-
Notifications
You must be signed in to change notification settings - Fork 492
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added eBPF networking plugins and events. (#3887)
- Loading branch information
Showing
14 changed files
with
149 additions
and
39 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| name: Linux.Events.DNS | ||
| description: | | ||
| This artifact uses eBPF to track DNS requests from various processes. | ||
| NOTE: This event is generated from network traffic - it is unable to | ||
| view DoH traffic. | ||
| type: CLIENT_EVENT | ||
|
|
||
| precondition: | | ||
| SELECT OS From info() where OS = 'linux' | ||
| parameters: | ||
| - name: ExcludeDestIP | ||
| description: Only show events with a different DestIP | ||
| type: regex | ||
| default: "Change this to your default DNS Server IP" | ||
| - name: Records | ||
| description: Only show events matching these DNS records | ||
| type: regex | ||
| default: . | ||
| - name: ProcessNameFilter | ||
| description: Filter Events by Process Name | ||
| type: regex | ||
| default: . | ||
| - name: IncludeDNSDetails | ||
| type: bool | ||
| description: If set we include more details like HTTP Headers | ||
| - name: IncludeProcessInfo | ||
| type: bool | ||
| description: If set we include more process information. | ||
|
|
||
| sources: | ||
| - query: | | ||
| SELECT System.Timestamp AS Timestamp, | ||
| System.ProcessName AS ProcessName, | ||
| System.ProcessID AS Pid, | ||
| if(condition=IncludeProcessInfo, | ||
| then=process_tracker_get(id=System.ProcessID).Data) AS ProcessInfo, | ||
| EventData.src AS src_ip, | ||
| EventData.src_port AS src_port, | ||
| EventData.dst AS dest_ip, | ||
| EventData.dst_port AS dest_port, | ||
| EventData.proto_dns.questions.name AS name, | ||
| EventData.proto_dns.questions.type AS type, | ||
| EventData.proto_dns.answers.IP AS IP, | ||
| if(condition=IncludeDNSDetails, | ||
| then=EventData) AS _DNSData | ||
| FROM watch_ebpf(events="net_packet_dns") | ||
| WHERE NOT dest_ip =~ ExcludeDestIP | ||
| AND if(condition=Records, then=EventData.proto_dns =~ Records, else=TRUE) | ||
| AND ProcessName =~ ProcessNameFilter |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| name: Linux.Events.HTTPConnections | ||
| description: | | ||
| This artifact uses eBPF to track HTTP and parse connections from | ||
| various processes. | ||
| NOTE: This event is generated from network traffic - it is unable to | ||
| view TLS encrypted data. | ||
| If the process tracker is enabled we also show more information | ||
| about the process. | ||
| type: CLIENT_EVENT | ||
|
|
||
| precondition: | | ||
| SELECT OS From info() where OS = 'linux' | ||
| parameters: | ||
| - name: HostFilter | ||
| description: Filter Events by Host header | ||
| type: regex | ||
| default: . | ||
| - name: URLFilter | ||
| description: Filter Events by URL | ||
| type: regex | ||
| default: . | ||
| - name: ProcessNameFilter | ||
| description: Filter Events by Process Name | ||
| type: regex | ||
| default: . | ||
| - name: IncludeHeaders | ||
| type: bool | ||
| description: If set we include more details like HTTP Headers | ||
| - name: IncludeProcessInfo | ||
| type: bool | ||
| description: If set we include more process information. | ||
|
|
||
| sources: | ||
| - query: | | ||
| SELECT System.Timestamp AS Timestamp, | ||
| System.ProcessName AS ProcessName, | ||
| System.ProcessID AS Pid, | ||
| if(condition=IncludeProcessInfo, | ||
| then=process_tracker_get(id=System.ProcessID).Data) AS ProcessInfo, | ||
| EventData.metadata.src_ip AS src_ip, | ||
| EventData.metadata.src_port AS src_port, | ||
| EventData.metadata.dst_ip AS dest_ip, | ||
| EventData.metadata.dst_port AS dest_port, | ||
| EventData.http_request.host AS host, | ||
| EventData.http_request.uri_path AS uri_path, | ||
| if(condition=IncludeHeaders, | ||
| then=EventData.http_request) AS _HTTPRequest | ||
| FROM watch_ebpf(events="net_packet_http_request") | ||
| WHERE host =~ HostFilter | ||
| AND uri_path =~ URLFilter | ||
| AND ProcessName =~ ProcessNameFilter |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.