aquasecurity / aquasecurity/tracee
User interface for event parameters
Open
area/ebpf
area/events
area/filtering
area/UX
kind/feature
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
Currently we are using filters to provide parameters for the `symbols_loaded` and `print_mem_dump` events.
This is an abuse of the filters and resulted in some workarounds.
We should implement a new way which users can provide parameters for events that needs them.
This can also affect the `hooked_syscalls` event as the syscall list is constant and can be varied with this feature.
As part of this change, we should also verify that the parameters given by the user are valid.
Contributor guide
Assessment
This issue has not been assessed yet.