8000 feat: Add list-events flag for listing events by simar7 · Pull Request #1071 · aquasecurity/tracee · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

feat: Add list-events flag for listing events #1071

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Oct 13, 2021
Merged

feat: Add list-events flag for listing events #1071

merged 2 commits into from
Oct 13, 2021

Conversation

simar7
Copy link
Member
@simar7 simar7 commented Oct 12, 2021 •
edited
Loading 
 ./dist/tracee-rules --list-events
security_socket_connect,dup,dup2,dup3,close,sched_process_exit,execve,security_socket_connect,ptrace,ptrace,security_file_open,process_vm_writev,security_sb_mount,magic_write,mem_prot_alert,security_bprm_check,security_bprm_check,security_file_open,init_module,security_kernel_read_file,security_file_open,execve,security_file_open

docker run --name tracee --rm --pid=host --privileged -v /tmp/tracee:/tmp/tracee -it tracee:latest 
+ TRACEE_EBPF_EXE=/tracee/tracee-ebpf
+ TRACEE_RULES_EXE=/tracee/tracee-rules
+ '['  '=' trace ]
+ /tracee/tracee-rules --list-events
+ EVENTS=security_socket_connect,dup,dup2,dup3,close,sched_process_exit,execve,security_socket_connect,ptrace,ptrace,security_file_open,process_vm_writev,security_sb_mount,magic_write,mem_prot_alert,security_bprm_check,security_bprm_check,security_file_open,init_module,security_kernel_read_file,security_file_open,execve,security_file_open
+ /tracee/tracee-ebpf '--output=format:gob' --security-alerts --trace 'event=security_socket_connect,dup,dup2,dup3,close,sched_process_exit,execve,security_socket_connect,ptrace,ptrace,security_file_open,process_vm_writev,security_sb_mount,magic_write,mem_prot_alert,security_bprm_check,security_bprm_check,security_file_open,init_module,security_kernel_read_file,security_file_open,execve,security_file_open'
+ /tracee/tracee-rules '--input-tracee=file:stdin' '--input-tracee=format:gob'
Loaded 14 signature(s): [TRC-1 TRC-13  TRC-2 TRC-3 TRC-11 TRC-9 TRC-4 TRC-5 TRC-12 TRC-8 TRC-6 TRC-10 TRC-7]

*** Detection ***
Time: 2021-10-13T05:13:46Z
Signature ID: TRC-8
Signature: K8S Service Account Token Use Detected
Data: map[]
Command: local-path-prov
Hostname: local-path-prov

Signed-off-by: Simar simar@linux.com

@simar7 simar7 requested review from itaysk and danielpacak October 12, 2021 23:59
@simar7 simar7 self-assigned this Oct 12, 2021
@itaysk
Copy link
Collaborator
itaysk commented Oct 13, 2021

Just noting that this doesn't address the linked issue.

@simar7
Copy link
Member Author
simar7 commented Oct 13, 2021

Just noting that this doesn't address the linked issue.

Could you explain why? Or what's missing from what's expected?

@itaysk
Copy link
Collaborator
itaysk commented Oct 13, 2021

the issue is about Tracee tracing just the events that the rules needed. this PR doesn't implement the requested feature, does it?

@simar7
feat: Add list-events flag for listing events
b5055b8 
Signed-off-by: Simar <simar@linux.com>
@simar7
feat: Use only relevant events to trace
e3a7171 
Signed-off-by: Simar <simar@linux.com>
@simar7
Copy link
Member Author
simar7 commented Oct 13, 2021

the issue is about Tracee tracing just the events that the rules needed. this PR doesn't implement the requested feature, does it?

I believe this was what you were thinking that was missing: e3a7171

This commit runs tracee-rules to gather the required events and then passes that output to tracee-ebpf to only trace relevant events.

@simar7 simar7 merged commit 7a46f53 into aquasecurity:main Oct 13, 2021
@itaysk itaysk mentioned this pull request Oct 13, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@itaysk itaysk itaysk approved these changes

@danielpacak danielpacak Awaiting requested review from danielpacak

Assignees

@simar7 simar7

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@simar7 @itaysk
0