tracee

Documentation

Index

• Constants
• type Arg
• type Context
• type Event
• type Filter
  • func NewFilter(minumumSeverity int, excludeRules []string) *Filter
  • func (f *Filter) Check(event Event) bool
• type SignatureMetadata

Constants

const (
	SeverityKey = "Severity"
	CategoryKey = "MITRE ATT&CK"
)

Types

type Arg

type Arg struct {
	Name  string      `json:"name"`
	Value interface{} `json:"value"`
}

type Context

type Context struct {
	Timestamp       int    `json:"timestamp"`
	UserID          int    `json:"userId"`
	ProcessName     string `json:"processName"`
	ProcessID       int    `json:"processId"`
	ParentProcessID int    `json:"parentProcessId"`
	CgroupID        int    `json:"cgroupId"`
	MountNamespace  int    `json:"mountNamespace"`
	PidNamespace    int    `json:"pidNamespace"`
	HostName        string `json:"hostName"`
	ContainerID     string `json:"containerId"`
	ContainerImage  string `json:"containerImage"`
	ContainerName   string `json:"containerName"`
	PodName         string `json:"podName"`
	PodNamespace    string `json:"podNamespace"`
	PodUID          string `json:"podUID"`
	EventID         int    `json:"eventId,string"`
	EventName       string `json:"eventName"`
	ReturnValue     int    `json:"returnValue"`
	Args            []Arg  `json:"args"`
}

type Event

type Event struct {
	Data        map[string]interface{}
	Context     Context
	SigMetadata SignatureMetadata
}

type Filter

type Filter struct {
	// contains filtered or unexported fields
}

func NewFilter

func NewFilter(minumumSeverity int, excludeRules []string) *Filter

func (*Filter) Check

func (f *Filter) Check(event Event) bool

type SignatureMetadata

type SignatureMetadata struct {
	ID          string
	Version     string
	Name        string
	Description string
	Severity    int
	Tags        []string
	Properties  map[string]interface{}
}