aquasecurity / aquasecurity/tracee
Support event data filtering using "parsed" argument values
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
Currently when I want to run tracee to filter (for example) `ptrace` events with `request=PTRACE_TRACEME` I need to run it like so:
`tracee -f e=ptrace -f ptrace.args.request=0`
This RFE is to change the required CLI to look like:
`tracee -f e=ptrace -f ptrace.args.request=PTRACE_TRACEME`
The solution should be maintainable in the long run, so if we can't make it maintainable it's probably not worth it (a possible scenario with this RFE IMO).
One way to implement that is by translating parsed argument values given by the user in the cli to their raw values internally when filtering
Contributor guide
Research direction
Start by tracing the CLI event-filter handling for argument values, using the ptrace example and its request=PTRACE_TRACEME versus request=0 forms as the reference behavior. Done means users can supply parsed argument values such as PTRACE_TRACEME while filtering still matches the corresponding raw value, with an approach maintainable for future arguments.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100