Skip to content

Commit 270f009

Browse files
amitschendelamitschendel
authored
Feature/identifiers (#587)
* Bumping armoapi-go Signed-off-by: Amit Schendel <[email protected]> * Adding identifiers to all rules Signed-off-by: Amit Schendel <[email protected]> * Adding filepath.Base for Name field Signed-off-by: Amit Schendel <[email protected]> --------- Signed-off-by: Amit Schendel <[email protected]>
1 parent c062501 commit 270f009

24 files changed

+267
-3
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ require (
88
github.com/DmitriyVTitov/size v1.5.0
99
github.com/anchore/syft v1.18.1
1010
github.com/aquilax/truncate v1.0.0
11-
github.com/armosec/armoapi-go v0.0.596
11+
github.com/armosec/armoapi-go v0.0.605
1212
github.com/armosec/utils-k8s-go v0.0.30
1313
github.com/cenkalti/backoff v2.2.1+incompatible
1414
github.com/cenkalti/backoff/v4 v4.3.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -157,8 +157,8 @@ github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj
157157
github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
158158
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
159159
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
160-
github.com/armosec/armoapi-go v0.0.596 h1:n8xB6Y/zuzjAqqwc7zJPXxdvn6pqZK94IC6x7nvj1oI=
161-
github.com/armosec/armoapi-go v0.0.596/go.mod h1:GQQzRuP8OBvbDx7GGwOyw3TCjk5NtK3WbeyfuLoiEts=
160+
github.com/armosec/armoapi-go v0.0.605 h1:EKvb2tbK0Edno6XaC+LxRecaVCeL6oxrL4Vg6iplocc=
161+
github.com/armosec/armoapi-go v0.0.605/go.mod h1:GQQzRuP8OBvbDx7GGwOyw3TCjk5NtK3WbeyfuLoiEts=
162162
github.com/armosec/gojay v1.2.17 h1:VSkLBQzD1c2V+FMtlGFKqWXNsdNvIKygTKJI9ysY8eM=
163163
github.com/armosec/gojay v1.2.17/go.mod h1:vuvX3DlY0nbVrJ0qCklSS733AWMoQboq3cFyuQW9ybc=
164164
github.com/armosec/utils-go v0.0.58 h1:g9RnRkxZAmzTfPe2ruMo2OXSYLwVSegQSkSavOfmaIE=

‎pkg/ruleengine/v1/r0001_unexpected_process_launched.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,12 @@ package ruleengine
22

33
import (
44
"fmt"
5+
"path/filepath"
56
"slices"
67
"strings"
78

89
apitypes "github.com/armosec/armoapi-go/armotypes"
10+
"github.com/armosec/armoapi-go/armotypes/common"
911
events "github.com/kubescape/node-agent/pkg/ebpf/events"
1012
"github.com/kubescape/node-agent/pkg/objectcache"
1113
"github.com/kubescape/node-agent/pkg/ruleengine"
@@ -119,6 +121,16 @@ func (rule *R0001UnexpectedProcessLaunched) CreateRuleFailure(eventType utils.Ev
119121
"args": execEvent.Args,
120122
},
121123
Severity: R0001UnexpectedProcessLaunchedRuleDescriptor.Priority,
124+
Identifiers: &common.Identifiers{
125+
Process: &common.ProcessEntity{
126+
Name: execEvent.Comm,
127+
CommandLine: fmt.Sprintf("%s %s", execPath, strings.Join(utils.GetExecArgsFromEvent(&execEvent.Event), " ")),
128+
},
129+
File: &common.FileEntity{
130+
Name: filepath.Base(GetExecFullPathFromEvent(execEvent)),
131+
Directory: filepath.Dir(GetExecFullPathFromEvent(execEvent)),
132+
},
133+
},
122134
},
123135
RuntimeProcessDetails: apitypes.ProcessTree{
124136
ProcessTree: apitypes.Process{

‎pkg/ruleengine/v1/r0002_unexpected_file_access.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package ruleengine
22

33
import (
44
"fmt"
5+
"path/filepath"
56
"strings"
67

78
"github.com/kubescape/node-agent/pkg/ebpf/events"
@@ -12,6 +13,7 @@ import (
1213
"github.com/kubescape/node-agent/pkg/objectcache"
1314

1415
apitypes "github.com/armosec/armoapi-go/armotypes"
16+
"github.com/armosec/armoapi-go/armotypes/common"
1517
"github.com/kubescape/go-logger"
1618
"github.com/kubescape/go-logger/helpers"
1719
)
@@ -187,6 +189,15 @@ func (rule *R0002UnexpectedFileAccess) CreateRuleFailure(eventType utils.EventTy
187189
"path": openEventTyped.FullPath,
188190
},
189191
Severity: R0002UnexpectedFileAccessRuleDescriptor.Priority,
192+
Identifiers: &common.Identifiers{
193+
Process: &common.ProcessEntity{
194+
Name: openEventTyped.Comm,
195+
},
196+
File: &common.FileEntity{
197+
Name: filepath.Base(openEventTyped.FullPath),
198+
Directory: filepath.Dir(openEventTyped.FullPath),
199+
},
200+
},
190201
},
191202
RuntimeProcessDetails: apitypes.ProcessTree{
192203
ProcessTree: apitypes.Process{

‎pkg/ruleengine/v1/r0004_unexpected_capability_used.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"fmt"
55

66
apitypes "github.com/armosec/armoapi-go/armotypes"
7+
"github.com/armosec/armoapi-go/armotypes/common"
78
"github.com/goradd/maps"
89
tracercapabilitiestype "github.com/inspektor-gadget/inspektor-gadget/pkg/gadgets/trace/capabilities/types"
910
"github.com/kubescape/node-agent/pkg/objectcache"
@@ -108,6 +109,11 @@ func (rule *R0004UnexpectedCapabilityUsed) CreateRuleFailure(eventType utils.Eve
108109
},
109110
InfectedPID: capEvent.Pid,
110111
Severity: R0004UnexpectedCapabilityUsedRuleDescriptor.Priority,
112+
Identifiers: &common.Identifiers{
113+
Process: &common.ProcessEntity{
114+
Name: capEvent.Comm,
115+
},
116+
},
111117
},
112118
RuntimeProcessDetails: apitypes.ProcessTree{
113119
ProcessTree: apitypes.Process{

‎pkg/ruleengine/v1/r0005_unexpected_domain_request.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"strings"
77

88
apitypes "github.com/armosec/armoapi-go/armotypes"
9+
"github.com/armosec/armoapi-go/armotypes/common"
910
"github.com/goradd/maps"
1011
tracerdnstype "github.com/inspektor-gadget/inspektor-gadget/pkg/gadgets/trace/dns/types"
1112
"github.com/kubescape/node-agent/pkg/objectcache"
@@ -107,6 +108,11 @@ func (rule *R0005UnexpectedDomainRequest) CreateRuleFailure(eventType utils.Even
107108
domainEvent, _ := event.(*tracerdnstype.Event)
108109
rule.alertedDomains.Set(domainEvent.DNSName, true)
109110

111+
dstIP := ""
112+
if len(domainEvent.Addresses) > 0 {
113+
dstIP = domainEvent.Addresses[0]
114+
}
115+
110116
return &GenericRuleFailure{
111117
BaseRuntimeAlert: apitypes.BaseRuntimeAlert{
112118
UniqueID: HashStringToMD5(fmt.Sprintf("%s%s", domainEvent.Comm, domainEvent.DNSName)),
@@ -119,6 +125,18 @@ func (rule *R0005UnexpectedDomainRequest) CreateRuleFailure(eventType utils.Even
119125
"port": domainEvent.DstPort,
120126
},
121127
Severity: R0005UnexpectedDomainRequestRuleDescriptor.Priority,
128+
Identifiers: &common.Identifiers{
129+
Process: &common.ProcessEntity{
130+
Name: domainEvent.Comm,
131+
},
132+
Dns: &common.DnsEntity{
133+
Domain: domainEvent.DNSName,
134+
},
135+
Network: &common.NetworkEntity{
136+
DstIP: dstIP,
137+
Protocol: domainEvent.Protocol,
138+
},
139+
},
122140
},
123141
RuntimeProcessDetails: apitypes.ProcessTree{
124142
ProcessTree: apitypes.Process{

‎pkg/ruleengine/v1/r0006_unexpected_service_account_token_access.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"strings"
77

88
apitypes "github.com/armosec/armoapi-go/armotypes"
9+
"github.com/armosec/armoapi-go/armotypes/common"
910
"github.com/kubescape/node-agent/pkg/ebpf/events"
1011
"github.com/kubescape/node-agent/pkg/objectcache"
1112
"github.com/kubescape/node-agent/pkg/ruleengine"
@@ -159,6 +160,15 @@ func (rule *R0006UnexpectedServiceAccountTokenAccess) CreateRuleFailure(eventTyp
159160
},
160161
InfectedPID: openEvent.Pid,
161162
Severity: R0006UnexpectedServiceAccountTokenAccessRuleDescriptor.Priority,
163+
Identifiers: &common.Identifiers{
164+
Process: &common.ProcessEntity{
165+
Name: openEvent.Comm,
166+
},
167+
File: &common.FileEntity{
168+
Name: filepath.Base(openEvent.FullPath),
169+
Directory: filepath.Dir(openEvent.FullPath),
170+
},
171+
},
162172
},
163173
RuntimeProcessDetails: apitypes.ProcessTree{
164174
ProcessTree: apitypes.Process{

‎pkg/ruleengine/v1/r0007_kubernetes_client_executed.go‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"strings"
88

99
apitypes "github.com/armosec/armoapi-go/armotypes"
10+
"github.com/armosec/armoapi-go/armotypes/common"
1011
tracernetworktype "github.com/inspektor-gadget/inspektor-gadget/pkg/gadgets/trace/network/types"
1112
events "github.com/kubescape/node-agent/pkg/ebpf/events"
1213
"github.com/kubescape/node-agent/pkg/objectcache"
@@ -159,6 +160,16 @@ func (rule *R0007KubernetesClientExecuted) CreateRuleFailure(eventType utils.Eve
159160
"args": execEvent.Args,
160161
},
161162
Severity: R0007KubernetesClientExecutedDescriptor.Priority,
163+
Identifiers: &common.Identifiers{
164+
Process: &common.ProcessEntity{
165+
Name: execEvent.Comm,
166+
CommandLine: fmt.Sprintf("%s %s", execPath, strings.Join(utils.GetExecArgsFromEvent(&execEvent.Event), " ")),
167+
},
168+
File: &common.FileEntity{
169+
Name: filepath.Base(execPath),
170+
Directory: filepath.Dir(execPath),
171+
},
172+
},
162173
},
163174
RuntimeProcessDetails: apitypes.ProcessTree{
164175
ProcessTree: apitypes.Process{
@@ -201,6 +212,16 @@ func (rule *R0007KubernetesClientExecuted) CreateRuleFailure(eventType utils.Eve
201212
},
202213
InfectedPID: networkEvent.Pid,
203214
Severity: R0007KubernetesClientExecutedDescriptor.Priority,
215+
Identifiers: &common.Identifiers{
216+
Process: &common.ProcessEntity{
217+
Name: networkEvent.Comm,
218+
},
219+
Network: &common.NetworkEntity{
220+
DstIP: networkEvent.DstEndpoint.Addr,
221+
DstPort: int(networkEvent.Port),
222+
Protocol: networkEvent.Proto,
223+
},
224+
},
204225
},
205226
RuntimeProcessDetails: apitypes.ProcessTree{
206227
ProcessTree: apitypes.Process{

‎pkg/ruleengine/v1/r0008_read_env_variables_procfs.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,11 @@ package ruleengine
22

33
import (
44
"fmt"
5+
"path/filepath"
56
"strings"
67

78
apitypes "github.com/armosec/armoapi-go/armotypes"
9+
"github.com/armosec/armoapi-go/armotypes/common"
810
events "github.com/kubescape/node-agent/pkg/ebpf/events"
911
"github.com/kubescape/node-agent/pkg/objectcache"
1012
"github.com/kubescape/node-agent/pkg/ruleengine"
@@ -121,6 +123,15 @@ func (rule *R0008ReadEnvironmentVariablesProcFS) CreateRuleFailure(eventType uti
121123
},
122124
InfectedPID: openEvent.Pid,
123125
Severity: R0008ReadEnvironmentVariablesProcFSRuleDescriptor.Priority,
126+
Identifiers: &common.Identifiers{
127+
Process: &common.ProcessEntity{
128+
Name: openEvent.Comm,
129+
},
130+
File: &common.FileEntity{
131+
Name: filepath.Base(openEvent.FullPath),
132+
Directory: filepath.Dir(openEvent.FullPath),
133+
},
134+
},
124135
},
125136
RuntimeProcessDetails: apitypes.ProcessTree{
126137
ProcessTree: apitypes.Process{

‎pkg/ruleengine/v1/r0010_unexpected_sensitive_file_access.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package ruleengine
22

33
import (
44
"fmt"
5+
"path/filepath"
56

67
events "github.com/kubescape/node-agent/pkg/ebpf/events"
78
"github.com/kubescape/node-agent/pkg/objectcache"
@@ -10,6 +11,7 @@ import (
1011
"github.com/kubescape/storage/pkg/registry/file/dynamicpathdetector"
1112

1213
apitypes "github.com/armosec/armoapi-go/armotypes"
14+
"github.com/armosec/armoapi-go/armotypes/common"
1315
"github.com/kubescape/go-logger"
1416
"github.com/kubescape/go-logger/helpers"
1517
)
@@ -174,6 +176,15 @@ func (rule *R0010UnexpectedSensitiveFileAccess) CreateRuleFailure(eventType util
174176
},
175177
InfectedPID: openEvent.Pid,
176178
Severity: R0010UnexpectedSensitiveFileAccessRuleDescriptor.Priority,
179+
Identifiers: &common.Identifiers{
180+
Process: &common.ProcessEntity{
181+
Name: openEvent.Comm,
182+
},
183+
File: &common.FileEntity{
184+
Name: filepath.Base(openEvent.FullPath),
185+
Directory: filepath.Dir(openEvent.FullPath),
186+
},
187+
},
177188
},
178189
RuntimeProcessDetails: apitypes.ProcessTree{
179190
ProcessTree: apitypes.Process{

0 commit comments

Comments
 (0)