Repository navigation
Added host agent rules - #485
Merged
Merged
Conversation
afek854
marked this pull request as ready for review
February 16, 2025 18:13
Signed-off-by: Afek Berger <afekb@armosec.io>
afek854
force-pushed
the
feature/host-agent-rules
branch
from
February 16, 2025 18:14
f66c204 to
ee3c488
Compare
…into feature/host-agent-rules Signed-off-by: Afek Berger <afekb@armosec.io>
Signed-off-by: Afek Berger <afekb@armosec.io>
afek854
force-pushed
the
feature/host-agent-rules
branch
from
February 16, 2025 18:36
256a9dc to
3735980
Compare
|
Summary:
|
matthyx
pushed a commit
that referenced
this pull request
Feb 17, 2025
* Added host agent rules Signed-off-by: Afek Berger <afekb@armosec.io> * fixed tests & naming Signed-off-by: Afek Berger <afekb@armosec.io> --------- Signed-off-by: Afek Berger <afekb@armosec.io>
matthyx
added a commit
that referenced
this pull request
Feb 20, 2025
* First commit Signed-off-by: Ben <ben@armosec.io> * Adding base host rules Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding base code of host rule manager Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding mock Signed-off-by: Amit Schendel <amitschendel@gmail.com> * fixing process details Signed-off-by: Ben <ben@armosec.io> * Adding main support for rule manager Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Removing import Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding process tree support Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding fixed config Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Chaning log to debug to prevent spamming Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding new code Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding rules Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding fixed rules Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding path and rules Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Commenting read env variable from proc Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Added host agent rules (#485) * Added host agent rules Signed-off-by: Afek Berger <afekb@armosec.io> * fixed tests & naming Signed-off-by: Afek Berger <afekb@armosec.io> --------- Signed-off-by: Afek Berger <afekb@armosec.io> * Fixing rule name Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Configuring event receiver export Signed-off-by: Ben <ben@armosec.io> * fix Signed-off-by: Ben <ben@armosec.io> * Fixing test Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Changing unused params to _ Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding syscall peeking Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding rule creation at constructor Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding generic cooldown queue Signed-off-by: Amit Schendel <amitschendel@gmail.com> * implementing caching in the hosthashsensor Signed-off-by: Ben <ben@armosec.io> * skip env check when running on host Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * fix kernel version parsing Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Using temp k8s interface Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding cloudmetadata to alerts Signed-off-by: Amit Schendel <amitschendel@gmail.com> * First commit Signed-off-by: Ben <ben@armosec.io> * Adding base host rules Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding base code of host rule manager Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding mock Signed-off-by: Amit Schendel <amitschendel@gmail.com> * fixing process details Signed-off-by: Ben <ben@armosec.io> * Adding main support for rule manager Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Removing import Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding process tree support Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding fixed config Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Chaning log to debug to prevent spamming Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding new code Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding rules Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding fixed rules Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding path and rules Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Commenting read env variable from proc Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Added host agent rules (#485) * Added host agent rules Signed-off-by: Afek Berger <afekb@armosec.io> * fixed tests & naming Signed-off-by: Afek Berger <afekb@armosec.io> --------- Signed-off-by: Afek Berger <afekb@armosec.io> * Fixing rule name Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Configuring event receiver export Signed-off-by: Ben <ben@armosec.io> * fix Signed-off-by: Ben <ben@armosec.io> * Fixing test Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Changing unused params to _ Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding syscall peeking Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding rule creation at constructor Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding generic cooldown queue Signed-off-by: Amit Schendel <amitschendel@gmail.com> * implementing caching in the hosthashsensor Signed-off-by: Ben <ben@armosec.io> * Using temp k8s interface Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding cloudmetadata to alerts Signed-off-by: Amit Schendel <amitschendel@gmail.com> * skip env check when running on host Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * fix kernel version parsing Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * split main into node and host agent Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Ptracewatcher Signed-off-by: Ben <ben@armosec.io> * Adding host network watcher (#486) * Adding host network watcher Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Fixing process tree Signed-off-by: Amit Schendel <amitschendel@gmail.com> * adding a goreleaser config Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> --------- Signed-off-by: Amit Schendel <amitschendel@gmail.com> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> Co-authored-by: Matthias Bertschy <matthias.bertschy@gmail.com> * Fixing Dockerfile - @matthias blame Signed-off-by: Amit Schendel <amitschendel@gmail.com> * fix Signed-off-by: Ben <ben@armosec.io> * Removing network on host Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Clean unused code Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Removing io_uring init on host Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding reporting of open and exec to hash sensor Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Adding injected rule creator Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Public validate Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Removing files Signed-off-by: Amit Schendel <amitschendel@gmail.com> * Removing host container Signed-off-by: Amit Schendel <amitschendel@gmail.com> * fixing nits before merging Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> --------- Signed-off-by: Ben <ben@armosec.io> Signed-off-by: Amit Schendel <amitschendel@gmail.com> Signed-off-by: Afek Berger <afekb@armosec.io> Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com> Co-authored-by: Amit Schendel <amitschendel@gmail.com> Co-authored-by: Afek Berger <afekb@armosec.io> Co-authored-by: Matthias Bertschy <matthias.bertschy@gmail.com> Co-authored-by: Amit Schendel <58078857+amitschendel@users.noreply.github.com>
This was referenced Nov 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview