aquasecurity / aquasecurity/tracee

Selecting event output fields

Open
#2,871 4 comments 0 reactions 0 assignees View on GitHub
kind/feature
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

Users should be able to select which event fields are printed or not. The motivation is to minimize event size. This surfaced in https://github.com/aquasecurity/tracee/issues/2870#issuecomment-1468743262 and in https://github.com/aquasecurity/tracee/discussions/2640.
We already allow conditional printing of some fields (stack traces, syscall, exec env) through output options. The same control should be available for all metadata and context fields in a consistent way.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the existing output options for stack traces, syscall, and exec env, then compare how metadata and context fields are represented. Read the linked issue and discussion for context. Done means users can consistently select all event metadata and context fields for printing while minimizing event size.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.