tracee

tracee copied to clipboard

## Prerequisites - I'll create a PR to implement this feature (assign to yourself). ## Feature description This feature is about adding rootkit hooking detection and enabling rules writing on...

AsafEitani

[RFE] kprobe security_socket_connect & security_socket_bind get local_addr 、local_port、protocol

1

## Prerequisites - [ ] There isn't an issue describing the feature I need. - [ ] I don't think opening a discussion thread first is relevant. - [ ]...

rockingl

## Prerequisites - [ ] This issue is an EPIC issue (add label: EPIC). - [ ] This issue is an EPIC TASK (add issue to EPIC description). Select one...

AlonZivony

## Prerequisites - [x] This affects latest released version. - [x] This affects current development tree (origin/HEAD). - [x] There isn't an issue describing the bug. Select one OR another:...

rafaeldtinoco

trace only relevant events for loaded signatures

5

based on the loaded signatures, get the relevant set of "event selectors" and use that to configure tracee-ebpf to trace just the relevant events for the loaded signatures related: #936...

itaysk

Drop events/rules with low priority on high load

9

When system load is high, we might be required to drop some events/rules. Currently we don't have a mechanism to prioritize events/rules, neither a mechanism to reduce load consumed by...

yanivagman

## Prerequisites - [ ] This issue is an EPIC issue (add label: EPIC). - [ ] This issue is an EPIC TASK (add issue to EPIC description). Select one...

NDStrahilevitz

## Prerequisites - [x] This issue is an EPIC issue (add label: EPIC). - [ ] This issue is an EPIC TASK (add issue to EPIC description). Select one OR...

NDStrahilevitz

eBPF CO-RE improvements: Load BPF programs based on available kernel features

4

From @yanivagman: We recently added the new "dependencies" field into the event definition. This concept of dependencies can be expanded to describe which BPF features are required for an event...

grantseltzer

Tracing file creation by kernel modules

1

Hi Sometimes, kernel rootkits try to commutate with the user-space. To accomplish that they create files with special file operations that handle their requests. To create those files from the...

itamarmaouda101