Documentation ¶
Overview ¶
Package model holds model related files
Package model holds model related files ¶
Package model holds model related files ¶
Package model holds model related files ¶
Package model holds model related files ¶
Package model holds model related files ¶
Package model holds the security profile data model ¶
Package model holds model related files
Index ¶
- Constants
- Variables
- func FilterEnvs(allEnvVars []string, desiredKeys map[string]bool) []string
- func SECLConstants() map[string]interface{}
- type AWSIMDSEvent
- type AWSSecurityCredentials
- type ActionReport
- type AddressFamily
- type ArgsEntry
- type ArgsEnvs
- type BaseEvent
- type BaseExtraFieldHandlers
- type ChangePermissionEvent
- type ContainerContext
- type CreateNewFileEvent
- type CreateRegistryKeyEvent
- type DNSEvent
- type DeleteFileEvent
- type DeleteRegistryKeyEvent
- type EnvsEntry
- type Event
- func (e *Event) AddToFlags(flag uint32)
- func (e *Event) GetActionReports() []ActionReport
- func (e *Event) GetEventType() EventType
- func (ev *Event) GetFieldEventType(field eval.Field) (eval.EventType, error)
- func (ev *Event) GetFieldType(field eval.Field) (reflect.Kind, error)
- func (ev *Event) GetFieldValue(field eval.Field) (interface{}, error)
- func (ev *Event) GetFields() []eval.Field
- func (e *Event) GetTags() []string
- func (e *Event) GetType() string
- func (e *Event) GetWorkloadID() string
- func (e *Event) HasActiveActivityDump() bool
- func (e *Event) Init()
- func (e *Event) IsActivityDumpSample() bool
- func (e *Event) IsAnomalyDetectionEvent() bool
- func (e *Event) IsInProfile() bool
- func (e *Event) IsSavedByActivityDumps() bool
- func (e *Event) Release()
- func (e *Event) RemoveFromFlags(flag uint32)
- func (e *Event) ResetAnomalyDetectionEvent()
- func (e *Event) ResolveEventTime() time.Time
- func (ev *Event) ResolveFields()
- func (ev *Event) ResolveFieldsForAD()
- func (e *Event) ResolveProcessCacheEntry(newEntryCb func(*ProcessCacheEntry, error)) (*ProcessCacheEntry, bool)
- func (e *Event) ResolveService() string
- func (e *Event) Retain() Event
- func (ev *Event) SetFieldValue(field eval.Field, value interface{}) error
- func (e *Event) Zero()
- type EventFilteringProfileState
- type EventType
- type ExecEvent
- type ExitCause
- type ExitEvent
- type ExtraFieldHandlers
- type FakeFieldHandlers
- func (dfh *FakeFieldHandlers) ResolveContainerContext(_ *Event) (*ContainerContext, bool)
- func (dfh *FakeFieldHandlers) ResolveContainerCreatedAt(ev *Event, e *ContainerContext) int
- func (dfh *FakeFieldHandlers) ResolveContainerID(ev *Event, e *ContainerContext) string
- func (dfh *FakeFieldHandlers) ResolveContainerRuntime(ev *Event, e *ContainerContext) string
- func (dfh *FakeFieldHandlers) ResolveContainerTags(ev *Event, e *ContainerContext) []string
- func (dfh *FakeFieldHandlers) ResolveEventTime(ev *Event, e *BaseEvent) time.Time
- func (dfh *FakeFieldHandlers) ResolveEventTimestamp(ev *Event, e *BaseEvent) int
- func (dfh *FakeFieldHandlers) ResolveFileBasename(ev *Event, e *FileEvent) string
- func (dfh *FakeFieldHandlers) ResolveFilePath(ev *Event, e *FileEvent) string
- func (dfh *FakeFieldHandlers) ResolveFileUserPath(ev *Event, e *FimFileEvent) string
- func (dfh *FakeFieldHandlers) ResolveFimFileBasename(ev *Event, e *FimFileEvent) string
- func (dfh *FakeFieldHandlers) ResolveFimFilePath(ev *Event, e *FimFileEvent) string
- func (dfh *FakeFieldHandlers) ResolveHostname(ev *Event, e *BaseEvent) string
- func (dfh *FakeFieldHandlers) ResolveNewSecurityDescriptor(ev *Event, e *ChangePermissionEvent) string
- func (dfh *FakeFieldHandlers) ResolveOldSecurityDescriptor(ev *Event, e *ChangePermissionEvent) string
- func (dfh *FakeFieldHandlers) ResolveProcessCacheEntry(_ *Event, _ func(*ProcessCacheEntry, error)) (*ProcessCacheEntry, bool)
- func (dfh *FakeFieldHandlers) ResolveProcessCmdLine(ev *Event, e *Process) string
- func (dfh *FakeFieldHandlers) ResolveProcessCmdLineScrubbed(ev *Event, e *Process) string
- func (dfh *FakeFieldHandlers) ResolveProcessCreatedAt(ev *Event, e *Process) int
- func (dfh *FakeFieldHandlers) ResolveProcessEnvp(ev *Event, e *Process) []string
- func (dfh *FakeFieldHandlers) ResolveProcessEnvs(ev *Event, e *Process) []string
- func (dfh *FakeFieldHandlers) ResolveService(ev *Event, e *BaseEvent) string
- func (dfh *FakeFieldHandlers) ResolveUser(ev *Event, e *Process) string
- type FieldHandlers
- type FileEvent
- type FimFileEvent
- type HashAlgorithm
- type HashState
- type IMDSEvent
- type IPPortContext
- type L3Protocol
- type L4Protocol
- type MatchedRule
- type Model
- func (m *Model) GetEvaluator(field eval.Field, regID eval.RegisterID) (eval.Evaluator, error)
- func (m *Model) GetEventTypes() []eval.EventType
- func (m *Model) GetFieldRestrictions(field eval.Field) []eval.EventType
- func (m *Model) NewDefaultEventWithType(kind EventType) eval.Event
- func (m *Model) NewEvent() eval.Event
- func (m *Model) ValidateField(field eval.Field, fieldValue eval.FieldValue) error
- type NetworkContext
- type NetworkDeviceContext
- type OpenRegistryKeyEvent
- type PIDContext
- type Process
- type ProcessAncestorsIterator
- func (it *ProcessAncestorsIterator) At(ctx *eval.Context, regID eval.RegisterID, pos int) *ProcessCacheEntry
- func (it *ProcessAncestorsIterator) Front(ctx *eval.Context) *ProcessCacheEntry
- func (it *ProcessAncestorsIterator) Len(ctx *eval.Context) int
- func (it *ProcessAncestorsIterator) Next() *ProcessCacheEntry
- type ProcessCacheEntry
- type ProcessContext
- type QClass
- type QType
- type RegistryEvent
- type Releasable
- type RenameFileEvent
- type RetValError
- type SecurityProfileContext
- type SetRegistryKeyValueEvent
- type SpanContext
- type SyscallDriftEventReason
- type TLSContext
- type TLSVersion
- type UserSessionContext
- type WriteFileEvent
Constants ¶
const ( // MaxArgEnvSize maximum size of one argument or environment variable MaxArgEnvSize = 256 // MaxArgsEnvsSize maximum number of args and/or envs MaxArgsEnvsSize = 256 )
const ( // MaxSegmentLength defines the maximum length of each segment of a path MaxSegmentLength = 255 // MaxPathDepth defines the maximum depth of a path // see pkg/security/ebpf/c/dentry_resolver.h: DR_MAX_TAIL_CALL * DR_MAX_ITERATION_DEPTH MaxPathDepth = 1363 // MaxBpfObjName defines the maximum length of a Bpf object name MaxBpfObjName = 16 // PathSuffix defines the suffix used for path fields PathSuffix = ".path" // NameSuffix defines the suffix used for name fields NameSuffix = ".name" // ContainerIDLen defines the length of a container ID ContainerIDLen = sha256.Size * 2 // MaxSymlinks maximum symlinks captured MaxSymlinks = 2 // MaxTracedCgroupsCount hard limit for the count of traced cgroups MaxTracedCgroupsCount = 128 )
const ( // EventFlagsAsync async event EventFlagsAsync = 1 << iota // EventFlagsSavedByAD saved by ad EventFlagsSavedByAD // EventFlagsActivityDumpSample an AD sample EventFlagsActivityDumpSample // EventFlagsSecurityProfileInProfile true if the event was found in a profile EventFlagsSecurityProfileInProfile // EventFlagsAnomalyDetectionEvent true if the event is marked as being an anomaly EventFlagsAnomalyDetectionEvent // EventFlagsHasActiveActivityDump true if the event has an active activity dump associated to it EventFlagsHasActiveActivityDump )
const ( // IMDSRequestType is used to specify that the event is an IDMS request event IMDSRequestType = "request" // IMDSResponseType is used to specify that the event is an IMDS response event IMDSResponseType = "response" // IMDSAWSCloudProvider is used to report that the IMDS event is for AWS IMDSAWSCloudProvider = "aws" // IMDSGCPCloudProvider is used to report that the IMDS event is for GCP IMDSGCPCloudProvider = "gcp" // IMDSAzureCloudProvider is used to report that the IMDS event is for Azure IMDSAzureCloudProvider = "azure" // IMDSIBMCloudProvider is used to report that the IMDS event is for ibm IMDSIBMCloudProvider = "ibm" // IMDSOracleCloudProvider is used to report that the IMDS event is for Oracle IMDSOracleCloudProvider = "oracle" )
const ( LowerLayer = 1 << iota UpperLayer )
File flags
const ( // SIGKILL id for the kill action SIGKILL = iota + 1 )
Variables ¶
var ( // DNSQTypeConstants see https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml // generate_constants:DNS qtypes,DNS qtypes are the supported DNS query types. DNSQTypeConstants = map[string]int{ "None": 0, "A": 1, "NS": 2, "MD": 3, "MF": 4, "CNAME": 5, "SOA": 6, "MB": 7, "MG": 8, "MR": 9, "NULL": 10, "PTR": 12, "HINFO": 13, "MINFO": 14, "MX": 15, "TXT": 16, "RP": 17, "AFSDB": 18, "X25": 19, "ISDN": 20, "RT": 21, "NSAPPTR": 23, "SIG": 24, "KEY": 25, "PX": 26, "GPOS": 27, "AAAA": 28, "LOC": 29, "NXT": 30, "EID": 31, "NIMLOC": 32, "SRV": 33, "ATMA": 34, "NAPTR": 35, "KX": 36, "CERT": 37, "DNAME": 39, "OPT": 41, "APL": 42, "DS": 43, "SSHFP": 44, "RRSIG": 46, "NSEC": 47, "DNSKEY": 48, "DHCID": 49, "NSEC3": 50, "NSEC3PARAM": 51, "TLSA": 52, "SMIMEA": 53, "HIP": 55, "NINFO": 56, "RKEY": 57, "TALINK": 58, "CDS": 59, "CDNSKEY": 60, "OPENPGPKEY": 61, "CSYNC": 62, "ZONEMD": 63, "SVCB": 64, "HTTPS": 65, "SPF": 99, "UINFO": 100, "UID": 101, "GID": 102, "UNSPEC": 103, "NID": 104, "L32": 105, "L64": 106, "LP": 107, "EUI48": 108, "EUI64": 109, "URI": 256, "CAA": 257, "AVC": 258, "TKEY": 249, "TSIG": 250, "IXFR": 251, "AXFR": 252, "MAILB": 253, "MAILA": 254, "ANY": 255, "TA": 32768, "DLV": 32769, "Reserved": 65535, } // DNSQClassConstants see https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml // generate_constants:DNS qclasses,DNS qclasses are the supported DNS query classes. DNSQClassConstants = map[string]int{ "CLASS_INET": 1, "CLASS_CSNET": 2, "CLASS_CHAOS": 3, "CLASS_HESIOD": 4, "CLASS_NONE": 254, "CLASS_ANY": 255, } // BooleanConstants holds the evaluator for boolean constants // generate_constants:Boolean constants,Boolean constants are the supported boolean constants. BooleanConstants = map[string]interface{}{ "true": &eval.BoolEvaluator{Value: true}, "false": &eval.BoolEvaluator{Value: false}, } // L3ProtocolConstants is the list of supported L3 protocols // generate_constants:L3 protocols,L3 protocols are the supported Layer 3 protocols. L3ProtocolConstants = map[string]L3Protocol{ "ETH_P_LOOP": EthPLOOP, "ETH_P_PUP": EthPPUP, "ETH_P_PUPAT": EthPPUPAT, "ETH_P_TSN": EthPTSN, "ETH_P_IP": EthPIP, "ETH_P_X25": EthPX25, "ETH_P_ARP": EthPARP, "ETH_P_BPQ": EthPBPQ, "ETH_P_IEEEPUP": EthPIEEEPUP, "ETH_P_IEEEPUPAT": EthPIEEEPUPAT, "ETH_P_BATMAN": EthPBATMAN, "ETH_P_DEC": EthPDEC, "ETH_P_DNADL": EthPDNADL, "ETH_P_DNARC": EthPDNARC, "ETH_P_DNART": EthPDNART, "ETH_P_LAT": EthPLAT, "ETH_P_DIAG": EthPDIAG, "ETH_P_CUST": EthPCUST, "ETH_P_SCA": EthPSCA, "ETH_P_TEB": EthPTEB, "ETH_P_RARP": EthPRARP, "ETH_P_ATALK": EthPATALK, "ETH_P_AARP": EthPAARP, "ETH_P_8021_Q": EthP8021Q, "ETH_P_ERSPAN": EthPERSPAN, "ETH_P_IPX": EthPIPX, "ETH_P_IPV6": EthPIPV6, "ETH_P_PAUSE": EthPPAUSE, "ETH_P_SLOW": EthPSLOW, "ETH_P_WCCP": EthPWCCP, "ETH_P_MPLSUC": EthPMPLSUC, "ETH_P_MPLSMC": EthPMPLSMC, "ETH_P_ATMMPOA": EthPATMMPOA, "ETH_P_PPPDISC": EthPPPPDISC, "ETH_P_PPPSES": EthPPPPSES, "ETH_P__LINK_CTL": EthPLinkCTL, "ETH_P_ATMFATE": EthPATMFATE, "ETH_P_PAE": EthPPAE, "ETH_P_AOE": EthPAOE, "ETH_P_8021_AD": EthP8021AD, "ETH_P_802_EX1": EthP802EX1, "ETH_P_TIPC": EthPTIPC, "ETH_P_MACSEC": EthPMACSEC, "ETH_P_8021_AH": EthP8021AH, "ETH_P_MVRP": EthPMVRP, "ETH_P_1588": EthP1588, "ETH_P_NCSI": EthPNCSI, "ETH_P_PRP": EthPPRP, "ETH_P_FCOE": EthPFCOE, "ETH_P_IBOE": EthPIBOE, "ETH_P_TDLS": EthPTDLS, "ETH_P_FIP": EthPFIP, "ETH_P_80221": EthP80221, "ETH_P_HSR": EthPHSR, "ETH_P_NSH": EthPNSH, "ETH_P_LOOPBACK": EthPLOOPBACK, "ETH_P_QINQ1": EthPQINQ1, "ETH_P_QINQ2": EthPQINQ2, "ETH_P_QINQ3": EthPQINQ3, "ETH_P_EDSA": EthPEDSA, "ETH_P_IFE": EthPIFE, "ETH_P_AFIUCV": EthPAFIUCV, "ETH_P_8023_MIN": EthP8023MIN, "ETH_P_IPV6_HOP_BY_HOP": EthPIPV6HopByHop, "ETH_P_8023": EthP8023, "ETH_P_AX25": EthPAX25, "ETH_P_ALL": EthPALL, "ETH_P_8022": EthP8022, "ETH_P_SNAP": EthPSNAP, "ETH_P_DDCMP": EthPDDCMP, "ETH_P_WANPPP": EthPWANPPP, "ETH_P_PPPMP": EthPPPPMP, "ETH_P_LOCALTALK": EthPLOCALTALK, "ETH_P_CAN": EthPCAN, "ETH_P_CANFD": EthPCANFD, "ETH_P_PPPTALK": EthPPPPTALK, "ETH_P_TR8022": EthPTR8022, "ETH_P_MOBITEX": EthPMOBITEX, "ETH_P_CONTROL": EthPCONTROL, "ETH_P_IRDA": EthPIRDA, "ETH_P_ECONET": EthPECONET, "ETH_P_HDLC": EthPHDLC, "ETH_P_ARCNET": EthPARCNET, "ETH_P_DSA": EthPDSA, "ETH_P_TRAILER": EthPTRAILER, "ETH_P_PHONET": EthPPHONET, "ETH_P_IEEE802154": EthPIEEE802154, "ETH_P_CAIF": EthPCAIF, "ETH_P_XDSA": EthPXDSA, "ETH_P_MAP": EthPMAP, } // L4ProtocolConstants is the list of supported L4 protocols // generate_constants:L4 protocols,L4 protocols are the supported Layer 4 protocols. L4ProtocolConstants = map[string]L4Protocol{ "IP_PROTO_IP": IPProtoIP, "IP_PROTO_ICMP": IPProtoICMP, "IP_PROTO_IGMP": IPProtoIGMP, "IP_PROTO_IPIP": IPProtoIPIP, "IP_PROTO_TCP": IPProtoTCP, "IP_PROTO_EGP": IPProtoEGP, "IP_PROTO_IGP": IPProtoIGP, "IP_PROTO_PUP": IPProtoPUP, "IP_PROTO_UDP": IPProtoUDP, "IP_PROTO_IDP": IPProtoIDP, "IP_PROTO_TP": IPProtoTP, "IP_PROTO_DCCP": IPProtoDCCP, "IP_PROTO_IPV6": IPProtoIPV6, "IP_PROTO_RSVP": IPProtoRSVP, "IP_PROTO_GRE": IPProtoGRE, "IP_PROTO_ESP": IPProtoESP, "IP_PROTO_AH": IPProtoAH, "IP_PROTO_ICMPV6": IPProtoICMPV6, "IP_PROTO_MTP": IPProtoMTP, "IP_PROTO_BEETPH": IPProtoBEETPH, "IP_PROTO_ENCAP": IPProtoENCAP, "IP_PROTO_PIM": IPProtoPIM, "IP_PROTO_COMP": IPProtoCOMP, "IP_PROTO_SCTP": IPProtoSCTP, "IP_PROTO_UDPLITE": IPProtoUDPLITE, "IP_PROTO_MPLS": IPProtoMPLS, "IP_PROTO_RAW": IPProtoRAW, } )
var AllEventFilteringProfileState = []EventFilteringProfileState{NoProfile, ProfileAtMaxSize, UnstableEventType, StableEventType, AutoLearning, WorkloadWarmup}
AllEventFilteringProfileState is the list of all EventFilteringProfileState
var SECLLegacyFields = map[eval.Field]eval.Field{
"async": "event.async",
"chmod.filename": "chmod.file.path",
"chmod.basename": "chmod.file.name",
"chmod.mode": "chmod.file.destination.mode",
"chown.filename": "chown.file.path",
"chown.basename": "chown.file.name",
"chown.uid": "chown.file.destination.uid",
"chown.user": "chown.file.destination.user",
"chown.gid": "chown.file.destination.gid",
"chown.group": "chown.file.destination.group",
"open.filename": "open.file.path",
"open.basename": "open.file.name",
"open.mode": "open.file.destination.mode",
"mkdir.filename": "mkdir.file.path",
"mkdir.basename": "mkdir.file.name",
"mkdir.mode": "mkdir.file.destination.mode",
"rmdir.filename": "rmdir.file.path",
"rmdir.basename": "rmdir.file.name",
"rename.old.filename": "rename.file.path",
"rename.old.basename": "rename.file.name",
"rename.new.filename": "rename.file.destination.path",
"rename.new.basename": "rename.file.destination.name",
"unlink.filename": "unlink.file.path",
"unlink.basename": "unlink.file.name",
"utimes.filename": "utimes.file.path",
"utimes.basename": "utimes.file.name",
"link.source.filename": "link.file.path",
"link.source.basename": "link.file.name",
"link.target.filename": "link.file.destination.path",
"link.target.basename": "link.file.destination.name",
"setxattr.filename": "setxattr.file.path",
"setxattr.basename": "setxattr.file.name",
"setxattr.namespace": "setxattr.file.destination.namespace",
"setxattr.name": "setxattr.file.destination.name",
"removexattr.filename": "removexattr.file.path",
"removexattr.basename": "removexattr.file.name",
"removexattr.namespace": "removexattr.file.destination.namespace",
"removexattr.name": "removexattr.file.destination.name",
"exec.filename": "exec.file.path",
"exec.overlay_numlower": "exec.file.overlay_numlower",
"exec.basename": "exec.file.name",
"exec.name": "exec.comm",
"process.filename": "process.file.path",
"process.basename": "process.file.name",
"process.name": "process.comm",
"process.ancestors.filename": "process.ancestors.file.path",
"process.ancestors.basename": "process.ancestors.file.name",
"process.ancestors.name": "process.ancestors.comm",
}
SECLLegacyFields contains the list of the legacy attributes we need to support
var ( // SignalConstants list of signals SignalConstants = map[string]int{ "SIGKILL": SIGKILL, } )
Functions ¶
func FilterEnvs ¶
FilterEnvs returns an array of environment variable key value pairs matching the desired keys
func SECLConstants ¶
func SECLConstants() map[string]interface{}
SECLConstants returns the constants supported in runtime security agent rules, initializing these constants during the first call
Types ¶
type AWSIMDSEvent ¶ added in v0.55.0
type AWSIMDSEvent struct { IsIMDSv2 bool `field:"is_imds_v2"` // SECLDoc[is_imds_v2] Definition:`a boolean which specifies if the IMDS event follows IMDSv1 or IMDSv2 conventions` SecurityCredentials AWSSecurityCredentials `field:"security_credentials"` // SECLDoc[credentials] Definition:`the security credentials in the IMDS answer` }
AWSIMDSEvent holds data from an AWS IMDS event
type AWSSecurityCredentials ¶ added in v0.55.0
type AWSSecurityCredentials struct { Code string `field:"-" json:"Code"` Type string `field:"type" json:"Type"` // SECLDoc[type] Definition:`the security credentials type` AccessKeyID string `field:"-" json:"AccessKeyId"` LastUpdated string `field:"-" json:"LastUpdated"` Expiration time.Time `field:"-"` ExpirationRaw string `field:"-" json:"Expiration"` }
AWSSecurityCredentials is used to parse the fields that are none to be free of credentials or secrets
type ActionReport ¶
type ActionReport interface { ToJSON() ([]byte, error) IsMatchingRule(ruleID eval.RuleID) bool IsResolved() error }
ActionReport defines an action report
type AddressFamily ¶
type AddressFamily int
AddressFamily represents a family address (AF_INET, AF_INET6, AF_UNIX etc)
func (AddressFamily) String ¶
func (af AddressFamily) String() string
type ArgsEnvs ¶
type ArgsEnvs struct { ID uint64 Size uint32 ValuesRaw [MaxArgEnvSize]byte }
ArgsEnvs raw value for args and envs
type BaseEvent ¶
type BaseEvent struct { ID string `field:"-"` Type uint32 `field:"-"` Flags uint32 `field:"-"` TimestampRaw uint64 `field:"event.timestamp,handler:ResolveEventTimestamp"` // SECLDoc[event.timestamp] Definition:`Timestamp of the event` Timestamp time.Time `field:"timestamp,opts:getters_only,handler:ResolveEventTime"` Rules []*MatchedRule `field:"-"` ActionReports []ActionReport `field:"-"` Os string `field:"event.os"` // SECLDoc[event.os] Definition:`Operating system of the event` Origin string `field:"event.origin"` // SECLDoc[event.origin] Definition:`Origin of the event` Service string `field:"event.service,handler:ResolveService,opts:skip_ad"` // SECLDoc[event.service] Definition:`Service associated with the event` Hostname string `field:"event.hostname,handler:ResolveHostname"` // SECLDoc[event.hostname] Definition:`Hostname associated with the event` // context shared with all events ProcessContext *ProcessContext `field:"process"` ContainerContext *ContainerContext `field:"container"` SecurityProfileContext SecurityProfileContext `field:"-"` // internal usage PIDContext PIDContext `field:"-"` ProcessCacheEntry *ProcessCacheEntry `field:"-"` // mark event with having error Error error `field:"-"` // field resolution FieldHandlers FieldHandlers `field:"-"` }
BaseEvent represents an event sent from the kernel
type BaseExtraFieldHandlers ¶
type BaseExtraFieldHandlers interface { ResolveProcessCacheEntry(ev *Event, newEntryCb func(*ProcessCacheEntry, error)) (*ProcessCacheEntry, bool) ResolveContainerContext(ev *Event) (*ContainerContext, bool) }
BaseExtraFieldHandlers handlers not hold by any field
type ChangePermissionEvent ¶ added in v0.55.0
type ChangePermissionEvent struct { UserName string `field:"username"` // SECLDoc[username] Definition:`Username of the permission change author` UserDomain string `field:"user_domain"` // SECLDoc[user_domain] Definition:`Domain name of the permission change author` ObjectName string `field:"path"` // SECLDoc[path] Definition:`Name of the object of which permission was changed` ObjectType string `field:"type"` // SECLDoc[type] Definition:`Type of the object of which permission was changed` OldSd string `field:"old_sd,handler:ResolveOldSecurityDescriptor"` // SECLDoc[old_sd] Definition:`Original Security Descriptor of the object of which permission was changed` NewSd string `field:"new_sd,handler:ResolveNewSecurityDescriptor"` // SECLDoc[new_sd] Definition:`New Security Descriptor of the object of which permission was changed` }
ChangePermissionEvent defines object permission change
type ContainerContext ¶
type ContainerContext struct { Releasable ContainerID containerutils.ContainerID `field:"id,handler:ResolveContainerID"` // SECLDoc[id] Definition:`ID of the container` CreatedAt uint64 `field:"created_at,handler:ResolveContainerCreatedAt"` // SECLDoc[created_at] Definition:`Timestamp of the creation of the container“ Tags []string `field:"tags,handler:ResolveContainerTags,opts:skip_ad,weight:9999"` // SECLDoc[tags] Definition:`Tags of the container` Resolved bool `field:"-"` Runtime string `field:"runtime,handler:ResolveContainerRuntime"` // SECLDoc[runtime] Definition:`Runtime managing the container` }
ContainerContext holds the container context of an event
type CreateNewFileEvent ¶
type CreateNewFileEvent struct {
File FimFileEvent `field:"file"` // SECLDoc[file] Definition:`File Event`
}
CreateNewFileEvent defines file creation
type CreateRegistryKeyEvent ¶
type CreateRegistryKeyEvent struct {
Registry RegistryEvent `field:"registry"` // SECLDoc[registry] Definition:`Registry Event`
}
CreateRegistryKeyEvent defines registry key creation
type DNSEvent ¶
type DNSEvent struct { ID uint16 `field:"id"` // SECLDoc[id] Definition:`[Experimental] the DNS request ID` Name string `field:"question.name,opts:length" op_override:"eval.CaseInsensitiveCmp"` // SECLDoc[question.name] Definition:`the queried domain name` Type uint16 `field:"question.type"` // SECLDoc[question.type] Definition:`a two octet code which specifies the DNS question type` Constants:`DNS qtypes` Class uint16 `field:"question.class"` // SECLDoc[question.class] Definition:`the class looked up by the DNS question` Constants:`DNS qclasses` Size uint16 `field:"question.length"` // SECLDoc[question.length] Definition:`the total DNS request size in bytes` Count uint16 `field:"question.count"` // SECLDoc[question.count] Definition:`the total count of questions in the DNS request` }
DNSEvent represents a DNS event
type DeleteFileEvent ¶ added in v0.54.0
type DeleteFileEvent struct {
File FimFileEvent `field:"file"` // SECLDoc[file] Definition:`File Event`
}
DeleteFileEvent represents an unlink event
type DeleteRegistryKeyEvent ¶
type DeleteRegistryKeyEvent struct {
Registry RegistryEvent `field:"registry"` // SECLDoc[registry] Definition:`Registry Event`
}
DeleteRegistryKeyEvent defines registry key deletion
type EnvsEntry ¶
EnvsEntry defines a args cache entry
func (*EnvsEntry) FilterEnvs ¶
FilterEnvs returns an array of envs, only the name of each variable is returned unless the variable name is part of the provided filter
type Event ¶
type Event struct { BaseEvent // process events Exec ExecEvent `field:"exec" event:"exec"` // [7.27] [Process] A process was executed or forked Exit ExitEvent `field:"exit" event:"exit"` // [7.38] [Process] A process was terminated // FIM CreateNewFile CreateNewFileEvent `field:"create" event:"create"` // [7.52] [File] A file was created RenameFile RenameFileEvent `field:"rename" event:"rename"` // [7.54] [File] A file was renamed DeleteFile DeleteFileEvent `field:"delete" event:"delete"` // [7.54] [File] A file was deleted WriteFile WriteFileEvent `field:"write" event:"write"` // [7.54] [File] A file was written // Registries CreateRegistryKey CreateRegistryKeyEvent `field:"create_key;create" event:"create_key" ` // [7.52] [Registry] A registry key was created OpenRegistryKey OpenRegistryKeyEvent `field:"open_key;open" event:"open_key"` // [7.52] [Registry] A registry key was opened SetRegistryKeyValue SetRegistryKeyValueEvent `field:"set_key_value;set" event:"set_key_value"` // [7.52] [Registry] A registry key value was set DeleteRegistryKey DeleteRegistryKeyEvent `field:"delete_key;delete" event:"delete_key"` // [7.52] [Registry] A registry key was deleted ChangePermission ChangePermissionEvent `field:"change_permission" event:"change_permission" ` // [7.55] [Registry] A permission change was made }
Event represents an event sent from the kernel genaccessors
func NewFakeEvent ¶
func NewFakeEvent() *Event
NewFakeEvent returns a new event using the default field handlers
func (*Event) AddToFlags ¶
AddToFlags adds a flag to the event
func (*Event) GetActionReports ¶
func (e *Event) GetActionReports() []ActionReport
GetActionReports returns the triggred action reports
func (*Event) GetEventType ¶
GetEventType returns the event type of the event
func (*Event) GetFieldEventType ¶
func (*Event) GetWorkloadID ¶
GetWorkloadID returns an ID that represents the workload
func (*Event) HasActiveActivityDump ¶
HasActiveActivityDump returns true if the event has an active activity dump associated to it
func (*Event) IsActivityDumpSample ¶
IsActivityDumpSample return whether AD sample
func (*Event) IsAnomalyDetectionEvent ¶
IsAnomalyDetectionEvent returns true if the current event is an anomaly detection event (kernel or user space)
func (*Event) IsInProfile ¶
IsInProfile return true if the event was found in the profile
func (*Event) IsSavedByActivityDumps ¶
IsSavedByActivityDumps return whether saved by AD
func (*Event) RemoveFromFlags ¶
RemoveFromFlags remove a flag to the event
func (*Event) ResetAnomalyDetectionEvent ¶ added in v0.61.0
func (e *Event) ResetAnomalyDetectionEvent()
ResetAnomalyDetectionEvent removes the anomaly detection event flag
func (*Event) ResolveEventTime ¶
ResolveEventTime uses the field handler
func (*Event) ResolveFields ¶
func (ev *Event) ResolveFields()
ResolveFields resolves all the fields associate to the event type. Context fields are automatically resolved.
func (*Event) ResolveFieldsForAD ¶
func (ev *Event) ResolveFieldsForAD()
ResolveFieldsForAD resolves all the fields associate to the event type. Context fields are automatically resolved.
func (*Event) ResolveProcessCacheEntry ¶
func (e *Event) ResolveProcessCacheEntry(newEntryCb func(*ProcessCacheEntry, error)) (*ProcessCacheEntry, bool)
ResolveProcessCacheEntry uses the field handler
func (*Event) ResolveService ¶
ResolveService uses the field handler
func (*Event) SetFieldValue ¶
type EventFilteringProfileState ¶ added in v0.55.0
type EventFilteringProfileState uint8
EventFilteringProfileState is used to compute metrics for the event filtering feature
const ( // NoProfile is used to count the events for which we didn't have a profile NoProfile EventFilteringProfileState = iota // ProfileAtMaxSize is used to count the events that didn't make it into a profile because their matching profile // reached the max size threshold ProfileAtMaxSize // UnstableEventType is used to count the events that didn't make it into a profile because their matching profile was // unstable for their event type UnstableEventType // StableEventType is used to count the events linked to a stable profile for their event type StableEventType // AutoLearning is used to count the event during the auto learning phase AutoLearning // WorkloadWarmup is used to count the learned events due to workload warm up time WorkloadWarmup )
func (EventFilteringProfileState) String ¶ added in v0.55.0
func (efr EventFilteringProfileState) String() string
String returns the string representation of the EventFilteringProfileState
func (EventFilteringProfileState) ToTag ¶ added in v0.55.0
func (efr EventFilteringProfileState) ToTag() string
ToTag returns the tag representation of the EventFilteringProfileState
type EventType ¶
type EventType uint32
EventType describes the type of an event sent from the kernel
const ( // UnknownEventType unknown event UnknownEventType EventType = iota // FileOpenEventType File open event FileOpenEventType // FileMkdirEventType Folder creation event FileMkdirEventType // FileLinkEventType Hard link creation event FileLinkEventType // FileRenameEventType File or folder rename event FileRenameEventType // FileUnlinkEventType Unlink event FileUnlinkEventType // FileRmdirEventType Rmdir event FileRmdirEventType // FileChmodEventType Chmod event FileChmodEventType // FileChownEventType Chown event FileChownEventType // FileUtimesEventType Utime event FileUtimesEventType // FileSetXAttrEventType Setxattr event FileSetXAttrEventType // FileRemoveXAttrEventType Removexattr event FileRemoveXAttrEventType // FileChdirEventType chdir event FileChdirEventType // FileMountEventType Mount event FileMountEventType // FileUmountEventType Umount event FileUmountEventType // ForkEventType Fork event ForkEventType // ExecEventType Exec event ExecEventType // ExitEventType Exit event ExitEventType // InvalidateDentryEventType Dentry invalidated event (DEPRECATED) InvalidateDentryEventType // SetuidEventType setuid event SetuidEventType // SetgidEventType setgid event SetgidEventType // CapsetEventType capset event CapsetEventType // ArgsEnvsEventType args and envs event ArgsEnvsEventType // MountReleasedEventType sent when a mount point is released MountReleasedEventType // SELinuxEventType selinux event SELinuxEventType // BPFEventType bpf event BPFEventType // PTraceEventType PTrace event PTraceEventType // MMapEventType MMap event MMapEventType // MProtectEventType MProtect event MProtectEventType // LoadModuleEventType LoadModule event LoadModuleEventType // UnloadModuleEventType UnloadModule evnt UnloadModuleEventType // SignalEventType Signal event SignalEventType // SpliceEventType Splice event SpliceEventType // CgroupTracingEventType is sent when a new cgroup is being traced CgroupTracingEventType // DNSEventType DNS event DNSEventType // NetDeviceEventType is sent for events on net devices NetDeviceEventType // VethPairEventType is sent when a new veth pair is created VethPairEventType // BindEventType Bind event BindEventType // ConnectEventType Connect event ConnectEventType UnshareMountNsEventType // SyscallsEventType Syscalls event SyscallsEventType // IMDSEventType is sent when an IMDS request or qnswer is captured IMDSEventType // OnDemandEventType is sent for on-demand events OnDemandEventType // LoginUIDWriteEventType is sent for login_uid write events LoginUIDWriteEventType // CgroupWriteEventType is sent when a new cgroup was created CgroupWriteEventType // RawPacketEventType raw packet event RawPacketEventType // MaxKernelEventType is used internally to get the maximum number of kernel events. MaxKernelEventType // FirstEventType is the first valid event type FirstEventType = FileOpenEventType // LastEventType is the last valid event type LastEventType = SyscallsEventType // FirstDiscarderEventType first event that accepts discarders FirstDiscarderEventType = FileOpenEventType // LastDiscarderEventType last event that accepts discarders LastDiscarderEventType = FileChdirEventType // LastApproverEventType is the last event that accepts approvers LastApproverEventType = SpliceEventType // CustomEventType represents a custom event type CustomEventType EventType = iota // CreateNewFileEventType event CreateNewFileEventType // DeleteFileEventType event DeleteFileEventType // WriteFileEventType event WriteFileEventType // CreateRegistryKeyEventType event CreateRegistryKeyEventType // OpenRegistryKeyEventType event OpenRegistryKeyEventType // SetRegistryKeyValueEventType event SetRegistryKeyValueEventType // DeleteRegistryKeyEventType event DeleteRegistryKeyEventType // ChangePermissionEventType event ChangePermissionEventType // MaxAllEventType is used internally to get the maximum number of events. MaxAllEventType )
type ExitEvent ¶
type ExitEvent struct { *Process Cause uint32 `field:"cause"` // SECLDoc[cause] Definition:`Cause of the process termination (one of EXITED, SIGNALED, COREDUMPED)` Code uint32 `field:"code"` // SECLDoc[code] Definition:`Exit code of the process or number of the signal that caused the process to terminate` }
ExitEvent represents a process exit event
type ExtraFieldHandlers ¶
type ExtraFieldHandlers interface { BaseExtraFieldHandlers }
ExtraFieldHandlers handlers not hold by any field
type FakeFieldHandlers ¶
type FakeFieldHandlers struct{}
func (*FakeFieldHandlers) ResolveContainerContext ¶
func (dfh *FakeFieldHandlers) ResolveContainerContext(_ *Event) (*ContainerContext, bool)
ResolveContainerContext stub implementation
func (*FakeFieldHandlers) ResolveContainerCreatedAt ¶
func (dfh *FakeFieldHandlers) ResolveContainerCreatedAt(ev *Event, e *ContainerContext) int
func (*FakeFieldHandlers) ResolveContainerID ¶
func (dfh *FakeFieldHandlers) ResolveContainerID(ev *Event, e *ContainerContext) string
func (*FakeFieldHandlers) ResolveContainerRuntime ¶ added in v0.57.0
func (dfh *FakeFieldHandlers) ResolveContainerRuntime(ev *Event, e *ContainerContext) string
func (*FakeFieldHandlers) ResolveContainerTags ¶
func (dfh *FakeFieldHandlers) ResolveContainerTags(ev *Event, e *ContainerContext) []string
func (*FakeFieldHandlers) ResolveEventTime ¶
func (dfh *FakeFieldHandlers) ResolveEventTime(ev *Event, e *BaseEvent) time.Time
func (*FakeFieldHandlers) ResolveEventTimestamp ¶
func (dfh *FakeFieldHandlers) ResolveEventTimestamp(ev *Event, e *BaseEvent) int
func (*FakeFieldHandlers) ResolveFileBasename ¶
func (dfh *FakeFieldHandlers) ResolveFileBasename(ev *Event, e *FileEvent) string
func (*FakeFieldHandlers) ResolveFilePath ¶
func (dfh *FakeFieldHandlers) ResolveFilePath(ev *Event, e *FileEvent) string
func (*FakeFieldHandlers) ResolveFileUserPath ¶ added in v0.55.0
func (dfh *FakeFieldHandlers) ResolveFileUserPath(ev *Event, e *FimFileEvent) string
func (*FakeFieldHandlers) ResolveFimFileBasename ¶ added in v0.54.0
func (dfh *FakeFieldHandlers) ResolveFimFileBasename(ev *Event, e *FimFileEvent) string
func (*FakeFieldHandlers) ResolveFimFilePath ¶ added in v0.54.0
func (dfh *FakeFieldHandlers) ResolveFimFilePath(ev *Event, e *FimFileEvent) string
func (*FakeFieldHandlers) ResolveHostname ¶ added in v0.56.0
func (dfh *FakeFieldHandlers) ResolveHostname(ev *Event, e *BaseEvent) string
func (*FakeFieldHandlers) ResolveNewSecurityDescriptor ¶ added in v0.55.0
func (dfh *FakeFieldHandlers) ResolveNewSecurityDescriptor(ev *Event, e *ChangePermissionEvent) string
func (*FakeFieldHandlers) ResolveOldSecurityDescriptor ¶ added in v0.55.0
func (dfh *FakeFieldHandlers) ResolveOldSecurityDescriptor(ev *Event, e *ChangePermissionEvent) string
func (*FakeFieldHandlers) ResolveProcessCacheEntry ¶
func (dfh *FakeFieldHandlers) ResolveProcessCacheEntry(_ *Event, _ func(*ProcessCacheEntry, error)) (*ProcessCacheEntry, bool)
ResolveProcessCacheEntry stub implementation
func (*FakeFieldHandlers) ResolveProcessCmdLine ¶
func (dfh *FakeFieldHandlers) ResolveProcessCmdLine(ev *Event, e *Process) string
func (*FakeFieldHandlers) ResolveProcessCmdLineScrubbed ¶
func (dfh *FakeFieldHandlers) ResolveProcessCmdLineScrubbed(ev *Event, e *Process) string
func (*FakeFieldHandlers) ResolveProcessCreatedAt ¶
func (dfh *FakeFieldHandlers) ResolveProcessCreatedAt(ev *Event, e *Process) int
func (*FakeFieldHandlers) ResolveProcessEnvp ¶
func (dfh *FakeFieldHandlers) ResolveProcessEnvp(ev *Event, e *Process) []string
func (*FakeFieldHandlers) ResolveProcessEnvs ¶
func (dfh *FakeFieldHandlers) ResolveProcessEnvs(ev *Event, e *Process) []string
func (*FakeFieldHandlers) ResolveService ¶
func (dfh *FakeFieldHandlers) ResolveService(ev *Event, e *BaseEvent) string
func (*FakeFieldHandlers) ResolveUser ¶
func (dfh *FakeFieldHandlers) ResolveUser(ev *Event, e *Process) string
type FieldHandlers ¶
type FieldHandlers interface { ResolveContainerCreatedAt(ev *Event, e *ContainerContext) int ResolveContainerID(ev *Event, e *ContainerContext) string ResolveContainerRuntime(ev *Event, e *ContainerContext) string ResolveContainerTags(ev *Event, e *ContainerContext) []string ResolveEventTime(ev *Event, e *BaseEvent) time.Time ResolveEventTimestamp(ev *Event, e *BaseEvent) int ResolveFileBasename(ev *Event, e *FileEvent) string ResolveFilePath(ev *Event, e *FileEvent) string ResolveFileUserPath(ev *Event, e *FimFileEvent) string ResolveFimFileBasename(ev *Event, e *FimFileEvent) string ResolveFimFilePath(ev *Event, e *FimFileEvent) string ResolveHostname(ev *Event, e *BaseEvent) string ResolveNewSecurityDescriptor(ev *Event, e *ChangePermissionEvent) string ResolveOldSecurityDescriptor(ev *Event, e *ChangePermissionEvent) string ResolveProcessCmdLine(ev *Event, e *Process) string ResolveProcessCmdLineScrubbed(ev *Event, e *Process) string ResolveProcessCreatedAt(ev *Event, e *Process) int ResolveProcessEnvp(ev *Event, e *Process) []string ResolveProcessEnvs(ev *Event, e *Process) []string ResolveService(ev *Event, e *BaseEvent) string ResolveUser(ev *Event, e *Process) string // custom handlers not tied to any fields ExtraFieldHandlers }
type FileEvent ¶
type FileEvent struct { FileObject uint64 `field:"-"` // handle numeric value PathnameStr string `field:"path,handler:ResolveFilePath,opts:length" op_override:"eval.WindowsPathCmp"` // SECLDoc[path] Definition:`File's path` Example:`exec.file.path == "c:\cmd.bat"` Description:`Matches the execution of the file located at c:\cmd.bat` BasenameStr string `field:"name,handler:ResolveFileBasename,opts:length" op_override:"eval.CaseInsensitiveCmp"` // SECLDoc[name] Definition:`File's basename` Example:`exec.file.name == "cmd.bat"` Description:`Matches the execution of any file named cmd.bat.` }
FileEvent is the common file event type
type FimFileEvent ¶ added in v0.54.0
type FimFileEvent struct { FileObject uint64 `field:"-"` // handle numeric value PathnameStr string `field:"device_path,handler:ResolveFimFilePath,opts:length" op_override:"eval.WindowsPathCmp"` // SECLDoc[device_path] Definition:`File's path` Example:`create.file.device_path == "\device\harddisk1\cmd.bat"` Description:`Matches the creation of the file located at c:\cmd.bat` UserPathnameStr string `field:"path,handler:ResolveFileUserPath,opts:length" op_override:"eval.WindowsPathCmp"` // SECLDoc[path] Definition:`File's path` Example:`create.file.path == "c:\cmd.bat"` Description:`Matches the creation of the file located at c:\cmd.bat` BasenameStr string `field:"name,handler:ResolveFimFileBasename,opts:length" op_override:"eval.CaseInsensitiveCmp"` // SECLDoc[name] Definition:`File's basename` Example:`create.file.name == "cmd.bat"` Description:`Matches the creation of any file named cmd.bat.` }
FimFileEvent is the common file event type
type HashAlgorithm ¶
type HashAlgorithm int
HashAlgorithm is used to configure the hash algorithms of the hash resolver
const ( // SHA1 is used to identify a SHA1 hash SHA1 HashAlgorithm = iota // SHA256 is used to identify a SHA256 hash SHA256 // MD5 is used to identify a MD5 hash MD5 // SSDEEP is used to identify a SSDEEP hash SSDEEP // MaxHashAlgorithm is used for initializations MaxHashAlgorithm )
func (HashAlgorithm) String ¶
func (ha HashAlgorithm) String() string
type HashState ¶
type HashState int
HashState is used to prevent the hash resolver from retrying to hash a file
const ( // NoHash means that computing a hash hasn't been attempted NoHash HashState = iota // Done means that the hashes were already computed Done // FileNotFound means that the underlying file is not longer available to compute the hash FileNotFound // PathnameResolutionError means that the underlying file wasn't properly resolved PathnameResolutionError // FileTooBig means that the underlying file is larger than the hash resolver file size limit FileTooBig // FileEmpty means that the underlying file is empty FileEmpty // FileOpenError is a generic hash state to say that we couldn't open the file FileOpenError // EventTypeNotConfigured means that the event type prevents a hash from being computed EventTypeNotConfigured // HashWasRateLimited means that the hash will be tried again later, it was rate limited HashWasRateLimited // HashFailed means that the hashing failed HashFailed // MaxHashState is used for initializations MaxHashState )
type IMDSEvent ¶ added in v0.55.0
type IMDSEvent struct { Type string `field:"type"` // SECLDoc[type] Definition:`the type of IMDS event` CloudProvider string `field:"cloud_provider"` // SECLDoc[cloud_provider] Definition:`the intended cloud provider of the IMDS event` URL string `field:"url"` // SECLDoc[url] Definition:`the queried IMDS URL` Host string `field:"host"` // SECLDoc[host] Definition:`the host of the HTTP protocol` UserAgent string `field:"user_agent"` // SECLDoc[user_agent] Definition:`the user agent of the HTTP client` Server string `field:"server"` // SECLDoc[server] Definition:`the server header of a response` // The fields below are optional and cloud specific fields AWS AWSIMDSEvent `field:"aws"` // SECLDoc[aws] Definition:`the AWS specific data parsed from the IMDS event` }
IMDSEvent represents an IMDS event
type IPPortContext ¶
type IPPortContext struct { IPNet net.IPNet `field:"ip"` // SECLDoc[ip] Definition:`IP address` Port uint16 `field:"port"` // SECLDoc[port] Definition:`Port number` IsPublic bool `field:"is_public,handler:ResolveIsIPPublic"` // SECLDoc[is_public] Definition:`Whether the IP address belongs to a public network` IsPublicResolved bool `field:"-"` }
IPPortContext is used to hold an IP and Port
type L3Protocol ¶
type L3Protocol uint16
L3Protocol Network protocols
const ( // EthPLOOP Ethernet Loopback packet EthPLOOP L3Protocol = 0x0060 // EthPPUP Xerox PUP packet EthPPUP L3Protocol = 0x0200 // EthPPUPAT Xerox PUP Addr Trans packet EthPPUPAT L3Protocol = 0x0201 // EthPTSN TSN (IEEE 1722) packet EthPTSN L3Protocol = 0x22F0 // EthPIP Internet Protocol packet EthPIP L3Protocol = 0x0800 // EthPX25 CCITT X.25 EthPX25 L3Protocol = 0x0805 // EthPARP Address Resolution packet EthPARP L3Protocol = 0x0806 // EthPBPQ G8BPQ AX.25 Ethernet Packet [ NOT AN OFFICIALLY REGISTERED ID ] EthPBPQ L3Protocol = 0x08FF // EthPIEEEPUP Xerox IEEE802.3 PUP packet EthPIEEEPUP L3Protocol = 0x0a00 // EthPIEEEPUPAT Xerox IEEE802.3 PUP Addr Trans packet EthPIEEEPUPAT L3Protocol = 0x0a01 // EthPBATMAN B.A.T.M.A.N.-Advanced packet [ NOT AN OFFICIALLY REGISTERED ID ] EthPBATMAN L3Protocol = 0x4305 // EthPDEC DEC Assigned proto EthPDEC L3Protocol = 0x6000 // EthPDNADL DEC DNA Dump/Load EthPDNADL L3Protocol = 0x6001 // EthPDNARC DEC DNA Remote Console EthPDNARC L3Protocol = 0x6002 // EthPDNART DEC DNA Routing EthPDNART L3Protocol = 0x6003 // EthPLAT DEC LAT EthPLAT L3Protocol = 0x6004 // EthPDIAG DEC Diagnostics EthPDIAG L3Protocol = 0x6005 // EthPCUST DEC Customer use EthPCUST L3Protocol = 0x6006 // EthPSCA DEC Systems Comms Arch EthPSCA L3Protocol = 0x6007 // EthPTEB Trans Ether Bridging EthPTEB L3Protocol = 0x6558 // EthPRARP Reverse Addr Res packet EthPRARP L3Protocol = 0x8035 // EthPATALK Appletalk DDP EthPATALK L3Protocol = 0x809B // EthPAARP Appletalk AARP EthPAARP L3Protocol = 0x80F3 // EthP8021Q 802.1Q VLAN Extended Header EthP8021Q L3Protocol = 0x8100 // EthPERSPAN ERSPAN type II EthPERSPAN L3Protocol = 0x88BE // EthPIPX IPX over DIX EthPIPX L3Protocol = 0x8137 // EthPIPV6 IPv6 over bluebook EthPIPV6 L3Protocol = 0x86DD // EthPPAUSE IEEE Pause frames. See 802.3 31B EthPPAUSE L3Protocol = 0x8808 // EthPSLOW Slow Protocol. See 802.3ad 43B EthPSLOW L3Protocol = 0x8809 // EthPWCCP Web-cache coordination protocol defined in draft-wilson-wrec-wccp-v2-00.txt EthPWCCP L3Protocol = 0x883E // EthPMPLSUC MPLS Unicast traffic EthPMPLSUC L3Protocol = 0x8847 // EthPMPLSMC MPLS Multicast traffic EthPMPLSMC L3Protocol = 0x8848 // EthPATMMPOA MultiProtocol Over ATM EthPATMMPOA L3Protocol = 0x884c // EthPPPPDISC PPPoE discovery messages EthPPPPDISC L3Protocol = 0x8863 // EthPPPPSES PPPoE session messages EthPPPPSES L3Protocol = 0x8864 // EthPLinkCTL HPNA, wlan link local tunnel EthPLinkCTL L3Protocol = 0x886c // EthPATMFATE Frame-based ATM Transport over Ethernet EthPATMFATE L3Protocol = 0x8884 // EthPPAE Port Access Entity (IEEE 802.1X) EthPPAE L3Protocol = 0x888E // EthPAOE ATA over Ethernet EthPAOE L3Protocol = 0x88A2 // EthP8021AD 802.1ad Service VLAN EthP8021AD L3Protocol = 0x88A8 // EthP802EX1 802.1 Local Experimental 1. EthP802EX1 L3Protocol = 0x88B5 // EthPTIPC TIPC EthPTIPC L3Protocol = 0x88CA // EthPMACSEC 802.1ae MACsec EthPMACSEC L3Protocol = 0x88E5 // EthP8021AH 802.1ah Backbone Service Tag EthP8021AH L3Protocol = 0x88E7 // EthPMVRP 802.1Q MVRP EthPMVRP L3Protocol = 0x88F5 // EthP1588 IEEE 1588 Timesync EthP1588 L3Protocol = 0x88F7 // EthPNCSI NCSI protocol EthPNCSI L3Protocol = 0x88F8 // EthPPRP IEC 62439-3 PRP/HSRv0 EthPPRP L3Protocol = 0x88FB // EthPFCOE Fibre Channel over Ethernet EthPFCOE L3Protocol = 0x8906 // EthPIBOE Infiniband over Ethernet EthPIBOE L3Protocol = 0x8915 // EthPTDLS TDLS EthPTDLS L3Protocol = 0x890D // EthPFIP FCoE Initialization Protocol EthPFIP L3Protocol = 0x8914 // EthP80221 IEEE 802.21 Media Independent Handover Protocol EthP80221 L3Protocol = 0x8917 // EthPHSR IEC 62439-3 HSRv1 EthPHSR L3Protocol = 0x892F // EthPNSH Network Service Header EthPNSH L3Protocol = 0x894F // EthPLOOPBACK Ethernet loopback packet, per IEEE 802.3 EthPLOOPBACK L3Protocol = 0x9000 // EthPQINQ1 deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] EthPQINQ1 L3Protocol = 0x9100 // EthPQINQ2 deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] EthPQINQ2 L3Protocol = 0x9200 // EthPQINQ3 deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] EthPQINQ3 L3Protocol = 0x9300 // EthPEDSA Ethertype DSA [ NOT AN OFFICIALLY REGISTERED ID ] EthPEDSA L3Protocol = 0xDADA // EthPIFE ForCES inter-FE LFB type EthPIFE L3Protocol = 0xED3E // EthPAFIUCV IBM afiucv [ NOT AN OFFICIALLY REGISTERED ID ] EthPAFIUCV L3Protocol = 0xFBFB // EthP8023MIN If the value in the ethernet type is less than this value then the frame is Ethernet II. Else it is 802.3 EthP8023MIN L3Protocol = 0x0600 // EthPIPV6HopByHop IPv6 Hop by hop option EthPIPV6HopByHop L3Protocol = 0x000 // EthP8023 Dummy type for 802.3 frames EthP8023 L3Protocol = 0x0001 // EthPAX25 Dummy protocol id for AX.25 EthPAX25 L3Protocol = 0x0002 // EthPALL Every packet (be careful!!!) EthPALL L3Protocol = 0x0003 // EthP8022 802.2 frames EthP8022 L3Protocol = 0x0004 // EthPSNAP Internal only EthPSNAP L3Protocol = 0x0005 // EthPDDCMP DEC DDCMP: Internal only EthPDDCMP L3Protocol = 0x0006 // EthPWANPPP Dummy type for WAN PPP frames*/ EthPWANPPP L3Protocol = 0x0007 // EthPPPPMP Dummy type for PPP MP frames EthPPPPMP L3Protocol = 0x0008 // EthPLOCALTALK Localtalk pseudo type EthPLOCALTALK L3Protocol = 0x0009 // EthPCAN CAN: Controller Area Network EthPCAN L3Protocol = 0x000C // EthPCANFD CANFD: CAN flexible data rate*/ EthPCANFD L3Protocol = 0x000D // EthPPPPTALK Dummy type for Atalk over PPP*/ EthPPPPTALK L3Protocol = 0x0010 // EthPTR8022 802.2 frames EthPTR8022 L3Protocol = 0x0011 // EthPMOBITEX Mobitex (kaz@cafe.net) EthPMOBITEX L3Protocol = 0x0015 // EthPCONTROL Card specific control frames EthPCONTROL L3Protocol = 0x0016 // EthPIRDA Linux-IrDA EthPIRDA L3Protocol = 0x0017 // EthPECONET Acorn Econet EthPECONET L3Protocol = 0x0018 // EthPHDLC HDLC frames EthPHDLC L3Protocol = 0x0019 // EthPARCNET 1A for ArcNet :-) EthPARCNET L3Protocol = 0x001A // EthPDSA Distributed Switch Arch. EthPDSA L3Protocol = 0x001B // EthPTRAILER Trailer switch tagging EthPTRAILER L3Protocol = 0x001C // EthPPHONET Nokia Phonet frames EthPPHONET L3Protocol = 0x00F5 // EthPIEEE802154 IEEE802.15.4 frame EthPIEEE802154 L3Protocol = 0x00F6 // EthPCAIF ST-Ericsson CAIF protocol EthPCAIF L3Protocol = 0x00F7 // EthPXDSA Multiplexed DSA protocol EthPXDSA L3Protocol = 0x00F8 // EthPMAP Qualcomm multiplexing and aggregation protocol EthPMAP L3Protocol = 0x00F9 )
func (L3Protocol) String ¶
func (proto L3Protocol) String() string
type L4Protocol ¶
type L4Protocol uint16
L4Protocol transport protocols
const ( // IPProtoIP Dummy protocol for TCP IPProtoIP L4Protocol = 0 // IPProtoICMP Internet Control Message Protocol (IPv4) IPProtoICMP L4Protocol = 1 // IPProtoIGMP Internet Group Management Protocol IPProtoIGMP L4Protocol = 2 // IPProtoIPIP IPIP tunnels (older KA9Q tunnels use 94) IPProtoIPIP L4Protocol = 4 // IPProtoTCP Transmission Control Protocol IPProtoTCP L4Protocol = 6 // IPProtoEGP Exterior Gateway Protocol IPProtoEGP L4Protocol = 8 // IPProtoIGP Interior Gateway Protocol (any private interior gateway (used by Cisco for their IGRP)) IPProtoIGP L4Protocol = 9 // IPProtoPUP PUP protocol IPProtoPUP L4Protocol = 12 // IPProtoUDP User Datagram Protocol IPProtoUDP L4Protocol = 17 // IPProtoIDP XNS IDP protocol IPProtoIDP L4Protocol = 22 // IPProtoTP SO Transport Protocol Class 4 IPProtoTP L4Protocol = 29 // IPProtoDCCP Datagram Congestion Control Protocol IPProtoDCCP L4Protocol = 33 // IPProtoIPV6 IPv6-in-IPv4 tunnelling IPProtoIPV6 L4Protocol = 41 // IPProtoRSVP RSVP Protocol IPProtoRSVP L4Protocol = 46 // IPProtoGRE Cisco GRE tunnels (rfc 1701,1702) IPProtoGRE L4Protocol = 47 // IPProtoESP Encapsulation Security Payload protocol IPProtoESP L4Protocol = 50 // IPProtoAH Authentication Header protocol IPProtoAH L4Protocol = 51 // IPProtoICMPV6 Internet Control Message Protocol (IPv6) IPProtoICMPV6 L4Protocol = 58 // IPProtoMTP Multicast Transport Protocol IPProtoMTP L4Protocol = 92 // IPProtoBEETPH IP option pseudo header for BEET IPProtoBEETPH L4Protocol = 94 // IPProtoENCAP Encapsulation Header IPProtoENCAP L4Protocol = 98 // IPProtoPIM Protocol Independent Multicast IPProtoPIM L4Protocol = 103 // IPProtoCOMP Compression Header Protocol IPProtoCOMP L4Protocol = 108 // IPProtoSCTP Stream Control Transport Protocol IPProtoSCTP L4Protocol = 132 // IPProtoUDPLITE UDP-Lite (RFC 3828) IPProtoUDPLITE L4Protocol = 136 // IPProtoMPLS MPLS in IP (RFC 4023) IPProtoMPLS L4Protocol = 137 // IPProtoRAW Raw IP packets IPProtoRAW L4Protocol = 255 )
func (L4Protocol) String ¶
func (proto L4Protocol) String() string
type MatchedRule ¶
type MatchedRule struct { RuleID string RuleVersion string RuleTags map[string]string PolicyName string PolicyVersion string }
MatchedRule contains the identification of one rule that has match
func AppendMatchedRule ¶
func AppendMatchedRule(list []*MatchedRule, toAdd []*MatchedRule) []*MatchedRule
AppendMatchedRule appends two lists, but avoiding duplicates
func NewMatchedRule ¶
func NewMatchedRule(ruleID, ruleVersion string, ruleTags map[string]string, policyName, policyVersion string) *MatchedRule
NewMatchedRule return a new MatchedRule instance
func (*MatchedRule) Match ¶
func (mr *MatchedRule) Match(mr2 *MatchedRule) bool
Match returns true if the rules are equal
type Model ¶
type Model struct {
ExtraValidateFieldFnc func(field eval.Field, fieldValue eval.FieldValue) error
}
Model describes the data model for the runtime security agent events
func (*Model) GetEvaluator ¶
func (*Model) GetEventTypes ¶
func (*Model) GetFieldRestrictions ¶ added in v0.57.0
func (*Model) NewDefaultEventWithType ¶
NewDefaultEventWithType returns a new Event for the given type
func (*Model) ValidateField ¶
ValidateField validates the value of a field
type NetworkContext ¶
type NetworkContext struct { Device NetworkDeviceContext `field:"device"` // network device on which the network packet was captured L3Protocol uint16 `field:"l3_protocol"` // SECLDoc[l3_protocol] Definition:`L3 protocol of the network packet` Constants:`L3 protocols` L4Protocol uint16 `field:"l4_protocol"` // SECLDoc[l4_protocol] Definition:`L4 protocol of the network packet` Constants:`L4 protocols` Source IPPortContext `field:"source"` // source of the network packet Destination IPPortContext `field:"destination"` // destination of the network packet Size uint32 `field:"size"` // SECLDoc[size] Definition:`Size in bytes of the network packet` }
NetworkContext represents the network context of the event
func (*NetworkContext) IsZero ¶ added in v0.59.0
func (nc *NetworkContext) IsZero() bool
IsZero returns if there is a network context
type NetworkDeviceContext ¶
type NetworkDeviceContext struct{}
NetworkDeviceContext defines a network device context
type OpenRegistryKeyEvent ¶
type OpenRegistryKeyEvent struct {
Registry RegistryEvent `field:"registry"` // SECLDoc[registry] Definition:`Registry Event`
}
OpenRegistryKeyEvent defines registry key opening
type PIDContext ¶
type PIDContext struct {
Pid uint32 `field:"pid"` // SECLDoc[pid] Definition:`Process ID of the process (also called thread group ID)`
}
PIDContext holds the process context of an kernel event
type Process ¶
type Process struct { PIDContext FileEvent FileEvent `field:"file"` ContainerID string `field:"container.id"` // SECLDoc[container.id] Definition:`Container ID` ExitTime time.Time `field:"exit_time,opts:getters_only"` ExecTime time.Time `field:"exec_time,opts:getters_only"` CreatedAt uint64 `field:"created_at,handler:ResolveProcessCreatedAt"` // SECLDoc[created_at] Definition:`Timestamp of the creation of the process` PPid uint32 `field:"ppid"` // SECLDoc[ppid] Definition:`Parent process ID` ArgsEntry *ArgsEntry `field:"-"` EnvsEntry *EnvsEntry `field:"-"` CmdLine string `field:"cmdline,handler:ResolveProcessCmdLine,weight:200" op_override:"eval.CaseInsensitiveCmp"` // SECLDoc[cmdline] Definition:`Command line of the process` Example:`exec.cmdline == "-sV -p 22,53,110,143,4564 198.116.0-255.1-127"` Description:`Matches any process with these exact arguments.` Example:`exec.cmdline =~ "* -F * http*"` Description:`Matches any process that has the "-F" argument anywhere before an argument starting with "http".` CmdLineScrubbed string `field:"cmdline_scrubbed,handler:ResolveProcessCmdLineScrubbed,weight:500,opts:getters_only"` OwnerSidString string `field:"user_sid"` // SECLDoc[user_sid] Definition:`Sid of the user of the process` User string `field:"user,handler:ResolveUser"` // SECLDoc[user] Definition:`User name` Envs []string `field:"envs,handler:ResolveProcessEnvs,weight:100"` // SECLDoc[envs] Definition:`Environment variable names of the process` Envp []string `field:"envp,handler:ResolveProcessEnvp,weight:100"` // SECLDoc[envp] Definition:`Environment variables of the process` // SECLDoc[envp] Definition:`Environment variables of the process` // cache version Variables eval.Variables `field:"-"` ScrubbedCmdLineResolved bool `field:"-"` }
Process represents a process
type ProcessAncestorsIterator ¶
type ProcessAncestorsIterator struct {
// contains filtered or unexported fields
}
ProcessAncestorsIterator defines an iterator of ancestors
func (*ProcessAncestorsIterator) At ¶ added in v0.60.0
func (it *ProcessAncestorsIterator) At(ctx *eval.Context, regID eval.RegisterID, pos int) *ProcessCacheEntry
At returns the element at the given position
func (*ProcessAncestorsIterator) Front ¶
func (it *ProcessAncestorsIterator) Front(ctx *eval.Context) *ProcessCacheEntry
Front returns the first element
func (*ProcessAncestorsIterator) Len ¶ added in v0.60.0
func (it *ProcessAncestorsIterator) Len(ctx *eval.Context) int
Len returns the len
func (*ProcessAncestorsIterator) Next ¶
func (it *ProcessAncestorsIterator) Next() *ProcessCacheEntry
Next returns the next element
type ProcessCacheEntry ¶
type ProcessCacheEntry struct { ProcessContext // contains filtered or unexported fields }
ProcessCacheEntry this struct holds process context kept in the process tree
func NewProcessCacheEntry ¶
func NewProcessCacheEntry(coreRelease func(_ *ProcessCacheEntry)) *ProcessCacheEntry
NewProcessCacheEntry returns a new process cache entry
func (*ProcessCacheEntry) AppendReleaseCallback ¶ added in v0.56.0
func (pc *ProcessCacheEntry) AppendReleaseCallback(callback func())
AppendReleaseCallback set the callback called when the entry is released
func (*ProcessCacheEntry) IsContainerRoot ¶
func (pc *ProcessCacheEntry) IsContainerRoot() bool
IsContainerRoot returns whether this is a top level process in the container ID
func (*ProcessCacheEntry) Release ¶
func (pc *ProcessCacheEntry) Release()
Release decrement and eventually release the entry
func (*ProcessCacheEntry) Retain ¶
func (pc *ProcessCacheEntry) Retain()
Retain increment ref counter
type ProcessContext ¶
type ProcessContext struct { Process Parent *Process `field:"parent,opts:exposed_at_event_root_only,check:HasParent"` Ancestor *ProcessCacheEntry `field:"ancestors,iterator:ProcessAncestorsIterator,check:IsNotKworker"` }
ProcessContext holds the process context of an event
func (*ProcessContext) HasParent ¶
func (p *ProcessContext) HasParent() bool
HasParent returns whether the process has a parent
type RegistryEvent ¶
type RegistryEvent struct { KeyName string `field:"key_name,opts:length"` // SECLDoc[key_name] Definition:`Registry's name` KeyPath string `field:"key_path,opts:length" op_override:"eval.CaseInsensitiveCmp"` // SECLDoc[key_path] Definition:`Registry's path` }
RegistryEvent is the common registry event type
type Releasable ¶
type Releasable struct {
// contains filtered or unexported fields
}
Releasable represents an object than can be released
func (*Releasable) AppendReleaseCallback ¶ added in v0.56.0
func (r *Releasable) AppendReleaseCallback(callback func())
AppendReleaseCallback sets a callback to be called when the cache entry is released
func (*Releasable) CallReleaseCallback ¶
func (r *Releasable) CallReleaseCallback()
CallReleaseCallback calls the on-release callback
type RenameFileEvent ¶ added in v0.54.0
type RenameFileEvent struct { Old FimFileEvent `field:"file"` // SECLDoc[file] Definition:`File Event` New FimFileEvent `field:"file.destination"` // SECLDoc[file] Definition:`File Event` }
RenameFileEvent defines file renaming
type RetValError ¶
type RetValError int
RetValError represents a syscall return error value
func (RetValError) String ¶
func (f RetValError) String() string
type SecurityProfileContext ¶
type SecurityProfileContext struct { Name string `field:"name"` // SECLDoc[name] Definition:`Name of the security profile` Version string `field:"version"` // SECLDoc[version] Definition:`Version of the security profile` Tags []string `field:"tags"` // SECLDoc[tags] Definition:`Tags of the security profile` EventTypes []EventType `field:"event_types"` // SECLDoc[event_types] Definition:`Event types enabled for the security profile` EventTypeState EventFilteringProfileState `field:"-"` // State of the event type in this profile }
SecurityProfileContext holds the security context of the profile
type SetRegistryKeyValueEvent ¶
type SetRegistryKeyValueEvent struct { Registry RegistryEvent `field:"registry"` // SECLDoc[registry] Definition:`Registry Event` ValueName string `field:"value_name;registry.value_name,opts:length"` // SECLDoc[value_name] Definition:`Registry's value name` SECLDoc[registry.value_name] Definition:`Registry's value name` }
SetRegistryKeyValueEvent defines the event of setting up a value of a registry key
type SpanContext ¶
SpanContext describes a span context
type SyscallDriftEventReason ¶ added in v0.57.0
type SyscallDriftEventReason uint64
SyscallDriftEventReason describes why a syscall drift event was sent
const ( // SyscallMonitorPeriodReason means that the event was sent because the syscall cache entry was dirty for longer than syscall_monitor.period SyscallMonitorPeriodReason SyscallDriftEventReason = iota + 1 // ExitReason means that the event was sent because a pid that was about to exit had a dirty cache entry ExitReason // ExecveReason means that the event was sent because an execve syscall was detected on a pid with a dirty cache entry ExecveReason )
func (SyscallDriftEventReason) String ¶ added in v0.57.0
func (r SyscallDriftEventReason) String() string
type TLSContext ¶ added in v0.60.0
type TLSContext struct {
Version uint16 `field:"version"` // SECLDoc[version] Definition:`TLS version`
}
TLSContext represents a tls context
type TLSVersion ¶ added in v0.60.0
type TLSVersion uint16
TLSVersion tls version
func (TLSVersion) String ¶ added in v0.60.0
func (tls TLSVersion) String() string
type UserSessionContext ¶
type UserSessionContext struct { ID uint64 `field:"-"` SessionType usersession.Type `field:"-"` Resolved bool `field:"-"` // Kubernetes User Session context K8SUsername string `field:"k8s_username,handler:ResolveK8SUsername" json:"username,omitempty"` // SECLDoc[k8s_username] Definition:`Kubernetes username of the user that executed the process` K8SUID string `field:"k8s_uid,handler:ResolveK8SUID" json:"uid,omitempty"` // SECLDoc[k8s_uid] Definition:`Kubernetes UID of the user that executed the process` K8SGroups []string `field:"k8s_groups,handler:ResolveK8SGroups" json:"groups,omitempty"` // SECLDoc[k8s_groups] Definition:`Kubernetes groups of the user that executed the process` K8SExtra map[string][]string `json:"extra,omitempty"` }
UserSessionContext describes the user session context Disclaimer: the `json` tags are used to parse K8s credentials from cws-instrumentation
type WriteFileEvent ¶ added in v0.54.0
type WriteFileEvent struct {
File FimFileEvent `field:"file"` // SECLDoc[file] Definition:`File Event`
}
WriteFileEvent represents a write event