santa icon indicating copy to clipboard operation
santa copied to clipboard

ProcessTree: integrate process tree throughout the event processing lifecycle (3/4)

Open kallsyms opened this issue 5 months ago • 0 comments

This PR:

  • Instantiates a process tree in SantaDeps, and threads it through to the enricher and proto serializer.
  • Adds a new SNTEndpointSecurityTreeAwareClient which clients subclass from to automatically have the tree updated before they run.
  • Adds a ProcessToken to the core Message type passed through Santa, which causes the tree to automatically "hold on" to process information, even after the process' exit event is received. This means the clients can get process information out of the tree at any point, even in (delayed) async processing.
  • Adds the basic configuration knobs to change which annotations are enabled (and if none are, disables the tree entirely).

N.B. Due to the last bullet above, while this code does technically begin to interact with event processing, the tree remains entirely disabled unless the config key is set.

kallsyms avatar Feb 05 '24 23:02 kallsyms