tracee icon indicating copy to clipboard operation
tracee copied to clipboard

[EPIC] Tracee-eBPF Filter configuration API

Open NDStrahilevitz opened this issue 3 years ago • 0 comments

Prerequisites

  • [x] This issue is an EPIC issue (add label: EPIC).

Select one OR another:

  • [x] I'll create a PR to implement this feature (assign to yourself).

Feature description

The API should allow configuration of filters, with parity to the filter capabilities of the CLI. It should be integrated into the API interface that tracee-ebpf exposes as described in #1725

The API should allow adding new filters, updating existing filters and deleting filters. Filters should be reconciled after a request, and a response should indicate any filter changes due to reconciliation.

#1727: In order to enable the logic for filter conflict resolving, an internal Filter API should be implemented. #1830: To enable sending per event context filters.

Additional Information (feature drawings, files, logs, etc)

image

NDStrahilevitz avatar May 03 '22 13:05 NDStrahilevitz