BaseEvent

+ Actions []*ActionTriggered

+ Origin string

+ Suppressed bool

type DefaultFieldHandlers — darwin/amd64, linux/amd64

+ func (dfh *DefaultFieldHandlers) ResolveMountRootPath(ev *Event, e *MountEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveProcessArgsScrubbed(ev *Event, e *Process) string

+ func (dfh *DefaultFieldHandlers) ResolveUserSessionContext(_ *UserSessionContext)

type DefaultFieldHandlers — windows/amd64

+ func (dfh *DefaultFieldHandlers) ResolveProcessCmdLine(ev *Event, e *Process) string

+ func (dfh *DefaultFieldHandlers) ResolveProcessCmdLineScrubbed(ev *Event, e *Process) string

type Event — darwin/amd64, linux/amd64

+ NSID uint64

+ func (e *Event) GetActions() []*ActionTriggered

+ func (e *Event) IsSuppressed() bool

+ func (ev *Event) GetExecArgsScrubbed() string

+ func (ev *Event) GetExecArgvScrubbed() []string

+ func (ev *Event) GetExitArgsScrubbed() string

+ func (ev *Event) GetExitArgvScrubbed() []string

+ func (ev *Event) GetMountRootPath() string

+ func (ev *Event) GetProcessAncestorsArgsScrubbed() []string

+ func (ev *Event) GetProcessAncestorsArgvScrubbed() []string

+ func (ev *Event) GetProcessArgsScrubbed() string

+ func (ev *Event) GetProcessArgvScrubbed() []string

+ func (ev *Event) GetProcessParentArgsScrubbed() string

+ func (ev *Event) GetProcessParentArgvScrubbed() []string

+ func (ev *Event) GetPtraceTraceeAncestorsArgsScrubbed() []string

+ func (ev *Event) GetPtraceTraceeAncestorsArgvScrubbed() []string

+ func (ev *Event) GetPtraceTraceeArgsScrubbed() string

+ func (ev *Event) GetPtraceTraceeArgvScrubbed() []string

+ func (ev *Event) GetPtraceTraceeParentArgsScrubbed() string

+ func (ev *Event) GetPtraceTraceeParentArgvScrubbed() []string

+ func (ev *Event) GetSignalTargetAncestorsArgsScrubbed() []string

+ func (ev *Event) GetSignalTargetAncestorsArgvScrubbed() []string

+ func (ev *Event) GetSignalTargetArgsScrubbed() string

+ func (ev *Event) GetSignalTargetArgvScrubbed() []string

+ func (ev *Event) GetSignalTargetParentArgsScrubbed() string

+ func (ev *Event) GetSignalTargetParentArgvScrubbed() []string

type Event — windows/amd64

+ func (ev *Event) GetExecCmdlineScrubbed() string

+ func (ev *Event) GetExitCmdlineScrubbed() string

+ func (ev *Event) GetProcessAncestorsCmdlineScrubbed() []string

+ func (ev *Event) GetProcessCmdlineScrubbed() string

+ func (ev *Event) GetProcessParentCmdlineScrubbed() string

type ExtraFieldHandlers — darwin/amd64, linux/amd64

+ ResolveUserSessionContext func(evtCtx *UserSessionContext)

type FieldHandlers — darwin/amd64, linux/amd64

+ ResolveEventTime func(ev *Event, e *BaseEvent) time.Time

+ ResolveMountRootPath func(ev *Event, e *MountEvent) string

+ ResolveProcessArgsScrubbed func(ev *Event, e *Process) string

type FieldHandlers — windows/amd64

+ ResolveProcessCmdLine func(ev *Event, e *Process) string

+ ResolveProcessCmdLineScrubbed func(ev *Event, e *Process) string

type HashAlgorithm

+ const SSDEEP

type HashState

+ const HashFailed

type MountEvent — darwin/amd64, linux/amd64

+ MountRootPath string

+ MountRootPathResolutionError error

type Process — darwin/amd64, linux/amd64

+ ArgsScrubbed string

+ ArgvScrubbed []string

+ func (p *Process) GetProcessArgv() ([]string, bool)

+ func (p *Process) GetProcessArgv0() (string, bool)

type Process — windows/amd64

+ CmdLineScrubbed string

type ProcessCacheEntry — darwin/amd64, linux/amd64

+ func (pc *ProcessCacheEntry) GetContainerPIDs() []uint32

v0.51.0-rc.6

Feb 7, 2024

v0.51.0-rc.5

Jan 28, 2024

v0.51.0-rc.4

Jan 22, 2024

v0.51.0-rc.3

Jan 15, 2024

v0.51.0-rc.2

Jan 11, 2024

v0.51.0-rc.1

Jan 8, 2024

v0.51.0-devel

Nov 20, 2023

v0.50.3-rc.1

Jan 8, 2024

v0.50.2

Jan 4, 2024

v0.50.2-rc.1

Jan 2, 2024

v0.50.1

Dec 20, 2023

v0.50.1-rc.1

Dec 19, 2023

v0.50.0

Dec 15, 2023

Changes in this version

+ var BooleanConstants = map[string]interface

+ var SignalConstants = map[string]int — darwin/amd64, js/wasm, windows/amd64

+ var SignalConstants = map[string]int — linux/amd64

+ type BaseExtraFieldHandlers interface

+ GetProcessService func(ev *Event) string

+ ResolveContainerContext func(ev *Event) (*ContainerContext, bool)

+ ResolveEventTime func(ev *Event) time.Time

+ ResolveK8SExtra func(ev *Event, ctx *UserSessionContext) map[string][]string

+ ResolveProcessCacheEntry func(ev *Event) (*ProcessCacheEntry, bool)

type DefaultFieldHandlers — darwin/amd64, linux/amd64

+ func (dfh *DefaultFieldHandlers) ResolveK8SExtra(_ *Event, _ *UserSessionContext) map[string][]string

+ func (dfh *DefaultFieldHandlers) ResolveK8SGroups(ev *Event, e *UserSessionContext) []string

+ func (dfh *DefaultFieldHandlers) ResolveK8SUID(ev *Event, e *UserSessionContext) string

+ func (dfh *DefaultFieldHandlers) ResolveK8SUsername(ev *Event, e *UserSessionContext) string

+ type ErrNoProcessContext struct

+ Err error

+ func (e *ErrNoProcessContext) Error() string

+ func (e *ErrNoProcessContext) Unwrap() error

+ type ErrProcessBrokenLineage struct

+ Err error

+ func (e *ErrProcessBrokenLineage) Error() string

+ func (e *ErrProcessBrokenLineage) Unwrap() error

+ type ErrProcessIncompleteLineage struct

+ ContainerID string

+ PID uint32

+ PPID uint32

+ func (e *ErrProcessIncompleteLineage) Error() string

+ type ErrProcessMissingParentNode struct

+ ContainerID string

+ PID uint32

+ PPID uint32

+ func (e *ErrProcessMissingParentNode) Error() string

+ type ErrProcessWrongParentNode struct

+ ContainerID string

+ PID uint32

+ PPID uint32

+ func (e *ErrProcessWrongParentNode) Error() string

type Event — darwin/amd64, linux/amd64

+ func (ev *Event) GetExecUserSessionK8sGroups() []string

+ func (ev *Event) GetExecUserSessionK8sUid() string

+ func (ev *Event) GetExecUserSessionK8sUsername() string

+ func (ev *Event) GetExitUserSessionK8sGroups() []string

+ func (ev *Event) GetExitUserSessionK8sUid() string

+ func (ev *Event) GetExitUserSessionK8sUsername() string

+ func (ev *Event) GetProcessAncestorsUserSessionK8sGroups() []string

+ func (ev *Event) GetProcessAncestorsUserSessionK8sUid() []string

+ func (ev *Event) GetProcessAncestorsUserSessionK8sUsername() []string

+ func (ev *Event) GetProcessParentUserSessionK8sGroups() []string

+ func (ev *Event) GetProcessParentUserSessionK8sUid() string

+ func (ev *Event) GetProcessParentUserSessionK8sUsername() string

+ func (ev *Event) GetProcessUserSessionK8sGroups() []string

+ func (ev *Event) GetProcessUserSessionK8sUid() string

+ func (ev *Event) GetProcessUserSessionK8sUsername() string

+ func (ev *Event) GetPtraceTraceeAncestorsUserSessionK8sGroups() []string

+ func (ev *Event) GetPtraceTraceeAncestorsUserSessionK8sUid() []string

+ func (ev *Event) GetPtraceTraceeAncestorsUserSessionK8sUsername() []string

+ func (ev *Event) GetPtraceTraceeParentUserSessionK8sGroups() []string

+ func (ev *Event) GetPtraceTraceeParentUserSessionK8sUid() string

+ func (ev *Event) GetPtraceTraceeParentUserSessionK8sUsername() string

+ func (ev *Event) GetPtraceTraceeUserSessionK8sGroups() []string

+ func (ev *Event) GetPtraceTraceeUserSessionK8sUid() string

+ func (ev *Event) GetPtraceTraceeUserSessionK8sUsername() string

+ func (ev *Event) GetSignalTargetAncestorsUserSessionK8sGroups() []string

+ func (ev *Event) GetSignalTargetAncestorsUserSessionK8sUid() []string

+ func (ev *Event) GetSignalTargetAncestorsUserSessionK8sUsername() []string

+ func (ev *Event) GetSignalTargetParentUserSessionK8sGroups() []string

+ func (ev *Event) GetSignalTargetParentUserSessionK8sUid() string

+ func (ev *Event) GetSignalTargetParentUserSessionK8sUsername() string

+ func (ev *Event) GetSignalTargetUserSessionK8sGroups() []string

+ func (ev *Event) GetSignalTargetUserSessionK8sUid() string

+ func (ev *Event) GetSignalTargetUserSessionK8sUsername() string

type Event — windows/amd64

+ func (ev *Event) GetContainerCreatedAt() int

+ func (ev *Event) GetContainerId() string

+ func (ev *Event) GetContainerTags() []string

+ func (ev *Event) GetEventTimestamp() int

+ func (ev *Event) GetExecCmdline() string

+ func (ev *Event) GetExecContainerId() string

+ func (ev *Event) GetExecCreatedAt() int

+ func (ev *Event) GetExecEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetExecEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetExecExecTime() time.Time

+ func (ev *Event) GetExecExitTime() time.Time

+ func (ev *Event) GetExecFileName() string

+ func (ev *Event) GetExecFileNameLength() int

+ func (ev *Event) GetExecFilePath() string

+ func (ev *Event) GetExecFilePathLength() int

+ func (ev *Event) GetExecPid() uint32

+ func (ev *Event) GetExecPpid() uint32

+ func (ev *Event) GetExitCause() uint32

+ func (ev *Event) GetExitCmdline() string

+ func (ev *Event) GetExitCode() uint32

+ func (ev *Event) GetExitContainerId() string

+ func (ev *Event) GetExitCreatedAt() int

+ func (ev *Event) GetExitEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetExitEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetExitExecTime() time.Time

+ func (ev *Event) GetExitExitTime() time.Time

+ func (ev *Event) GetExitFileName() string

+ func (ev *Event) GetExitFileNameLength() int

+ func (ev *Event) GetExitFilePath() string

+ func (ev *Event) GetExitFilePathLength() int

+ func (ev *Event) GetExitPid() uint32

+ func (ev *Event) GetExitPpid() uint32

+ func (ev *Event) GetNetworkDestinationIp() net.IPNet

+ func (ev *Event) GetNetworkDestinationPort() uint16

+ func (ev *Event) GetNetworkL3Protocol() uint16

+ func (ev *Event) GetNetworkL4Protocol() uint16

+ func (ev *Event) GetNetworkSize() uint32

+ func (ev *Event) GetNetworkSourceIp() net.IPNet

+ func (ev *Event) GetNetworkSourcePort() uint16

+ func (ev *Event) GetProcessAncestorsCmdline() []string

+ func (ev *Event) GetProcessAncestorsContainerId() []string

+ func (ev *Event) GetProcessAncestorsCreatedAt() []int

+ func (ev *Event) GetProcessAncestorsEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessAncestorsEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessAncestorsFileName() []string

+ func (ev *Event) GetProcessAncestorsFileNameLength() []int

+ func (ev *Event) GetProcessAncestorsFilePath() []string

+ func (ev *Event) GetProcessAncestorsFilePathLength() []int

+ func (ev *Event) GetProcessAncestorsPid() []uint32

+ func (ev *Event) GetProcessAncestorsPpid() []uint32

+ func (ev *Event) GetProcessCmdline() string

+ func (ev *Event) GetProcessContainerId() string

+ func (ev *Event) GetProcessCreatedAt() int

+ func (ev *Event) GetProcessEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessExecTime() time.Time

+ func (ev *Event) GetProcessExitTime() time.Time

+ func (ev *Event) GetProcessFileName() string

+ func (ev *Event) GetProcessFileNameLength() int

+ func (ev *Event) GetProcessFilePath() string

+ func (ev *Event) GetProcessFilePathLength() int

+ func (ev *Event) GetProcessParentCmdline() string

+ func (ev *Event) GetProcessParentContainerId() string

+ func (ev *Event) GetProcessParentCreatedAt() int

+ func (ev *Event) GetProcessParentEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessParentEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessParentFileName() string

+ func (ev *Event) GetProcessParentFileNameLength() int

+ func (ev *Event) GetProcessParentFilePath() string

+ func (ev *Event) GetProcessParentFilePathLength() int

+ func (ev *Event) GetProcessParentPid() uint32

+ func (ev *Event) GetProcessParentPpid() uint32

+ func (ev *Event) GetProcessPid() uint32

+ func (ev *Event) GetProcessPpid() uint32

+ func (ev *Event) GetTimestamp() time.Time

type EventType

+ const CustomHeartbeatEventType

type FieldHandlers — darwin/amd64, linux/amd64

+ ResolveK8SGroups func(ev *Event, e *UserSessionContext) []string

+ ResolveK8SUID func(ev *Event, e *UserSessionContext) string

+ ResolveK8SUsername func(ev *Event, e *UserSessionContext) string

type PathLeaf — darwin/amd64, linux/amd64

+ Padding [6]uint8

type Process — darwin/amd64, linux/amd64

+ UserSession UserSessionContext

type Process — windows/amd64

+ ScrubbedCmdLineResolved bool

+ type UserSessionContext struct

+ ID uint64

+ K8SExtra map[string][]string

+ K8SGroups []string

+ K8SUID string

+ K8SUsername string

+ RawData string

+ Resolved bool

+ SessionType usersession.Type

+ func (e *UserSessionContext) UnmarshalBinary(data []byte) error

+ type UserSessionKey struct

+ Cursor byte

+ ID uint64

+ Padding [7]byte

v0.50.0-rc.7

Dec 11, 2023

v0.50.0-rc.6

Dec 6, 2023

v0.50.0-rc.5

Nov 30, 2023

v0.50.0-rc.4

Nov 20, 2023

v0.50.0-rc.3

Nov 16, 2023

v0.50.0-rc.2

Nov 14, 2023

v0.50.0-rc.1

Nov 13, 2023

v0.50.0-devel

Oct 10, 2023

v0.49.1-rc.1

Nov 10, 2023

v0.49.0

Oct 31, 2023

Changes in this version

+ const DNSPreallocSize — linux/amd64

+ const ProcessCacheEntryFromPlaceholder — darwin/amd64, linux/amd64

+ const SizeOfCookie — darwin/amd64, linux/amd64

type DefaultFieldHandlers — darwin/amd64, linux/amd64

+ func (dfh *DefaultFieldHandlers) ResolveProcessArgvScrubbed(ev *Event, e *Process) []string

type Event — darwin/amd64, linux/amd64

+ func (ev *Event) GetBindAddrFamily() uint16

+ func (ev *Event) GetBindAddrIp() net.IPNet

+ func (ev *Event) GetBindAddrPort() uint16

+ func (ev *Event) GetBindRetval() int64

+ func (ev *Event) GetBpfCmd() uint32

+ func (ev *Event) GetBpfMapName() string

+ func (ev *Event) GetBpfMapType() uint32

+ func (ev *Event) GetBpfProgAttachType() uint32

+ func (ev *Event) GetBpfProgHelpers() []uint32

+ func (ev *Event) GetBpfProgName() string

+ func (ev *Event) GetBpfProgTag() string

+ func (ev *Event) GetBpfProgType() uint32

+ func (ev *Event) GetBpfRetval() int64

+ func (ev *Event) GetCapsetCapEffective() uint64

+ func (ev *Event) GetCapsetCapPermitted() uint64

+ func (ev *Event) GetChmodFileChangeTime() uint64

+ func (ev *Event) GetChmodFileDestinationMode() uint32

+ func (ev *Event) GetChmodFileDestinationRights() uint32

+ func (ev *Event) GetChmodFileFilesystem() string

+ func (ev *Event) GetChmodFileGid() uint32

+ func (ev *Event) GetChmodFileGroup() string

+ func (ev *Event) GetChmodFileHashes() []string

+ func (ev *Event) GetChmodFileInUpperLayer() bool

+ func (ev *Event) GetChmodFileInode() uint64

+ func (ev *Event) GetChmodFileMode() uint16

+ func (ev *Event) GetChmodFileModificationTime() uint64

+ func (ev *Event) GetChmodFileMountId() uint32

+ func (ev *Event) GetChmodFileName() string

+ func (ev *Event) GetChmodFileNameLength() int

+ func (ev *Event) GetChmodFilePackageName() string

+ func (ev *Event) GetChmodFilePackageSourceVersion() string

+ func (ev *Event) GetChmodFilePackageVersion() string

+ func (ev *Event) GetChmodFilePath() string

+ func (ev *Event) GetChmodFilePathLength() int

+ func (ev *Event) GetChmodFileRights() int

+ func (ev *Event) GetChmodFileUid() uint32

+ func (ev *Event) GetChmodFileUser() string

+ func (ev *Event) GetChmodRetval() int64

+ func (ev *Event) GetChownFileChangeTime() uint64

+ func (ev *Event) GetChownFileDestinationGid() int64

+ func (ev *Event) GetChownFileDestinationGroup() string

+ func (ev *Event) GetChownFileDestinationUid() int64

+ func (ev *Event) GetChownFileDestinationUser() string

+ func (ev *Event) GetChownFileFilesystem() string

+ func (ev *Event) GetChownFileGid() uint32

+ func (ev *Event) GetChownFileGroup() string

+ func (ev *Event) GetChownFileHashes() []string

+ func (ev *Event) GetChownFileInUpperLayer() bool

+ func (ev *Event) GetChownFileInode() uint64

+ func (ev *Event) GetChownFileMode() uint16

+ func (ev *Event) GetChownFileModificationTime() uint64

+ func (ev *Event) GetChownFileMountId() uint32

+ func (ev *Event) GetChownFileName() string

+ func (ev *Event) GetChownFileNameLength() int

+ func (ev *Event) GetChownFilePackageName() string

+ func (ev *Event) GetChownFilePackageSourceVersion() string

+ func (ev *Event) GetChownFilePackageVersion() string

+ func (ev *Event) GetChownFilePath() string

+ func (ev *Event) GetChownFilePathLength() int

+ func (ev *Event) GetChownFileRights() int

+ func (ev *Event) GetChownFileUid() uint32

+ func (ev *Event) GetChownFileUser() string

+ func (ev *Event) GetChownRetval() int64

+ func (ev *Event) GetContainerCreatedAt() int

+ func (ev *Event) GetContainerId() string

+ func (ev *Event) GetContainerTags() []string

+ func (ev *Event) GetDnsId() uint16

+ func (ev *Event) GetDnsQuestionClass() uint16

+ func (ev *Event) GetDnsQuestionCount() uint16

+ func (ev *Event) GetDnsQuestionLength() uint16

+ func (ev *Event) GetDnsQuestionName() string

+ func (ev *Event) GetDnsQuestionNameLength() int

+ func (ev *Event) GetDnsQuestionType() uint16

+ func (ev *Event) GetEventAsync() bool

+ func (ev *Event) GetEventTimestamp() int

+ func (ev *Event) GetExecArgs() string

+ func (ev *Event) GetExecArgsFlags() []string

+ func (ev *Event) GetExecArgsOptions() []string

+ func (ev *Event) GetExecArgsTruncated() bool

+ func (ev *Event) GetExecArgv() []string

+ func (ev *Event) GetExecArgv0() string

+ func (ev *Event) GetExecCapEffective() uint64

+ func (ev *Event) GetExecCapPermitted() uint64

+ func (ev *Event) GetExecComm() string

+ func (ev *Event) GetExecContainerId() string

+ func (ev *Event) GetExecCreatedAt() int

+ func (ev *Event) GetExecEgid() uint32

+ func (ev *Event) GetExecEgroup() string

+ func (ev *Event) GetExecEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetExecEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetExecEnvsTruncated() bool

+ func (ev *Event) GetExecEuid() uint32

+ func (ev *Event) GetExecEuser() string

+ func (ev *Event) GetExecExecTime() time.Time

+ func (ev *Event) GetExecExitTime() time.Time

+ func (ev *Event) GetExecFileChangeTime() uint64

+ func (ev *Event) GetExecFileFilesystem() string

+ func (ev *Event) GetExecFileGid() uint32

+ func (ev *Event) GetExecFileGroup() string

+ func (ev *Event) GetExecFileHashes() []string

+ func (ev *Event) GetExecFileInUpperLayer() bool

+ func (ev *Event) GetExecFileInode() uint64

+ func (ev *Event) GetExecFileMode() uint16

+ func (ev *Event) GetExecFileModificationTime() uint64

+ func (ev *Event) GetExecFileMountId() uint32

+ func (ev *Event) GetExecFileName() string

+ func (ev *Event) GetExecFileNameLength() int

+ func (ev *Event) GetExecFilePackageName() string

+ func (ev *Event) GetExecFilePackageSourceVersion() string

+ func (ev *Event) GetExecFilePackageVersion() string

+ func (ev *Event) GetExecFilePath() string

+ func (ev *Event) GetExecFilePathLength() int

+ func (ev *Event) GetExecFileRights() int

+ func (ev *Event) GetExecFileUid() uint32

+ func (ev *Event) GetExecFileUser() string

+ func (ev *Event) GetExecForkTime() time.Time

+ func (ev *Event) GetExecFsgid() uint32

+ func (ev *Event) GetExecFsgroup() string

+ func (ev *Event) GetExecFsuid() uint32

+ func (ev *Event) GetExecFsuser() string

+ func (ev *Event) GetExecGid() uint32

+ func (ev *Event) GetExecGroup() string

+ func (ev *Event) GetExecInterpreterFileChangeTime() uint64

+ func (ev *Event) GetExecInterpreterFileFilesystem() string

+ func (ev *Event) GetExecInterpreterFileGid() uint32

+ func (ev *Event) GetExecInterpreterFileGroup() string

+ func (ev *Event) GetExecInterpreterFileHashes() []string

+ func (ev *Event) GetExecInterpreterFileInUpperLayer() bool

+ func (ev *Event) GetExecInterpreterFileInode() uint64

+ func (ev *Event) GetExecInterpreterFileMode() uint16

+ func (ev *Event) GetExecInterpreterFileModificationTime() uint64

+ func (ev *Event) GetExecInterpreterFileMountId() uint32

+ func (ev *Event) GetExecInterpreterFileName() string

+ func (ev *Event) GetExecInterpreterFileNameLength() int

+ func (ev *Event) GetExecInterpreterFilePackageName() string

+ func (ev *Event) GetExecInterpreterFilePackageSourceVersion() string

+ func (ev *Event) GetExecInterpreterFilePackageVersion() string

+ func (ev *Event) GetExecInterpreterFilePath() string

+ func (ev *Event) GetExecInterpreterFilePathLength() int

+ func (ev *Event) GetExecInterpreterFileRights() int

+ func (ev *Event) GetExecInterpreterFileUid() uint32

+ func (ev *Event) GetExecInterpreterFileUser() string

+ func (ev *Event) GetExecIsKworker() bool

+ func (ev *Event) GetExecIsThread() bool

+ func (ev *Event) GetExecPid() uint32

+ func (ev *Event) GetExecPpid() uint32

+ func (ev *Event) GetExecTid() uint32

+ func (ev *Event) GetExecTtyName() string

+ func (ev *Event) GetExecUid() uint32

+ func (ev *Event) GetExecUser() string

+ func (ev *Event) GetExitArgs() string

+ func (ev *Event) GetExitArgsFlags() []string

+ func (ev *Event) GetExitArgsOptions() []string

+ func (ev *Event) GetExitArgsTruncated() bool

+ func (ev *Event) GetExitArgv() []string

+ func (ev *Event) GetExitArgv0() string

+ func (ev *Event) GetExitCapEffective() uint64

+ func (ev *Event) GetExitCapPermitted() uint64

+ func (ev *Event) GetExitCause() uint32

+ func (ev *Event) GetExitCode() uint32

+ func (ev *Event) GetExitComm() string

+ func (ev *Event) GetExitContainerId() string

+ func (ev *Event) GetExitCreatedAt() int

+ func (ev *Event) GetExitEgid() uint32

+ func (ev *Event) GetExitEgroup() string

+ func (ev *Event) GetExitEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetExitEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetExitEnvsTruncated() bool

+ func (ev *Event) GetExitEuid() uint32

+ func (ev *Event) GetExitEuser() string

+ func (ev *Event) GetExitExecTime() time.Time

+ func (ev *Event) GetExitExitTime() time.Time

+ func (ev *Event) GetExitFileChangeTime() uint64

+ func (ev *Event) GetExitFileFilesystem() string

+ func (ev *Event) GetExitFileGid() uint32

+ func (ev *Event) GetExitFileGroup() string

+ func (ev *Event) GetExitFileHashes() []string

+ func (ev *Event) GetExitFileInUpperLayer() bool

+ func (ev *Event) GetExitFileInode() uint64

+ func (ev *Event) GetExitFileMode() uint16

+ func (ev *Event) GetExitFileModificationTime() uint64

+ func (ev *Event) GetExitFileMountId() uint32

+ func (ev *Event) GetExitFileName() string

+ func (ev *Event) GetExitFileNameLength() int

+ func (ev *Event) GetExitFilePackageName() string

+ func (ev *Event) GetExitFilePackageSourceVersion() string

+ func (ev *Event) GetExitFilePackageVersion() string

+ func (ev *Event) GetExitFilePath() string

+ func (ev *Event) GetExitFilePathLength() int

+ func (ev *Event) GetExitFileRights() int

+ func (ev *Event) GetExitFileUid() uint32

+ func (ev *Event) GetExitFileUser() string

+ func (ev *Event) GetExitForkTime() time.Time

+ func (ev *Event) GetExitFsgid() uint32

+ func (ev *Event) GetExitFsgroup() string

+ func (ev *Event) GetExitFsuid() uint32

+ func (ev *Event) GetExitFsuser() string

+ func (ev *Event) GetExitGid() uint32

+ func (ev *Event) GetExitGroup() string

+ func (ev *Event) GetExitInterpreterFileChangeTime() uint64

+ func (ev *Event) GetExitInterpreterFileFilesystem() string

+ func (ev *Event) GetExitInterpreterFileGid() uint32

+ func (ev *Event) GetExitInterpreterFileGroup() string

+ func (ev *Event) GetExitInterpreterFileHashes() []string

+ func (ev *Event) GetExitInterpreterFileInUpperLayer() bool

+ func (ev *Event) GetExitInterpreterFileInode() uint64

+ func (ev *Event) GetExitInterpreterFileMode() uint16

+ func (ev *Event) GetExitInterpreterFileModificationTime() uint64

+ func (ev *Event) GetExitInterpreterFileMountId() uint32

+ func (ev *Event) GetExitInterpreterFileName() string

+ func (ev *Event) GetExitInterpreterFileNameLength() int

+ func (ev *Event) GetExitInterpreterFilePackageName() string

+ func (ev *Event) GetExitInterpreterFilePackageSourceVersion() string

+ func (ev *Event) GetExitInterpreterFilePackageVersion() string

+ func (ev *Event) GetExitInterpreterFilePath() string

+ func (ev *Event) GetExitInterpreterFilePathLength() int

+ func (ev *Event) GetExitInterpreterFileRights() int

+ func (ev *Event) GetExitInterpreterFileUid() uint32

+ func (ev *Event) GetExitInterpreterFileUser() string

+ func (ev *Event) GetExitIsKworker() bool

+ func (ev *Event) GetExitIsThread() bool

+ func (ev *Event) GetExitPid() uint32

+ func (ev *Event) GetExitPpid() uint32

+ func (ev *Event) GetExitTid() uint32

+ func (ev *Event) GetExitTtyName() string

+ func (ev *Event) GetExitUid() uint32

+ func (ev *Event) GetExitUser() string

+ func (ev *Event) GetLinkFileChangeTime() uint64

+ func (ev *Event) GetLinkFileDestinationChangeTime() uint64

+ func (ev *Event) GetLinkFileDestinationFilesystem() string

+ func (ev *Event) GetLinkFileDestinationGid() uint32

+ func (ev *Event) GetLinkFileDestinationGroup() string

+ func (ev *Event) GetLinkFileDestinationHashes() []string

+ func (ev *Event) GetLinkFileDestinationInUpperLayer() bool

+ func (ev *Event) GetLinkFileDestinationInode() uint64

+ func (ev *Event) GetLinkFileDestinationMode() uint16

+ func (ev *Event) GetLinkFileDestinationModificationTime() uint64

+ func (ev *Event) GetLinkFileDestinationMountId() uint32

+ func (ev *Event) GetLinkFileDestinationName() string

+ func (ev *Event) GetLinkFileDestinationNameLength() int

+ func (ev *Event) GetLinkFileDestinationPackageName() string

+ func (ev *Event) GetLinkFileDestinationPackageSourceVersion() string

+ func (ev *Event) GetLinkFileDestinationPackageVersion() string

+ func (ev *Event) GetLinkFileDestinationPath() string

+ func (ev *Event) GetLinkFileDestinationPathLength() int

+ func (ev *Event) GetLinkFileDestinationRights() int

+ func (ev *Event) GetLinkFileDestinationUid() uint32

+ func (ev *Event) GetLinkFileDestinationUser() string

+ func (ev *Event) GetLinkFileFilesystem() string

+ func (ev *Event) GetLinkFileGid() uint32

+ func (ev *Event) GetLinkFileGroup() string

+ func (ev *Event) GetLinkFileHashes() []string

+ func (ev *Event) GetLinkFileInUpperLayer() bool

+ func (ev *Event) GetLinkFileInode() uint64

+ func (ev *Event) GetLinkFileMode() uint16

+ func (ev *Event) GetLinkFileModificationTime() uint64

+ func (ev *Event) GetLinkFileMountId() uint32

+ func (ev *Event) GetLinkFileName() string

+ func (ev *Event) GetLinkFileNameLength() int

+ func (ev *Event) GetLinkFilePackageName() string

+ func (ev *Event) GetLinkFilePackageSourceVersion() string

+ func (ev *Event) GetLinkFilePackageVersion() string

+ func (ev *Event) GetLinkFilePath() string

+ func (ev *Event) GetLinkFilePathLength() int

+ func (ev *Event) GetLinkFileRights() int

+ func (ev *Event) GetLinkFileUid() uint32

+ func (ev *Event) GetLinkFileUser() string

+ func (ev *Event) GetLinkRetval() int64

+ func (ev *Event) GetLoadModuleArgs() string

+ func (ev *Event) GetLoadModuleArgsTruncated() bool

+ func (ev *Event) GetLoadModuleArgv() []string

+ func (ev *Event) GetLoadModuleFileChangeTime() uint64

+ func (ev *Event) GetLoadModuleFileFilesystem() string

+ func (ev *Event) GetLoadModuleFileGid() uint32

+ func (ev *Event) GetLoadModuleFileGroup() string

+ func (ev *Event) GetLoadModuleFileHashes() []string

+ func (ev *Event) GetLoadModuleFileInUpperLayer() bool

+ func (ev *Event) GetLoadModuleFileInode() uint64

+ func (ev *Event) GetLoadModuleFileMode() uint16

+ func (ev *Event) GetLoadModuleFileModificationTime() uint64

+ func (ev *Event) GetLoadModuleFileMountId() uint32

+ func (ev *Event) GetLoadModuleFileName() string

+ func (ev *Event) GetLoadModuleFileNameLength() int

+ func (ev *Event) GetLoadModuleFilePackageName() string

+ func (ev *Event) GetLoadModuleFilePackageSourceVersion() string

+ func (ev *Event) GetLoadModuleFilePackageVersion() string

+ func (ev *Event) GetLoadModuleFilePath() string

+ func (ev *Event) GetLoadModuleFilePathLength() int

+ func (ev *Event) GetLoadModuleFileRights() int

+ func (ev *Event) GetLoadModuleFileUid() uint32

+ func (ev *Event) GetLoadModuleFileUser() string

+ func (ev *Event) GetLoadModuleLoadedFromMemory() bool

+ func (ev *Event) GetLoadModuleName() string

+ func (ev *Event) GetLoadModuleRetval() int64

+ func (ev *Event) GetMkdirFileChangeTime() uint64

+ func (ev *Event) GetMkdirFileDestinationMode() uint32

+ func (ev *Event) GetMkdirFileDestinationRights() uint32

+ func (ev *Event) GetMkdirFileFilesystem() string

+ func (ev *Event) GetMkdirFileGid() uint32

+ func (ev *Event) GetMkdirFileGroup() string

+ func (ev *Event) GetMkdirFileHashes() []string

+ func (ev *Event) GetMkdirFileInUpperLayer() bool

+ func (ev *Event) GetMkdirFileInode() uint64

+ func (ev *Event) GetMkdirFileMode() uint16

+ func (ev *Event) GetMkdirFileModificationTime() uint64

+ func (ev *Event) GetMkdirFileMountId() uint32

+ func (ev *Event) GetMkdirFileName() string

+ func (ev *Event) GetMkdirFileNameLength() int

+ func (ev *Event) GetMkdirFilePackageName() string

+ func (ev *Event) GetMkdirFilePackageSourceVersion() string

+ func (ev *Event) GetMkdirFilePackageVersion() string

+ func (ev *Event) GetMkdirFilePath() string

+ func (ev *Event) GetMkdirFilePathLength() int

+ func (ev *Event) GetMkdirFileRights() int

+ func (ev *Event) GetMkdirFileUid() uint32

+ func (ev *Event) GetMkdirFileUser() string

+ func (ev *Event) GetMkdirRetval() int64

+ func (ev *Event) GetMmapFileChangeTime() uint64

+ func (ev *Event) GetMmapFileFilesystem() string

+ func (ev *Event) GetMmapFileGid() uint32

+ func (ev *Event) GetMmapFileGroup() string

+ func (ev *Event) GetMmapFileHashes() []string

+ func (ev *Event) GetMmapFileInUpperLayer() bool

+ func (ev *Event) GetMmapFileInode() uint64

+ func (ev *Event) GetMmapFileMode() uint16

+ func (ev *Event) GetMmapFileModificationTime() uint64

+ func (ev *Event) GetMmapFileMountId() uint32

+ func (ev *Event) GetMmapFileName() string

+ func (ev *Event) GetMmapFileNameLength() int

+ func (ev *Event) GetMmapFilePackageName() string

+ func (ev *Event) GetMmapFilePackageSourceVersion() string

+ func (ev *Event) GetMmapFilePackageVersion() string

+ func (ev *Event) GetMmapFilePath() string

+ func (ev *Event) GetMmapFilePathLength() int

+ func (ev *Event) GetMmapFileRights() int

+ func (ev *Event) GetMmapFileUid() uint32

+ func (ev *Event) GetMmapFileUser() string

+ func (ev *Event) GetMmapFlags() int

+ func (ev *Event) GetMmapProtection() int

+ func (ev *Event) GetMmapRetval() int64

+ func (ev *Event) GetMountFsType() string

+ func (ev *Event) GetMountMountpointPath() string

+ func (ev *Event) GetMountRetval() int64

+ func (ev *Event) GetMountSourcePath() string

+ func (ev *Event) GetMprotectReqProtection() int

+ func (ev *Event) GetMprotectRetval() int64

+ func (ev *Event) GetMprotectVmProtection() int

+ func (ev *Event) GetNetworkDestinationIp() net.IPNet

+ func (ev *Event) GetNetworkDestinationPort() uint16

+ func (ev *Event) GetNetworkDeviceIfindex() uint32

+ func (ev *Event) GetNetworkDeviceIfname() string

+ func (ev *Event) GetNetworkL3Protocol() uint16

+ func (ev *Event) GetNetworkL4Protocol() uint16

+ func (ev *Event) GetNetworkSize() uint32

+ func (ev *Event) GetNetworkSourceIp() net.IPNet

+ func (ev *Event) GetNetworkSourcePort() uint16

+ func (ev *Event) GetOpenFileChangeTime() uint64

+ func (ev *Event) GetOpenFileDestinationMode() uint32

+ func (ev *Event) GetOpenFileFilesystem() string

+ func (ev *Event) GetOpenFileGid() uint32

+ func (ev *Event) GetOpenFileGroup() string

+ func (ev *Event) GetOpenFileHashes() []string

+ func (ev *Event) GetOpenFileInUpperLayer() bool

+ func (ev *Event) GetOpenFileInode() uint64

+ func (ev *Event) GetOpenFileMode() uint16

+ func (ev *Event) GetOpenFileModificationTime() uint64

+ func (ev *Event) GetOpenFileMountId() uint32

+ func (ev *Event) GetOpenFileName() string

+ func (ev *Event) GetOpenFileNameLength() int

+ func (ev *Event) GetOpenFilePackageName() string

+ func (ev *Event) GetOpenFilePackageSourceVersion() string

+ func (ev *Event) GetOpenFilePackageVersion() string

+ func (ev *Event) GetOpenFilePath() string

+ func (ev *Event) GetOpenFilePathLength() int

+ func (ev *Event) GetOpenFileRights() int

+ func (ev *Event) GetOpenFileUid() uint32

+ func (ev *Event) GetOpenFileUser() string

+ func (ev *Event) GetOpenFlags() uint32

+ func (ev *Event) GetOpenRetval() int64

+ func (ev *Event) GetProcessAncestorsArgs() []string

+ func (ev *Event) GetProcessAncestorsArgsFlags() []string

+ func (ev *Event) GetProcessAncestorsArgsOptions() []string

+ func (ev *Event) GetProcessAncestorsArgsTruncated() []bool

+ func (ev *Event) GetProcessAncestorsArgv() []string

+ func (ev *Event) GetProcessAncestorsArgv0() []string

+ func (ev *Event) GetProcessAncestorsCapEffective() []uint64

+ func (ev *Event) GetProcessAncestorsCapPermitted() []uint64

+ func (ev *Event) GetProcessAncestorsComm() []string

+ func (ev *Event) GetProcessAncestorsContainerId() []string

+ func (ev *Event) GetProcessAncestorsCreatedAt() []int

+ func (ev *Event) GetProcessAncestorsEgid() []uint32

+ func (ev *Event) GetProcessAncestorsEgroup() []string

+ func (ev *Event) GetProcessAncestorsEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessAncestorsEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessAncestorsEnvsTruncated() []bool

+ func (ev *Event) GetProcessAncestorsEuid() []uint32

+ func (ev *Event) GetProcessAncestorsEuser() []string

+ func (ev *Event) GetProcessAncestorsFileChangeTime() []uint64

+ func (ev *Event) GetProcessAncestorsFileFilesystem() []string

+ func (ev *Event) GetProcessAncestorsFileGid() []uint32

+ func (ev *Event) GetProcessAncestorsFileGroup() []string

+ func (ev *Event) GetProcessAncestorsFileHashes() []string

+ func (ev *Event) GetProcessAncestorsFileInUpperLayer() []bool

+ func (ev *Event) GetProcessAncestorsFileInode() []uint64

+ func (ev *Event) GetProcessAncestorsFileMode() []uint16

+ func (ev *Event) GetProcessAncestorsFileModificationTime() []uint64

+ func (ev *Event) GetProcessAncestorsFileMountId() []uint32

+ func (ev *Event) GetProcessAncestorsFileName() []string

+ func (ev *Event) GetProcessAncestorsFileNameLength() []int

+ func (ev *Event) GetProcessAncestorsFilePackageName() []string

+ func (ev *Event) GetProcessAncestorsFilePackageSourceVersion() []string

+ func (ev *Event) GetProcessAncestorsFilePackageVersion() []string

+ func (ev *Event) GetProcessAncestorsFilePath() []string

+ func (ev *Event) GetProcessAncestorsFilePathLength() []int

+ func (ev *Event) GetProcessAncestorsFileRights() []int

+ func (ev *Event) GetProcessAncestorsFileUid() []uint32

+ func (ev *Event) GetProcessAncestorsFileUser() []string

+ func (ev *Event) GetProcessAncestorsFsgid() []uint32

+ func (ev *Event) GetProcessAncestorsFsgroup() []string

+ func (ev *Event) GetProcessAncestorsFsuid() []uint32

+ func (ev *Event) GetProcessAncestorsFsuser() []string

+ func (ev *Event) GetProcessAncestorsGid() []uint32

+ func (ev *Event) GetProcessAncestorsGroup() []string

+ func (ev *Event) GetProcessAncestorsInterpreterFileChangeTime() []uint64

+ func (ev *Event) GetProcessAncestorsInterpreterFileFilesystem() []string

+ func (ev *Event) GetProcessAncestorsInterpreterFileGid() []uint32

+ func (ev *Event) GetProcessAncestorsInterpreterFileGroup() []string

+ func (ev *Event) GetProcessAncestorsInterpreterFileHashes() []string

+ func (ev *Event) GetProcessAncestorsInterpreterFileInUpperLayer() []bool

+ func (ev *Event) GetProcessAncestorsInterpreterFileInode() []uint64

+ func (ev *Event) GetProcessAncestorsInterpreterFileMode() []uint16

+ func (ev *Event) GetProcessAncestorsInterpreterFileModificationTime() []uint64

+ func (ev *Event) GetProcessAncestorsInterpreterFileMountId() []uint32

+ func (ev *Event) GetProcessAncestorsInterpreterFileName() []string

+ func (ev *Event) GetProcessAncestorsInterpreterFileNameLength() []int

+ func (ev *Event) GetProcessAncestorsInterpreterFilePackageName() []string

+ func (ev *Event) GetProcessAncestorsInterpreterFilePackageSourceVersion() []string

+ func (ev *Event) GetProcessAncestorsInterpreterFilePackageVersion() []string

+ func (ev *Event) GetProcessAncestorsInterpreterFilePath() []string

+ func (ev *Event) GetProcessAncestorsInterpreterFilePathLength() []int

+ func (ev *Event) GetProcessAncestorsInterpreterFileRights() []int

+ func (ev *Event) GetProcessAncestorsInterpreterFileUid() []uint32

+ func (ev *Event) GetProcessAncestorsInterpreterFileUser() []string

+ func (ev *Event) GetProcessAncestorsIsKworker() []bool

+ func (ev *Event) GetProcessAncestorsIsThread() []bool

+ func (ev *Event) GetProcessAncestorsPid() []uint32

+ func (ev *Event) GetProcessAncestorsPpid() []uint32

+ func (ev *Event) GetProcessAncestorsTid() []uint32

+ func (ev *Event) GetProcessAncestorsTtyName() []string

+ func (ev *Event) GetProcessAncestorsUid() []uint32

+ func (ev *Event) GetProcessAncestorsUser() []string

+ func (ev *Event) GetProcessArgs() string

+ func (ev *Event) GetProcessArgsFlags() []string

+ func (ev *Event) GetProcessArgsOptions() []string

+ func (ev *Event) GetProcessArgsTruncated() bool

+ func (ev *Event) GetProcessArgv() []string

+ func (ev *Event) GetProcessArgv0() string

+ func (ev *Event) GetProcessCapEffective() uint64

+ func (ev *Event) GetProcessCapPermitted() uint64

+ func (ev *Event) GetProcessComm() string

+ func (ev *Event) GetProcessContainerId() string

+ func (ev *Event) GetProcessCreatedAt() int

+ func (ev *Event) GetProcessEgid() uint32

+ func (ev *Event) GetProcessEgroup() string

+ func (ev *Event) GetProcessEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessEnvsTruncated() bool

+ func (ev *Event) GetProcessEuid() uint32

+ func (ev *Event) GetProcessEuser() string

+ func (ev *Event) GetProcessExecTime() time.Time

+ func (ev *Event) GetProcessExitTime() time.Time

+ func (ev *Event) GetProcessFileChangeTime() uint64

+ func (ev *Event) GetProcessFileFilesystem() string

+ func (ev *Event) GetProcessFileGid() uint32

+ func (ev *Event) GetProcessFileGroup() string

+ func (ev *Event) GetProcessFileHashes() []string

+ func (ev *Event) GetProcessFileInUpperLayer() bool

+ func (ev *Event) GetProcessFileInode() uint64

+ func (ev *Event) GetProcessFileMode() uint16

+ func (ev *Event) GetProcessFileModificationTime() uint64

+ func (ev *Event) GetProcessFileMountId() uint32

+ func (ev *Event) GetProcessFileName() string

+ func (ev *Event) GetProcessFileNameLength() int

+ func (ev *Event) GetProcessFilePackageName() string

+ func (ev *Event) GetProcessFilePackageSourceVersion() string

+ func (ev *Event) GetProcessFilePackageVersion() string

+ func (ev *Event) GetProcessFilePath() string

+ func (ev *Event) GetProcessFilePathLength() int

+ func (ev *Event) GetProcessFileRights() int

+ func (ev *Event) GetProcessFileUid() uint32

+ func (ev *Event) GetProcessFileUser() string

+ func (ev *Event) GetProcessForkTime() time.Time

+ func (ev *Event) GetProcessFsgid() uint32

+ func (ev *Event) GetProcessFsgroup() string

+ func (ev *Event) GetProcessFsuid() uint32

+ func (ev *Event) GetProcessFsuser() string

+ func (ev *Event) GetProcessGid() uint32

+ func (ev *Event) GetProcessGroup() string

+ func (ev *Event) GetProcessInterpreterFileChangeTime() uint64

+ func (ev *Event) GetProcessInterpreterFileFilesystem() string

+ func (ev *Event) GetProcessInterpreterFileGid() uint32

+ func (ev *Event) GetProcessInterpreterFileGroup() string

+ func (ev *Event) GetProcessInterpreterFileHashes() []string

+ func (ev *Event) GetProcessInterpreterFileInUpperLayer() bool

+ func (ev *Event) GetProcessInterpreterFileInode() uint64

+ func (ev *Event) GetProcessInterpreterFileMode() uint16

+ func (ev *Event) GetProcessInterpreterFileModificationTime() uint64

+ func (ev *Event) GetProcessInterpreterFileMountId() uint32

+ func (ev *Event) GetProcessInterpreterFileName() string

+ func (ev *Event) GetProcessInterpreterFileNameLength() int

+ func (ev *Event) GetProcessInterpreterFilePackageName() string

+ func (ev *Event) GetProcessInterpreterFilePackageSourceVersion() string

+ func (ev *Event) GetProcessInterpreterFilePackageVersion() string

+ func (ev *Event) GetProcessInterpreterFilePath() string

+ func (ev *Event) GetProcessInterpreterFilePathLength() int

+ func (ev *Event) GetProcessInterpreterFileRights() int

+ func (ev *Event) GetProcessInterpreterFileUid() uint32

+ func (ev *Event) GetProcessInterpreterFileUser() string

+ func (ev *Event) GetProcessIsKworker() bool

+ func (ev *Event) GetProcessIsThread() bool

+ func (ev *Event) GetProcessParentArgs() string

+ func (ev *Event) GetProcessParentArgsFlags() []string

+ func (ev *Event) GetProcessParentArgsOptions() []string

+ func (ev *Event) GetProcessParentArgsTruncated() bool

+ func (ev *Event) GetProcessParentArgv() []string

+ func (ev *Event) GetProcessParentArgv0() string

+ func (ev *Event) GetProcessParentCapEffective() uint64

+ func (ev *Event) GetProcessParentCapPermitted() uint64

+ func (ev *Event) GetProcessParentComm() string

+ func (ev *Event) GetProcessParentContainerId() string

+ func (ev *Event) GetProcessParentCreatedAt() int

+ func (ev *Event) GetProcessParentEgid() uint32

+ func (ev *Event) GetProcessParentEgroup() string

+ func (ev *Event) GetProcessParentEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessParentEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetProcessParentEnvsTruncated() bool

+ func (ev *Event) GetProcessParentEuid() uint32

+ func (ev *Event) GetProcessParentEuser() string

+ func (ev *Event) GetProcessParentFileChangeTime() uint64

+ func (ev *Event) GetProcessParentFileFilesystem() string

+ func (ev *Event) GetProcessParentFileGid() uint32

+ func (ev *Event) GetProcessParentFileGroup() string

+ func (ev *Event) GetProcessParentFileHashes() []string

+ func (ev *Event) GetProcessParentFileInUpperLayer() bool

+ func (ev *Event) GetProcessParentFileInode() uint64

+ func (ev *Event) GetProcessParentFileMode() uint16

+ func (ev *Event) GetProcessParentFileModificationTime() uint64

+ func (ev *Event) GetProcessParentFileMountId() uint32

+ func (ev *Event) GetProcessParentFileName() string

+ func (ev *Event) GetProcessParentFileNameLength() int

+ func (ev *Event) GetProcessParentFilePackageName() string

+ func (ev *Event) GetProcessParentFilePackageSourceVersion() string

+ func (ev *Event) GetProcessParentFilePackageVersion() string

+ func (ev *Event) GetProcessParentFilePath() string

+ func (ev *Event) GetProcessParentFilePathLength() int

+ func (ev *Event) GetProcessParentFileRights() int

+ func (ev *Event) GetProcessParentFileUid() uint32

+ func (ev *Event) GetProcessParentFileUser() string

+ func (ev *Event) GetProcessParentFsgid() uint32

+ func (ev *Event) GetProcessParentFsgroup() string

+ func (ev *Event) GetProcessParentFsuid() uint32

+ func (ev *Event) GetProcessParentFsuser() string

+ func (ev *Event) GetProcessParentGid() uint32

+ func (ev *Event) GetProcessParentGroup() string

+ func (ev *Event) GetProcessParentInterpreterFileChangeTime() uint64

+ func (ev *Event) GetProcessParentInterpreterFileFilesystem() string

+ func (ev *Event) GetProcessParentInterpreterFileGid() uint32

+ func (ev *Event) GetProcessParentInterpreterFileGroup() string

+ func (ev *Event) GetProcessParentInterpreterFileHashes() []string

+ func (ev *Event) GetProcessParentInterpreterFileInUpperLayer() bool

+ func (ev *Event) GetProcessParentInterpreterFileInode() uint64

+ func (ev *Event) GetProcessParentInterpreterFileMode() uint16

+ func (ev *Event) GetProcessParentInterpreterFileModificationTime() uint64

+ func (ev *Event) GetProcessParentInterpreterFileMountId() uint32

+ func (ev *Event) GetProcessParentInterpreterFileName() string

+ func (ev *Event) GetProcessParentInterpreterFileNameLength() int

+ func (ev *Event) GetProcessParentInterpreterFilePackageName() string

+ func (ev *Event) GetProcessParentInterpreterFilePackageSourceVersion() string

+ func (ev *Event) GetProcessParentInterpreterFilePackageVersion() string

+ func (ev *Event) GetProcessParentInterpreterFilePath() string

+ func (ev *Event) GetProcessParentInterpreterFilePathLength() int

+ func (ev *Event) GetProcessParentInterpreterFileRights() int

+ func (ev *Event) GetProcessParentInterpreterFileUid() uint32

+ func (ev *Event) GetProcessParentInterpreterFileUser() string

+ func (ev *Event) GetProcessParentIsKworker() bool

+ func (ev *Event) GetProcessParentIsThread() bool

+ func (ev *Event) GetProcessParentPid() uint32

+ func (ev *Event) GetProcessParentPpid() uint32

+ func (ev *Event) GetProcessParentTid() uint32

+ func (ev *Event) GetProcessParentTtyName() string

+ func (ev *Event) GetProcessParentUid() uint32

+ func (ev *Event) GetProcessParentUser() string

+ func (ev *Event) GetProcessPid() uint32

+ func (ev *Event) GetProcessPpid() uint32

+ func (ev *Event) GetProcessTid() uint32

+ func (ev *Event) GetProcessTtyName() string

+ func (ev *Event) GetProcessUid() uint32

+ func (ev *Event) GetProcessUser() string

+ func (ev *Event) GetPtraceRequest() uint32

+ func (ev *Event) GetPtraceRetval() int64

+ func (ev *Event) GetPtraceTraceeAncestorsArgs() []string

+ func (ev *Event) GetPtraceTraceeAncestorsArgsFlags() []string

+ func (ev *Event) GetPtraceTraceeAncestorsArgsOptions() []string

+ func (ev *Event) GetPtraceTraceeAncestorsArgsTruncated() []bool

+ func (ev *Event) GetPtraceTraceeAncestorsArgv() []string

+ func (ev *Event) GetPtraceTraceeAncestorsArgv0() []string

+ func (ev *Event) GetPtraceTraceeAncestorsCapEffective() []uint64

+ func (ev *Event) GetPtraceTraceeAncestorsCapPermitted() []uint64

+ func (ev *Event) GetPtraceTraceeAncestorsComm() []string

+ func (ev *Event) GetPtraceTraceeAncestorsContainerId() []string

+ func (ev *Event) GetPtraceTraceeAncestorsCreatedAt() []int

+ func (ev *Event) GetPtraceTraceeAncestorsEgid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsEgroup() []string

+ func (ev *Event) GetPtraceTraceeAncestorsEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetPtraceTraceeAncestorsEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetPtraceTraceeAncestorsEnvsTruncated() []bool

+ func (ev *Event) GetPtraceTraceeAncestorsEuid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsEuser() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFileChangeTime() []uint64

+ func (ev *Event) GetPtraceTraceeAncestorsFileFilesystem() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFileGid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsFileGroup() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFileHashes() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFileInUpperLayer() []bool

+ func (ev *Event) GetPtraceTraceeAncestorsFileInode() []uint64

+ func (ev *Event) GetPtraceTraceeAncestorsFileMode() []uint16

+ func (ev *Event) GetPtraceTraceeAncestorsFileModificationTime() []uint64

+ func (ev *Event) GetPtraceTraceeAncestorsFileMountId() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsFileName() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFileNameLength() []int

+ func (ev *Event) GetPtraceTraceeAncestorsFilePackageName() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFilePackageSourceVersion() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFilePackageVersion() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFilePath() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFilePathLength() []int

+ func (ev *Event) GetPtraceTraceeAncestorsFileRights() []int

+ func (ev *Event) GetPtraceTraceeAncestorsFileUid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsFileUser() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFsgid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsFsgroup() []string

+ func (ev *Event) GetPtraceTraceeAncestorsFsuid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsFsuser() []string

+ func (ev *Event) GetPtraceTraceeAncestorsGid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsGroup() []string

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileChangeTime() []uint64

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileFilesystem() []string

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileGid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileGroup() []string

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileHashes() []string

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileInUpperLayer() []bool

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileInode() []uint64

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileMode() []uint16

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileModificationTime() []uint64

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileMountId() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileName() []string

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileNameLength() []int

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFilePackageName() []string

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFilePackageSourceVersion() []string

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFilePackageVersion() []string

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFilePath() []string

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFilePathLength() []int

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileRights() []int

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileUid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileUser() []string

+ func (ev *Event) GetPtraceTraceeAncestorsIsKworker() []bool

+ func (ev *Event) GetPtraceTraceeAncestorsIsThread() []bool

+ func (ev *Event) GetPtraceTraceeAncestorsPid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsPpid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsTid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsTtyName() []string

+ func (ev *Event) GetPtraceTraceeAncestorsUid() []uint32

+ func (ev *Event) GetPtraceTraceeAncestorsUser() []string

+ func (ev *Event) GetPtraceTraceeArgs() string

+ func (ev *Event) GetPtraceTraceeArgsFlags() []string

+ func (ev *Event) GetPtraceTraceeArgsOptions() []string

+ func (ev *Event) GetPtraceTraceeArgsTruncated() bool

+ func (ev *Event) GetPtraceTraceeArgv() []string

+ func (ev *Event) GetPtraceTraceeArgv0() string

+ func (ev *Event) GetPtraceTraceeCapEffective() uint64

+ func (ev *Event) GetPtraceTraceeCapPermitted() uint64

+ func (ev *Event) GetPtraceTraceeComm() string

+ func (ev *Event) GetPtraceTraceeContainerId() string

+ func (ev *Event) GetPtraceTraceeCreatedAt() int

+ func (ev *Event) GetPtraceTraceeEgid() uint32

+ func (ev *Event) GetPtraceTraceeEgroup() string

+ func (ev *Event) GetPtraceTraceeEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetPtraceTraceeEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetPtraceTraceeEnvsTruncated() bool

+ func (ev *Event) GetPtraceTraceeEuid() uint32

+ func (ev *Event) GetPtraceTraceeEuser() string

+ func (ev *Event) GetPtraceTraceeExecTime() time.Time

+ func (ev *Event) GetPtraceTraceeExitTime() time.Time

+ func (ev *Event) GetPtraceTraceeFileChangeTime() uint64

+ func (ev *Event) GetPtraceTraceeFileFilesystem() string

+ func (ev *Event) GetPtraceTraceeFileGid() uint32

+ func (ev *Event) GetPtraceTraceeFileGroup() string

+ func (ev *Event) GetPtraceTraceeFileHashes() []string

+ func (ev *Event) GetPtraceTraceeFileInUpperLayer() bool

+ func (ev *Event) GetPtraceTraceeFileInode() uint64

+ func (ev *Event) GetPtraceTraceeFileMode() uint16

+ func (ev *Event) GetPtraceTraceeFileModificationTime() uint64

+ func (ev *Event) GetPtraceTraceeFileMountId() uint32

+ func (ev *Event) GetPtraceTraceeFileName() string

+ func (ev *Event) GetPtraceTraceeFileNameLength() int

+ func (ev *Event) GetPtraceTraceeFilePackageName() string

+ func (ev *Event) GetPtraceTraceeFilePackageSourceVersion() string

+ func (ev *Event) GetPtraceTraceeFilePackageVersion() string

+ func (ev *Event) GetPtraceTraceeFilePath() string

+ func (ev *Event) GetPtraceTraceeFilePathLength() int

+ func (ev *Event) GetPtraceTraceeFileRights() int

+ func (ev *Event) GetPtraceTraceeFileUid() uint32

+ func (ev *Event) GetPtraceTraceeFileUser() string

+ func (ev *Event) GetPtraceTraceeForkTime() time.Time

+ func (ev *Event) GetPtraceTraceeFsgid() uint32

+ func (ev *Event) GetPtraceTraceeFsgroup() string

+ func (ev *Event) GetPtraceTraceeFsuid() uint32

+ func (ev *Event) GetPtraceTraceeFsuser() string

+ func (ev *Event) GetPtraceTraceeGid() uint32

+ func (ev *Event) GetPtraceTraceeGroup() string

+ func (ev *Event) GetPtraceTraceeInterpreterFileChangeTime() uint64

+ func (ev *Event) GetPtraceTraceeInterpreterFileFilesystem() string

+ func (ev *Event) GetPtraceTraceeInterpreterFileGid() uint32

+ func (ev *Event) GetPtraceTraceeInterpreterFileGroup() string

+ func (ev *Event) GetPtraceTraceeInterpreterFileHashes() []string

+ func (ev *Event) GetPtraceTraceeInterpreterFileInUpperLayer() bool

+ func (ev *Event) GetPtraceTraceeInterpreterFileInode() uint64

+ func (ev *Event) GetPtraceTraceeInterpreterFileMode() uint16

+ func (ev *Event) GetPtraceTraceeInterpreterFileModificationTime() uint64

+ func (ev *Event) GetPtraceTraceeInterpreterFileMountId() uint32

+ func (ev *Event) GetPtraceTraceeInterpreterFileName() string

+ func (ev *Event) GetPtraceTraceeInterpreterFileNameLength() int

+ func (ev *Event) GetPtraceTraceeInterpreterFilePackageName() string

+ func (ev *Event) GetPtraceTraceeInterpreterFilePackageSourceVersion() string

+ func (ev *Event) GetPtraceTraceeInterpreterFilePackageVersion() string

+ func (ev *Event) GetPtraceTraceeInterpreterFilePath() string

+ func (ev *Event) GetPtraceTraceeInterpreterFilePathLength() int

+ func (ev *Event) GetPtraceTraceeInterpreterFileRights() int

+ func (ev *Event) GetPtraceTraceeInterpreterFileUid() uint32

+ func (ev *Event) GetPtraceTraceeInterpreterFileUser() string

+ func (ev *Event) GetPtraceTraceeIsKworker() bool

+ func (ev *Event) GetPtraceTraceeIsThread() bool

+ func (ev *Event) GetPtraceTraceeParentArgs() string

+ func (ev *Event) GetPtraceTraceeParentArgsFlags() []string

+ func (ev *Event) GetPtraceTraceeParentArgsOptions() []string

+ func (ev *Event) GetPtraceTraceeParentArgsTruncated() bool

+ func (ev *Event) GetPtraceTraceeParentArgv() []string

+ func (ev *Event) GetPtraceTraceeParentArgv0() string

+ func (ev *Event) GetPtraceTraceeParentCapEffective() uint64

+ func (ev *Event) GetPtraceTraceeParentCapPermitted() uint64

+ func (ev *Event) GetPtraceTraceeParentComm() string

+ func (ev *Event) GetPtraceTraceeParentContainerId() string

+ func (ev *Event) GetPtraceTraceeParentCreatedAt() int

+ func (ev *Event) GetPtraceTraceeParentEgid() uint32

+ func (ev *Event) GetPtraceTraceeParentEgroup() string

+ func (ev *Event) GetPtraceTraceeParentEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetPtraceTraceeParentEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetPtraceTraceeParentEnvsTruncated() bool

+ func (ev *Event) GetPtraceTraceeParentEuid() uint32

+ func (ev *Event) GetPtraceTraceeParentEuser() string

+ func (ev *Event) GetPtraceTraceeParentFileChangeTime() uint64

+ func (ev *Event) GetPtraceTraceeParentFileFilesystem() string

+ func (ev *Event) GetPtraceTraceeParentFileGid() uint32

+ func (ev *Event) GetPtraceTraceeParentFileGroup() string

+ func (ev *Event) GetPtraceTraceeParentFileHashes() []string

+ func (ev *Event) GetPtraceTraceeParentFileInUpperLayer() bool

+ func (ev *Event) GetPtraceTraceeParentFileInode() uint64

+ func (ev *Event) GetPtraceTraceeParentFileMode() uint16

+ func (ev *Event) GetPtraceTraceeParentFileModificationTime() uint64

+ func (ev *Event) GetPtraceTraceeParentFileMountId() uint32

+ func (ev *Event) GetPtraceTraceeParentFileName() string

+ func (ev *Event) GetPtraceTraceeParentFileNameLength() int

+ func (ev *Event) GetPtraceTraceeParentFilePackageName() string

+ func (ev *Event) GetPtraceTraceeParentFilePackageSourceVersion() string

+ func (ev *Event) GetPtraceTraceeParentFilePackageVersion() string

+ func (ev *Event) GetPtraceTraceeParentFilePath() string

+ func (ev *Event) GetPtraceTraceeParentFilePathLength() int

+ func (ev *Event) GetPtraceTraceeParentFileRights() int

+ func (ev *Event) GetPtraceTraceeParentFileUid() uint32

+ func (ev *Event) GetPtraceTraceeParentFileUser() string

+ func (ev *Event) GetPtraceTraceeParentFsgid() uint32

+ func (ev *Event) GetPtraceTraceeParentFsgroup() string

+ func (ev *Event) GetPtraceTraceeParentFsuid() uint32

+ func (ev *Event) GetPtraceTraceeParentFsuser() string

+ func (ev *Event) GetPtraceTraceeParentGid() uint32

+ func (ev *Event) GetPtraceTraceeParentGroup() string

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileChangeTime() uint64

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileFilesystem() string

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileGid() uint32

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileGroup() string

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileHashes() []string

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileInUpperLayer() bool

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileInode() uint64

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileMode() uint16

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileModificationTime() uint64

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileMountId() uint32

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileName() string

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileNameLength() int

+ func (ev *Event) GetPtraceTraceeParentInterpreterFilePackageName() string

+ func (ev *Event) GetPtraceTraceeParentInterpreterFilePackageSourceVersion() string

+ func (ev *Event) GetPtraceTraceeParentInterpreterFilePackageVersion() string

+ func (ev *Event) GetPtraceTraceeParentInterpreterFilePath() string

+ func (ev *Event) GetPtraceTraceeParentInterpreterFilePathLength() int

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileRights() int

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileUid() uint32

+ func (ev *Event) GetPtraceTraceeParentInterpreterFileUser() string

+ func (ev *Event) GetPtraceTraceeParentIsKworker() bool

+ func (ev *Event) GetPtraceTraceeParentIsThread() bool

+ func (ev *Event) GetPtraceTraceeParentPid() uint32

+ func (ev *Event) GetPtraceTraceeParentPpid() uint32

+ func (ev *Event) GetPtraceTraceeParentTid() uint32

+ func (ev *Event) GetPtraceTraceeParentTtyName() string

+ func (ev *Event) GetPtraceTraceeParentUid() uint32

+ func (ev *Event) GetPtraceTraceeParentUser() string

+ func (ev *Event) GetPtraceTraceePid() uint32

+ func (ev *Event) GetPtraceTraceePpid() uint32

+ func (ev *Event) GetPtraceTraceeTid() uint32

+ func (ev *Event) GetPtraceTraceeTtyName() string

+ func (ev *Event) GetPtraceTraceeUid() uint32

+ func (ev *Event) GetPtraceTraceeUser() string

+ func (ev *Event) GetRemovexattrFileChangeTime() uint64

+ func (ev *Event) GetRemovexattrFileDestinationName() string

+ func (ev *Event) GetRemovexattrFileDestinationNamespace() string

+ func (ev *Event) GetRemovexattrFileFilesystem() string

+ func (ev *Event) GetRemovexattrFileGid() uint32

+ func (ev *Event) GetRemovexattrFileGroup() string

+ func (ev *Event) GetRemovexattrFileHashes() []string

+ func (ev *Event) GetRemovexattrFileInUpperLayer() bool

+ func (ev *Event) GetRemovexattrFileInode() uint64

+ func (ev *Event) GetRemovexattrFileMode() uint16

+ func (ev *Event) GetRemovexattrFileModificationTime() uint64

+ func (ev *Event) GetRemovexattrFileMountId() uint32

+ func (ev *Event) GetRemovexattrFileName() string

+ func (ev *Event) GetRemovexattrFileNameLength() int

+ func (ev *Event) GetRemovexattrFilePackageName() string

+ func (ev *Event) GetRemovexattrFilePackageSourceVersion() string

+ func (ev *Event) GetRemovexattrFilePackageVersion() string

+ func (ev *Event) GetRemovexattrFilePath() string

+ func (ev *Event) GetRemovexattrFilePathLength() int

+ func (ev *Event) GetRemovexattrFileRights() int

+ func (ev *Event) GetRemovexattrFileUid() uint32

+ func (ev *Event) GetRemovexattrFileUser() string

+ func (ev *Event) GetRemovexattrRetval() int64

+ func (ev *Event) GetRenameFileChangeTime() uint64

+ func (ev *Event) GetRenameFileDestinationChangeTime() uint64

+ func (ev *Event) GetRenameFileDestinationFilesystem() string

+ func (ev *Event) GetRenameFileDestinationGid() uint32

+ func (ev *Event) GetRenameFileDestinationGroup() string

+ func (ev *Event) GetRenameFileDestinationHashes() []string

+ func (ev *Event) GetRenameFileDestinationInUpperLayer() bool

+ func (ev *Event) GetRenameFileDestinationInode() uint64

+ func (ev *Event) GetRenameFileDestinationMode() uint16

+ func (ev *Event) GetRenameFileDestinationModificationTime() uint64

+ func (ev *Event) GetRenameFileDestinationMountId() uint32

+ func (ev *Event) GetRenameFileDestinationName() string

+ func (ev *Event) GetRenameFileDestinationNameLength() int

+ func (ev *Event) GetRenameFileDestinationPackageName() string

+ func (ev *Event) GetRenameFileDestinationPackageSourceVersion() string

+ func (ev *Event) GetRenameFileDestinationPackageVersion() string

+ func (ev *Event) GetRenameFileDestinationPath() string

+ func (ev *Event) GetRenameFileDestinationPathLength() int

+ func (ev *Event) GetRenameFileDestinationRights() int

+ func (ev *Event) GetRenameFileDestinationUid() uint32

+ func (ev *Event) GetRenameFileDestinationUser() string

+ func (ev *Event) GetRenameFileFilesystem() string

+ func (ev *Event) GetRenameFileGid() uint32

+ func (ev *Event) GetRenameFileGroup() string

+ func (ev *Event) GetRenameFileHashes() []string

+ func (ev *Event) GetRenameFileInUpperLayer() bool

+ func (ev *Event) GetRenameFileInode() uint64

+ func (ev *Event) GetRenameFileMode() uint16

+ func (ev *Event) GetRenameFileModificationTime() uint64

+ func (ev *Event) GetRenameFileMountId() uint32

+ func (ev *Event) GetRenameFileName() string

+ func (ev *Event) GetRenameFileNameLength() int

+ func (ev *Event) GetRenameFilePackageName() string

+ func (ev *Event) GetRenameFilePackageSourceVersion() string

+ func (ev *Event) GetRenameFilePackageVersion() string

+ func (ev *Event) GetRenameFilePath() string

+ func (ev *Event) GetRenameFilePathLength() int

+ func (ev *Event) GetRenameFileRights() int

+ func (ev *Event) GetRenameFileUid() uint32

+ func (ev *Event) GetRenameFileUser() string

+ func (ev *Event) GetRenameRetval() int64

+ func (ev *Event) GetRmdirFileChangeTime() uint64

+ func (ev *Event) GetRmdirFileFilesystem() string

+ func (ev *Event) GetRmdirFileGid() uint32

+ func (ev *Event) GetRmdirFileGroup() string

+ func (ev *Event) GetRmdirFileHashes() []string

+ func (ev *Event) GetRmdirFileInUpperLayer() bool

+ func (ev *Event) GetRmdirFileInode() uint64

+ func (ev *Event) GetRmdirFileMode() uint16

+ func (ev *Event) GetRmdirFileModificationTime() uint64

+ func (ev *Event) GetRmdirFileMountId() uint32

+ func (ev *Event) GetRmdirFileName() string

+ func (ev *Event) GetRmdirFileNameLength() int

+ func (ev *Event) GetRmdirFilePackageName() string

+ func (ev *Event) GetRmdirFilePackageSourceVersion() string

+ func (ev *Event) GetRmdirFilePackageVersion() string

+ func (ev *Event) GetRmdirFilePath() string

+ func (ev *Event) GetRmdirFilePathLength() int

+ func (ev *Event) GetRmdirFileRights() int

+ func (ev *Event) GetRmdirFileUid() uint32

+ func (ev *Event) GetRmdirFileUser() string

+ func (ev *Event) GetRmdirRetval() int64

+ func (ev *Event) GetSelinuxBoolCommitState() bool

+ func (ev *Event) GetSelinuxBoolName() string

+ func (ev *Event) GetSelinuxBoolState() string

+ func (ev *Event) GetSelinuxEnforceStatus() string

+ func (ev *Event) GetSetgidEgid() uint32

+ func (ev *Event) GetSetgidEgroup() string

+ func (ev *Event) GetSetgidFsgid() uint32

+ func (ev *Event) GetSetgidFsgroup() string

+ func (ev *Event) GetSetgidGid() uint32

+ func (ev *Event) GetSetgidGroup() string

+ func (ev *Event) GetSetuidEuid() uint32

+ func (ev *Event) GetSetuidEuser() string

+ func (ev *Event) GetSetuidFsuid() uint32

+ func (ev *Event) GetSetuidFsuser() string

+ func (ev *Event) GetSetuidUid() uint32

+ func (ev *Event) GetSetuidUser() string

+ func (ev *Event) GetSetxattrFileChangeTime() uint64

+ func (ev *Event) GetSetxattrFileDestinationName() string

+ func (ev *Event) GetSetxattrFileDestinationNamespace() string

+ func (ev *Event) GetSetxattrFileFilesystem() string

+ func (ev *Event) GetSetxattrFileGid() uint32

+ func (ev *Event) GetSetxattrFileGroup() string

+ func (ev *Event) GetSetxattrFileHashes() []string

+ func (ev *Event) GetSetxattrFileInUpperLayer() bool

+ func (ev *Event) GetSetxattrFileInode() uint64

+ func (ev *Event) GetSetxattrFileMode() uint16

+ func (ev *Event) GetSetxattrFileModificationTime() uint64

+ func (ev *Event) GetSetxattrFileMountId() uint32

+ func (ev *Event) GetSetxattrFileName() string

+ func (ev *Event) GetSetxattrFileNameLength() int

+ func (ev *Event) GetSetxattrFilePackageName() string

+ func (ev *Event) GetSetxattrFilePackageSourceVersion() string

+ func (ev *Event) GetSetxattrFilePackageVersion() string

+ func (ev *Event) GetSetxattrFilePath() string

+ func (ev *Event) GetSetxattrFilePathLength() int

+ func (ev *Event) GetSetxattrFileRights() int

+ func (ev *Event) GetSetxattrFileUid() uint32

+ func (ev *Event) GetSetxattrFileUser() string

+ func (ev *Event) GetSetxattrRetval() int64

+ func (ev *Event) GetSignalPid() uint32

+ func (ev *Event) GetSignalRetval() int64

+ func (ev *Event) GetSignalTargetAncestorsArgs() []string

+ func (ev *Event) GetSignalTargetAncestorsArgsFlags() []string

+ func (ev *Event) GetSignalTargetAncestorsArgsOptions() []string

+ func (ev *Event) GetSignalTargetAncestorsArgsTruncated() []bool

+ func (ev *Event) GetSignalTargetAncestorsArgv() []string

+ func (ev *Event) GetSignalTargetAncestorsArgv0() []string

+ func (ev *Event) GetSignalTargetAncestorsCapEffective() []uint64

+ func (ev *Event) GetSignalTargetAncestorsCapPermitted() []uint64

+ func (ev *Event) GetSignalTargetAncestorsComm() []string

+ func (ev *Event) GetSignalTargetAncestorsContainerId() []string

+ func (ev *Event) GetSignalTargetAncestorsCreatedAt() []int

+ func (ev *Event) GetSignalTargetAncestorsEgid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsEgroup() []string

+ func (ev *Event) GetSignalTargetAncestorsEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetSignalTargetAncestorsEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetSignalTargetAncestorsEnvsTruncated() []bool

+ func (ev *Event) GetSignalTargetAncestorsEuid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsEuser() []string

+ func (ev *Event) GetSignalTargetAncestorsFileChangeTime() []uint64

+ func (ev *Event) GetSignalTargetAncestorsFileFilesystem() []string

+ func (ev *Event) GetSignalTargetAncestorsFileGid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsFileGroup() []string

+ func (ev *Event) GetSignalTargetAncestorsFileHashes() []string

+ func (ev *Event) GetSignalTargetAncestorsFileInUpperLayer() []bool

+ func (ev *Event) GetSignalTargetAncestorsFileInode() []uint64

+ func (ev *Event) GetSignalTargetAncestorsFileMode() []uint16

+ func (ev *Event) GetSignalTargetAncestorsFileModificationTime() []uint64

+ func (ev *Event) GetSignalTargetAncestorsFileMountId() []uint32

+ func (ev *Event) GetSignalTargetAncestorsFileName() []string

+ func (ev *Event) GetSignalTargetAncestorsFileNameLength() []int

+ func (ev *Event) GetSignalTargetAncestorsFilePackageName() []string

+ func (ev *Event) GetSignalTargetAncestorsFilePackageSourceVersion() []string

+ func (ev *Event) GetSignalTargetAncestorsFilePackageVersion() []string

+ func (ev *Event) GetSignalTargetAncestorsFilePath() []string

+ func (ev *Event) GetSignalTargetAncestorsFilePathLength() []int

+ func (ev *Event) GetSignalTargetAncestorsFileRights() []int

+ func (ev *Event) GetSignalTargetAncestorsFileUid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsFileUser() []string

+ func (ev *Event) GetSignalTargetAncestorsFsgid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsFsgroup() []string

+ func (ev *Event) GetSignalTargetAncestorsFsuid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsFsuser() []string

+ func (ev *Event) GetSignalTargetAncestorsGid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsGroup() []string

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileChangeTime() []uint64

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileFilesystem() []string

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileGid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileGroup() []string

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileHashes() []string

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileInUpperLayer() []bool

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileInode() []uint64

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileMode() []uint16

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileModificationTime() []uint64

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileMountId() []uint32

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileName() []string

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileNameLength() []int

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFilePackageName() []string

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFilePackageSourceVersion() []string

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFilePackageVersion() []string

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFilePath() []string

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFilePathLength() []int

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileRights() []int

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileUid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsInterpreterFileUser() []string

+ func (ev *Event) GetSignalTargetAncestorsIsKworker() []bool

+ func (ev *Event) GetSignalTargetAncestorsIsThread() []bool

+ func (ev *Event) GetSignalTargetAncestorsPid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsPpid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsTid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsTtyName() []string

+ func (ev *Event) GetSignalTargetAncestorsUid() []uint32

+ func (ev *Event) GetSignalTargetAncestorsUser() []string

+ func (ev *Event) GetSignalTargetArgs() string

+ func (ev *Event) GetSignalTargetArgsFlags() []string

+ func (ev *Event) GetSignalTargetArgsOptions() []string

+ func (ev *Event) GetSignalTargetArgsTruncated() bool

+ func (ev *Event) GetSignalTargetArgv() []string

+ func (ev *Event) GetSignalTargetArgv0() string

+ func (ev *Event) GetSignalTargetCapEffective() uint64

+ func (ev *Event) GetSignalTargetCapPermitted() uint64

+ func (ev *Event) GetSignalTargetComm() string

+ func (ev *Event) GetSignalTargetContainerId() string

+ func (ev *Event) GetSignalTargetCreatedAt() int

+ func (ev *Event) GetSignalTargetEgid() uint32

+ func (ev *Event) GetSignalTargetEgroup() string

+ func (ev *Event) GetSignalTargetEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetSignalTargetEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetSignalTargetEnvsTruncated() bool

+ func (ev *Event) GetSignalTargetEuid() uint32

+ func (ev *Event) GetSignalTargetEuser() string

+ func (ev *Event) GetSignalTargetExecTime() time.Time

+ func (ev *Event) GetSignalTargetExitTime() time.Time

+ func (ev *Event) GetSignalTargetFileChangeTime() uint64

+ func (ev *Event) GetSignalTargetFileFilesystem() string

+ func (ev *Event) GetSignalTargetFileGid() uint32

+ func (ev *Event) GetSignalTargetFileGroup() string

+ func (ev *Event) GetSignalTargetFileHashes() []string

+ func (ev *Event) GetSignalTargetFileInUpperLayer() bool

+ func (ev *Event) GetSignalTargetFileInode() uint64

+ func (ev *Event) GetSignalTargetFileMode() uint16

+ func (ev *Event) GetSignalTargetFileModificationTime() uint64

+ func (ev *Event) GetSignalTargetFileMountId() uint32

+ func (ev *Event) GetSignalTargetFileName() string

+ func (ev *Event) GetSignalTargetFileNameLength() int

+ func (ev *Event) GetSignalTargetFilePackageName() string

+ func (ev *Event) GetSignalTargetFilePackageSourceVersion() string

+ func (ev *Event) GetSignalTargetFilePackageVersion() string

+ func (ev *Event) GetSignalTargetFilePath() string

+ func (ev *Event) GetSignalTargetFilePathLength() int

+ func (ev *Event) GetSignalTargetFileRights() int

+ func (ev *Event) GetSignalTargetFileUid() uint32

+ func (ev *Event) GetSignalTargetFileUser() string

+ func (ev *Event) GetSignalTargetForkTime() time.Time

+ func (ev *Event) GetSignalTargetFsgid() uint32

+ func (ev *Event) GetSignalTargetFsgroup() string

+ func (ev *Event) GetSignalTargetFsuid() uint32

+ func (ev *Event) GetSignalTargetFsuser() string

+ func (ev *Event) GetSignalTargetGid() uint32

+ func (ev *Event) GetSignalTargetGroup() string

+ func (ev *Event) GetSignalTargetInterpreterFileChangeTime() uint64

+ func (ev *Event) GetSignalTargetInterpreterFileFilesystem() string

+ func (ev *Event) GetSignalTargetInterpreterFileGid() uint32

+ func (ev *Event) GetSignalTargetInterpreterFileGroup() string

+ func (ev *Event) GetSignalTargetInterpreterFileHashes() []string

+ func (ev *Event) GetSignalTargetInterpreterFileInUpperLayer() bool

+ func (ev *Event) GetSignalTargetInterpreterFileInode() uint64

+ func (ev *Event) GetSignalTargetInterpreterFileMode() uint16

+ func (ev *Event) GetSignalTargetInterpreterFileModificationTime() uint64

+ func (ev *Event) GetSignalTargetInterpreterFileMountId() uint32

+ func (ev *Event) GetSignalTargetInterpreterFileName() string

+ func (ev *Event) GetSignalTargetInterpreterFileNameLength() int

+ func (ev *Event) GetSignalTargetInterpreterFilePackageName() string

+ func (ev *Event) GetSignalTargetInterpreterFilePackageSourceVersion() string

+ func (ev *Event) GetSignalTargetInterpreterFilePackageVersion() string

+ func (ev *Event) GetSignalTargetInterpreterFilePath() string

+ func (ev *Event) GetSignalTargetInterpreterFilePathLength() int

+ func (ev *Event) GetSignalTargetInterpreterFileRights() int

+ func (ev *Event) GetSignalTargetInterpreterFileUid() uint32

+ func (ev *Event) GetSignalTargetInterpreterFileUser() string

+ func (ev *Event) GetSignalTargetIsKworker() bool

+ func (ev *Event) GetSignalTargetIsThread() bool

+ func (ev *Event) GetSignalTargetParentArgs() string

+ func (ev *Event) GetSignalTargetParentArgsFlags() []string

+ func (ev *Event) GetSignalTargetParentArgsOptions() []string

+ func (ev *Event) GetSignalTargetParentArgsTruncated() bool

+ func (ev *Event) GetSignalTargetParentArgv() []string

+ func (ev *Event) GetSignalTargetParentArgv0() string

+ func (ev *Event) GetSignalTargetParentCapEffective() uint64

+ func (ev *Event) GetSignalTargetParentCapPermitted() uint64

+ func (ev *Event) GetSignalTargetParentComm() string

+ func (ev *Event) GetSignalTargetParentContainerId() string

+ func (ev *Event) GetSignalTargetParentCreatedAt() int

+ func (ev *Event) GetSignalTargetParentEgid() uint32

+ func (ev *Event) GetSignalTargetParentEgroup() string

+ func (ev *Event) GetSignalTargetParentEnvp(desiredKeys map[string]bool) []string

+ func (ev *Event) GetSignalTargetParentEnvs(desiredKeys map[string]bool) []string

+ func (ev *Event) GetSignalTargetParentEnvsTruncated() bool

+ func (ev *Event) GetSignalTargetParentEuid() uint32

+ func (ev *Event) GetSignalTargetParentEuser() string

+ func (ev *Event) GetSignalTargetParentFileChangeTime() uint64

+ func (ev *Event) GetSignalTargetParentFileFilesystem() string

+ func (ev *Event) GetSignalTargetParentFileGid() uint32

+ func (ev *Event) GetSignalTargetParentFileGroup() string

+ func (ev *Event) GetSignalTargetParentFileHashes() []string

+ func (ev *Event) GetSignalTargetParentFileInUpperLayer() bool

+ func (ev *Event) GetSignalTargetParentFileInode() uint64

+ func (ev *Event) GetSignalTargetParentFileMode() uint16

+ func (ev *Event) GetSignalTargetParentFileModificationTime() uint64

+ func (ev *Event) GetSignalTargetParentFileMountId() uint32

+ func (ev *Event) GetSignalTargetParentFileName() string

+ func (ev *Event) GetSignalTargetParentFileNameLength() int

+ func (ev *Event) GetSignalTargetParentFilePackageName() string

+ func (ev *Event) GetSignalTargetParentFilePackageSourceVersion() string

+ func (ev *Event) GetSignalTargetParentFilePackageVersion() string

+ func (ev *Event) GetSignalTargetParentFilePath() string

+ func (ev *Event) GetSignalTargetParentFilePathLength() int

+ func (ev *Event) GetSignalTargetParentFileRights() int

+ func (ev *Event) GetSignalTargetParentFileUid() uint32

+ func (ev *Event) GetSignalTargetParentFileUser() string

+ func (ev *Event) GetSignalTargetParentFsgid() uint32

+ func (ev *Event) GetSignalTargetParentFsgroup() string

+ func (ev *Event) GetSignalTargetParentFsuid() uint32

+ func (ev *Event) GetSignalTargetParentFsuser() string

+ func (ev *Event) GetSignalTargetParentGid() uint32

+ func (ev *Event) GetSignalTargetParentGroup() string

+ func (ev *Event) GetSignalTargetParentInterpreterFileChangeTime() uint64

+ func (ev *Event) GetSignalTargetParentInterpreterFileFilesystem() string

+ func (ev *Event) GetSignalTargetParentInterpreterFileGid() uint32

+ func (ev *Event) GetSignalTargetParentInterpreterFileGroup() string

+ func (ev *Event) GetSignalTargetParentInterpreterFileHashes() []string

+ func (ev *Event) GetSignalTargetParentInterpreterFileInUpperLayer() bool

+ func (ev *Event) GetSignalTargetParentInterpreterFileInode() uint64

+ func (ev *Event) GetSignalTargetParentInterpreterFileMode() uint16

+ func (ev *Event) GetSignalTargetParentInterpreterFileModificationTime() uint64

+ func (ev *Event) GetSignalTargetParentInterpreterFileMountId() uint32

+ func (ev *Event) GetSignalTargetParentInterpreterFileName() string

+ func (ev *Event) GetSignalTargetParentInterpreterFileNameLength() int

+ func (ev *Event) GetSignalTargetParentInterpreterFilePackageName() string

+ func (ev *Event) GetSignalTargetParentInterpreterFilePackageSourceVersion() string

+ func (ev *Event) GetSignalTargetParentInterpreterFilePackageVersion() string

+ func (ev *Event) GetSignalTargetParentInterpreterFilePath() string

+ func (ev *Event) GetSignalTargetParentInterpreterFilePathLength() int

+ func (ev *Event) GetSignalTargetParentInterpreterFileRights() int

+ func (ev *Event) GetSignalTargetParentInterpreterFileUid() uint32

+ func (ev *Event) GetSignalTargetParentInterpreterFileUser() string

+ func (ev *Event) GetSignalTargetParentIsKworker() bool

+ func (ev *Event) GetSignalTargetParentIsThread() bool

+ func (ev *Event) GetSignalTargetParentPid() uint32

+ func (ev *Event) GetSignalTargetParentPpid() uint32

+ func (ev *Event) GetSignalTargetParentTid() uint32

+ func (ev *Event) GetSignalTargetParentTtyName() string

+ func (ev *Event) GetSignalTargetParentUid() uint32

+ func (ev *Event) GetSignalTargetParentUser() string

+ func (ev *Event) GetSignalTargetPid() uint32

+ func (ev *Event) GetSignalTargetPpid() uint32

+ func (ev *Event) GetSignalTargetTid() uint32

+ func (ev *Event) GetSignalTargetTtyName() string

+ func (ev *Event) GetSignalTargetUid() uint32

+ func (ev *Event) GetSignalTargetUser() string

+ func (ev *Event) GetSignalType() uint32

+ func (ev *Event) GetSpliceFileChangeTime() uint64

+ func (ev *Event) GetSpliceFileFilesystem() string

+ func (ev *Event) GetSpliceFileGid() uint32

+ func (ev *Event) GetSpliceFileGroup() string

+ func (ev *Event) GetSpliceFileHashes() []string

+ func (ev *Event) GetSpliceFileInUpperLayer() bool

+ func (ev *Event) GetSpliceFileInode() uint64

+ func (ev *Event) GetSpliceFileMode() uint16

+ func (ev *Event) GetSpliceFileModificationTime() uint64

+ func (ev *Event) GetSpliceFileMountId() uint32

+ func (ev *Event) GetSpliceFileName() string

+ func (ev *Event) GetSpliceFileNameLength() int

+ func (ev *Event) GetSpliceFilePackageName() string

+ func (ev *Event) GetSpliceFilePackageSourceVersion() string

+ func (ev *Event) GetSpliceFilePackageVersion() string

+ func (ev *Event) GetSpliceFilePath() string

+ func (ev *Event) GetSpliceFilePathLength() int

+ func (ev *Event) GetSpliceFileRights() int

+ func (ev *Event) GetSpliceFileUid() uint32

+ func (ev *Event) GetSpliceFileUser() string

+ func (ev *Event) GetSplicePipeEntryFlag() uint32

+ func (ev *Event) GetSplicePipeExitFlag() uint32

+ func (ev *Event) GetSpliceRetval() int64

+ func (ev *Event) GetTimestamp() time.Time

+ func (ev *Event) GetUnlinkFileChangeTime() uint64

+ func (ev *Event) GetUnlinkFileFilesystem() string

+ func (ev *Event) GetUnlinkFileGid() uint32

+ func (ev *Event) GetUnlinkFileGroup() string

+ func (ev *Event) GetUnlinkFileHashes() []string

+ func (ev *Event) GetUnlinkFileInUpperLayer() bool

+ func (ev *Event) GetUnlinkFileInode() uint64

+ func (ev *Event) GetUnlinkFileMode() uint16

+ func (ev *Event) GetUnlinkFileModificationTime() uint64

+ func (ev *Event) GetUnlinkFileMountId() uint32

+ func (ev *Event) GetUnlinkFileName() string

+ func (ev *Event) GetUnlinkFileNameLength() int

+ func (ev *Event) GetUnlinkFilePackageName() string

+ func (ev *Event) GetUnlinkFilePackageSourceVersion() string

+ func (ev *Event) GetUnlinkFilePackageVersion() string

+ func (ev *Event) GetUnlinkFilePath() string

+ func (ev *Event) GetUnlinkFilePathLength() int

+ func (ev *Event) GetUnlinkFileRights() int

+ func (ev *Event) GetUnlinkFileUid() uint32

+ func (ev *Event) GetUnlinkFileUser() string

+ func (ev *Event) GetUnlinkFlags() uint32

+ func (ev *Event) GetUnlinkRetval() int64

+ func (ev *Event) GetUnloadModuleName() string

+ func (ev *Event) GetUnloadModuleRetval() int64

+ func (ev *Event) GetUtimesFileChangeTime() uint64

+ func (ev *Event) GetUtimesFileFilesystem() string

+ func (ev *Event) GetUtimesFileGid() uint32

+ func (ev *Event) GetUtimesFileGroup() string

+ func (ev *Event) GetUtimesFileHashes() []string

+ func (ev *Event) GetUtimesFileInUpperLayer() bool

+ func (ev *Event) GetUtimesFileInode() uint64

+ func (ev *Event) GetUtimesFileMode() uint16

+ func (ev *Event) GetUtimesFileModificationTime() uint64

+ func (ev *Event) GetUtimesFileMountId() uint32

+ func (ev *Event) GetUtimesFileName() string

+ func (ev *Event) GetUtimesFileNameLength() int

+ func (ev *Event) GetUtimesFilePackageName() string

+ func (ev *Event) GetUtimesFilePackageSourceVersion() string

+ func (ev *Event) GetUtimesFilePackageVersion() string

+ func (ev *Event) GetUtimesFilePath() string

+ func (ev *Event) GetUtimesFilePathLength() int

+ func (ev *Event) GetUtimesFileRights() int

+ func (ev *Event) GetUtimesFileUid() uint32

+ func (ev *Event) GetUtimesFileUser() string

+ func (ev *Event) GetUtimesRetval() int64

type FieldHandlers — darwin/amd64, linux/amd64

+ ResolveProcessArgvScrubbed func(ev *Event, e *Process) []string

type FileFields — darwin/amd64, linux/amd64

+ Device uint32

type HashState

+ const FileEmpty

+ const FileOpenError

type Process — darwin/amd64, linux/amd64

+ IsParentMissing bool

type Process — windows/amd64

+ CmdLine string

type ProcessCacheEntry — darwin/amd64, linux/amd64, windows/amd64

+ func GetPlaceholderProcessCacheEntry(pid uint32, tid uint32, isKworker bool) *ProcessCacheEntry

+ func NewPlaceholderProcessCacheEntry(pid uint32, tid uint32, isKworker bool) *ProcessCacheEntry

+ func (pc *ProcessCacheEntry) HasValidLineage() bool

v0.49.0-rc.7

Oct 28, 2023

v0.49.0-rc.6

Oct 20, 2023

v0.49.0-rc.5

Oct 19, 2023

v0.49.0-rc.4

Oct 16, 2023

v0.49.0-rc.3

Oct 11, 2023

v0.49.0-rc.2

Oct 5, 2023

v0.49.0-rc.1

Oct 2, 2023

v0.49.0-devel

Aug 29, 2023

v0.48.1

Oct 16, 2023

v0.48.1-rc.1

Oct 12, 2023

v0.48.0

Oct 6, 2023

Changes in this version

+ const ErrPathDepthLimit — darwin/amd64, linux/amd64

+ const ErrPathMustBeAbsolute — darwin/amd64, linux/amd64

+ const ErrPathSegmentLimit — darwin/amd64, linux/amd64

+ type BaseEvent struct

+ ContainerContext *ContainerContext

+ Error error

+ FieldHandlers FieldHandlers

+ Flags uint32

+ ID string

+ NetworkContext NetworkContext

+ PIDContext PIDContext

+ ProcessCacheEntry *ProcessCacheEntry

+ ProcessContext *ProcessContext

+ Rules []*MatchedRule

+ SecurityProfileContext SecurityProfileContext

+ SpanContext SpanContext

+ Timestamp time.Time

+ TimestampRaw uint64

+ Type uint32

type ContainerContext

+ Resolved bool

type Event — darwin/amd64, linux/amd64, windows/amd64

+ func (e *Event) Zero()

+ type NetIP = net.IP — darwin/amd64, linux/amd64, windows/amd64

type Process — darwin/amd64, linux/amd64

+ func (p *Process) SetSpan(spanID uint64, traceID uint64)

v0.48.0-rc.10

Oct 4, 2023

v0.48.0-rc.9

Sep 26, 2023

v0.48.0-rc.8

Sep 26, 2023

v0.48.0-rc.7

Sep 22, 2023

v0.48.0-rc.6

Sep 20, 2023

v0.48.0-rc.5

Sep 14, 2023

v0.48.0-rc.4

Sep 7, 2023

v0.48.0-rc.3

Aug 31, 2023

v0.48.0-rc.2

Aug 25, 2023

v0.48.0-rc.1

Aug 21, 2023

v0.48.0-devel

Jul 17, 2023

v0.48.0-beta.1

Aug 4, 2023

v0.47.1

Sep 21, 2023

v0.47.1-rc.1

Sep 19, 2023

v0.47.0

Aug 31, 2023

Changes in this version

+ const ProcessCacheEntryFromSnapshot

+ const ProcessCacheEntryFromUnknown

+ const TmpFS

+ var ContainerIDPatternStr = fmt.Sprintf(`([[:xdigit:]]{%v})`, sha256.Size * 2)

+ var ErrDNSNameMalformatted = errors.New("dns name mal-formatted")

type Credentials

+ func (c *Credentials) Equals(o *Credentials) bool

type DefaultFieldHandlers — darwin/amd64, linux/amd64

+ func (dfh *DefaultFieldHandlers) ResolveHashes(eventType EventType, process *Process, file *FileEvent) []string

+ func (dfh *DefaultFieldHandlers) ResolveHashesFromEvent(ev *Event, e *FileEvent) []string

type Event

+ func (e *Event) GetWorkloadID() string

+ func (e *Event) IsAnomalyDetectionEvent() bool

+ func (e *Event) IsKernelSpaceAnomalyDetectionEvent() bool

type ExtraFieldHandlers

+ ResolveHashes func(eventType EventType, process *Process, file *FileEvent) []string

type FieldHandlers — darwin/amd64, linux/amd64

+ ResolveHashesFromEvent func(ev *Event, e *FileEvent) []string

type FileEvent

+ HashState HashState

+ Hashes []string

+ func (e *FileEvent) Equals(o *FileEvent) bool

type FileFields

+ func (f *FileFields) Equals(o *FileFields) bool

+ type HashAlgorithm int

+ const MD5

+ const MaxHashAlgorithm

+ const SHA1

+ const SHA256

+ func (ha HashAlgorithm) String() string

+ type HashState int

+ const Done

+ const EventTypeNotConfigured

+ const FileNotFound

+ const FileTooBig

+ const HashWasRateLimited

+ const MaxHashState

+ const NoHash

+ const PathnameResolutionError

+ const UnknownHashError

+ func (i HashState) String() string

type Mount

+ ParentPathKey PathKey

+ RootPathKey PathKey

type Process

+ IsExecChild bool

type ProcessCacheEntry

+ func (pc *ProcessCacheEntry) ApplyExecTimeOf(entry *ProcessCacheEntry)

v0.47.0-rc.9

Aug 25, 2023

v0.47.0-rc.8

Aug 22, 2023

v0.47.0-rc.7

Aug 7, 2023

v0.47.0-rc.6

Aug 3, 2023

v0.47.0-rc.5

Jul 31, 2023

v0.47.0-rc.4

Jul 20, 2023

v0.47.0-rc.3

Jul 14, 2023

v0.47.0-rc.2

Jul 11, 2023

v0.47.0-rc.1

Jul 10, 2023

v0.47.0-devel

Jun 7, 2023

v0.46.0

Jul 6, 2023

Changes in this version

+ const DNS_PREALLOC_SIZE

+ const ProcessCacheEntryFromEvent

+ const ProcessCacheEntryFromKernelMap

+ const ProcessCacheEntryFromProcFS

+ var ProcessSources = [...]string

+ func ProcessSourceToString(source uint64) string

type DefaultFieldHandlers — darwin/amd64, linux/amd64, windows/amd64

+ func (dfh *DefaultFieldHandlers) GetProcessService(ev *Event) string

+ func (dfh *DefaultFieldHandlers) ResolveContainerContext(ev *Event) (*ContainerContext, bool)

+ func (dfh *DefaultFieldHandlers) ResolveEventTime(ev *Event) time.Time

type Event

+ Error error

+ func (ev *Event) GetProcessService() string

+ func (ev *Event) ResolveEventTime() time.Time

type EventType

+ const LastApproverEventType

type ExtraFieldHandlers

+ GetProcessService func(ev *Event) string

+ ResolveContainerContext func(ev *Event) (*ContainerContext, bool)

+ ResolveEventTime func(ev *Event) time.Time

type FieldHandlers — darwin/amd64, linux/amd64, windows/amd64

+ ResolveEventTimestamp func(ev *Event) int

type FileEvent

+ func (e *FileEvent) IsOverlayFS() bool

+ type FileMode int

+ func (m FileMode) String() string

+ type InodeMode int

+ func (m InodeMode) String() string

type PIDContext

+ ExecInode uint64

type Process

+ Source uint64

+ type Releasable struct

+ func (r *Releasable) CallReleaseCallback()

+ func (r *Releasable) OnRelease()

+ func (r *Releasable) SetReleaseCallback(callback func())

type SecurityProfileContext

+ AnomalyDetectionEventTypes []EventType

+ func (spc SecurityProfileContext) CanGenerateAnomaliesFor(evtType EventType) bool

v0.46.0-rc.4

Jun 27, 2023

v0.46.0-rc.3

Jun 12, 2023

v0.46.0-rc.2

Jun 4, 2023

v0.46.0-rc.1

May 30, 2023

v0.45.1

Jun 21, 2023

v0.45.1-rc.3

Jun 19, 2023

v0.45.1-rc.2

Jun 12, 2023

v0.45.1-rc.1

Jun 7, 2023

v0.45.0

May 31, 2023

Changes in this version

+ const EventFlagsSecurityProfileInProfile

+ const PathKeySize

+ const PathLeafSize

+ const UnknownFS

+ func IsAnomalyDetectionEvent(eventyType eval.EventType) bool

+ type AnomalyDetectionSyscallEvent struct

+ SyscallID Syscall

+ func (e *AnomalyDetectionSyscallEvent) UnmarshalBinary(data []byte) (int, error)

type DefaultFieldHandlers — darwin/amd64, linux/amd64

+ func (dfh *DefaultFieldHandlers) ResolveModuleArgs(ev *Event, e *LoadModuleEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveModuleArgv(ev *Event, e *LoadModuleEvent) []string

type Event

+ AnomalyDetectionSyscallEvent AnomalyDetectionSyscallEvent

+ SecurityProfileContext SecurityProfileContext

+ func (e *Event) AddToFlags(flag uint32)

+ func (e *Event) HasProfile() bool

+ func (e *Event) IsInProfile() bool

+ func (e *Event) RemoveFromFlags(flag uint32)

type EventType

+ const AnomalyDetectionSyscallEventType

+ const FirstEventType

+ const LastEventType

type FieldHandlers — darwin/amd64, linux/amd64

+ ResolveModuleArgs func(ev *Event, e *LoadModuleEvent) string

+ ResolveModuleArgv func(ev *Event, e *LoadModuleEvent) []string

type LoadModuleEvent

+ Args string

+ ArgsTruncated bool

+ Argv []string

+ type PathLeaf struct

+ Len uint16

+ Name [MaxSegmentLength + 1]byte

+ Parent PathKey

+ func (pl *PathLeaf) GetName() string

+ func (pl *PathLeaf) MarshalBinary() ([]byte, error)

+ func (pl *PathLeaf) SetName(name string)

type ProcessContext

+ func (pc *ProcessContext) GetNextAncestorBinary() *ProcessCacheEntry

+ type SecurityProfileContext struct

+ Name string

+ Status Status

+ Tags []string

+ Version string

+ type Status uint32

+ const AnomalyDetection

+ const AutoSuppression

+ const WorkloadHardening

+ func (s Status) IsEnabled(option Status) bool

+ func (s Status) String() string

v0.45.0-rc.6

May 21, 2023

v0.45.0-rc.5

May 16, 2023

v0.45.0-rc.4

Apr 28, 2023

v0.45.0-rc.3

Apr 24, 2023

v0.45.0-rc.2

Apr 19, 2023

v0.45.0-rc.1

Apr 17, 2023

v0.44.1

May 15, 2023

v0.44.1-rc.1

May 10, 2023

v0.44.0

Apr 25, 2023

Changes in this version

+ const EventFlagsActivityDumpSample

+ const EventFlagsAsync

+ const EventFlagsSavedByAD

type ContainerContext

+ CreatedAt uint64

type DefaultFieldHandlers

+ func (dfh *DefaultFieldHandlers) ResolveAsync(ev *Event) bool

+ func (dfh *DefaultFieldHandlers) ResolveContainerCreatedAt(ev *Event, e *ContainerContext) int

+ func (dfh *DefaultFieldHandlers) ResolvePackageName(ev *Event, e *FileEvent) string

+ func (dfh *DefaultFieldHandlers) ResolvePackageSourceVersion(ev *Event, e *FileEvent) string

+ func (dfh *DefaultFieldHandlers) ResolvePackageVersion(ev *Event, e *FileEvent) string

+ type ErrInvalidKeyPath struct

+ Inode uint64

+ MountID uint32

+ func (e *ErrInvalidKeyPath) Error() string

type Event

+ Flags uint32

+ Rules []*MatchedRule

+ func (e *Event) IsSavedByActivityDumps() bool

+ func (ev *Event) ResolveFieldsForAD()

type FieldHandlers

+ ResolveAsync func(ev *Event) bool

+ ResolveContainerCreatedAt func(ev *Event, e *ContainerContext) int

+ ResolvePackageName func(ev *Event, e *FileEvent) string

+ ResolvePackageSourceVersion func(ev *Event, e *FileEvent) string

+ ResolvePackageVersion func(ev *Event, e *FileEvent) string

type FileEvent

+ PkgName string

+ PkgSrcVersion string

+ PkgVersion string

+ type MatchedRule struct

+ PolicyName string

+ PolicyVersion string

+ RuleID string

+ RuleTags map[string]string

+ RuleVersion string

+ func AppendMatchedRule(list []*MatchedRule, toAdd []*MatchedRule) []*MatchedRule

+ func NewMatchedRule(ruleID, ruleVersion string, ruleTags map[string]string, ...) *MatchedRule

+ func (mr *MatchedRule) Match(mr2 *MatchedRule) bool

+ type PathKey struct

+ Inode uint64

+ MountID uint32

+ PathID uint32

+ func (p *PathKey) IsNull() bool

+ func (p *PathKey) MarshalBinary() ([]byte, error)

+ func (p *PathKey) String() string

+ func (p *PathKey) UnmarshalBinary(data []byte) (int, error)

+ func (p *PathKey) Write(buffer []byte)

type ProcessCacheEntry

+ func (pc *ProcessCacheEntry) IsContainerRoot() bool

v0.44.0-rc.7

Apr 14, 2023

v0.44.0-rc.6

Mar 31, 2023

v0.44.0-rc.5

Mar 21, 2023

v0.44.0-rc.4

Mar 15, 2023

v0.44.0-rc.3

Mar 13, 2023

v0.44.0-rc.2

Mar 7, 2023

v0.44.0-rc.1

Mar 6, 2023

v0.43.2

Apr 20, 2023

v0.43.2-rc.1

Apr 15, 2023

v0.43.1

Mar 7, 2023

v0.43.1-rc.1

Mar 7, 2023

v0.43.0

Feb 22, 2023

Changes in this version

+ var SECLVariables = map[string]eval.VariableValue — darwin/amd64, js/wasm, windows/amd64

+ func NewDefaultEvent() eval.Event

+ type DefaultFieldHandlers struct

+ func (dfh *DefaultFieldHandlers) GetProcessServiceTag(ev *Event) string

+ func (dfh *DefaultFieldHandlers) ResolveChownGID(ev *Event, e *ChownEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveChownUID(ev *Event, e *ChownEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveContainerID(ev *Event, e *ContainerContext) string

+ func (dfh *DefaultFieldHandlers) ResolveContainerTags(ev *Event, e *ContainerContext) []string

+ func (dfh *DefaultFieldHandlers) ResolveEventTimestamp(ev *Event) time.Time

+ func (dfh *DefaultFieldHandlers) ResolveFileBasename(ev *Event, e *FileEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveFileFieldsGroup(ev *Event, e *FileFields) string

+ func (dfh *DefaultFieldHandlers) ResolveFileFieldsInUpperLayer(ev *Event, e *FileFields) bool

+ func (dfh *DefaultFieldHandlers) ResolveFileFieldsUser(ev *Event, e *FileFields) string

+ func (dfh *DefaultFieldHandlers) ResolveFileFilesystem(ev *Event, e *FileEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveFilePath(ev *Event, e *FileEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveMountPointPath(ev *Event, e *MountEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveMountSourcePath(ev *Event, e *MountEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveNetworkDeviceIfName(ev *Event, e *NetworkDeviceContext) string

+ func (dfh *DefaultFieldHandlers) ResolveProcessArgs(ev *Event, e *Process) string

+ func (dfh *DefaultFieldHandlers) ResolveProcessArgsFlags(ev *Event, e *Process) []string

+ func (dfh *DefaultFieldHandlers) ResolveProcessArgsOptions(ev *Event, e *Process) []string

+ func (dfh *DefaultFieldHandlers) ResolveProcessArgsTruncated(ev *Event, e *Process) bool

+ func (dfh *DefaultFieldHandlers) ResolveProcessArgv(ev *Event, e *Process) []string

+ func (dfh *DefaultFieldHandlers) ResolveProcessArgv0(ev *Event, e *Process) string

+ func (dfh *DefaultFieldHandlers) ResolveProcessCacheEntry(ev *Event) (*ProcessCacheEntry, bool)

+ func (dfh *DefaultFieldHandlers) ResolveProcessCreatedAt(ev *Event, e *Process) int

+ func (dfh *DefaultFieldHandlers) ResolveProcessEnvp(ev *Event, e *Process) []string

+ func (dfh *DefaultFieldHandlers) ResolveProcessEnvs(ev *Event, e *Process) []string

+ func (dfh *DefaultFieldHandlers) ResolveProcessEnvsTruncated(ev *Event, e *Process) bool

+ func (dfh *DefaultFieldHandlers) ResolveRights(ev *Event, e *FileFields) int

+ func (dfh *DefaultFieldHandlers) ResolveSELinuxBoolName(ev *Event, e *SELinuxEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveSetgidEGroup(ev *Event, e *SetgidEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveSetgidFSGroup(ev *Event, e *SetgidEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveSetgidGroup(ev *Event, e *SetgidEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveSetuidEUser(ev *Event, e *SetuidEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveSetuidFSUser(ev *Event, e *SetuidEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveSetuidUser(ev *Event, e *SetuidEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveXAttrName(ev *Event, e *SetXAttrEvent) string

+ func (dfh *DefaultFieldHandlers) ResolveXAttrNamespace(ev *Event, e *SetXAttrEvent) string

type Event

+ FieldHandlers FieldHandlers

+ PathResolutionError error

+ func (ev *Event) GetProcessServiceTag() string

+ func (ev *Event) Release()

+ func (ev *Event) ResolveEventTimestamp() time.Time

+ func (ev *Event) ResolveFields(forADs bool)

+ func (ev *Event) ResolveProcessCacheEntry() (*ProcessCacheEntry, bool)

+ func (ev *Event) Retain() Event

+ func (ev *Event) SetPathResolutionError(fileFields *FileEvent, err error)

+ type ExtraFieldHandlers interface

+ GetProcessServiceTag func(ev *Event) string

+ ResolveEventTimestamp func(ev *Event) time.Time

+ ResolveProcessCacheEntry func(ev *Event) (*ProcessCacheEntry, bool)

+ type FieldHandlers interface

+ ResolveChownGID func(ev *Event, e *ChownEvent) string

+ ResolveChownUID func(ev *Event, e *ChownEvent) string

+ ResolveContainerID func(ev *Event, e *ContainerContext) string

+ ResolveContainerTags func(ev *Event, e *ContainerContext) []string

+ ResolveFileBasename func(ev *Event, e *FileEvent) string

+ ResolveFileFieldsGroup func(ev *Event, e *FileFields) string

+ ResolveFileFieldsInUpperLayer func(ev *Event, e *FileFields) bool

+ ResolveFileFieldsUser func(ev *Event, e *FileFields) string

+ ResolveFileFilesystem func(ev *Event, e *FileEvent) string

+ ResolveFilePath func(ev *Event, e *FileEvent) string

+ ResolveMountPointPath func(ev *Event, e *MountEvent) string

+ ResolveMountSourcePath func(ev *Event, e *MountEvent) string

+ ResolveNetworkDeviceIfName func(ev *Event, e *NetworkDeviceContext) string

+ ResolveProcessArgs func(ev *Event, e *Process) string

+ ResolveProcessArgsFlags func(ev *Event, e *Process) []string

+ ResolveProcessArgsOptions func(ev *Event, e *Process) []string

+ ResolveProcessArgsTruncated func(ev *Event, e *Process) bool

+ ResolveProcessArgv func(ev *Event, e *Process) []string

+ ResolveProcessArgv0 func(ev *Event, e *Process) string

+ ResolveProcessCreatedAt func(ev *Event, e *Process) int

+ ResolveProcessEnvp func(ev *Event, e *Process) []string

+ ResolveProcessEnvs func(ev *Event, e *Process) []string

+ ResolveProcessEnvsTruncated func(ev *Event, e *Process) bool

+ ResolveRights func(ev *Event, e *FileFields) int

+ ResolveSELinuxBoolName func(ev *Event, e *SELinuxEvent) string

+ ResolveSetgidEGroup func(ev *Event, e *SetgidEvent) string

+ ResolveSetgidFSGroup func(ev *Event, e *SetgidEvent) string

+ ResolveSetgidGroup func(ev *Event, e *SetgidEvent) string

+ ResolveSetuidEUser func(ev *Event, e *SetuidEvent) string

+ ResolveSetuidFSUser func(ev *Event, e *SetuidEvent) string

+ ResolveSetuidUser func(ev *Event, e *SetuidEvent) string

+ ResolveXAttrName func(ev *Event, e *SetXAttrEvent) string

+ ResolveXAttrNamespace func(ev *Event, e *SetXAttrEvent) string

type Model

+ ExtraValidateFieldFnc func(field eval.Field, fieldValue eval.FieldValue) error

+ func (m *Model) NewDefaultEventWithType(kind EventType) eval.Event

type PIDContext

+ Inode uint64

type ProcessCacheEntry

+ func NewEmptyProcessCacheEntry(pid uint32, tid uint32, isKworker bool) *ProcessCacheEntry

+ func (pc *ProcessCacheEntry) GetNextAncestorBinary() *ProcessCacheEntry

+ func (pc *ProcessCacheEntry) HasCompleteLineage() bool

v0.43.0-rc.7

Feb 21, 2023

v0.43.0-rc.6

Feb 14, 2023

v0.43.0-rc.5

Feb 8, 2023

v0.43.0-rc.4

Feb 2, 2023

v0.43.0-rc.3

Jan 30, 2023

v0.43.0-rc.2

Jan 25, 2023

v0.43.0-rc.1

Jan 23, 2023

v0.42.2

Feb 16, 2023

v0.42.2-rc.1

Feb 14, 2023

v0.42.1-rc.3

Feb 1, 2023

v0.42.1-rc.2

Feb 1, 2023

v0.42.1-rc.1

Jan 31, 2023

v0.42.0

Jan 18, 2023

Changes in this version

+ const OverlayFS

type ArgsEntry

+ func NewArgsEntry(cacheEntry *ArgsEnvsCacheEntry) *ArgsEntry

+ func (p *ArgsEntry) SetValues(values []string)

type EnvsEntry

+ func NewEnvsEntry(cacheEntry *ArgsEnvsCacheEntry) *EnvsEntry

+ func (p *EnvsEntry) SetValues(values []string)

type Event

+ UnshareMountNS UnshareMountNSEvent

type EventType

+ const UnshareMountNsEventType

type FileFields

+ func (f *FileFields) IsFileless() bool

+ type Mount struct

+ BindSrcMountID uint32

+ Device uint32

+ FSType string

+ GroupID uint32

+ MountID uint32

+ MountPointStr string

+ ParentInode uint64

+ ParentMountID uint32

+ Path string

+ RootInode uint64

+ RootMountID uint32

+ RootStr string

+ func (m *Mount) GetFSType() string

+ func (m *Mount) IsOverlayFS() bool

+ func (m *Mount) UnmarshalBinary(data []byte) (int, error)

type MountEvent

+ MountPointPath string

+ MountSourcePath string

+ MountSourcePathResolutionError error

type Process

+ func (p *Process) IsNotKworker() bool

type ProcessCacheEntry

+ func (pc *ProcessCacheEntry) IsContainerInit() bool

+ func (pc *ProcessCacheEntry) SetParentOfForkChild(parent *ProcessCacheEntry)

type ProcessContext

+ Parent *Process

+ func (p *ProcessContext) HasParent() bool

+ type UnshareMountNSEvent struct

+ func (e *UnshareMountNSEvent) UnmarshalBinary(data []byte) (int, error)

v0.42.0-rc.5

Jan 6, 2023

v0.42.0-rc.4

Dec 28, 2022

v0.42.0-rc.3

Dec 17, 2022

v0.42.0-rc.2

Dec 13, 2022

v0.42.0-rc.1

Dec 12, 2022

v0.41.1

Dec 20, 2022

v0.41.1-rc.1

Dec 16, 2022

v0.41.0

Dec 9, 2022

Changes in this version

+ func NullTerminatedString(d []byte) string

type ArgsEntry

+ func (p *ArgsEntry) Release()

+ func (p *ArgsEntry) Retain()

type EnvsEntry

+ func (p *EnvsEntry) Release()

+ func (p *EnvsEntry) Retain()

v0.41.0-rc.7

Dec 2, 2022

v0.41.0-rc.6

Nov 29, 2022

v0.41.0-rc.5

Nov 21, 2022

v0.41.0-rc.4

Nov 15, 2022

v0.41.0-rc.3

Nov 10, 2022

v0.41.0-rc.2

Nov 4, 2022

v0.41.0-rc.1

Oct 31, 2022

v0.40.1

Nov 9, 2022

v0.40.1-rc.3

Nov 8, 2022

v0.40.1-rc.2

Nov 7, 2022

v0.40.1-rc.1

Nov 4, 2022

v0.40.0

Oct 31, 2022

Changes in this version

+ const MaxArgEnvSize

+ const MaxTracedCgroupsCount

+ var ErrDNSNameNonPrintableASCII = errors.New("dns name non-printable ascii")

+ var ErrDNSNameOutOfBounds = errors.New("dns name out of bound")

+ var ErrDNSNamePointerNotSupported = errors.New("dns name pointer compression is not supported")

+ type ActivityDumpLoadConfig struct

+ EndTimestampRaw uint64

+ Paused uint32

+ Rate uint32

+ StartTimestampRaw uint64

+ Timeout time.Duration

+ TracedEventTypes []EventType

+ WaitListTimestampRaw uint64

+ func (adlc *ActivityDumpLoadConfig) EventUnmarshalBinary(data []byte) (int, error)

+ func (adlc *ActivityDumpLoadConfig) MarshalBinary() ([]byte, error)

+ func (adlc *ActivityDumpLoadConfig) SetTimeout(duration time.Duration)

+ func (adlc *ActivityDumpLoadConfig) UnmarshalBinary(data []byte) error

type ArgsEnvsCacheEntry

+ TotalSize uint64

type CgroupTracingEvent

+ Config ActivityDumpLoadConfig

+ ConfigCookie uint32

type Event

+ IsActivityDumpSample bool

+ SavedByActivityDumps bool

+ type LinuxBinprm struct

+ FileEvent FileEvent

+ func (z *LinuxBinprm) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *LinuxBinprm) EncodeMsg(en *msgp.Writer) (err error)

+ func (z *LinuxBinprm) MarshalMsg(b []byte) (o []byte, err error)

+ func (z *LinuxBinprm) Msgsize() (s int)

+ func (z *LinuxBinprm) UnmarshalMsg(bts []byte) (o []byte, err error)

type Process

+ LinuxBinprm LinuxBinprm

+ func (p *Process) HasInterpreter() bool

v0.40.0-rc.7

Oct 25, 2022

v0.40.0-rc.6

Oct 17, 2022

v0.40.0-rc.5

Oct 13, 2022

v0.40.0-rc.4

Oct 7, 2022

v0.40.0-rc.3

Sep 29, 2022

v0.40.0-rc.2

Sep 22, 2022

v0.40.0-rc.1

Sep 19, 2022

v0.39.2-rc.1

Oct 6, 2022

v0.39.1-rc.2

Sep 22, 2022

v0.39.1-rc.1

Sep 19, 2022

v0.39.0

Sep 8, 2022

Changes in this version

+ var ErrIncorrectDataSize = errors.New("incorrect data size")

type EnvsEntry

+ func (p *EnvsEntry) FilterEnvs(envsWithValue map[string]bool) ([]string, bool)

type Event

+ Syscalls SyscallsEvent

+ func (e *Event) Init()

type EventType

+ const SyscallsEventType

type Model

+ func (m *Model) NewEventWithType(kind EventType) eval.Event

type PIDContext

+ IsKworker bool

type Process

+ func (e *Process) UnmarshalPidCacheBinary(data []byte) (int, error)

+ func (e *Process) UnmarshalProcEntryBinary(data []byte) (int, error)

+ type Syscall int

+ const SysAccept

+ const SysAccept4

+ const SysAccess

+ const SysAcct

+ const SysAddKey

+ const SysAdjtimex

+ const SysAfsSyscall

+ const SysAlarm

+ const SysArchPrctl

+ const SysBind

+ const SysBpf

+ const SysBrk

+ const SysCapget

+ const SysCapset

+ const SysChdir

+ const SysChmod

+ const SysChown

+ const SysChroot

+ const SysClockAdjtime

+ const SysClockGetres

+ const SysClockGettime

+ const SysClockNanosleep

+ const SysClockSettime

+ const SysClone

+ const SysClone3

+ const SysClose

+ const SysCloseRange

+ const SysConnect

+ const SysCopyFileRange

+ const SysCreat

+ const SysCreateModule

+ const SysDeleteModule

+ const SysDup

+ const SysDup2

+ const SysDup3

+ const SysEpollCreate

+ const SysEpollCreate1

+ const SysEpollCtl

+ const SysEpollCtlOld

+ const SysEpollPwait

+ const SysEpollPwait2

+ const SysEpollWait

+ const SysEpollWaitOld

+ const SysEventfd

+ const SysEventfd2

+ const SysExecve

+ const SysExecveat

+ const SysExit

+ const SysExitGroup

+ const SysFaccessat

+ const SysFaccessat2

+ const SysFadvise64

+ const SysFallocate

+ const SysFanotifyInit

+ const SysFanotifyMark

+ const SysFchdir

+ const SysFchmod

+ const SysFchmodat

+ const SysFchown

+ const SysFchownat

+ const SysFcntl

+ const SysFdatasync

+ const SysFgetxattr

+ const SysFinitModule

+ const SysFlistxattr

+ const SysFlock

+ const SysFork

+ const SysFremovexattr

+ const SysFsconfig

+ const SysFsetxattr

+ const SysFsmount

+ const SysFsopen

+ const SysFspick

+ const SysFstat

+ const SysFstatfs

+ const SysFsync

+ const SysFtruncate

+ const SysFutex

+ const SysFutexWaitv

+ const SysFutimesat

+ const SysGetKernelSyms

+ const SysGetMempolicy

+ const SysGetRobustList

+ const SysGetThreadArea

+ const SysGetcpu

+ const SysGetcwd

+ const SysGetdents

+ const SysGetdents64

+ const SysGetegid

+ const SysGeteuid

+ const SysGetgid

+ const SysGetgroups

+ const SysGetitimer

+ const SysGetpeername

+ const SysGetpgid

+ const SysGetpgrp

+ const SysGetpid

+ const SysGetpmsg

+ const SysGetppid

+ const SysGetpriority

+ const SysGetrandom

+ const SysGetresgid

+ const SysGetresuid

+ const SysGetrlimit

+ const SysGetrusage

+ const SysGetsid

+ const SysGetsockname

+ const SysGetsockopt

+ const SysGettid

+ const SysGettimeofday

+ const SysGetuid

+ const SysGetxattr

+ const SysInitModule

+ const SysInotifyAddWatch

+ const SysInotifyInit

+ const SysInotifyInit1

+ const SysInotifyRmWatch

+ const SysIoCancel

+ const SysIoDestroy

+ const SysIoGetevents

+ const SysIoPgetevents

+ const SysIoSetup

+ const SysIoSubmit

+ const SysIoUringEnter

+ const SysIoUringRegister

+ const SysIoUringSetup

+ const SysIoctl

+ const SysIoperm

+ const SysIopl

+ const SysIoprioGet

+ const SysIoprioSet

+ const SysKcmp

+ const SysKexecFileLoad

+ const SysKexecLoad

+ const SysKeyctl

+ const SysKill

+ const SysLandlockAddRule

+ const SysLandlockCreateRuleset

+ const SysLandlockRestrictSelf

+ const SysLchown

+ const SysLgetxattr

+ const SysLink

+ const SysLinkat

+ const SysListen

+ const SysListxattr

+ const SysLlistxattr

+ const SysLookupDcookie

+ const SysLremovexattr

+ const SysLseek

+ const SysLsetxattr

+ const SysLstat

+ const SysMadvise

+ const SysMbind

+ const SysMembarrier

+ const SysMemfdCreate

+ const SysMemfdSecret

+ const SysMigratePages

+ const SysMincore

+ const SysMkdir

+ const SysMkdirat

+ const SysMknod

+ const SysMknodat

+ const SysMlock

+ const SysMlock2

+ const SysMlockall

+ const SysMmap

+ const SysModifyLdt

+ const SysMount

+ const SysMountSetattr

+ const SysMoveMount

+ const SysMovePages

+ const SysMprotect

+ const SysMqGetsetattr

+ const SysMqNotify

+ const SysMqOpen

+ const SysMqTimedreceive

+ const SysMqTimedsend

+ const SysMqUnlink

+ const SysMremap

+ const SysMsgctl

+ const SysMsgget

+ const SysMsgrcv

+ const SysMsgsnd

+ const SysMsync

+ const SysMunlock

+ const SysMunlockall

+ const SysMunmap

+ const SysNameToHandleAt

+ const SysNanosleep

+ const SysNewfstatat

+ const SysNfsservctl

+ const SysOpen

+ const SysOpenByHandleAt

+ const SysOpenTree

+ const SysOpenat

+ const SysOpenat2

+ const SysPause

+ const SysPerfEventOpen

+ const SysPersonality

+ const SysPidfdGetfd

+ const SysPidfdOpen

+ const SysPidfdSendSignal

+ const SysPipe

+ const SysPipe2

+ const SysPivotRoot

+ const SysPkeyAlloc

+ const SysPkeyFree

+ const SysPkeyMprotect

+ const SysPoll

+ const SysPpoll

+ const SysPrctl

+ const SysPread64

+ const SysPreadv

+ const SysPreadv2

+ const SysPrlimit64

+ const SysProcessMadvise

+ const SysProcessMrelease

+ const SysProcessVmReadv

+ const SysProcessVmWritev

+ const SysPselect6

+ const SysPtrace

+ const SysPutpmsg

+ const SysPwrite64

+ const SysPwritev

+ const SysPwritev2

+ const SysQueryModule

+ const SysQuotactl

+ const SysQuotactlFd

+ const SysRead

+ const SysReadahead

+ const SysReadlink

+ const SysReadlinkat

+ const SysReadv

+ const SysReboot

+ const SysRecvfrom

+ const SysRecvmmsg

+ const SysRecvmsg

+ const SysRemapFilePages

+ const SysRemovexattr

+ const SysRename

+ const SysRenameat

+ const SysRenameat2

+ const SysRequestKey

+ const SysRestartSyscall

+ const SysRmdir

+ const SysRseq

+ const SysRtSigaction

+ const SysRtSigpending

+ const SysRtSigprocmask

+ const SysRtSigqueueinfo

+ const SysRtSigreturn

+ const SysRtSigsuspend

+ const SysRtSigtimedwait

+ const SysRtTgsigqueueinfo

+ const SysSchedGetPriorityMax

+ const SysSchedGetPriorityMin

+ const SysSchedGetaffinity

+ const SysSchedGetattr

+ const SysSchedGetparam

+ const SysSchedGetscheduler

+ const SysSchedRrGetInterval

+ const SysSchedSetaffinity

+ const SysSchedSetattr

+ const SysSchedSetparam

+ const SysSchedSetscheduler

+ const SysSchedYield

+ const SysSeccomp

+ const SysSecurity

+ const SysSelect

+ const SysSemctl

+ const SysSemget

+ const SysSemop

+ const SysSemtimedop

+ const SysSendfile

+ const SysSendmmsg

+ const SysSendmsg

+ const SysSendto

+ const SysSetMempolicy

+ const SysSetMempolicyHomeNode

+ const SysSetRobustList

+ const SysSetThreadArea

+ const SysSetTidAddress

+ const SysSetdomainname

+ const SysSetfsgid

+ const SysSetfsuid

+ const SysSetgid

+ const SysSetgroups

+ const SysSethostname

+ const SysSetitimer

+ const SysSetns

+ const SysSetpgid

+ const SysSetpriority

+ const SysSetregid

+ const SysSetresgid

+ const SysSetresuid

+ const SysSetreuid

+ const SysSetrlimit

+ const SysSetsid

+ const SysSetsockopt

+ const SysSettimeofday

+ const SysSetuid

+ const SysSetxattr

+ const SysShmat

+ const SysShmctl

+ const SysShmdt

+ const SysShmget

+ const SysShutdown

+ const SysSigaltstack

+ const SysSignalfd

+ const SysSignalfd4

+ const SysSocket

+ const SysSocketpair

+ const SysSplice

+ const SysStat

+ const SysStatfs

+ const SysStatx

+ const SysSwapoff

+ const SysSwapon

+ const SysSymlink

+ const SysSymlinkat

+ const SysSync

+ const SysSyncFileRange

+ const SysSyncfs

+ const SysSysctl

+ const SysSysfs

+ const SysSysinfo

+ const SysSyslog

+ const SysTee

+ const SysTgkill

+ const SysTime

+ const SysTimerCreate

+ const SysTimerDelete

+ const SysTimerGetoverrun

+ const SysTimerGettime

+ const SysTimerSettime

+ const SysTimerfdCreate

+ const SysTimerfdGettime

+ const SysTimerfdSettime

+ const SysTimes

+ const SysTkill

+ const SysTruncate

+ const SysTuxcall

+ const SysUmask

+ const SysUmount2

+ const SysUname

+ const SysUnlink

+ const SysUnlinkat

+ const SysUnshare

+ const SysUselib

+ const SysUserfaultfd

+ const SysUstat

+ const SysUtime

+ const SysUtimensat

+ const SysUtimes

+ const SysVfork

+ const SysVhangup

+ const SysVmsplice

+ const SysVserver

+ const SysWait4

+ const SysWaitid

+ const SysWrite

+ const SysWritev

+ func (i Syscall) String() string

+ func (s Syscall) MarshalText() ([]byte, error)

+ type SyscallsEvent struct

+ Syscalls []Syscall

+ func (e *SyscallsEvent) UnmarshalBinary(data []byte) (int, error)

v0.39.0-rc.8

Sep 3, 2022

v0.39.0-rc.7

Aug 31, 2022

v0.39.0-rc.6

Aug 24, 2022

v0.39.0-rc.5

Aug 17, 2022

v0.39.0-rc.4

Aug 17, 2022

v0.39.0-rc.3

Aug 16, 2022

v0.39.0-rc.2

Aug 12, 2022

v0.39.0-rc.1

Aug 8, 2022

v0.38.2

Aug 9, 2022

v0.38.2-rc.2

Aug 9, 2022

v0.38.2-rc.1

Aug 8, 2022

v0.38.1-rc.1

Aug 1, 2022

v0.38.0

Jul 21, 2022

Changes in this version

+ const MaxSymlinks

+ var ProcessSymlinkBasename = &eval.OpOverrides

+ var ProcessSymlinkPathname = &eval.OpOverrides

type DNSEvent

+ func (z *DNSEvent) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *DNSEvent) EncodeMsg(en *msgp.Writer) (err error)

+ func (z *DNSEvent) MarshalMsg(b []byte) (o []byte, err error)

+ func (z *DNSEvent) Msgsize() (s int)

+ func (z *DNSEvent) UnmarshalMsg(bts []byte) (o []byte, err error)

type Event

+ Async bool

+ Exit ExitEvent

+ type ExitCause uint32

+ const ExitCoreDumped

+ const ExitExited

+ const ExitSignaled

+ func (cause ExitCause) String() string

+ type ExitEvent struct

+ Cause uint32

+ Code uint32

+ func (e *ExitEvent) UnmarshalBinary(data []byte) (int, error)

type Process

+ IsThread bool

+ SymlinkBasenameStr string

+ SymlinkPathnameStr [MaxSymlinks]string

v0.38.0-rc.6

Jul 20, 2022

v0.38.0-rc.5

Jul 13, 2022

v0.38.0-rc.4

Jul 8, 2022

v0.38.0-rc.3

Jul 4, 2022

v0.38.0-rc.2

Jun 30, 2022

v0.38.0-rc.1

Jun 27, 2022

v0.37.1

Jun 28, 2022

v0.37.1-rc.1

Jun 27, 2022

v0.37.0

Jun 24, 2022

Changes in this version

+ type AddressFamily int

+ func (af AddressFamily) String() string

type ArgsEnvsCacheEntry

+ Size uint32

+ ValuesRaw []byte

+ type BindEvent struct

+ Addr IPPortContext

+ AddrFamily uint16

+ func (e *BindEvent) UnmarshalBinary(data []byte) (int, error)

type Event

+ Bind BindEvent

+ PIDContext PIDContext

+ ProcessCacheEntry *ProcessCacheEntry

type EventType

+ const BindEventType

+ const CustomSelfTestEventType

+ const MaxAllEventType

+ const MaxKernelEventType

type IPPortContext

+ IPNet net.IPNet

+ type PIDContext struct

+ NetNS uint32

+ Pid uint32

+ Tid uint32

+ func (p *PIDContext) UnmarshalBinary(data []byte) (int, error)

+ func (z *PIDContext) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *PIDContext) UnmarshalMsg(bts []byte) (o []byte, err error)

+ func (z PIDContext) EncodeMsg(en *msgp.Writer) (err error)

+ func (z PIDContext) MarshalMsg(b []byte) (o []byte, err error)

+ func (z PIDContext) Msgsize() (s int)

type SyscallEvent

+ Async bool

v0.37.0-rc.11

Jun 20, 2022

v0.37.0-rc.10

Jun 17, 2022

v0.37.0-rc.9

Jun 17, 2022

v0.37.0-rc.8

Jun 14, 2022

v0.37.0-rc.7

Jun 13, 2022

v0.37.0-rc.6

Jun 9, 2022

v0.37.0-rc.5

Jun 6, 2022

v0.37.0-rc.4

Jun 1, 2022

v0.37.0-rc.3

May 26, 2022

v0.37.0-rc.2

May 19, 2022

v0.37.0-rc.1

May 16, 2022

v0.36.1

May 31, 2022

v0.36.1-rc.2

May 30, 2022

v0.36.1-rc.1

May 27, 2022

v0.36.0

May 23, 2022

Changes in this version

+ const ContainerIDLen

+ var DNSQClassConstants = map[string]int

+ var DNSQTypeConstants = map[string]int

+ var ErrNotEnoughSpace = errors.New("not enough space")

+ var L3ProtocolConstants = map[string]L3Protocol

+ var L4ProtocolConstants = map[string]L4Protocol

+ func MarshalBinary(data []byte, binaryMarshalers ...BinaryMarshaler) (int, error)

type ArgsEntry

+ func (p *ArgsEntry) Equals(o *ArgsEntry) bool

+ func (z *ArgsEntry) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *ArgsEntry) EncodeMsg(en *msgp.Writer) (err error)

+ func (z *ArgsEntry) MarshalMsg(b []byte) (o []byte, err error)

+ func (z *ArgsEntry) Msgsize() (s int)

+ func (z *ArgsEntry) UnmarshalMsg(bts []byte) (o []byte, err error)

type ArgsEnvsCacheEntry

+ Container *list.Element

+ type BinaryMarshaler interface

+ MarshalBinary func(data []byte) (int, error)

+ type CgroupTracingEvent struct

+ ContainerContext ContainerContext

+ TimeoutRaw uint64

+ func (e *CgroupTracingEvent) UnmarshalBinary(data []byte) (int, error)

type Credentials

+ func (e *Credentials) MarshalBinary(data []byte) (int, error)

+ func (z *Credentials) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *Credentials) EncodeMsg(en *msgp.Writer) (err error)

+ func (z *Credentials) MarshalMsg(b []byte) (o []byte, err error)

+ func (z *Credentials) Msgsize() (s int)

+ func (z *Credentials) UnmarshalMsg(bts []byte) (o []byte, err error)

+ type DNSEvent struct

+ Class uint16

+ Count uint16

+ ID uint16

+ Name string

+ Size uint16

+ Type uint16

+ func (e *DNSEvent) UnmarshalBinary(data []byte) (int, error)

type EnvsEntry

+ func (p *EnvsEntry) Equals(o *EnvsEntry) bool

+ func (z *EnvsEntry) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *EnvsEntry) EncodeMsg(en *msgp.Writer) (err error)

+ func (z *EnvsEntry) MarshalMsg(b []byte) (o []byte, err error)

+ func (z *EnvsEntry) Msgsize() (s int)

+ func (z *EnvsEntry) UnmarshalMsg(bts []byte) (o []byte, err error)

type Event

+ CgroupTracing CgroupTracingEvent

+ DNS DNSEvent

+ NetDevice NetDeviceEvent

+ NetworkContext NetworkContext

+ VethPair VethPairEvent

type EventCategory

+ const NetworkCategory

type EventType

+ const CgroupTracingEventType

+ const DNSEventType

+ const NetDeviceEventType

+ const VethPairEventType

+ func ParseEventTypeStringSlice(eventTypes []string) []EventType

type FileEvent

+ Filesystem string

+ IsBasenameStrResolved bool

+ IsPathnameStrResolved bool

+ func (e *FileEvent) SetBasenameStr(str string)

+ func (e *FileEvent) SetPathnameStr(str string)

+ func (z *FileEvent) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *FileEvent) EncodeMsg(en *msgp.Writer) (err error)

+ func (z *FileEvent) MarshalMsg(b []byte) (o []byte, err error)

+ func (z *FileEvent) Msgsize() (s int)

+ func (z *FileEvent) UnmarshalMsg(bts []byte) (o []byte, err error)

type FileFields

+ func (e *FileFields) MarshalBinary(data []byte) (int, error)

+ func (z *FileFields) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *FileFields) EncodeMsg(en *msgp.Writer) (err error)

+ func (z *FileFields) MarshalMsg(b []byte) (o []byte, err error)

+ func (z *FileFields) Msgsize() (s int)

+ func (z *FileFields) UnmarshalMsg(bts []byte) (o []byte, err error)

+ type IPPortContext struct

+ IP net.IP

+ Port uint16

+ type L3Protocol uint16

+ const EthP1588

+ const EthP8021AD

+ const EthP8021AH

+ const EthP8021Q

+ const EthP8022

+ const EthP80221

+ const EthP8023

+ const EthP8023MIN

+ const EthP802EX1

+ const EthPAARP

+ const EthPAFIUCV

+ const EthPALL

+ const EthPAOE

+ const EthPARCNET

+ const EthPARP

+ const EthPATALK

+ const EthPATMFATE

+ const EthPATMMPOA

+ const EthPAX25

+ const EthPBATMAN

+ const EthPBPQ

+ const EthPCAIF

+ const EthPCAN

+ const EthPCANFD

+ const EthPCONTROL

+ const EthPCUST

+ const EthPDDCMP

+ const EthPDEC

+ const EthPDIAG

+ const EthPDNADL

+ const EthPDNARC

+ const EthPDNART

+ const EthPDSA

+ const EthPECONET

+ const EthPEDSA

+ const EthPERSPAN

+ const EthPFCOE

+ const EthPFIP

+ const EthPHDLC

+ const EthPHSR

+ const EthPIBOE

+ const EthPIEEE802154

+ const EthPIEEEPUP

+ const EthPIEEEPUPAT

+ const EthPIFE

+ const EthPIP

+ const EthPIPV6

+ const EthPIPV6HopByHop

+ const EthPIPX

+ const EthPIRDA

+ const EthPLAT

+ const EthPLOCALTALK

+ const EthPLOOP

+ const EthPLOOPBACK

+ const EthPLinkCTL

+ const EthPMACSEC

+ const EthPMAP

+ const EthPMOBITEX

+ const EthPMPLSMC

+ const EthPMPLSUC

+ const EthPMVRP

+ const EthPNCSI

+ const EthPNSH

+ const EthPPAE

+ const EthPPAUSE

+ const EthPPHONET

+ const EthPPPPDISC

+ const EthPPPPMP

+ const EthPPPPSES

+ const EthPPPPTALK

+ const EthPPRP

+ const EthPPUP

+ const EthPPUPAT

+ const EthPQINQ1

+ const EthPQINQ2

+ const EthPQINQ3

+ const EthPRARP

+ const EthPSCA

+ const EthPSLOW

+ const EthPSNAP

+ const EthPTDLS

+ const EthPTEB

+ const EthPTIPC

+ const EthPTR8022

+ const EthPTRAILER

+ const EthPTSN

+ const EthPWANPPP

+ const EthPWCCP

+ const EthPX25

+ const EthPXDSA

+ func (proto L3Protocol) String() string

+ type L4Protocol uint16

+ const IPProtoAH

+ const IPProtoBEETPH

+ const IPProtoCOMP

+ const IPProtoDCCP

+ const IPProtoEGP

+ const IPProtoENCAP

+ const IPProtoESP

+ const IPProtoGRE

+ const IPProtoICMP

+ const IPProtoICMPV6

+ const IPProtoIDP

+ const IPProtoIGMP

+ const IPProtoIGP

+ const IPProtoIP

+ const IPProtoIPIP

+ const IPProtoIPV6

+ const IPProtoMPLS

+ const IPProtoMTP

+ const IPProtoPIM

+ const IPProtoPUP

+ const IPProtoRAW

+ const IPProtoRSVP

+ const IPProtoSCTP

+ const IPProtoTCP

+ const IPProtoTP

+ const IPProtoUDP

+ const IPProtoUDPLITE

+ func (proto L4Protocol) String() string

+ type NetDevice struct

+ IfIndex uint32

+ Name string

+ NetNS uint32

+ PeerIfIndex uint32

+ PeerNetNS uint32

+ func (d *NetDevice) UnmarshalBinary(data []byte) (int, error)

+ func (d NetDevice) GetKey() string

+ type NetDeviceEvent struct

+ Device NetDevice

+ func (e *NetDeviceEvent) UnmarshalBinary(data []byte) (int, error)

+ type NetworkContext struct

+ Destination IPPortContext

+ Device NetworkDeviceContext

+ L3Protocol uint16

+ L4Protocol uint16

+ Size uint32

+ Source IPPortContext

+ func (e *NetworkContext) UnmarshalBinary(data []byte) (int, error)

+ type NetworkDeviceContext struct

+ IfIndex uint32

+ IfName string

+ NetNS uint32

+ func (e *NetworkDeviceContext) UnmarshalBinary(data []byte) (int, error)

type Process

+ ContainerTags []string

+ FileEvent FileEvent

+ NetNS uint32

+ SpanID uint64

+ TraceID uint64

+ func (e *Process) MarshalPidCache(data []byte) (int, error)

+ func (e *Process) MarshalProcCache(data []byte) (int, error)

+ func (z *Process) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *Process) EncodeMsg(en *msgp.Writer) (err error)

+ func (z *Process) MarshalMsg(b []byte) (o []byte, err error)

+ func (z *Process) Msgsize() (s int)

+ func (z *Process) UnmarshalMsg(bts []byte) (o []byte, err error)

type ProcessCacheEntry

+ func (pc *ProcessCacheEntry) Equals(entry *ProcessCacheEntry) bool

+ func (pc *ProcessCacheEntry) GetNextAncestorNoFork() *ProcessCacheEntry

+ func (pc *ProcessCacheEntry) SetParent(parent *ProcessCacheEntry)

+ func (pc *ProcessCacheEntry) SetSpan(spanID uint64, traceID uint64)

+ func (pc *ProcessCacheEntry) ShareArgsEnvs(childEntry *ProcessCacheEntry)

+ func (z *ProcessCacheEntry) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *ProcessCacheEntry) EncodeMsg(en *msgp.Writer) (err error)

+ func (z *ProcessCacheEntry) MarshalMsg(b []byte) (o []byte, err error)

+ func (z *ProcessCacheEntry) Msgsize() (s int)

+ func (z *ProcessCacheEntry) UnmarshalMsg(bts []byte) (o []byte, err error)

type ProcessContext

+ func (z *ProcessContext) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *ProcessContext) EncodeMsg(en *msgp.Writer) (err error)

+ func (z *ProcessContext) MarshalMsg(b []byte) (o []byte, err error)

+ func (z *ProcessContext) Msgsize() (s int)

+ func (z *ProcessContext) UnmarshalMsg(bts []byte) (o []byte, err error)

+ type QClass uint32

+ func (qc QClass) String() string

+ type QType uint32

+ func (qt QType) String() string

type SpanContext

+ func (z *SpanContext) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *SpanContext) UnmarshalMsg(bts []byte) (o []byte, err error)

+ func (z SpanContext) EncodeMsg(en *msgp.Writer) (err error)

+ func (z SpanContext) MarshalMsg(b []byte) (o []byte, err error)

+ func (z SpanContext) Msgsize() (s int)

type SyscallEvent

+ func (z *SyscallEvent) DecodeMsg(dc *msgp.Reader) (err error)

+ func (z *SyscallEvent) UnmarshalMsg(bts []byte) (o []byte, err error)

+ func (z SyscallEvent) EncodeMsg(en *msgp.Writer) (err error)

+ func (z SyscallEvent) MarshalMsg(b []byte) (o []byte, err error)

+ func (z SyscallEvent) Msgsize() (s int)

+ type VethPairEvent struct

+ HostDevice NetDevice

+ PeerDevice NetDevice

+ func (e *VethPairEvent) UnmarshalBinary(data []byte) (int, error)

v0.36.0-rc.12

May 18, 2022

v0.36.0-rc.11

May 16, 2022

v0.36.0-rc.10

May 9, 2022

v0.36.0-rc.9

May 6, 2022

v0.36.0-rc.8

May 4, 2022

v0.36.0-rc.7

May 3, 2022

v0.36.0-rc.6

Apr 28, 2022

v0.36.0-rc.5

Apr 21, 2022

v0.36.0-rc.4

Apr 15, 2022

v0.36.0-rc.3

Apr 15, 2022

v0.36.0-rc.2

Apr 11, 2022

v0.36.0-rc.1

Apr 6, 2022

v0.35.2

May 5, 2022

v0.35.2-rc.1

May 4, 2022

v0.35.1

Apr 12, 2022

v0.35.1-rc.1

Apr 8, 2022

v0.35.0

Apr 6, 2022

Changes in this version

+ const MaxBpfObjName

+ var PipeBufFlagConstants = map[string]PipeBufFlag

type BPFProgram

+ Tag string

type EnvsEntry

+ func (p *EnvsEntry) ToArray() ([]string, bool)

type Event

+ LoadModule LoadModuleEvent

+ Signal SignalEvent

+ Splice SpliceEvent

+ UnloadModule UnloadModuleEvent

type EventType

+ const LoadModuleEventType

+ const SignalEventType

+ const SpliceEventType

+ const UnloadModuleEventType

+ type LoadModuleEvent struct

+ File FileEvent

+ LoadedFromMemory bool

+ Name string

+ func (e *LoadModuleEvent) UnmarshalBinary(data []byte) (int, error)

+ type PipeBufFlag int

+ const PipeBufFlagAtomic

+ const PipeBufFlagCanMerge

+ const PipeBufFlagGift

+ const PipeBufFlagLRU

+ const PipeBufFlagLoss

+ const PipeBufFlagPacket

+ const PipeBufFlagWhole

+ func (pbf PipeBufFlag) String() string

type Process

+ Envp []string

+ Variables eval.Variables

type ProcessCacheEntry

+ func (e *ProcessCacheEntry) SetReleaseCallback(callback func())

+ type Signal int

+ func (sig Signal) String() string

+ type SignalEvent struct

+ PID uint32

+ Target ProcessContext

+ TargetProcessCacheEntry *ProcessCacheEntry

+ Type uint32

+ func (e *SignalEvent) UnmarshalBinary(data []byte) (int, error)

+ type SpliceEvent struct

+ File FileEvent

+ PipeEntryFlag uint32

+ PipeExitFlag uint32

+ func (e *SpliceEvent) UnmarshalBinary(data []byte) (int, error)

+ type UnloadModuleEvent struct

+ Name string

+ func (e *UnloadModuleEvent) UnmarshalBinary(data []byte) (int, error)

v0.35.0-rc.9

Apr 4, 2022

v0.35.0-rc.8

Mar 25, 2022

v0.35.0-rc.7

Mar 22, 2022

v0.35.0-rc.6

Mar 18, 2022

v0.35.0-rc.5

Mar 11, 2022

v0.35.0-rc.4

Mar 4, 2022

v0.35.0-rc.3

Feb 25, 2022

v0.35.0-rc.2

Feb 24, 2022

v0.35.0-rc.1

Feb 21, 2022

v0.34.0

Feb 28, 2022

Changes in this version

+ const LowerLayer — darwin/amd64, js/wasm, windows/amd64

+ const MaxPathDepth — darwin/amd64, js/wasm, windows/amd64

+ const MaxSegmentLength — darwin/amd64, js/wasm, windows/amd64

+ const NameSuffix — darwin/amd64, js/wasm, windows/amd64

+ const PathSuffix — darwin/amd64, js/wasm, windows/amd64

+ const UpperLayer — darwin/amd64, js/wasm, windows/amd64

+ var BPFAttachTypeConstants = map[string]BPFAttachType — darwin/amd64, js/wasm, windows/amd64

+ var BPFCmdConstants = map[string]BPFCmd — darwin/amd64, js/wasm, windows/amd64

+ var BPFHelperFuncConstants = map[string]BPFHelperFunc — darwin/amd64, js/wasm, windows/amd64

+ var BPFMapTypeConstants = map[string]BPFMapType — darwin/amd64, js/wasm, windows/amd64

+ var BPFProgramTypeConstants = map[string]BPFProgramType — darwin/amd64, js/wasm, windows/amd64

+ var KernelCapabilityConstants = map[string]uint64 — darwin/amd64, js/wasm, windows/amd64

+ var SECLConstants = map[string]interface — darwin/amd64, js/wasm, windows/amd64

+ var SECLLegacyFields = map[eval.Field]eval.Field

+ var SECLVariables = map[string]eval.VariableValue — linux/amd64

+ func GetEventTypePerCategory() map[EventCategory][]eval.EventType — darwin/amd64, js/wasm, windows/amd64

+ func StringifyHelpersList(input []uint32) []string — darwin/amd64, js/wasm, windows/amd64

+ func UnmarshalBinary(data []byte, binaryUnmarshalers ...BinaryUnmarshaler) (int, error) — darwin/amd64, js/wasm, windows/amd64

+ type ArgsEntry struct — darwin/amd64, js/wasm, windows/amd64

+ Truncated bool

+ Values []string

+ func (p *ArgsEntry) ToArray() ([]string, bool)

+ type ArgsEnvs struct — darwin/amd64, js/wasm, windows/amd64

+ ID uint32

+ Size uint32

+ ValuesRaw [256]byte

+ type ArgsEnvsCacheEntry struct — darwin/amd64, js/wasm, windows/amd64

+ func NewArgsEnvsCacheEntry(onRelease func(_ *ArgsEnvsCacheEntry)) *ArgsEnvsCacheEntry

+ func (p *ArgsEnvsCacheEntry) Append(entry *ArgsEnvsCacheEntry)

+ func (p *ArgsEnvsCacheEntry) Release()

+ func (p *ArgsEnvsCacheEntry) Retain()

+ type ArgsEnvsEvent struct — darwin/amd64, js/wasm, windows/amd64

+ func (e *ArgsEnvsEvent) UnmarshalBinary(data []byte) (int, error)

+ type BPFAttachType uint32 — darwin/amd64, js/wasm, windows/amd64

+ const BpfCgroupDevice

+ const BpfCgroupGetsockopt

+ const BpfCgroupInet4Bind

+ const BpfCgroupInet4Connect

+ const BpfCgroupInet4Getpeername

+ const BpfCgroupInet4Getsockname

+ const BpfCgroupInet4PostBind

+ const BpfCgroupInet6Bind

+ const BpfCgroupInet6Connect

+ const BpfCgroupInet6Getpeername

+ const BpfCgroupInet6Getsockname

+ const BpfCgroupInet6PostBind

+ const BpfCgroupInetEgress

+ const BpfCgroupInetIngress

+ const BpfCgroupInetSockCreate

+ const BpfCgroupInetSockRelease

+ const BpfCgroupSetsockopt

+ const BpfCgroupSockOps

+ const BpfCgroupSysctl

+ const BpfCgroupUDP4Recvmsg

+ const BpfCgroupUDP4Sendmsg

+ const BpfCgroupUDP6Recvmsg

+ const BpfCgroupUDP6Sendmsg

+ const BpfFlowDissector

+ const BpfLircMode2

+ const BpfLsmMac

+ const BpfModifyReturn

+ const BpfSkLookup

+ const BpfSkMsgVerdict

+ const BpfSkSkbStreamParser

+ const BpfSkSkbStreamVerdict

+ const BpfSkSkbVerdict

+ const BpfTraceFentry

+ const BpfTraceFexit

+ const BpfTraceIter

+ const BpfTraceRawTp

+ const BpfXdp

+ const BpfXdpCPUmap

+ const BpfXdpDevmap

+ func (t BPFAttachType) String() string

+ type BPFCmd uint64 — darwin/amd64, js/wasm, windows/amd64

+ const BpfBtfGetFdByIDCmd

+ const BpfBtfGetNextIDCmd

+ const BpfBtfLoadCmd

+ const BpfEnableStatsCmd

+ const BpfIterCreateCmd

+ const BpfLinkCreateCmd

+ const BpfLinkDetachCmd

+ const BpfLinkGetFdByIDCmd

+ const BpfLinkGetNextIDCmd

+ const BpfLinkUpdateCmd

+ const BpfMapCreateCmd

+ const BpfMapDeleteBatchCmd

+ const BpfMapDeleteElemCmd

+ const BpfMapFreezeCmd

+ const BpfMapGetFdByIDCmd

+ const BpfMapGetNextIDCmd

+ const BpfMapGetNextKeyCmd

+ const BpfMapLookupAndDeleteBatchCmd

+ const BpfMapLookupAndDeleteElemCmd

+ const BpfMapLookupBatchCmd

+ const BpfMapLookupElemCmd

+ const BpfMapUpdateBatchCmd

+ const BpfMapUpdateElemCmd

+ const BpfObjGetCmd

+ const BpfObjGetInfoByFdCmd

+ const BpfObjPinCmd

+ const BpfProgAttachCmd

+ const BpfProgBindMapCmd

+ const BpfProgDetachCmd

+ const BpfProgGetFdByIDCmd

+ const BpfProgGetNextIDCmd

+ const BpfProgLoadCmd

+ const BpfProgQueryCmd

+ const BpfProgTestRunCmd

+ const BpfRawTracepointOpenCmd

+ const BpfTaskFdQueryCmd

+ func (cmd BPFCmd) String() string

+ type BPFEvent struct — darwin/amd64, js/wasm, windows/amd64

+ Cmd uint32

+ Map BPFMap

+ Program BPFProgram

+ func (e *BPFEvent) UnmarshalBinary(data []byte) (int, error)

+ type BPFHelperFunc uint32 — darwin/amd64, js/wasm, windows/amd64

+ const BpfBind

+ const BpfBprmOptsSet

+ const BpfCheckMtu

+ const BpfCloneRedirect

+ const BpfCopyFromUser

+ const BpfCsumDiff

+ const BpfCsumLevel

+ const BpfCsumUpdate

+ const BpfCurrentTaskUnderCgroup

+ const BpfDPath

+ const BpfFibLookup

+ const BpfForEachMapElem

+ const BpfGetCgroupClassid

+ const BpfGetCurrentAncestorCgroupID

+ const BpfGetCurrentCgroupID

+ const BpfGetCurrentComm

+ const BpfGetCurrentPidTgid

+ const BpfGetCurrentTask

+ const BpfGetCurrentTaskBtf

+ const BpfGetCurrentUIDGid

+ const BpfGetHashRecalc

+ const BpfGetListenerSock

+ const BpfGetLocalStorage

+ const BpfGetNetnsCookie

+ const BpfGetNsCurrentPidTgid

+ const BpfGetNumaNodeID

+ const BpfGetPrandomU32

+ const BpfGetRouteRealm

+ const BpfGetSmpProcessorID

+ const BpfGetSocketCookie

+ const BpfGetSocketUID

+ const BpfGetStack

+ const BpfGetStackid

+ const BpfGetTaskStack

+ const BpfGetsockopt

+ const BpfImaInodeHash

+ const BpfInodeStorageDelete

+ const BpfInodeStorageGet

+ const BpfJiffies64

+ const BpfKtimeGetBootNs

+ const BpfKtimeGetCoarseNs

+ const BpfKtimeGetNs

+ const BpfL3CsumReplace

+ const BpfL4CsumReplace

+ const BpfLoadHdrOpt

+ const BpfLwtPushEncap

+ const BpfLwtSeg6Action

+ const BpfLwtSeg6AdjustSrh

+ const BpfLwtSeg6StoreBytes

+ const BpfMapDeleteElem

+ const BpfMapLookupElem

+ const BpfMapPeekElem

+ const BpfMapPopElem

+ const BpfMapPushElem

+ const BpfMapUpdateElem

+ const BpfMsgApplyBytes

+ const BpfMsgCorkBytes

+ const BpfMsgPopData

+ const BpfMsgPullData

+ const BpfMsgPushData

+ const BpfMsgRedirectHash

+ const BpfMsgRedirectMap

+ const BpfOverrideReturn

+ const BpfPerCPUPtr

+ const BpfPerfEventOutput

+ const BpfPerfEventRead

+ const BpfPerfEventReadValue

+ const BpfPerfProgReadValue

+ const BpfProbeRead

+ const BpfProbeReadKernel

+ const BpfProbeReadKernelStr

+ const BpfProbeReadStr

+ const BpfProbeReadUser

+ const BpfProbeReadUserStr

+ const BpfProbeWriteUser

+ const BpfRcKeydown

+ const BpfRcPointerRel

+ const BpfRcRepeat

+ const BpfReadBranchRecords

+ const BpfRedirect

+ const BpfRedirectMap

+ const BpfRedirectNeigh

+ const BpfRedirectPeer

+ const BpfReserveHdrOpt

+ const BpfRingbufDiscard

+ const BpfRingbufOutput

+ const BpfRingbufQuery

+ const BpfRingbufReserve

+ const BpfRingbufSubmit

+ const BpfSendSignal

+ const BpfSendSignalThread

+ const BpfSeqPrintf

+ const BpfSeqPrintfBtf

+ const BpfSeqWrite

+ const BpfSetHash

+ const BpfSetHashInvalid

+ const BpfSetsockopt

+ const BpfSkAncestorCgroupID

+ const BpfSkAssign

+ const BpfSkCgroupID

+ const BpfSkFullsock

+ const BpfSkLookupTCP

+ const BpfSkLookupUDP

+ const BpfSkRedirectHash

+ const BpfSkRedirectMap

+ const BpfSkRelease

+ const BpfSkSelectReuseport

+ const BpfSkStorageDelete

+ const BpfSkStorageGet

+ const BpfSkbAdjustRoom

+ const BpfSkbAncestorCgroupID

+ const BpfSkbCgroupClassid

+ const BpfSkbCgroupID

+ const BpfSkbChangeHead

+ const BpfSkbChangeProto

+ const BpfSkbChangeTail

+ const BpfSkbChangeType

+ const BpfSkbEcnSetCe

+ const BpfSkbGetTunnelKey

+ const BpfSkbGetTunnelOpt

+ const BpfSkbGetXfrmState

+ const BpfSkbLoadBytes

+ const BpfSkbLoadBytesRelative

+ const BpfSkbOutput

+ const BpfSkbPullData

+ const BpfSkbSetTunnelKey

+ const BpfSkbSetTunnelOpt

+ const BpfSkbStoreBytes

+ const BpfSkbUnderCgroup

+ const BpfSkbVlanPop

+ const BpfSkbVlanPush

+ const BpfSkcLookupTCP

+ const BpfSkcToTCP6Sock

+ const BpfSkcToTCPRequestSock

+ const BpfSkcToTCPSock

+ const BpfSkcToTCPTimewaitSock

+ const BpfSkcToUDP6Sock

+ const BpfSnprintf

+ const BpfSnprintfBtf

+ const BpfSockFromFile

+ const BpfSockHashUpdate

+ const BpfSockMapUpdate

+ const BpfSockOpsCbFlagsSet

+ const BpfSpinLock

+ const BpfSpinUnlock

+ const BpfStoreHdrOpt

+ const BpfStrtol

+ const BpfStrtoul

+ const BpfSysctlGetCurrentValue

+ const BpfSysctlGetName

+ const BpfSysctlGetNewValue

+ const BpfSysctlSetNewValue

+ const BpfTCPCheckSyncookie

+ const BpfTCPGenSyncookie

+ const BpfTCPSendAck

+ const BpfTCPSock

+ const BpfTailCall

+ const BpfTaskStorageDelete

+ const BpfTaskStorageGet

+ const BpfThisCPUPtr

+ const BpfTracePrintk

+ const BpfUnspec

+ const BpfXdpAdjustHead

+ const BpfXdpAdjustMeta

+ const BpfXdpAdjustTail

+ const BpfXdpOutput

+ func (f BPFHelperFunc) String() string

+ type BPFMap struct — darwin/amd64, js/wasm, windows/amd64

+ ID uint32

+ Name string

+ Type uint32

+ func (m *BPFMap) UnmarshalBinary(data []byte) (int, error)

+ type BPFMapType uint32 — darwin/amd64, js/wasm, windows/amd64

+ const BpfMapTypeArray

+ const BpfMapTypeArrayOfMaps

+ const BpfMapTypeCPUmap

+ const BpfMapTypeCgroupArray

+ const BpfMapTypeCgroupStorage

+ const BpfMapTypeDevmap

+ const BpfMapTypeDevmapHash

+ const BpfMapTypeHash

+ const BpfMapTypeHashOfMaps

+ const BpfMapTypeInodeStorage

+ const BpfMapTypeLpmTrie

+ const BpfMapTypeLruHash

+ const BpfMapTypeLruPercpuHash

+ const BpfMapTypePercpuArray

+ const BpfMapTypePercpuCgroupStorage

+ const BpfMapTypePercpuHash

+ const BpfMapTypePerfEventArray

+ const BpfMapTypeProgArray

+ const BpfMapTypeQueue

+ const BpfMapTypeReuseportSockarray

+ const BpfMapTypeRingbuf

+ const BpfMapTypeSkStorage

+ const BpfMapTypeSockhash

+ const BpfMapTypeSockmap

+ const BpfMapTypeStack

+ const BpfMapTypeStackTrace

+ const BpfMapTypeStructOps

+ const BpfMapTypeTaskStorage

+ const BpfMapTypeUnspec

+ const BpfMapTypeXskmap

+ func (t BPFMapType) String() string

+ type BPFProgram struct — darwin/amd64, js/wasm, windows/amd64

+ AttachType uint32

+ Helpers []uint32

+ ID uint32

+ Name string

+ Type uint32

+ func (p *BPFProgram) UnmarshalBinary(data []byte) (int, error)

+ type BPFProgramType uint32 — darwin/amd64, js/wasm, windows/amd64

+ const BpfProgTypeCgroupDevice

+ const BpfProgTypeCgroupSkb

+ const BpfProgTypeCgroupSock

+ const BpfProgTypeCgroupSockAddr

+ const BpfProgTypeCgroupSockopt

+ const BpfProgTypeCgroupSysctl

+ const BpfProgTypeExt

+ const BpfProgTypeFlowDissector

+ const BpfProgTypeKprobe

+ const BpfProgTypeLircMode2

+ const BpfProgTypeLsm

+ const BpfProgTypeLwtIn

+ const BpfProgTypeLwtOut

+ const BpfProgTypeLwtSeg6local

+ const BpfProgTypeLwtXmit

+ const BpfProgTypePerfEvent

+ const BpfProgTypeRawTracepoint

+ const BpfProgTypeRawTracepointWritable

+ const BpfProgTypeSchedAct

+ const BpfProgTypeSchedCls

+ const BpfProgTypeSkLookup

+ const BpfProgTypeSkMsg

+ const BpfProgTypeSkReuseport

+ const BpfProgTypeSkSkb

+ const BpfProgTypeSockOps

+ const BpfProgTypeSocketFilter

+ const BpfProgTypeStructOps

+ const BpfProgTypeTracepoint

+ const BpfProgTypeTracing

+ const BpfProgTypeUnspec

+ const BpfProgTypeXdp

+ func (t BPFProgramType) String() string

+ type BinaryUnmarshaler interface — darwin/amd64, js/wasm, windows/amd64

+ UnmarshalBinary func(data []byte) (int, error)

+ type CapsetEvent struct — darwin/amd64, js/wasm, windows/amd64

+ CapEffective uint64

+ CapPermitted uint64

+ func (e *CapsetEvent) UnmarshalBinary(data []byte) (int, error)

+ type ChmodEvent struct — darwin/amd64, js/wasm, windows/amd64

+ File FileEvent

+ Mode uint32

+ func (e *ChmodEvent) UnmarshalBinary(data []byte) (int, error)

+ type ChmodMode int — darwin/amd64, js/wasm, windows/amd64

+ func (m ChmodMode) String() string

+ type ChownEvent struct — darwin/amd64, js/wasm, windows/amd64

+ File FileEvent

+ GID uint32

+ Group string

+ UID uint32

+ User string

+ func (e *ChownEvent) UnmarshalBinary(data []byte) (int, error)

+ type ContainerContext struct — darwin/amd64, js/wasm, windows/amd64

+ ID string

+ Tags []string

+ func (e *ContainerContext) UnmarshalBinary(data []byte) (int, error)

+ type Credentials struct — darwin/amd64, js/wasm, windows/amd64

+ CapEffective uint64

+ CapPermitted uint64

+ EGID uint32

+ EGroup string

+ EUID uint32

+ EUser string

+ FSGID uint32

+ FSGroup string

+ FSUID uint32

+ FSUser string

+ GID uint32

+ Group string

+ UID uint32

+ User string

+ func (e *Credentials) UnmarshalBinary(data []byte) (int, error)

+ type EnvsEntry struct — darwin/amd64, js/wasm, windows/amd64

+ Truncated bool

+ Values map[string]string

+ func (p *EnvsEntry) Get(key string) string

+ func (p *EnvsEntry) Keys() ([]string, bool)

+ func (p *EnvsEntry) ToMap() (map[string]string, bool)

+ type Event struct — darwin/amd64, js/wasm, windows/amd64

+ ArgsEnvs ArgsEnvsEvent

+ BPF BPFEvent

+ Capset CapsetEvent

+ Chmod ChmodEvent

+ Chown ChownEvent

+ ContainerContext ContainerContext

+ Exec ExecEvent

+ ID string

+ InvalidateDentry InvalidateDentryEvent

+ Link LinkEvent

+ MMap MMapEvent

+ MProtect MProtectEvent

+ Mkdir MkdirEvent

+ Mount MountEvent

+ MountReleased MountReleasedEvent

+ Open OpenEvent

+ PTrace PTraceEvent

+ ProcessContext ProcessContext

+ RemoveXAttr SetXAttrEvent

+ Rename RenameEvent

+ Rmdir RmdirEvent

+ SELinux SELinuxEvent

+ SetGID SetgidEvent

+ SetUID SetuidEvent

+ SetXAttr SetXAttrEvent

+ SpanContext SpanContext

+ Timestamp time.Time

+ TimestampRaw uint64

+ Type uint64

+ Umount UmountEvent

+ Unlink UnlinkEvent

+ Utimes UtimesEvent

+ func (e *Event) GetEventType() EventType

+ func (e *Event) GetFieldEventType(field eval.Field) (eval.EventType, error)

+ func (e *Event) GetFieldType(field eval.Field) (reflect.Kind, error)

+ func (e *Event) GetFieldValue(field eval.Field) (interface{}, error)

+ func (e *Event) GetFields() []eval.Field

+ func (e *Event) GetPointer() unsafe.Pointer

+ func (e *Event) GetTags() []string

+ func (e *Event) GetType() string

+ func (e *Event) SetFieldValue(field eval.Field, value interface{}) error

+ func (e *Event) UnmarshalBinary(data []byte) (int, error)

+ type EventCategory = string — darwin/amd64, js/wasm, windows/amd64

+ const FIMCategory

+ const KernelCategory

+ const ProcessCategory

+ func GetAllCategories() []EventCategory

+ func GetEventTypeCategory(eventType eval.EventType) EventCategory

type EventType

+ const MMapEventType

+ const MProtectEventType

+ const PTraceEventType

+ type ExecEvent struct — darwin/amd64, js/wasm, windows/amd64

+ func (e *ExecEvent) UnmarshalBinary(data []byte) (int, error)

+ type FileEvent struct — darwin/amd64, js/wasm, windows/amd64

+ BasenameStr string

+ Filesytem string

+ PathResolutionError error

+ PathnameStr string

+ func (e *FileEvent) GetPathResolutionError() string

+ func (e *FileEvent) UnmarshalBinary(data []byte) (int, error)

+ type FileFields struct — darwin/amd64, js/wasm, windows/amd64

+ CTime uint64

+ Flags int32

+ GID uint32

+ Group string

+ InUpperLayer bool

+ Inode uint64

+ MTime uint64

+ Mode uint16

+ MountID uint32

+ NLink uint32

+ PathID uint32

+ UID uint32

+ User string

+ func (e *FileFields) UnmarshalBinary(data []byte) (int, error)

+ func (f *FileFields) GetInLowerLayer() bool

+ func (f *FileFields) GetInUpperLayer() bool

+ func (f *FileFields) HasHardLinks() bool

+ type InvalidateDentryEvent struct — darwin/amd64, js/wasm, windows/amd64

+ DiscarderRevision uint32

+ Inode uint64

+ MountID uint32

+ func (e *InvalidateDentryEvent) UnmarshalBinary(data []byte) (int, error)

+ type KernelCapability uint64 — darwin/amd64, js/wasm, windows/amd64

+ func (kc KernelCapability) String() string

+ func (kc KernelCapability) StringArray() []string

+ type LinkEvent struct — darwin/amd64, js/wasm, windows/amd64

+ Source FileEvent

+ Target FileEvent

+ func (e *LinkEvent) UnmarshalBinary(data []byte) (int, error)

+ type MMapEvent struct

+ Addr uint64

+ File FileEvent

+ Flags int

+ Len uint32

+ Offset uint64

+ Protection int

+ func (e *MMapEvent) UnmarshalBinary(data []byte) (int, error)

+ type MMapFlag int

+ func (mmf MMapFlag) String() string

+ type MProtectEvent struct

+ ReqProtection int

+ VMEnd uint64

+ VMProtection int

+ VMStart uint64

+ func (e *MProtectEvent) UnmarshalBinary(data []byte) (int, error)

+ type MkdirEvent struct — darwin/amd64, js/wasm, windows/amd64

+ File FileEvent

+ Mode uint32

+ func (e *MkdirEvent) UnmarshalBinary(data []byte) (int, error)

+ type Model struct — darwin/amd64, js/wasm, windows/amd64

+ func (m *Model) GetEvaluator(field eval.Field, regID eval.RegisterID) (eval.Evaluator, error)

+ func (m *Model) GetEventTypes() []eval.EventType

+ func (m *Model) GetIterator(field eval.Field) (eval.Iterator, error)

+ func (m *Model) NewEvent() eval.Event

+ func (m *Model) ValidateField(field eval.Field, fieldValue eval.FieldValue) error

+ type MountEvent struct — darwin/amd64, js/wasm, windows/amd64

+ Device uint32

+ FSType string

+ FSTypeRaw [16]byte

+ GroupID uint32

+ MountID uint32

+ MountPointPathResolutionError error

+ MountPointStr string

+ ParentInode uint64

+ ParentMountID uint32

+ RootInode uint64

+ RootMountID uint32

+ RootPathResolutionError error

+ RootStr string

+ func (e *MountEvent) UnmarshalBinary(data []byte) (int, error)

+ func (m *MountEvent) GetFSType() string

+ func (m *MountEvent) GetMountPointPathResolutionError() string

+ func (m *MountEvent) GetRootPathResolutionError() string

+ func (m *MountEvent) IsOverlayFS() bool

+ type MountReleasedEvent struct — darwin/amd64, js/wasm, windows/amd64

+ DiscarderRevision uint32

+ MountID uint32

+ func (e *MountReleasedEvent) UnmarshalBinary(data []byte) (int, error)

+ type OpenEvent struct — darwin/amd64, js/wasm, windows/amd64

+ File FileEvent

+ Flags uint32

+ Mode uint32

+ func (e *OpenEvent) UnmarshalBinary(data []byte) (int, error)

+ type OpenFlags int — darwin/amd64, js/wasm, windows/amd64

+ func (f OpenFlags) String() string

+ func (f OpenFlags) StringArray() []string

+ type PTraceEvent struct

+ Address uint64

+ PID uint32

+ Request uint32

+ Tracee ProcessContext

+ TraceeProcessCacheEntry *ProcessCacheEntry

+ func (e *PTraceEvent) UnmarshalBinary(data []byte) (int, error)

+ type PTraceRequest uint32

+ func (f PTraceRequest) String() string

+ type Process struct — darwin/amd64, js/wasm, windows/amd64

+ Args string

+ ArgsEntry *ArgsEntry

+ ArgsID uint32

+ ArgsTruncated bool

+ Argv []string

+ Argv0 string

+ BasenameStr string

+ Comm string

+ ContainerID string

+ Cookie uint32

+ CreatedAt uint64

+ Envs []string

+ EnvsEntry *EnvsEntry

+ EnvsID uint32

+ EnvsTruncated bool

+ ExecTime time.Time

+ ExitTime time.Time

+ FileFields FileFields

+ Filesystem string

+ ForkTime time.Time

+ PPid uint32

+ PathResolutionError error

+ PathnameStr string

+ Pid uint32

+ ScrubbedArgsTruncated bool

+ ScrubbedArgv []string

+ ScrubbedArgvResolved bool

+ TTYName string

+ Tid uint32

+ func (e *Process) GetPathResolutionError() string

+ func (e *Process) UnmarshalBinary(data []byte) (int, error)

+ type ProcessAncestorsIterator struct — darwin/amd64, js/wasm, windows/amd64

+ func (it *ProcessAncestorsIterator) Front(ctx *eval.Context) unsafe.Pointer

+ func (it *ProcessAncestorsIterator) Next() unsafe.Pointer

+ type ProcessCacheEntry struct — darwin/amd64, js/wasm, windows/amd64

+ func NewProcessCacheEntry(onRelease func(_ *ProcessCacheEntry)) *ProcessCacheEntry

+ func (e *ProcessCacheEntry) Release()

+ func (e *ProcessCacheEntry) Reset()

+ func (e *ProcessCacheEntry) Retain()

+ func (pc *ProcessCacheEntry) Exec(entry *ProcessCacheEntry)

+ func (pc *ProcessCacheEntry) Exit(exitTime time.Time)

+ func (pc *ProcessCacheEntry) Fork(childEntry *ProcessCacheEntry)

+ func (pc *ProcessCacheEntry) SetAncestor(parent *ProcessCacheEntry)

+ type ProcessContext struct — darwin/amd64, js/wasm, windows/amd64

+ Ancestor *ProcessCacheEntry

+ func (p *ProcessContext) UnmarshalBinary(data []byte) (int, error)

+ type Protection int

+ func (p Protection) String() string

+ type RenameEvent struct — darwin/amd64, js/wasm, windows/amd64

+ DiscarderRevision uint32

+ New FileEvent

+ Old FileEvent

+ func (e *RenameEvent) UnmarshalBinary(data []byte) (int, error)

+ type RetValError int — darwin/amd64, js/wasm, windows/amd64

+ func (f RetValError) String() string

+ type RmdirEvent struct — darwin/amd64, js/wasm, windows/amd64

+ DiscarderRevision uint32

+ File FileEvent

+ func (e *RmdirEvent) UnmarshalBinary(data []byte) (int, error)

+ type SELinuxEvent struct — darwin/amd64, js/wasm, windows/amd64

+ BoolChangeValue string

+ BoolCommitValue bool

+ BoolName string

+ EnforceStatus string

+ EventKind SELinuxEventKind

+ File FileEvent

+ func (e *SELinuxEvent) UnmarshalBinary(data []byte) (int, error)

+ type SELinuxEventKind uint32 — darwin/amd64, js/wasm, windows/amd64

+ const SELinuxBoolChangeEventKind

+ const SELinuxBoolCommitEventKind

+ const SELinuxStatusChangeEventKind

+ type SetXAttrEvent struct — darwin/amd64, js/wasm, windows/amd64

+ File FileEvent

+ Name string

+ NameRaw [200]byte

+ Namespace string

+ func (e *SetXAttrEvent) UnmarshalBinary(data []byte) (int, error)

+ type SetgidEvent struct — darwin/amd64, js/wasm, windows/amd64

+ EGID uint32

+ EGroup string

+ FSGID uint32

+ FSGroup string

+ GID uint32

+ Group string

+ func (e *SetgidEvent) UnmarshalBinary(data []byte) (int, error)

+ type SetuidEvent struct — darwin/amd64, js/wasm, windows/amd64

+ EUID uint32

+ EUser string

+ FSUID uint32

+ FSUser string

+ UID uint32

+ User string

+ func (e *SetuidEvent) UnmarshalBinary(data []byte) (int, error)

+ type SpanContext struct — darwin/amd64, js/wasm, windows/amd64

+ SpanID uint64

+ TraceID uint64

+ func (s *SpanContext) UnmarshalBinary(data []byte) (int, error)

+ type SyscallEvent struct — darwin/amd64, js/wasm, windows/amd64

+ Retval int64

+ func (e *SyscallEvent) UnmarshalBinary(data []byte) (int, error)

+ type UmountEvent struct — darwin/amd64, js/wasm, windows/amd64

+ MountID uint32

+ func (e *UmountEvent) UnmarshalBinary(data []byte) (int, error)

+ type UnlinkEvent struct — darwin/amd64, js/wasm, windows/amd64

+ DiscarderRevision uint32

+ File FileEvent

+ Flags uint32

+ func (e *UnlinkEvent) UnmarshalBinary(data []byte) (int, error)

+ type UnlinkFlags int — darwin/amd64, js/wasm, windows/amd64

+ func (f UnlinkFlags) String() string

+ func (f UnlinkFlags) StringArray() []string

+ type UtimesEvent struct — darwin/amd64, js/wasm, windows/amd64

+ Atime time.Time

+ File FileEvent

+ Mtime time.Time

+ func (e *UtimesEvent) UnmarshalBinary(data []byte) (int, error)

+ type VMFlag int

+ func (vmf VMFlag) String() string

v0.34.0-rc.12

Feb 24, 2022

v0.34.0-rc.11

Feb 23, 2022

v0.34.0-rc.10

Feb 17, 2022

v0.34.0-rc.9

Feb 14, 2022

v0.34.0-rc.8

Feb 10, 2022

v0.34.0-rc.7

Feb 4, 2022

v0.34.0-rc.6

Feb 1, 2022

v0.34.0-rc.5

Jan 31, 2022

v0.34.0-rc.4

Jan 24, 2022

v0.34.0-rc.3

Jan 19, 2022

v0.34.0-rc.2

Jan 13, 2022

v0.34.0-rc.1

Jan 10, 2022

v0.33.1

Feb 10, 2022

v0.33.1-rc.1

Feb 8, 2022

v0.33.0

Jan 12, 2022

Changes in this version

+ const LowerLayer — linux/amd64

+ const MaxPathDepth — linux/amd64

+ const MaxSegmentLength — linux/amd64

+ const NameSuffix — linux/amd64

+ const PathSuffix — linux/amd64

+ const UpperLayer — linux/amd64

+ var BPFAttachTypeConstants = map[string]BPFAttachType — linux/amd64

+ var BPFCmdConstants = map[string]BPFCmd — linux/amd64

+ var BPFHelperFuncConstants = map[string]BPFHelperFunc — linux/amd64

+ var BPFMapTypeConstants = map[string]BPFMapType — linux/amd64

+ var BPFProgramTypeConstants = map[string]BPFProgramType — linux/amd64

+ var ByteOrder binary.ByteOrder

+ var ErrNonPrintable = errors.New("non printable")

+ var ErrNotEnoughData = errors.New("not enough data")

+ var ErrStringArrayOverflow = errors.New("string array overflow")

+ var KernelCapabilityConstants = map[string]uint64 — linux/amd64

+ var SECLConstants = map[string]interface — linux/amd64

+ var SECLLegacyAttributes = map[eval.Field]eval.Field — linux/amd64

+ func FindContainerID(s string) string

+ func GetEventTypePerCategory() map[EventCategory][]eval.EventType — linux/amd64

+ func GetHostByteOrder() binary.ByteOrder

+ func IsAlphaNumeric(r rune) bool

+ func IsPrintable(s string) bool

+ func IsPrintableASCII(s string) bool

+ func SliceToArray(src []byte, dst unsafe.Pointer)

+ func StringifyHelpersList(input []uint32) []string — linux/amd64

+ func UnmarshalBinary(data []byte, binaryUnmarshalers ...BinaryUnmarshaler) (int, error) — linux/amd64

+ func UnmarshalPrintableString(data []byte, size int) (string, error)

+ func UnmarshalString(data []byte, size int) (string, error)

+ func UnmarshalStringArray(data []byte) ([]string, error)

+ type ArgsEntry struct — linux/amd64

+ Truncated bool

+ Values []string

+ func (p *ArgsEntry) ToArray() ([]string, bool)

+ type ArgsEnvs struct — linux/amd64

+ ID uint32

+ Size uint32

+ ValuesRaw [256]byte

+ type ArgsEnvsCacheEntry struct — linux/amd64

+ func NewArgsEnvsCacheEntry(onRelease func(_ *ArgsEnvsCacheEntry)) *ArgsEnvsCacheEntry

+ func (p *ArgsEnvsCacheEntry) Append(entry *ArgsEnvsCacheEntry)

+ func (p *ArgsEnvsCacheEntry) Release()

+ func (p *ArgsEnvsCacheEntry) Retain()

+ type ArgsEnvsEvent struct — linux/amd64

+ func (e *ArgsEnvsEvent) UnmarshalBinary(data []byte) (int, error)

+ type BPFAttachType uint32 — linux/amd64

+ const BpfCgroupDevice

+ const BpfCgroupGetsockopt

+ const BpfCgroupInet4Bind

+ const BpfCgroupInet4Connect

+ const BpfCgroupInet4Getpeername

+ const BpfCgroupInet4Getsockname

+ const BpfCgroupInet4PostBind

+ const BpfCgroupInet6Bind

+ const BpfCgroupInet6Connect

+ const BpfCgroupInet6Getpeername

+ const BpfCgroupInet6Getsockname

+ const BpfCgroupInet6PostBind

+ const BpfCgroupInetEgress

+ const BpfCgroupInetIngress

+ const BpfCgroupInetSockCreate

+ const BpfCgroupInetSockRelease

+ const BpfCgroupSetsockopt

+ const BpfCgroupSockOps

+ const BpfCgroupSysctl

+ const BpfCgroupUDP4Recvmsg

+ const BpfCgroupUDP4Sendmsg

+ const BpfCgroupUDP6Recvmsg

+ const BpfCgroupUDP6Sendmsg

+ const BpfFlowDissector

+ const BpfLircMode2

+ const BpfLsmMac

+ const BpfModifyReturn

+ const BpfSkLookup

+ const BpfSkMsgVerdict

+ const BpfSkSkbStreamParser

+ const BpfSkSkbStreamVerdict

+ const BpfSkSkbVerdict

+ const BpfTraceFentry

+ const BpfTraceFexit

+ const BpfTraceIter

+ const BpfTraceRawTp

+ const BpfXdp

+ const BpfXdpCPUmap

+ const BpfXdpDevmap

+ func (t BPFAttachType) String() string

+ type BPFCmd uint64 — linux/amd64

+ const BpfBtfGetFdByIDCmd

+ const BpfBtfGetNextIDCmd

+ const BpfBtfLoadCmd

+ const BpfEnableStatsCmd

+ const BpfIterCreateCmd

+ const BpfLinkCreateCmd

+ const BpfLinkDetachCmd

+ const BpfLinkGetFdByIDCmd

+ const BpfLinkGetNextIDCmd

+ const BpfLinkUpdateCmd

+ const BpfMapCreateCmd

+ const BpfMapDeleteBatchCmd

+ const BpfMapDeleteElemCmd

+ const BpfMapFreezeCmd

+ const BpfMapGetFdByIDCmd

+ const BpfMapGetNextIDCmd

+ const BpfMapGetNextKeyCmd

+ const BpfMapLookupAndDeleteBatchCmd

+ const BpfMapLookupAndDeleteElemCmd

+ const BpfMapLookupBatchCmd

+ const BpfMapLookupElemCmd

+ const BpfMapUpdateBatchCmd

+ const BpfMapUpdateElemCmd

+ const BpfObjGetCmd

+ const BpfObjGetInfoByFdCmd

+ const BpfObjPinCmd

+ const BpfProgAttachCmd

+ const BpfProgBindMapCmd

+ const BpfProgDetachCmd

+ const BpfProgGetFdByIDCmd

+ const BpfProgGetNextIDCmd

+ const BpfProgLoadCmd

+ const BpfProgQueryCmd

+ const BpfProgTestRunCmd

+ const BpfRawTracepointOpenCmd

+ const BpfTaskFdQueryCmd

+ func (cmd BPFCmd) String() string

+ type BPFEvent struct — linux/amd64

+ Cmd uint32

+ Map BPFMap

+ Program BPFProgram

+ func (e *BPFEvent) UnmarshalBinary(data []byte) (int, error)

+ type BPFHelperFunc uint32 — linux/amd64

+ const BpfBind

+ const BpfBprmOptsSet

+ const BpfCheckMtu

+ const BpfCloneRedirect

+ const BpfCopyFromUser

+ const BpfCsumDiff

+ const BpfCsumLevel

+ const BpfCsumUpdate

+ const BpfCurrentTaskUnderCgroup

+ const BpfDPath

+ const BpfFibLookup

+ const BpfForEachMapElem

+ const BpfGetCgroupClassid

+ const BpfGetCurrentAncestorCgroupID

+ const BpfGetCurrentCgroupID

+ const BpfGetCurrentComm

+ const BpfGetCurrentPidTgid

+ const BpfGetCurrentTask

+ const BpfGetCurrentTaskBtf

+ const BpfGetCurrentUIDGid

+ const BpfGetHashRecalc

+ const BpfGetListenerSock

+ const BpfGetLocalStorage

+ const BpfGetNetnsCookie

+ const BpfGetNsCurrentPidTgid

+ const BpfGetNumaNodeID

+ const BpfGetPrandomU32

+ const BpfGetRouteRealm

+ const BpfGetSmpProcessorID

+ const BpfGetSocketCookie

+ const BpfGetSocketUID

+ const BpfGetStack

+ const BpfGetStackid

+ const BpfGetTaskStack

+ const BpfGetsockopt

+ const BpfImaInodeHash

+ const BpfInodeStorageDelete

+ const BpfInodeStorageGet

+ const BpfJiffies64

+ const BpfKtimeGetBootNs

+ const BpfKtimeGetCoarseNs

+ const BpfKtimeGetNs

+ const BpfL3CsumReplace

+ const BpfL4CsumReplace

+ const BpfLoadHdrOpt

+ const BpfLwtPushEncap

+ const BpfLwtSeg6Action

+ const BpfLwtSeg6AdjustSrh

+ const BpfLwtSeg6StoreBytes

+ const BpfMapDeleteElem

+ const BpfMapLookupElem

+ const BpfMapPeekElem

+ const BpfMapPopElem

+ const BpfMapPushElem

+ const BpfMapUpdateElem

+ const BpfMsgApplyBytes

+ const BpfMsgCorkBytes

+ const BpfMsgPopData

+ const BpfMsgPullData

+ const BpfMsgPushData

+ const BpfMsgRedirectHash

+ const BpfMsgRedirectMap

+ const BpfOverrideReturn

+ const BpfPerCPUPtr

+ const BpfPerfEventOutput

+ const BpfPerfEventRead

+ const BpfPerfEventReadValue

+ const BpfPerfProgReadValue

+ const BpfProbeRead

+ const BpfProbeReadKernel

+ const BpfProbeReadKernelStr

+ const BpfProbeReadStr

+ const BpfProbeReadUser

+ const BpfProbeReadUserStr

+ const BpfProbeWriteUser

+ const BpfRcKeydown

+ const BpfRcPointerRel

+ const BpfRcRepeat

+ const BpfReadBranchRecords

+ const BpfRedirect

+ const BpfRedirectMap

+ const BpfRedirectNeigh

+ const BpfRedirectPeer

+ const BpfReserveHdrOpt

+ const BpfRingbufDiscard

+ const BpfRingbufOutput

+ const BpfRingbufQuery

+ const BpfRingbufReserve

+ const BpfRingbufSubmit

+ const BpfSendSignal

+ const BpfSendSignalThread

+ const BpfSeqPrintf

+ const BpfSeqPrintfBtf

+ const BpfSeqWrite

+ const BpfSetHash

+ const BpfSetHashInvalid

+ const BpfSetsockopt

+ const BpfSkAncestorCgroupID

+ const BpfSkAssign

+ const BpfSkCgroupID

+ const BpfSkFullsock

+ const BpfSkLookupTCP

+ const BpfSkLookupUDP

+ const BpfSkRedirectHash

+ const BpfSkRedirectMap

+ const BpfSkRelease

+ const BpfSkSelectReuseport

+ const BpfSkStorageDelete

+ const BpfSkStorageGet

+ const BpfSkbAdjustRoom

+ const BpfSkbAncestorCgroupID

+ const BpfSkbCgroupClassid

+ const BpfSkbCgroupID

+ const BpfSkbChangeHead

+ const BpfSkbChangeProto

+ const BpfSkbChangeTail

+ const BpfSkbChangeType

+ const BpfSkbEcnSetCe

+ const BpfSkbGetTunnelKey

+ const BpfSkbGetTunnelOpt

+ const BpfSkbGetXfrmState

+ const BpfSkbLoadBytes

+ const BpfSkbLoadBytesRelative

+ const BpfSkbOutput

+ const BpfSkbPullData

+ const BpfSkbSetTunnelKey

+ const BpfSkbSetTunnelOpt

+ const BpfSkbStoreBytes

+ const BpfSkbUnderCgroup

+ const BpfSkbVlanPop

+ const BpfSkbVlanPush

+ const BpfSkcLookupTCP

+ const BpfSkcToTCP6Sock

+ const BpfSkcToTCPRequestSock

+ const BpfSkcToTCPSock

+ const BpfSkcToTCPTimewaitSock

+ const BpfSkcToUDP6Sock

+ const BpfSnprintf

+ const BpfSnprintfBtf

+ const BpfSockFromFile

+ const BpfSockHashUpdate

+ const BpfSockMapUpdate

+ const BpfSockOpsCbFlagsSet

+ const BpfSpinLock

+ const BpfSpinUnlock

+ const BpfStoreHdrOpt

+ const BpfStrtol

+ const BpfStrtoul

+ const BpfSysctlGetCurrentValue

+ const BpfSysctlGetName

+ const BpfSysctlGetNewValue

+ const BpfSysctlSetNewValue

+ const BpfTCPCheckSyncookie

+ const BpfTCPGenSyncookie

+ const BpfTCPSendAck

+ const BpfTCPSock

+ const BpfTailCall

+ const BpfTaskStorageDelete

+ const BpfTaskStorageGet

+ const BpfThisCPUPtr

+ const BpfTracePrintk

+ const BpfUnspec

+ const BpfXdpAdjustHead

+ const BpfXdpAdjustMeta

+ const BpfXdpAdjustTail

+ const BpfXdpOutput

+ func (f BPFHelperFunc) String() string

+ type BPFMap struct — linux/amd64

+ ID uint32

+ Name string

+ Type uint32

+ func (m *BPFMap) UnmarshalBinary(data []byte) (int, error)

+ type BPFMapType uint32 — linux/amd64

+ const BpfMapTypeArray

+ const BpfMapTypeArrayOfMaps

+ const BpfMapTypeCPUmap

+ const BpfMapTypeCgroupArray

+ const BpfMapTypeCgroupStorage

+ const BpfMapTypeDevmap

+ const BpfMapTypeDevmapHash

+ const BpfMapTypeHash

+ const BpfMapTypeHashOfMaps

+ const BpfMapTypeInodeStorage

+ const BpfMapTypeLpmTrie

+ const BpfMapTypeLruHash

+ const BpfMapTypeLruPercpuHash

+ const BpfMapTypePercpuArray

+ const BpfMapTypePercpuCgroupStorage

+ const BpfMapTypePercpuHash

+ const BpfMapTypePerfEventArray

+ const BpfMapTypeProgArray

+ const BpfMapTypeQueue

+ const BpfMapTypeReuseportSockarray

+ const BpfMapTypeRingbuf

+ const BpfMapTypeSkStorage

+ const BpfMapTypeSockhash

+ const BpfMapTypeSockmap

+ const BpfMapTypeStack

+ const BpfMapTypeStackTrace

+ const BpfMapTypeStructOps

+ const BpfMapTypeTaskStorage

+ const BpfMapTypeUnspec

+ const BpfMapTypeXskmap

+ func (t BPFMapType) String() string

+ type BPFProgram struct — linux/amd64

+ AttachType uint32

+ Helpers []uint32

+ ID uint32

+ Name string

+ Type uint32

+ func (p *BPFProgram) UnmarshalBinary(data []byte) (int, error)

+ type BPFProgramType uint32 — linux/amd64

+ const BpfProgTypeCgroupDevice

+ const BpfProgTypeCgroupSkb

+ const BpfProgTypeCgroupSock

+ const BpfProgTypeCgroupSockAddr

+ const BpfProgTypeCgroupSockopt

+ const BpfProgTypeCgroupSysctl

+ const BpfProgTypeExt

+ const BpfProgTypeFlowDissector

+ const BpfProgTypeKprobe

+ const BpfProgTypeLircMode2

+ const BpfProgTypeLsm

+ const BpfProgTypeLwtIn

+ const BpfProgTypeLwtOut

+ const BpfProgTypeLwtSeg6local

+ const BpfProgTypeLwtXmit

+ const BpfProgTypePerfEvent

+ const BpfProgTypeRawTracepoint

+ const BpfProgTypeRawTracepointWritable

+ const BpfProgTypeSchedAct

+ const BpfProgTypeSchedCls

+ const BpfProgTypeSkLookup

+ const BpfProgTypeSkMsg

+ const BpfProgTypeSkReuseport

+ const BpfProgTypeSkSkb

+ const BpfProgTypeSockOps

+ const BpfProgTypeSocketFilter

+ const BpfProgTypeStructOps

+ const BpfProgTypeTracepoint

+ const BpfProgTypeTracing

+ const BpfProgTypeUnspec

+ const BpfProgTypeXdp

+ func (t BPFProgramType) String() string

+ type BinaryUnmarshaler interface — linux/amd64

+ UnmarshalBinary func(data []byte) (int, error)

+ type CapsetEvent struct — linux/amd64

+ CapEffective uint64

+ CapPermitted uint64

+ func (e *CapsetEvent) UnmarshalBinary(data []byte) (int, error)

+ type ChmodEvent struct — linux/amd64

+ File FileEvent

+ Mode uint32

+ func (e *ChmodEvent) UnmarshalBinary(data []byte) (int, error)

+ type ChmodMode int — linux/amd64

+ func (m ChmodMode) String() string

+ type ChownEvent struct — linux/amd64

+ File FileEvent

+ GID uint32

+ Group string

+ UID uint32

+ User string

+ func (e *ChownEvent) UnmarshalBinary(data []byte) (int, error)

+ type ContainerContext struct — linux/amd64

+ ID string

+ Tags []string

+ func (e *ContainerContext) UnmarshalBinary(data []byte) (int, error)

+ type Credentials struct — linux/amd64

+ CapEffective uint64

+ CapPermitted uint64

+ EGID uint32

+ EGroup string

+ EUID uint32

+ EUser string

+ FSGID uint32

+ FSGroup string

+ FSUID uint32

+ FSUser string

+ GID uint32

+ Group string

+ UID uint32

+ User string

+ func (e *Credentials) UnmarshalBinary(data []byte) (int, error)

+ type EnvsEntry struct — linux/amd64

+ Truncated bool

+ Values map[string]string

+ func (p *EnvsEntry) Get(key string) string

+ func (p *EnvsEntry) ToMap() (map[string]string, bool)

+ type Event struct — linux/amd64

+ ArgsEnvs ArgsEnvsEvent

+ BPF BPFEvent

+ Capset CapsetEvent

+ Chmod ChmodEvent

+ Chown ChownEvent

+ ContainerContext ContainerContext

+ Exec ExecEvent

+ ID string

+ InvalidateDentry InvalidateDentryEvent

+ Link LinkEvent

+ Mkdir MkdirEvent

+ Mount MountEvent

+ MountReleased MountReleasedEvent

+ Open OpenEvent

+ ProcessContext ProcessContext

+ RemoveXAttr SetXAttrEvent

+ Rename RenameEvent

+ Rmdir RmdirEvent

+ SELinux SELinuxEvent

+ SetGID SetgidEvent

+ SetUID SetuidEvent

+ SetXAttr SetXAttrEvent

+ SpanContext SpanContext

+ Timestamp time.Time

+ TimestampRaw uint64

+ Type uint64

+ Umount UmountEvent

+ Unlink UnlinkEvent

+ Utimes UtimesEvent

+ func (e *Event) GetEventType() EventType

+ func (e *Event) GetFieldEventType(field eval.Field) (eval.EventType, error)

+ func (e *Event) GetFieldType(field eval.Field) (reflect.Kind, error)

+ func (e *Event) GetFieldValue(field eval.Field) (interface{}, error)

+ func (e *Event) GetFields() []eval.Field

+ func (e *Event) GetPointer() unsafe.Pointer

+ func (e *Event) GetTags() []string

+ func (e *Event) GetType() string

+ func (e *Event) SetFieldValue(field eval.Field, value interface{}) error

+ func (e *Event) UnmarshalBinary(data []byte) (int, error)

+ type EventCategory = string — linux/amd64

+ const FIMCategory

+ const RuntimeCategory

+ func GetEventTypeCategory(eventType eval.EventType) EventCategory

+ type EventType uint64

+ const ArgsEnvsEventType

+ const BPFEventType

+ const CapsetEventType

+ const CustomForkBombEventType

+ const CustomLostReadEventType

+ const CustomLostWriteEventType

+ const CustomNoisyProcessEventType

+ const CustomRulesetLoadedEventType

+ const CustomTruncatedParentsEventType

+ const ExecEventType

+ const ExitEventType

+ const FileChmodEventType

+ const FileChownEventType

+ const FileLinkEventType

+ const FileMkdirEventType

+ const FileMountEventType

+ const FileOpenEventType

+ const FileRemoveXAttrEventType

+ const FileRenameEventType

+ const FileRmdirEventType

+ const FileSetXAttrEventType

+ const FileUmountEventType

+ const FileUnlinkEventType

+ const FileUtimesEventType

+ const FirstDiscarderEventType

+ const ForkEventType

+ const InvalidateDentryEventType

+ const LastDiscarderEventType

+ const MaxEventType

+ const MountReleasedEventType

+ const SELinuxEventType

+ const SetgidEventType

+ const SetuidEventType

+ const UnknownEventType

+ func ParseEvalEventType(eventType eval.EventType) EventType

+ func (t EventType) String() string

+ type ExecEvent struct — linux/amd64

+ Args string

+ ArgsTruncated bool

+ Argv []string

+ Envs []string

+ EnvsTruncated bool

+ func (e *ExecEvent) UnmarshalBinary(data []byte) (int, error)

+ type FileEvent struct — linux/amd64

+ BasenameStr string

+ Filesytem string

+ PathResolutionError error

+ PathnameStr string

+ func (e *FileEvent) GetPathResolutionError() string

+ func (e *FileEvent) UnmarshalBinary(data []byte) (int, error)

+ type FileFields struct — linux/amd64

+ CTime uint64

+ Flags int32

+ GID uint32

+ Group string

+ InUpperLayer bool

+ Inode uint64

+ MTime uint64

+ Mode uint16

+ MountID uint32

+ NLink uint32

+ PathID uint32

+ UID uint32

+ User string

+ func (e *FileFields) UnmarshalBinary(data []byte) (int, error)

+ func (f *FileFields) GetInLowerLayer() bool

+ func (f *FileFields) GetInUpperLayer() bool

+ func (f *FileFields) HasHardLinks() bool

+ type InvalidateDentryEvent struct — linux/amd64

+ DiscarderRevision uint32

+ Inode uint64

+ MountID uint32

+ func (e *InvalidateDentryEvent) UnmarshalBinary(data []byte) (int, error)

+ type KernelCapability uint64 — linux/amd64

+ func (kc KernelCapability) String() string

+ func (kc KernelCapability) StringArray() []string

+ type LinkEvent struct — linux/amd64

+ Source FileEvent

+ Target FileEvent

+ func (e *LinkEvent) UnmarshalBinary(data []byte) (int, error)

+ type MkdirEvent struct — linux/amd64

+ File FileEvent

+ Mode uint32

+ func (e *MkdirEvent) UnmarshalBinary(data []byte) (int, error)

+ type Model struct — linux/amd64

+ func (m *Model) GetEvaluator(field eval.Field, regID eval.RegisterID) (eval.Evaluator, error)

+ func (m *Model) GetEventTypes() []eval.EventType

+ func (m *Model) GetIterator(field eval.Field) (eval.Iterator, error)

+ func (m *Model) NewEvent() eval.Event

+ func (m *Model) ValidateField(field eval.Field, fieldValue eval.FieldValue) error

+ type MountEvent struct — linux/amd64

+ Device uint32

+ FSType string

+ FSTypeRaw [16]byte

+ GroupID uint32

+ MountID uint32

+ MountPointPathResolutionError error

+ MountPointStr string

+ ParentInode uint64

+ ParentMountID uint32

+ RootInode uint64

+ RootMountID uint32

+ RootPathResolutionError error

+ RootStr string

+ func (e *MountEvent) UnmarshalBinary(data []byte) (int, error)

+ func (m *MountEvent) GetFSType() string

+ func (m *MountEvent) GetMountPointPathResolutionError() string

+ func (m *MountEvent) GetRootPathResolutionError() string

+ func (m *MountEvent) IsOverlayFS() bool

+ type MountReleasedEvent struct — linux/amd64

+ DiscarderRevision uint32

+ MountID uint32

+ func (e *MountReleasedEvent) UnmarshalBinary(data []byte) (int, error)

+ type OpenEvent struct — linux/amd64

+ File FileEvent

+ Flags uint32

+ Mode uint32

+ func (e *OpenEvent) UnmarshalBinary(data []byte) (int, error)

+ type OpenFlags int — linux/amd64

+ func (f OpenFlags) String() string

+ func (f OpenFlags) StringArray() []string

+ type Process struct — linux/amd64

+ ArgsEntry *ArgsEntry

+ ArgsID uint32

+ ArgsTruncated bool

+ BasenameStr string

+ Comm string

+ ContainerID string

+ Cookie uint32

+ CreatedAt uint64

+ EnvsEntry *EnvsEntry

+ EnvsID uint32

+ EnvsTruncated bool

+ ExecTime time.Time

+ ExitTime time.Time

+ FileFields FileFields

+ Filesystem string

+ ForkTime time.Time

+ PPid uint32

+ PathResolutionError error

+ PathnameStr string

+ Pid uint32

+ TTYName string

+ Tid uint32

+ func (e *Process) GetPathResolutionError() string

+ func (e *Process) UnmarshalBinary(data []byte) (int, error)

+ type ProcessAncestorsIterator struct — linux/amd64

+ func (it *ProcessAncestorsIterator) Front(ctx *eval.Context) unsafe.Pointer

+ func (it *ProcessAncestorsIterator) Next() unsafe.Pointer

+ type ProcessCacheEntry struct — linux/amd64

+ func NewProcessCacheEntry(onRelease func(_ *ProcessCacheEntry)) *ProcessCacheEntry

+ func (e *ProcessCacheEntry) Release()

+ func (e *ProcessCacheEntry) Reset()

+ func (e *ProcessCacheEntry) Retain()

+ func (pc *ProcessCacheEntry) Exec(entry *ProcessCacheEntry)

+ func (pc *ProcessCacheEntry) Exit(exitTime time.Time)

+ func (pc *ProcessCacheEntry) Fork(childEntry *ProcessCacheEntry)

+ func (pc *ProcessCacheEntry) SetAncestor(parent *ProcessCacheEntry)

+ type ProcessContext struct — linux/amd64

+ Ancestor *ProcessCacheEntry

+ func (p *ProcessContext) UnmarshalBinary(data []byte) (int, error)

+ type RenameEvent struct — linux/amd64

+ DiscarderRevision uint32

+ New FileEvent

+ Old FileEvent

+ func (e *RenameEvent) UnmarshalBinary(data []byte) (int, error)

+ type RetValError int — linux/amd64

+ func (f RetValError) String() string

+ type RmdirEvent struct — linux/amd64

+ DiscarderRevision uint32

+ File FileEvent

+ func (e *RmdirEvent) UnmarshalBinary(data []byte) (int, error)

+ type SELinuxEvent struct — linux/amd64

+ BoolChangeValue string

+ BoolCommitValue bool

+ BoolName string

+ EnforceStatus string

+ EventKind SELinuxEventKind

+ File FileEvent

+ func (e *SELinuxEvent) UnmarshalBinary(data []byte) (int, error)

+ type SELinuxEventKind uint32 — linux/amd64

+ const SELinuxBoolChangeEventKind

+ const SELinuxBoolCommitEventKind

+ const SELinuxStatusChangeEventKind

+ type SetXAttrEvent struct — linux/amd64

+ File FileEvent

+ Name string

+ NameRaw [200]byte

+ Namespace string

+ func (e *SetXAttrEvent) UnmarshalBinary(data []byte) (int, error)

+ type SetgidEvent struct — linux/amd64

+ EGID uint32

+ EGroup string

+ FSGID uint32

+ FSGroup string

+ GID uint32

+ Group string

+ func (e *SetgidEvent) UnmarshalBinary(data []byte) (int, error)

+ type SetuidEvent struct — linux/amd64

+ EUID uint32

+ EUser string

+ FSUID uint32

+ FSUser string

+ UID uint32

+ User string

+ func (e *SetuidEvent) UnmarshalBinary(data []byte) (int, error)

+ type SpanContext struct — linux/amd64

+ SpanID uint64

+ TraceID uint64

+ func (s *SpanContext) UnmarshalBinary(data []byte) (int, error)

+ type SyscallEvent struct — linux/amd64

+ Retval int64

+ func (e *SyscallEvent) UnmarshalBinary(data []byte) (int, error)

+ type UmountEvent struct — linux/amd64

+ MountID uint32

+ func (e *UmountEvent) UnmarshalBinary(data []byte) (int, error)

+ type UnlinkEvent struct — linux/amd64

+ DiscarderRevision uint32

+ File FileEvent

+ Flags uint32

+ func (e *UnlinkEvent) UnmarshalBinary(data []byte) (int, error)

+ type UnlinkFlags int — linux/amd64

+ func (f UnlinkFlags) String() string

+ func (f UnlinkFlags) StringArray() []string

+ type UtimesEvent struct — linux/amd64

+ Atime time.Time

+ File FileEvent

+ Mtime time.Time

+ func (e *UtimesEvent) UnmarshalBinary(data []byte) (int, error)

v0.33.0-rc.17

Jan 20, 2022

v0.33.0-rc.16

Jan 17, 2022

v0.33.0-rc.15

Jan 13, 2022

v0.33.0-rc.14

Jan 10, 2022

v0.33.0-rc.13

Jan 6, 2022

v0.33.0-rc.12

Jan 5, 2022

v0.33.0-rc.11

Dec 23, 2021

v0.33.0-rc.10

Dec 20, 2021

v0.33.0-rc.9

Dec 16, 2021

v0.33.0-rc.8

Dec 14, 2021

v0.33.0-rc.7

Dec 13, 2021

v0.33.0-rc.6

Dec 9, 2021

v0.33.0-rc.5

Dec 3, 2021

v0.33.0-rc.4

Nov 26, 2021

v0.33.0-rc.3

Nov 23, 2021

v0.33.0-rc.2

Nov 17, 2021

v0.33.0-rc.1

Nov 15, 2021

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL