tracee
tracee copied to clipboard
[EPIC] Tracee-eBPF Filter configuration API
Prerequisites
- [x] This issue is an EPIC issue (add label: EPIC).
Select one OR another:
- [x] I'll create a PR to implement this feature (assign to yourself).
Feature description
The API should allow configuration of filters, with parity to the filter capabilities of the CLI. It should be integrated into the API interface that tracee-ebpf exposes as described in #1725
The API should allow adding new filters, updating existing filters and deleting filters. Filters should be reconciled after a request, and a response should indicate any filter changes due to reconciliation.
#1727: In order to enable the logic for filter conflict resolving, an internal Filter API should be implemented.
#1830: To enable sending per event context filters.
Additional Information (feature drawings, files, logs, etc)