search

SUSE / linux-security-sensor

Linux security sensor
Other
18 stars 9 forks source link

Add artifact to collect new hidden files #91

Closed djoreilly closed 5 months ago

djoreilly commented 7 months ago

This is a monitoring artifact that collects new hidden files or directories in a list of monitoring locations that can be specified with a parameter.

If the OS and filesystem support statx, then files older than the max_age parameter are filtered out to ensure only new files are reported.

The hashes reported could be out-dated as more writes could have happened after the event.

djoreilly commented 5 months ago

I was able to rework this to use Paths[1].nametype = "CREATE" to ensure that we only get newly created files/directories. Now there is no need for statx for birthtime.