derive

Documentation

Index

• func ContainerCreate(containers *containers.Containers) events.DeriveFunction
• func ContainerRemove(containers *containers.Containers) events.DeriveFunction
• func DetectHookedSyscall(kernelSymbols *helpers.KernelSymbolTable) events.DeriveFunction
• func HookedSeqOps(kernelSymbols *helpers.KernelSymbolTable) events.DeriveFunction
• func NetPacket() events.DeriveFunction

Functions

func ContainerCreate

func ContainerCreate(containers *containers.Containers) events.DeriveFunction

ContainerCreate receives a containers as a closure argument to track it's containers. If it receives a cgroup_mkdir event, it can derive a container_create event from it.

func ContainerRemove

func ContainerRemove(containers *containers.Containers) events.DeriveFunction

ContainerRemove receives a containers.Containers object as a closure argument to track it's containers. If it receives a cgroup_rmdir event, it can derive a container_remove event from it.

func DetectHookedSyscall

func DetectHookedSyscall(kernelSymbols *helpers.KernelSymbolTable) events.DeriveFunction

func HookedSeqOps

func HookedSeqOps(kernelSymbols *helpers.KernelSymbolTable) events.DeriveFunction

func NetPacket

func NetPacket() events.DeriveFunction

NetPacket derives net_packet from net events with 'metadata' arg