aquasecurity / aquasecurity/tracee

Network enforcement

Open
#2,935 0 comments 0 reactions 0 assignees View on GitHub
area/network kind/feature priority/backlog
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

Now that we have network events and policies ready, we can add blocking capabilties to network connections.
This can be done by introducing a new `block` action to network events and moving some network related filters into the kernel.

- [ ] Allow filtering network events by ingress/egress, source ip/port, destination ip/port and protocol **in the kernel**
#2965
- [ ] Introduce a new `AllowedActions` field to the Event struct to know which actions can be taken on event match
- [ ] Support blocking network events in Tracee policies

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the existing network events and policies, then inspect the Event struct and the network-related filters associated with #2965. The work spans kernel filtering, event actions, and Tracee policies. Done means network events can be filtered and blocked according to the listed policy actions.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.