# Packages
No description provided by the author
No description provided by the author
# Functions
AllCustomRuleIDs returns the list of custom rule IDs.
ExtractEventInfo extracts cpu and timestamp from the raw data event.
GetCapababilities returns all the filtering capabilities.
NewAbnormalPathEvent returns the rule and a populated custom event for a abnormal_path event.
NewArgsEnvsPool returns a new ArgsEnvEntry pool.
NewERPC returns a new ERPC object.
NewEvent returns a new event.
NewEventLostReadEvent returns the rule and a populated custom event for a lost_events_read event.
NewEventLostWriteEvent returns the rule and a populated custom event for a lost_events_write event.
NewEventSerializer creates a new event serializer based on the event type.
NewLoadController instantiates a new load controller.
NewMonitor returns a new instance of a ProbeMonitor.
NewMountResolver instantiates a new mount resolver.
NewNoisyProcessEvent returns the rule and a populated custom event for a noisy_process event.
NewPerfBufferMonitor instantiates a new event statistics counter.
NewProbe instantiates a new runtime security agent probe.
NewProcessCacheEntryPool returns a new ProcessCacheEntryPool pool.
NewProcessResolver returns a new process resolver.
NewProcessResolverOpts returns a new set of process resolver options.
NewReOrderer returns a new ReOrderer.
NewReOrderMonitor instantiates a new reorder statistics counter.
NewReport returns a new report.
NewReporter instantiates a new reporter.
NewResolvers creates a new instance of Resolvers.
NewRuleSetApplier returns a new RuleSetApplier.
NewRuleSetLoadedEvent returns the rule and a populated custom event for a new_rules_loaded event.
NewTagsResolver returns a new tags resolver.
NewTimeResolver returns a new time resolver.
NewUserGroupResolver instantiates a new user and group resolver.
TTYConstants returns the tty constants.
# Constants
AbnormalPathRuleID is the rule ID for the abnormal_path events.
need to be aligned with the kernel size.
DiscardInodeOp discards an inode.
DiscardPidOp discards a pid.
DiscardRetention time a discard is retained but not discarding.
ERPCMaxDataSize maximum size of data of a request.
Event categories for JSON serialization.
Event categories for JSON serialization.
LostEventsRuleID is the rule ID for the lost_events_* events.
NoisyProcessRuleID is the rule ID for the noisy_process events.
Policy flags.
Policy flags.
Policy flags.
Policy modes.
Policy modes.
Policy modes.
Event categories for JSON serialization.
nolint:deadcode,unused.
ResolveParentOp resolves the parent of the provide path key.
ResolvePathOp resolves the requested path.
ResolveSegmentOp resolves the requested segment.
RulesetLoadedRuleID is the rule ID for the ruleset_loaded events.
SELinuxStatusDisableKey represents the key in the kernel map managing the current SELinux disable status.
SELinuxStatusEnforceKey represents the key in the kernel map managing the current SELinux enforce status.
ServiceEnvVar environment variable used to report service.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
Linux syscall identifiers.
# Variables
DiscarderConstants ebpf constants.
ErrMountNotFound is used when an unknown mount identifier is found.
InvalidDiscarders exposes list of values that are not discarders.
SupportedDiscarders lists all field which supports discarders.
# Structs
AbnormalPathEvent is used to report that a path resolution failed for a suspicious reason easyjson:json.
ArgsEnvsPool defines a pool for args/envs allocations.
Capability represents the type of values we are able to filter kernel side.
CapsetSerializer serializes a capset event easyjson:json.
ContainerContextSerializer serializes a container context to JSON easyjson:json.
ContainerResolver is used to resolve the container context of the events.
CredentialsSerializer serializes a set credentials to JSON easyjson:json.
CustomEvent is used to send custom security events to Datadog.
DDContextSerializer serializes a span context to JSON easyjson:json.
Discarder represents a discarder which is basically the field that we know for sure that the value will be always rejected by the rules.
ERPC defines a krpc object.
ERPCRequest defines a EPRC request.
ErrDiscarderNotSupported is returned when trying to discover a discarder on a field that doesn't support them.
Event describes a probe event.
EventContextSerializer serializes an event context to JSON easyjson:json.
EventLostRead is the event used to report lost events detected from user space easyjson:json.
EventLostWrite is the event used to report lost events detected from kernel space easyjson:json.
EventSerializer serializes an event to JSON easyjson:json.
FileEventSerializer serializes a file event to JSON easyjson:json.
FileSerializer serializes a file to JSON easyjson:json.
FilterPolicy describes a filtering policy.
LoadController is used to monitor and control the pressure put on the host.
Model describes the data model for the runtime security agent probe events.
Monitor regroups all the work we want to do to monitor the probes we pushed in the kernel.
MountResolver represents a cache for mountpoints and the corresponding file systems.
NoisyProcessEvent is used to report that a noisy process was temporarily discarded easyjson:json.
PerfBufferMonitor holds statistics about the number of lost and received eventsnolint:structcheck,unused.
PerfMapStats contains the collected metrics for one event and one cpu in a perf buffer statistics map.
PoliciesIgnored holds the errors.
PolicyLoaded is used to report policy was loaded easyjson:json.
PolicyReport describes the result of the kernel policy and the approvers for an event type.
Probe represents the runtime security eBPF probe in charge of setting up the required kProbes and decoding events sent from the kernel.
ProcessCacheEntryPool defines a pool for process entry allocations.
ProcessCacheEntrySerializer serializes a process cache entry to JSON easyjson:json jsonschema_description:"".
ProcessContextSerializer serializes a process context to JSON easyjson:json.
ProcessCredentialsSerializer serializes the process credentials to JSON easyjson:json.
ProcessResolver resolved process context.
ProcessResolverOpts options of resolver.
ReOrderer defines an event re-orderer.
ReOrdererMetric holds reordering metrics.
ReordererMonitor represents a reorderer monitor.
ReOrdererOpts options to pass when creating a new instance of ReOrderer.
Report describes the event types and their associated policy reports.
Reporter describes a reporter of policy application.
Resolvers holds the list of the event attribute resolvers.
RuleIgnored defines a ignored easyjson:json.
RuleLoaded defines a loaded rule easyjson:json.
RuleSetApplier defines a rule set applier.
RulesetLoadedEvent is used to report that a new ruleset was loaded easyjson:json.
RuleSetLoadedReport represents the rule and the custom event related to a RuleSetLoaded event, ready to be dispatched.
SELinuxEventSerializer serializes a SELinux context to JSON easyjson:json.
SetgidSerializer serializes a setgid event easyjson:json.
SetuidSerializer serializes a setuid event easyjson:json.
TagsResolver represents a cache resolver.
TimeResolver converts kernel monotonic timestamps to absolute times.
UserContextSerializer serializes a user context to JSON easyjson:json.
UserGroupResolver resolves user and group ids to names.
# Interfaces
EventHandler represents an handler for the events sent by the probe.
Tagger defines a Tagger for the Tags Resolver.
# Type aliases
Capabilities represents the filtering capabilities for a set of fields.
JStringArray handles empty array properly not generating null output but [].
PolicyFlag is a bitmask of the active filtering policies.
PolicyMode represents the policy mode (accept or deny).
Syscall represents a syscall identifier.