elastic / elastic/beats

Process misattribution in system/socket dataset

Open
#44,741 3 comments 0 reactions 0 assignees View on GitHub
bug Team:Security-Service Integrations
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

Related to a SDH.

Sometimes the TCP connections are assigned an incorrect process, for example `sed` having made a TCP connection.

This was observed in 8.12.2 with debian9, more information on the SDH.

It took me awhile to reproduce but the following works:
In one session:
```
while true;do make clean-all;make -j4;sleep 0.1;done
```
Another:
```
while true; do sudo apt-get -y purge gnome;sudo apt-get -y autoremove;sudo apt-get -y clean;sudo apt-get -y install gnome;done
```

Here we see that one SSH session was incorrectly assigned to `cc`:

![Image](https://github.com/user-attachments/assets/7208cb7d-34e3-4e2b-a78c-59d7c20f0040)

More information in the SDH.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.