-
Notifications
You must be signed in to change notification settings - Fork 0
/
canonicalize.go
188 lines (175 loc) · 4.28 KB
/
canonicalize.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
/*
* Copyright 2022 by Mel2oo <https://github.com/saferun/owl>
*
* Licensed under the GNU General Public License version 3 (GPLv3)
*
* If you distribute GPL-licensed software the license requires
* that you also distribute the complete, corresponding source
* code (as defined by GPL) to that GPL-licensed software.
*
* You should have received a copy of the GNU General Public License
* with this program. If not, see <https://www.gnu.org/licenses/>
*/
package event
const (
uniqueProcessKey = "UniqueProcessKey"
processID = "ProcessId"
parentID = "ParentId"
sessionID = "SessionId"
exitStatus = "ExitStatus"
dirTableBase = "DirectoryTableBase"
userSID = "UserSID"
imageFileName = "ImageFileName"
commandLine = "CommandLine"
tthreadID = "TThreadId"
issuingThreadID = "IssuingThreadId"
ttid = "TTID"
pid = "PID"
basePriority = "BasePriority"
ioPriority = "IoPriority"
pagePriority = "PagePriority"
stackBase = "StackBase"
stackLimit = "StackLimit"
userStackBase = "UserStackBase"
userStackLimit = "UserStackLimit"
win32StartAddr = "Win32StartAddr"
fileObject = "FileObject"
fileName = "FileName"
openPath = "OpenPath"
fileCreateOptions = "CreateOptions"
fileShareAccess = "ShareAccess"
fileOffset = "Offset"
fileIoSize = "IoSize"
fileInfoClass = "InfoClass"
fileKey = "FileKey"
fileExtraInfo = "ExtraInfo"
fileIrpPtr = "IrpPtr"
keyName = "KeyName"
keyHandle = "KeyHandle"
registryStatus = "Status"
ntStatus = "NtStatus"
imageBase = "ImageBase"
imageSize = "ImageSize"
imageChecksum = "ImageCheckSum"
imageDefaultBase = "DefaultBase"
netDaddr = "daddr"
netSaddr = "saddr"
netDport = "dport"
netSport = "sport"
netSize = "size"
handleID = "Handle"
handleObject = "Object"
handleObjectName = "ObjectName"
handleObjectType = "ObjectType"
)
var ignore = map[string]bool{
"Reserved0": true,
"Reserved1": true,
"Reserved2": true,
"Reserved3": true,
"Reserved4": true,
"ThreadFlags": true,
"ApplicationId": true,
"PackageFullName": true,
"IoFlags": true,
}
// Ignored returns the collection of parameters that are ignored by kernel stream consumer.
func Ignored(name string) bool {
return ignore[name]
}
// Canonicalize takes an original kernel event property name and normalizes it
// to canonical parameter name.
func Canonicalize(name string) string {
switch name {
case tthreadID, issuingThreadID, ttid:
return ThreadID
case processID, pid:
return ProcessID
case uniqueProcessKey:
return ProcessObject
case parentID:
return ProcessParentID
case sessionID:
return SessionID
case imageFileName:
return ProcessName
case commandLine:
return Comm
case userSID:
return UserSID
case exitStatus:
return ExitStatus
case dirTableBase:
return DTB
case basePriority:
return BasePrio
case ioPriority:
return IOPrio
case pagePriority:
return PagePrio
case stackBase:
return KstackBase
case stackLimit:
return KstackLimit
case userStackBase:
return UstackBase
case userStackLimit:
return UstackLimit
case win32StartAddr:
return ThreadEntrypoint
case fileObject:
return FileObject
case fileName, openPath:
return FileName
case fileCreateOptions:
return FileCreateOptions
case fileShareAccess:
return FileShareMask
case fileOffset:
return FileOffset
case fileIoSize:
return FileIoSize
case fileInfoClass:
return FileInfoClass
case fileKey:
return FileKey
case fileExtraInfo:
return FileExtraInfo
case fileIrpPtr:
return FileIrpPtr
case keyName:
return RegKeyName
case keyHandle:
return RegKeyHandle
case imageBase:
return ImageBase
case imageDefaultBase:
return ImageDefaultBase
case imageSize:
return ImageSize
case imageChecksum:
return ImageCheckSum
case netDaddr:
return NetDIP
case netSaddr:
return NetSIP
case netDport:
return NetDport
case netSport:
return NetSport
case netSize:
return NetSize
case handleID:
return HandleID
case handleObject:
return HandleObject
case handleObjectName:
return HandleObjectName
case handleObjectType:
return HandleObjectTypeID
case registryStatus, ntStatus:
return NTStatus
default:
return ""
}
}