aquasecurity / aquasecurity/tracee

Add higher level events

Open
#1,310 3 comments 0 reactions 0 assignees View on GitHub
area/ebpf area/events kind/feature priority/backlog
Dominant language
Go
Stars
4.6k
Forks
508
Avg merge
2d 8h
Merged PRs (30d)
9

Description

For a user using tracee as a monitoring or threat hunting tool to be able to understand the outputted events there is a need for a deep understanding of linux internals and syscalls.
Because the events are a reflection of the actual syscalls and lsm hooks it's really hard for a user to understand the meaning behind them.

Adding a higher level events which will symbolize common actions performed on the system will enable monitoring, threat hunting and writing tracee-rules rules much easier.
For example:

- [ ] Processes:
- [ ] Process creation (#2725)
- [ ] Process termination (#2725)
- [ ] Process creation failed
- [x] SO load (#1631)
- [ ] Thread creation (clone/fork)
- [ ] Network connections:
- [ ] accept
- [ ] connect
- [ ] DNS
- [ ] Files:
- [ ] File creation
- [ ] File modification
- [ ] File deletion (#2725)
- [ ] IPC:
- [ ] Pipe creation
- [ ] Pipe connect
- [ ] Signals
- [ ] Kernel:
- [ ] Kernel module loaded
- [ ] Kernel module unloaded
- [ ] Misc:
- [ ] System login
- [ ] Container create/run/stop

Those events can be part of a new set which will contain the events that are human (not linux experts) readable.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the existing higher-level event work referenced in issues #2725 and #1631, then map the proposed process, network, file, IPC, kernel, and miscellaneous events. Done means defining and implementing an agreed set of human-readable events, but the issue does not identify entry-point files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.