Create your own GitHub profile
Sign up for your own profile on GitHub, the best place to host code, manage projects, and build software alongside 50 million developers.
Sign up
Pinned
604 contributions in the last year
Activity overview
Contributed to
aquasecurity/tracee,
itaysk/kubectl-neat,
aquasecurity/kube-hunter
and 5 other
repositories
Contribution activity
July 2020
Created a pull request in aquasecurity/tracee that received 1 comment
process event hook, raw_syscall show name, capture executed files
This PR has 3 commits that build on one another: add a hook in the processevents loop that allows to further transform and enrich events. this is …
+149
−2
•
1
comment
- validate capture options
- don't capture same exec twice
- fix test for ptrace printing
- fix file capture when dependent event is missing
- allow granular selection of capture-files
- fix lost event counter
- fix raw_syscall printing if syscall is not known to tracee
- print errors to a dedicated file
- capture executed files
- add hook to process events and use it to show syscall name for raw_syscalls
- refactor stats collection and printing
- decouple intenal and external types
- add output gob output format
- Use alert struct and save alert payload using timestamp
- Don't print syscall twice
- Add security alerts
- Fix "memory leaks" in bin_args_map and args_map
- Fix write error when buffer and chunk are equal in size
- fix ptrace flags print
- Print raw syscalls names and simplify code
- Add event configuration map
- fix map update issue with old kernels
- Change save_args key to be unique
- Add tail call event handler
- Use generic method to send binary data