feature: add signature name to event definition

[josedonizetti]

Close: #3741

[josedonizetti]

@denisgersh Below an example of threat on the event when streaming, and one in the event definition:

Event:

{"timestamp":{"seconds":1702039071373397805},"id":6018,"name":"anti_debugging","policies":{"matched":["test"]},"context":{"process":{"entity_id":{"value":1760601237},"pid":{"value":3450284},"namespaced_pid":{"value":3450284},"real_user":{"id":{"value":1000}},"thread":{"start":{"seconds":1702039071373301549},"name":"strace","entity_id":{"value":1760601237},"tid":{"value":3450284},"namespaced_tid":{"value":3450284},"syscall":"ptrace"},"parent":{"entity_id":{"value":1531890111},"pid":{"value":3450282},"namespaced_pid":{"value":3450282}}}},"event_data":{"triggeredBy":{"Value":{"TriggeredBy":{"id":101,"name":"ptrace","data":{"args":{"Value":{"Args":{"value":[{"Value":{"Str":{"value":"PTRACE_TRACEME"}}},{"Value":{"Int32":{}}},{"Value":{"Str":{"value":"0x0"}}},{"Value":{"Str":{"value":"0x0"}}}]}}},"returnValue":{"Value":{"Int64":{}}}}}}}},"threat":{"description":"A process used anti-debugging techniques to block a debugger. Malware use anti-debugging to stay invisible and inhibit analysis of their behavior.","mitre":{"tactic":{"name":"defense-evasion"},"technique":{"id":"T1622","name":"Debugger Evasion"}},"severity":1,"properties":{"Kubernetes_Technique":"","id":"attack-pattern--e4dc8c01-417f-458d-9ee0-bb0617c1b391","signatureID":"TRC-102","signatureName":"Anti-Debugging detected","test1":"test1","test2":"2"}}}

EventDefinition:

{"id":6018,"name":"anti_debugging","version":{"major":1,"patch":1},"description":"A process used anti-debugging techniques to block a debugger. Malware use anti-debugging to stay invisible and inhibit analysis of their behavior.","tags":["signatures","default"],"threat":{"description":"A process used anti-debugging techniques to block a debugger. Malware use anti-debugging to stay invisible and inhibit analysis of their behavior.","mitre":{"tactic":{"name":"defense-evasion"},"technique":{"id":"T1622","name":"Debugger Evasion"}},"severity":1,"properties":{"Kubernetes_Technique":"","id":"attack-pattern--e4dc8c01-417f-458d-9ee0-bb0617c1b391","signatureID":"TRC-102","signatureName":"Anti-Debugging detected","test1":"test1","test2":"2"}}}

[denisgersh]

@josedonizetti,

@denisgersh Below an example of threat on the event when streaming, and one in the event definition:

Event:

{"timestamp":{"seconds":1702039071373397805},"id":6018,"name":"anti_debugging","policies":{"matched":["test"]},"context":{"process":{"entity_id":{"value":1760601237},"pid":{"value":3450284},"namespaced_pid":{"value":3450284},"real_user":{"id":{"value":1000}},"thread":{"start":{"seconds":1702039071373301549},"name":"strace","entity_id":{"value":1760601237},"tid":{"value":3450284},"namespaced_tid":{"value":3450284},"syscall":"ptrace"},"parent":{"entity_id":{"value":1531890111},"pid":{"value":3450282},"namespaced_pid":{"value":3450282}}}},"event_data":{"triggeredBy":{"Value":{"TriggeredBy":{"id":101,"name":"ptrace","data":{"args":{"Value":{"Args":{"value":[{"Value":{"Str":{"value":"PTRACE_TRACEME"}}},{"Value":{"Int32":{}}},{"Value":{"Str":{"value":"0x0"}}},{"Value":{"Str":{"value":"0x0"}}}]}}},"returnValue":{"Value":{"Int64":{}}}}}}}},"threat":{"description":"A process used anti-debugging techniques to block a debugger. Malware use anti-debugging to stay invisible and inhibit analysis of their behavior.","mitre":{"tactic":{"name":"defense-evasion"},"technique":{"id":"T1622","name":"Debugger Evasion"}},"severity":1,"properties":{"Kubernetes_Technique":"","id":"attack-pattern--e4dc8c01-417f-458d-9ee0-bb0617c1b391","signatureID":"TRC-102","signatureName":"Anti-Debugging detected","test1":"test1","test2":"2"}}}

EventDefinition:

{"id":6018,"name":"anti_debugging","version":{"major":1,"patch":1},"description":"A process used anti-debugging techniques to block a debugger. Malware use anti-debugging to stay invisible and inhibit analysis of their behavior.","tags":["signatures","default"],"threat":{"description":"A process used anti-debugging techniques to block a debugger. Malware use anti-debugging to stay invisible and inhibit analysis of their behavior.","mitre":{"tactic":{"name":"defense-evasion"},"technique":{"id":"T1622","name":"Debugger Evasion"}},"severity":1,"properties":{"Kubernetes_Technique":"","id":"attack-pattern--e4dc8c01-417f-458d-9ee0-bb0617c1b391","signatureID":"TRC-102","signatureName":"Anti-Debugging detected","test1":"test1","test2":"2"}}}

I see here in EventDefinition example that you posted that there is a duplication of the description field & its' value.
I think there is no need to duplicate it. It just increases the size of the message.
I suggest to leave it only in the Threat section.

For the id field in properties I suggest to rename it to attackID as you did with signatureID. WDYT?

BTW, the tags field contains what? Policy names or hardcoded tags or the actual tags from the signature?
Because as I see in tracee/types/detect/detect.go the SignatureMetadata struct contains tags: https://github.com/josedonizetti/tracee/blob/f949b0fff6a72617cbb30c5233ce730d8de65db6/types/detect/detect.go#L39
Looks like it currently hardcoded and not being filled with signatures' tags: https://github.com/josedonizetti/tracee/blob/f949b0fff6a72617cbb30c5233ce730d8de65db6/pkg/cmd/initialize/sigs.go#L64

[denisgersh]

Left a few suggestions/requests.

[josedonizetti]

@NDStrahilevitz @denisgersh can you review? And if you agree, I need an approve on #3742 so I can merge it and rebase this one. Thanks

[NDStrahilevitz]

LGTM

[NDStrahilevitz]

I'm approving types for merging, since I think we're fine on that front, anything missing implementation wise would be here.

[NDStrahilevitz]

@josedonizetti rebase and we can merge

[NDStrahilevitz]

nit: pretty sure you can do
set.New[string]("signatures", "default", m.Tags...)

[josedonizetti]

I'll try again, but it complained about arguments string,string,[]string

[NDStrahilevitz]

You're right jsut checked myself. odd that golang wouldn't support it, it's rather intuitive...