santa
santa copied to clipboard
ProcessTree: integrate process tree throughout the event processing lifecycle (3/4)
This PR:
- Instantiates a process tree in SantaDeps, and threads it through to the enricher and proto serializer.
- Adds a new
SNTEndpointSecurityTreeAwareClient
which clients subclass from to automatically have the tree updated before they run. - Adds a
ProcessToken
to the coreMessage
type passed through Santa, which causes the tree to automatically "hold on" to process information, even after the process' exit event is received. This means the clients can get process information out of the tree at any point, even in (delayed) async processing. - Adds the basic configuration knobs to change which annotations are enabled (and if none are, disables the tree entirely).
N.B. Due to the last bullet above, while this code does technically begin to interact with event processing, the tree remains entirely disabled unless the config key is set.