aquasecurity / aquasecurity/tracee

Add Kubernetes filters to scopes

Open
#3,711 5 comments 0 reactions 0 assignees View on GitHub
kind/feature
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

As of today, when using tracee on k8s we can filter events based on the pod namespace (as attached on the picture)
![image](https://github.com/aquasecurity/tracee/assets/70207874/efb4a060-77bc-419a-a243-8ed59c51a6a1)

Lately, we have encountered numerous situations where we need to trace events and signatures only from a specific pod namespace.
Cloud you please add this ability to the scope so we could filter the whole policy?
Attaching the desired outcome:
![image](https://github.com/aquasecurity/tracee/assets/70207874/05560664-4b54-4038-9522-19d964c714c9)

Thank you

Contributor guide

Open the contributing guide

Research direction

Start by tracing the existing scope filters and the Kubernetes pod namespace data used by Tracee. Confirm how scopes apply to both events and signatures, then define the expected behavior for filtering a whole policy by namespace. Done means a policy can select a specific pod namespace and the corresponding events and signatures are filtered accordingly.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes, linux
Domain
operating-systems, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.