Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add_process_metadata - report linux capabilities #36403

Closed
andrewkroh opened this issue Aug 23, 2023 · 2 comments
Closed

add_process_metadata - report linux capabilities #36403

andrewkroh opened this issue Aug 23, 2023 · 2 comments
Labels
enhancement :Processors Team:Security-Linux Platform Linux Platform Team in Security Solution

Comments

@andrewkroh
Copy link
Member

andrewkroh commented Aug 23, 2023 •
edited
Loading

Describe the enhancement:

The add_process_metadata processor should be able to report the Linux capabilities associated with a process. ECS has these two new fields in 8.10.0.

The data would be read from /proc/<pid>/status. go-sysinfo supports fetching this data (source), but the returned strings are not in the exact format expected by ECS.

Describe a specific use case for the enhancement or feature:

A user might want to enrich auditd execve events with Linux capability info.
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Aug 23, 2023
@andrewkroh andrewkroh added the Team:Security-Linux Platform Linux Platform Team in Security Solution label Aug 23, 2023
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Aug 23, 2023
@norrietaylor
Copy link
Member

elastic/go-sysinfo#196

@andrewkroh
Copy link
Member Author

I think this has been implemented in #38252. Closing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement :Processors Team:Security-Linux Platform Linux Platform Team in Security Solution
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@andrewkroh @norrietaylor