sysdig

Documentation

Index

• Constants
• Variables
• type Actionner
  • func Register() *Actionner
  • func (a Actionner) CheckParameters(action *rules.Action) error
  • func (a Actionner) Checks(event *events.Event, _ *rules.Action) error
  • func (a Actionner) Information() models.Information
  • func (a Actionner) Init() error
  • func (a Actionner) Parameters() models.Parameters
  • func (a Actionner) Run(event *events.Event, action *rules.Action) (utils.LogLine, *models.Data, error)
• type Parameters

Constants

const (
	Name          string = "sysdig"
	Category      string = "kubernetes"
	Description   string = "Capture the syscalls packets in a pod"
	Source        string = "syscalls, k8s_audit"
	Continue      bool   = false
	UseContext    bool   = false
	AllowOutput   bool   = false
	RequireOutput bool   = true
	Permissions   string = `` /* 323-byte string literal not displayed */

	Example string = `` /* 224-byte string literal not displayed */

)

Variables

var (
	RequiredOutputFields = []string{"k8s.ns.name, k8s.pod.name", "ka.target.namespace, (ka.target.pod.name or ka.target.name)"}
)

Types

type Actionner

type Actionner struct{}

func Register

func Register() *Actionner

func (Actionner) CheckParameters

func (a Actionner) CheckParameters(action *rules.Action) error

func (Actionner) Checks

func (a Actionner) Checks(event *events.Event, _ *rules.Action) error

func (Actionner) Information

func (a Actionner) Information() models.Information

func (Actionner) Init

func (a Actionner) Init() error

func (Actionner) Parameters

func (a Actionner) Parameters() models.Parameters

func (Actionner) Run

func (a Actionner) Run(event *events.Event, action *rules.Action) (utils.LogLine, *models.Data, error)

type Parameters

type Parameters struct {
	Image      string `mapstructure:"image"`
	Scope      string `mapstructure:"scope" validate:"oneof=pod node"`
	Duration   int    `mapstructure:"duration" validate:"gt=0,lte=30"`
	BufferSize int    `mapstructure:"buffer_size" validate:"gte=128"`
}