enrichment

Documentation

Index

• Variables
• type Config
• type ContainerForCgroupGetter
• type EnrichRequest
• type EventEnricher
  • func EnrichWithFileHash(log *logging.Logger, mountNamespacePIDStore *types.PIDsPerNamespace, ...) EventEnricher
• type PIDsInNamespaceGetter
• type SensitiveValueRedactor
  • func NewSensitiveValueRedactor(sensitiveValueRegex *regexp.Regexp) *SensitiveValueRedactor
  • func (r *SensitiveValueRedactor) Enrich(ctx context.Context, req *EnrichRequest)
  • func (r *SensitiveValueRedactor) EventTypes() []castpb.EventType
• type Service
  • func NewService(log *logging.Logger, cfg Config) *Service
  • func (s *Service) Enqueue(e *EnrichRequest) bool
  • func (s *Service) Events() <-chan *castpb.Event
  • func (s *Service) Run(ctx context.Context) error

Variables

var (
	ErrCannotGetInode         = errors.New("cannot get inode for path")
	ErrProcFolderDoesNotExist = errors.New("/proc/<pid> folder does not exist")
	ErrFileDoesNotExist       = errors.New("wanted file does not exist")
)

Types

type Config

type Config struct {
	WorkerCount    int
	EventEnrichers []EventEnricher
}

type ContainerForCgroupGetter

type ContainerForCgroupGetter func(cgroup uint64) (*containers.Container, bool, error)

type EnrichRequest

type EnrichRequest struct {
	Event     *castpb.Event
	EbpfEvent *types.Event
}

type EventEnricher

type EventEnricher interface {
	// Enrich will add additional data to the provided Event.
	Enrich(context.Context, *EnrichRequest)

	// EventsTypes returns a slice of event types, this enricher reacts to.
	EventTypes() []castpb.EventType
}

func EnrichWithFileHash

func EnrichWithFileHash(log *logging.Logger, mountNamespacePIDStore *types.PIDsPerNamespace, procFS proc.ProcFS) EventEnricher

type PIDsInNamespaceGetter

type PIDsInNamespaceGetter func(ns uint32) []uint32

type SensitiveValueRedactor

type SensitiveValueRedactor struct {
	// contains filtered or unexported fields
}

func NewSensitiveValueRedactor

func NewSensitiveValueRedactor(sensitiveValueRegex *regexp.Regexp) *SensitiveValueRedactor

NewSensitiveValueRedactor creates a new SensitiveValueRedactor.

func (*SensitiveValueRedactor) Enrich

func (r *SensitiveValueRedactor) Enrich(ctx context.Context, req *EnrichRequest)

Enrich will add additional data to the provided Event.

func (*SensitiveValueRedactor) EventTypes

func (r *SensitiveValueRedactor) EventTypes() []castpb.EventType

EventsTypes returns a slice of event types, this enricher reacts to.

type Service

type Service struct {
	// contains filtered or unexported fields
}

func NewService

func NewService(log *logging.Logger, cfg Config) *Service

func (*Service) Enqueue

func (s *Service) Enqueue(e *EnrichRequest) bool

func (*Service) Events

func (s *Service) Events() <-chan *castpb.Event

func (*Service) Run

func (s *Service) Run(ctx context.Context) error