aquasecurity / aquasecurity/tracee
Network enforcement
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
Now that we have network events and policies ready, we can add blocking capabilties to network connections.
This can be done by introducing a new `block` action to network events and moving some network related filters into the kernel.
- [ ] Allow filtering network events by ingress/egress, source ip/port, destination ip/port and protocol **in the kernel**
#2965
- [ ] Introduce a new `AllowedActions` field to the Event struct to know which actions can be taken on event match
- [ ] Support blocking network events in Tracee policies
Contributor guide
Research direction
Start by reviewing the existing network events and policies, then inspect the Event struct and the network-related filters associated with #2965. The work spans kernel filtering, event actions, and Tracee policies. Done means network events can be filtered and blocked according to the listed policy actions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100