aquasecurity / aquasecurity/tracee
Add higher level events
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 508
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
For a user using tracee as a monitoring or threat hunting tool to be able to understand the outputted events there is a need for a deep understanding of linux internals and syscalls.
Because the events are a reflection of the actual syscalls and lsm hooks it's really hard for a user to understand the meaning behind them.
Adding a higher level events which will symbolize common actions performed on the system will enable monitoring, threat hunting and writing tracee-rules rules much easier.
For example:
- [ ] Processes:
- [ ] Process creation (#2725)
- [ ] Process termination (#2725)
- [ ] Process creation failed
- [x] SO load (#1631)
- [ ] Thread creation (clone/fork)
- [ ] Network connections:
- [ ] accept
- [ ] connect
- [ ] DNS
- [ ] Files:
- [ ] File creation
- [ ] File modification
- [ ] File deletion (#2725)
- [ ] IPC:
- [ ] Pipe creation
- [ ] Pipe connect
- [ ] Signals
- [ ] Kernel:
- [ ] Kernel module loaded
- [ ] Kernel module unloaded
- [ ] Misc:
- [ ] System login
- [ ] Container create/run/stop
Those events can be part of a new set which will contain the events that are human (not linux experts) readable.
Contributor guide
Research direction
Start by reviewing the existing higher-level event work referenced in issues #2725 and #1631, then map the proposed process, network, file, IPC, kernel, and miscellaneous events. Done means defining and implementing an agreed set of human-readable events, but the issue does not identify entry-point files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100