aquasecurity / aquasecurity/tracee

Support event data filtering using "parsed" argument values

Open
#3,019 0 comments 0 reactions 0 assignees View on GitHub
area/filtering kind/feature priority/backlog
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

Currently when I want to run tracee to filter (for example) `ptrace` events with `request=PTRACE_TRACEME` I need to run it like so:
`tracee -f e=ptrace -f ptrace.args.request=0`
This RFE is to change the required CLI to look like:
`tracee -f e=ptrace -f ptrace.args.request=PTRACE_TRACEME`

The solution should be maintainable in the long run, so if we can't make it maintainable it's probably not worth it (a possible scenario with this RFE IMO).

One way to implement that is by translating parsed argument values given by the user in the cli to their raw values internally when filtering

Contributor guide

Open the contributing guide

Research direction

Start by tracing the CLI event-filter handling for argument values, using the ptrace example and its request=PTRACE_TRACEME versus request=0 forms as the reference behavior. Done means users can supply parsed argument values such as PTRACE_TRACEME while filtering still matches the corresponding raw value, with an approach maintainable for future arguments.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.