jasondellaluce
commented
2 years ago Hi @Snailll, this is not supported yet but is in high demand in the community. This will be on the project roadmap, but I think no progress has been made so far.
Closed Snailll closed 1 year ago
jasondellaluce
commented
2 years ago Hi @Snailll, this is not supported yet but is in high demand in the community. This will be on the project roadmap, but I think no progress has been made so far.
Snailll
commented
2 years ago Hi @jasondellaluce ,thanks for your reply. How about the feasibility of writing a custom ebpf driver , a source plugin and a extractor plugin. So I can get syscall info from the ebpf driver then extend fields in the syscall events by a custom plugin?
jasondellaluce
commented
2 years ago From a feasibility perspective, you can make something like this work even right now. However, the events coming from your source plugin will only be of "plugin type" from the standpoint of libsinsp and libscap, and so existing fields (evt.type, fd.name, proc.name, ...) will not be usable in Falco rules because the libsinsp internal state is not built from those kind of events.
I hope we will able to change this in the future. An OK solution will be to let plugins generate events of any type (not just "plugin type"). Note that the event type is a very meaningful information used by both libscap and libsinsp to implement things like capture reproduction (.scap files) and the reproduction of the system's state. I hope we'll explore this direction in the near future.
On the bright side, if you plan to built a plugin on top of other non syscall-related features of eBPF, than that would make sense even now and would be a cool project/contribution to attempt! 😄
poiana
commented
1 year ago Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
poiana
commented
1 year ago Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
poiana
commented
1 year ago Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Provide feedback via https://github.com/falcosecurity/community. /close
poiana
commented
1 year ago @poiana: Closing this issue.
jasondellaluce
commented
1 year ago /remove-lifecycle rotten /reopen
poiana
commented
1 year ago @jasondellaluce: Reopened this issue.
poiana
commented
1 year ago Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
jasondellaluce
commented
1 year ago /remove-lifecycle stale
poiana
commented
1 year ago Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Andreagit97
commented
1 year ago /remove-lifecycle stale
Motivation I want to make a custom extractor plugin to extend some field in the syscall events, just like some file stats . So can I use 'syscall' source in my custom extractor plugin?
Feature
Alternatives
Additional context