Documentation
¶
Overview ¶
Package config holds config related files
Package config holds config related files
Index ¶
- Constants
- func ActivityDumpRemoteStorageEndpoints(endpointPrefix string, intakeTrackType logsconfig.IntakeTrackType, ...) (*logsconfig.Endpoints, error)
- func GetFamilyAddress(path string) (string, string)
- func ParseEvalEventType(eventType eval.EventType) model.EventType
- type Config
- type Policy
- type RuntimeSecurityConfig
- type StorageFormat
- type StorageRequest
- type StorageType
Constants ¶
View Source
const (
// ADMinMaxDumSize represents the minimum value for runtime_security_config.activity_dump.max_dump_size
ADMinMaxDumSize = 100
)
Variables ¶
This section is empty.
Functions ¶
func ActivityDumpRemoteStorageEndpoints ¶
func ActivityDumpRemoteStorageEndpoints(endpointPrefix string, intakeTrackType logsconfig.IntakeTrackType, intakeProtocol logsconfig.IntakeProtocol, intakeOrigin logsconfig.IntakeOrigin) (*logsconfig.Endpoints, error)
ActivityDumpRemoteStorageEndpoints returns the list of activity dump remote storage endpoints parsed from the agent config
func GetFamilyAddress ¶
GetFamilyAddress returns the address famility to use for system-probe <-> security-agent communication
Types ¶
type Config ¶
type Config struct {
// Probe Config
Probe *pconfig.Config
// CWS specific parameters
RuntimeSecurity *RuntimeSecurityConfig
}
Config defines a security config
type Policy ¶
type Policy struct {
Name string `mapstructure:"name"`
Files []string `mapstructure:"files"`
Tags []string `mapstructure:"tags"`
}
Policy represents a policy file in the configuration file
type RuntimeSecurityConfig ¶
type RuntimeSecurityConfig struct {
// RuntimeEnabled defines if the runtime security module should be enabled
RuntimeEnabled bool
// PoliciesDir defines the folder in which the policy files are located
PoliciesDir string
// WatchPoliciesDir activate policy dir inotify
WatchPoliciesDir bool
// PolicyMonitorEnabled enable policy monitoring
PolicyMonitorEnabled bool
// PolicyMonitorPerRuleEnabled enabled per-rule policy monitoring
PolicyMonitorPerRuleEnabled bool
// PolicyMonitorReportInternalPolicies enable internal policies monitoring
PolicyMonitorReportInternalPolicies bool
// SocketPath is the path to the socket that is used to communicate with the security agent
SocketPath string
// EventServerBurst defines the maximum burst of events that can be sent over the grpc server
EventServerBurst int
// EventServerRate defines the grpc server rate at which events can be sent
EventServerRate int
// EventServerRetention defines an event retention period so that some fields can be resolved
EventServerRetention time.Duration
// FIMEnabled determines whether fim rules will be loaded
FIMEnabled bool
// SelfTestEnabled defines if the self tests should be executed at startup or not
SelfTestEnabled bool
// SelfTestSendReport defines if a self test event will be emitted
SelfTestSendReport bool
// RemoteConfigurationEnabled defines whether to use remote monitoring
RemoteConfigurationEnabled bool
// LogPatterns pattern to be used by the logger for trace level
LogPatterns []string
// LogTags tags to be used by the logger for trace level
LogTags []string
// HostServiceName string
HostServiceName string
// InternalMonitoringEnabled determines if the monitoring events of the agent should be sent to Datadog
InternalMonitoringEnabled bool
// ActivityDumpEnabled defines if the activity dump manager should be enabled
ActivityDumpEnabled bool
// ActivityDumpCleanupPeriod defines the period at which the activity dump manager should perform its cleanup
// operation.
ActivityDumpCleanupPeriod time.Duration
// ActivityDumpTagsResolutionPeriod defines the period at which the activity dump manager should try to resolve
// missing container tags.
ActivityDumpTagsResolutionPeriod time.Duration
// ActivityDumpLoadControlPeriod defines the period at which the activity dump manager should trigger the load controller
ActivityDumpLoadControlPeriod time.Duration
// ActivityDumpLoadControlMinDumpTimeout defines minimal duration of a activity dump recording
ActivityDumpLoadControlMinDumpTimeout time.Duration
// ActivityDumpTracedCgroupsCount defines the maximum count of cgroups that should be monitored concurrently. Leave this parameter to 0 to prevent the generation
// of activity dumps based on cgroups.
ActivityDumpTracedCgroupsCount int
// ActivityDumpTracedEventTypes defines the list of events that should be captured in an activity dump. Leave this
// parameter empty to monitor all event types. If not already present, the `exec` event will automatically be added
// to this list.
ActivityDumpTracedEventTypes []model.EventType
// ActivityDumpCgroupDumpTimeout defines the cgroup activity dumps timeout.
ActivityDumpCgroupDumpTimeout time.Duration
// ActivityDumpRateLimiter defines the kernel rate of max events per sec for activity dumps.
ActivityDumpRateLimiter int
// ActivityDumpCgroupWaitListTimeout defines the time to wait before a cgroup can be dumped again.
ActivityDumpCgroupWaitListTimeout time.Duration
// ActivityDumpCgroupDifferentiateArgs defines if system-probe should differentiate process nodes using process
// arguments for dumps.
ActivityDumpCgroupDifferentiateArgs bool
// ActivityDumpLocalStorageDirectory defines the output directory for the activity dumps and graphs. Leave
// this field empty to prevent writing any output to disk.
ActivityDumpLocalStorageDirectory string
// ActivityDumpLocalStorageFormats defines the formats that should be used to persist the activity dumps locally.
ActivityDumpLocalStorageFormats []StorageFormat
// ActivityDumpLocalStorageCompression defines if the local storage should compress the persisted data.
ActivityDumpLocalStorageCompression bool
// ActivityDumpLocalStorageMaxDumpsCount defines the maximum count of activity dumps that should be kept locally.
// When the limit is reached, the oldest dumps will be deleted first.
ActivityDumpLocalStorageMaxDumpsCount int
// ActivityDumpSyscallMonitorPeriod defines the minimum amount of time to wait between 2 syscalls event for the same
// process.
ActivityDumpSyscallMonitorPeriod time.Duration
// ActivityDumpMaxDumpCountPerWorkload defines the maximum amount of dumps that the agent should send for a workload
ActivityDumpMaxDumpCountPerWorkload int
// ActivityDumpWorkloadDenyList defines the list of workloads for which we shouldn't generate dumps. Workloads should
// be provided as strings in the following format "{image_name}:[{image_tag}|*]". If "*" is provided instead of a
// specific image tag, then the entry will match any workload with the input {image_name} regardless of their tag.
ActivityDumpWorkloadDenyList []string
// ActivityDumpTagRulesEnabled enable the tagging of nodes with matched rules (only for rules having the tag ruleset:threat_score)
ActivityDumpTagRulesEnabled bool
// ActivityDumpSilentWorkloadsDelay defines the minimum amount of time to wait before the activity dump manager will start tracing silent workloads
ActivityDumpSilentWorkloadsDelay time.Duration
// ActivityDumpSilentWorkloadsTicker configures ticker that will check if a workload is silent and should be traced
ActivityDumpSilentWorkloadsTicker time.Duration
// ActivityDumpAutoSuppressionEnabled bool do not send event if part of a dump
ActivityDumpAutoSuppressionEnabled bool
// # Dynamic configuration fields:
// ActivityDumpMaxDumpSize defines the maximum size of a dump
ActivityDumpMaxDumpSize func() int
// SecurityProfileEnabled defines if the Security Profile manager should be enabled
SecurityProfileEnabled bool
// SecurityProfileMaxImageTags defines the maximum number of profile versions to maintain
SecurityProfileMaxImageTags int
// SecurityProfileDir defines the directory in which Security Profiles are stored
SecurityProfileDir string
// SecurityProfileWatchDir defines if the Security Profiles directory should be monitored
SecurityProfileWatchDir bool
// SecurityProfileCacheSize defines the count of Security Profiles held in cache
SecurityProfileCacheSize int
// SecurityProfileMaxCount defines the maximum number of Security Profiles that may be evaluated concurrently
SecurityProfileMaxCount int
// SecurityProfileRCEnabled defines if remote-configuration is enabled
SecurityProfileRCEnabled bool
// SecurityProfileDNSMatchMaxDepth defines the max depth of subdomain to be matched for DNS anomaly detection (0 to match everything)
SecurityProfileDNSMatchMaxDepth int
// SecurityProfileAutoSuppressionEnabled do not send event if part of a profile
SecurityProfileAutoSuppressionEnabled bool
// SecurityProfileAutoSuppressionEventTypes defines the list of event types the can be auto suppressed using security profiles
SecurityProfileAutoSuppressionEventTypes []model.EventType
// AnomalyDetectionEventTypes defines the list of events that should be allowed to generate anomaly detections
AnomalyDetectionEventTypes []model.EventType
// AnomalyDetectionDefaultMinimumStablePeriod defines the default minimum amount of time during which the events
// that diverge from their profiles are automatically added in their profiles without triggering an anomaly detection
// event.
AnomalyDetectionDefaultMinimumStablePeriod time.Duration
// AnomalyDetectionMinimumStablePeriods defines the minimum amount of time per event type during which the events
// that diverge from their profiles are automatically added in their profiles without triggering an anomaly detection
// event.
AnomalyDetectionMinimumStablePeriods map[model.EventType]time.Duration
// AnomalyDetectionUnstableProfileTimeThreshold defines the maximum amount of time to wait until a profile that
// hasn't reached a stable state is considered as unstable.
AnomalyDetectionUnstableProfileTimeThreshold time.Duration
// AnomalyDetectionUnstableProfileSizeThreshold defines the maximum size a profile can reach past which it is
// considered unstable
AnomalyDetectionUnstableProfileSizeThreshold int64
// AnomalyDetectionWorkloadWarmupPeriod defines the duration we ignore the anomaly detections for
// because of workload warm up
AnomalyDetectionWorkloadWarmupPeriod time.Duration
// AnomalyDetectionRateLimiterPeriod is the duration during which a limited number of anomaly detection events are allowed
AnomalyDetectionRateLimiterPeriod time.Duration
// AnomalyDetectionRateLimiterNumEventsAllowed is the number of anomaly detection events allowed per duration by the rate limiter
AnomalyDetectionRateLimiterNumEventsAllowed int
// AnomalyDetectionRateLimiterNumKeys is the number of keys in the rate limiter
AnomalyDetectionRateLimiterNumKeys int
// AnomalyDetectionTagRulesEnabled defines if the events that triggered anomaly detections should be tagged with the
// rules they might have matched.
AnomalyDetectionTagRulesEnabled bool
// AnomalyDetectionSilentRuleEventsEnabled do not send rule event if also part of an anomaly event
AnomalyDetectionSilentRuleEventsEnabled bool
// AnomalyDetectionEnabled defines if we should send anomaly detection events
AnomalyDetectionEnabled bool
// SBOMResolverEnabled defines if the SBOM resolver should be enabled
SBOMResolverEnabled bool
// SBOMResolverWorkloadsCacheSize defines the count of SBOMs to keep in memory in order to prevent re-computing
// the SBOMs of short-lived and periodical workloads
SBOMResolverWorkloadsCacheSize int
// HashResolverEnabled defines if the hash resolver should be enabled
HashResolverEnabled bool
// HashResolverMaxFileSize defines the maximum size of the files that the hash resolver is allowed to hash
HashResolverMaxFileSize int64
// HashResolverMaxHashRate defines the rate at which the hash resolver may compute hashes
HashResolverMaxHashRate int
// HashResolverMaxHashBurst defines the burst of files for which the hash resolver may compute a hash
HashResolverMaxHashBurst int
// HashResolverHashAlgorithms defines the hashes that hash resolver needs to compute
HashResolverHashAlgorithms []model.HashAlgorithm
// HashResolverEventTypes defines the list of event which files may be hashed
HashResolverEventTypes []model.EventType
// HashResolverCacheSize defines the number of hashes to keep in cache
HashResolverCacheSize int
// HashResolverReplace is used to apply specific hash to specific file path
HashResolverReplace map[string]string
// UserSessionsCacheSize defines the size of the User Sessions cache size
UserSessionsCacheSize int
// EBPFLessEnabled enables the ebpfless probe
EBPFLessEnabled bool
// EBPFLessSocket defines the socket used for the communication between system-probe and the ebpfless source
EBPFLessSocket string
// Enforcement capabilities
EnforcementEnabled bool
}
RuntimeSecurityConfig holds the configuration for the runtime security agent
func NewRuntimeSecurityConfig ¶
func NewRuntimeSecurityConfig() (*RuntimeSecurityConfig, error)
NewRuntimeSecurityConfig returns the runtime security (CWS) config, build from the system probe one
func (*RuntimeSecurityConfig) GetAnomalyDetectionMinimumStablePeriod ¶
func (c *RuntimeSecurityConfig) GetAnomalyDetectionMinimumStablePeriod(eventType model.EventType) time.Duration
GetAnomalyDetectionMinimumStablePeriod returns the minimum stable period for a given event type
func (*RuntimeSecurityConfig) IsRuntimeEnabled ¶
func (c *RuntimeSecurityConfig) IsRuntimeEnabled() bool
IsRuntimeEnabled returns true if any feature is enabled. Has to be applied in config package too
type StorageFormat ¶
type StorageFormat int
StorageFormat is used to define the format of a dump
const ( // JSON is used to request the JSON format JSON StorageFormat = iota // json // Protobuf is used to request the protobuf format Protobuf // protobuf // Dot is used to request the dot format Dot // dot // Profile is used to request the generation of a profile Profile // profile )
func AllStorageFormats ¶
func AllStorageFormats() []StorageFormat
AllStorageFormats returns the list of supported formats
func ParseStorageFormat ¶
func ParseStorageFormat(input string) (StorageFormat, error)
ParseStorageFormat returns a storage format from a string input
func ParseStorageFormats ¶
func ParseStorageFormats(input []string) ([]StorageFormat, error)
ParseStorageFormats returns a list of storage formats from a list of strings
func (StorageFormat) String ¶
func (i StorageFormat) String() string
type StorageRequest ¶
type StorageRequest struct {
Type StorageType
Format StorageFormat
Compression bool
// LocalStorage specific parameters
OutputDirectory string
}
StorageRequest is used to request a type of storage for a dump
func NewStorageRequest ¶
func NewStorageRequest(storageType StorageType, format StorageFormat, compression bool, outputDirectory string) StorageRequest
NewStorageRequest returns a new StorageRequest instance
func ParseStorageRequests ¶
func ParseStorageRequests(requests *api.StorageRequestParams) ([]StorageRequest, error)
ParseStorageRequests parses storage requests from a gRPC call
func (*StorageRequest) GetOutputPath ¶
func (sr *StorageRequest) GetOutputPath(filename string) string
GetOutputPath returns the output path to the file in the storage
func (*StorageRequest) ToStorageRequestMessage ¶
func (sr *StorageRequest) ToStorageRequestMessage(filename string) *api.StorageRequestMessage
ToStorageRequestMessage returns an api.StorageRequestMessage from the StorageRequest
type StorageType ¶
type StorageType int
StorageType is used to define the type of storage
const ( // LocalStorage is used to request a local storage LocalStorage StorageType = iota // local_storage // RemoteStorage is used to request a remote storage RemoteStorage // remote_storage )
func AllStorageTypes ¶
func AllStorageTypes() []StorageType
AllStorageTypes returns the list of supported storage types
func ParseStorageType ¶
func ParseStorageType(input string) (StorageType, error)
ParseStorageType returns a storage type from its string representation
func (StorageType) String ¶
func (i StorageType) String() string
Source Files
Click to show internal directories.
Click to hide internal directories.