Skip to content

Commit 47e8258

Browse files
slashbenslashben
authored
Merge pull request #438 from armosec/feature/malware_metadata
Added malware metadata struct
2 parents cb387d8 + f1c9e64 commit 47e8258

File tree

2 files changed

+76
-35
lines changed

2 files changed

+76
-35
lines changed

‎armotypes/linuxobjects.go

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
package armotypes
2+
3+
import "time"
4+
5+
type File struct {
6+
Path string `json:"path,omitempty" bson:"path,omitempty"`
7+
Size int64 `json:"size,omitempty" bson:"size,omitempty"`
8+
Hashes FileHashes `json:"hashes,omitempty" bson:"hashes,omitempty"`
9+
Timestamps FileTimestamps `json:"timestamps,omitempty" bson:"timestamps,omitempty"`
10+
Ownership FileOwnership `json:"ownership,omitempty" bson:"ownership,omitempty"`
11+
Attributes FileAttributes `json:"attributes,omitempty" bson:"attributes,omitempty"`
12+
}
13+
14+
type Process struct {
15+
PID uint32 `json:"pid,omitempty" bson:"pid,omitempty"`
16+
Cmdline string `json:"cmdline,omitempty" bson:"cmdline,omitempty"`
17+
Comm string `json:"comm,omitempty" bson:"comm,omitempty"`
18+
PPID uint32 `json:"ppid,omitempty" bson:"ppid,omitempty"`
19+
Pcomm string `json:"pcomm,omitempty" bson:"pcomm,omitempty"`
20+
Hardlink string `json:"hardlink,omitempty" bson:"hardlink,omitempty"`
21+
Uid *uint32 `json:"uid,omitempty" bson:"uid,omitempty"`
22+
Gid *uint32 `json:"gid,omitempty" bson:"gid,omitempty"`
23+
UserName string `json:"userName,omitempty" bson:"userName,omitempty"`
24+
GroupName string `json:"groupName,omitempty" bson:"groupName,omitempty"`
25+
StartTime time.Time `json:"startTime,omitempty" bson:"startTime,omitempty"`
26+
UpperLayer *bool `json:"upperLayer,omitempty" bson:"upperLayer,omitempty"`
27+
Cwd string `json:"cwd,omitempty" bson:"cwd,omitempty"`
28+
Path string `json:"path,omitempty" bson:"path,omitempty"`
29+
Children []Process `json:"children,omitempty" bson:"children,omitempty"`
30+
}
31+
32+
type FileHashes struct {
33+
MD5 string `json:"md5,omitempty" bson:"md5,omitempty"`
34+
SHA1 string `json:"sha1,omitempty" bson:"sha1,omitempty"`
35+
SHA256 string `json:"sha256,omitempty" bson:"sha256,omitempty"`
36+
}
37+
38+
type FileTimestamps struct {
39+
CreationTime time.Time `json:"creationTime,omitempty" bson:"creationTime,omitempty"`
40+
ModificationTime time.Time `json:"modificationTime,omitempty" bson:"modificationTime,omitempty"`
41+
AccessTime time.Time `json:"accessTime,omitempty" bson:"accessTime,omitempty"`
42+
}
43+
44+
type FileOwnership struct {
45+
Uid *uint32 `json:"uid,omitempty" bson:"uid,omitempty"`
46+
Gid *uint32 `json:"gid,omitempty" bson:"gid,omitempty"`
47+
UserName string `json:"userName,omitempty" bson:"userName,omitempty"`
48+
GroupName string `json:"groupName,omitempty" bson:"groupName,omitempty"`
49+
}
50+
51+
type FileAttributes struct {
52+
Permissions string `json:"permissions,omitempty" bson:"permissions,omitempty"`
53+
}

‎armotypes/runtimeincidents.go

+23-35
Original file line numberDiff line numberDiff line change
@@ -10,23 +10,15 @@ import (
1010
"k8s.io/apiserver/pkg/authentication/user"
1111
)
1212

13-
type Process struct {
14-
PID uint32 `json:"pid,omitempty" bson:"pid,omitempty"`
15-
Cmdline string `json:"cmdline,omitempty" bson:"cmdline,omitempty"`
16-
Comm string `json:"comm,omitempty" bson:"comm,omitempty"`
17-
PPID uint32 `json:"ppid,omitempty" bson:"ppid,omitempty"`
18-
Pcomm string `json:"pcomm,omitempty" bson:"pcomm,omitempty"`
19-
Hardlink string `json:"hardlink,omitempty" bson:"hardlink,omitempty"`
20-
Uid *uint32 `json:"uid,omitempty" bson:"uid,omitempty"`
21-
Gid *uint32 `json:"gid,omitempty" bson:"gid,omitempty"`
22-
UserName string `json:"userName,omitempty" bson:"userName,omitempty"`
23-
GroupName string `json:"groupName,omitempty" bson:"groupName,omitempty"`
24-
StartTime time.Time `json:"startTime,omitempty" bson:"startTime,omitempty"`
25-
UpperLayer *bool `json:"upperLayer,omitempty" bson:"upperLayer,omitempty"`
26-
Cwd string `json:"cwd,omitempty" bson:"cwd,omitempty"`
27-
Path string `json:"path,omitempty" bson:"path,omitempty"`
28-
Children []Process `json:"children,omitempty" bson:"children,omitempty"`
29-
}
13+
type AlertType int
14+
15+
const (
16+
AlertTypeRule AlertType = iota
17+
AlertTypeMalware
18+
AlertTypeAdmission
19+
AlertTypeCdr
20+
AlertTypeHttpRule
21+
)
3022

3123
type CloudMetadata struct {
3224
// Provider is the cloud provider name (e.g. aws, gcp, azure).
@@ -42,16 +34,6 @@ type CloudMetadata struct {
4234
Services []string `json:"services,omitempty" bson:"services,omitempty"`
4335
}
4436

45-
type AlertType int
46-
47-
const (
48-
AlertTypeRule AlertType = iota
49-
AlertTypeMalware
50-
AlertTypeAdmission
51-
AlertTypeCdr
52-
AlertTypeHttpRule
53-
)
54-
5537
type StackFrame struct {
5638
// Frame ID
5739
FrameID string `json:"frameId,omitempty" bson:"frameId,omitempty"`
@@ -66,7 +48,7 @@ type StackFrame struct {
6648
// Arguments
6749
Arguments []string `json:"arguments,omitempty" bson:"arguments,omitempty"`
6850
// User/Kernel space
69-
UserSpace bool `json:"userSpace" bson:"userSpace"`
51+
UserSpace bool `json:"userSpace,omitempty" bson:"userSpace,omitempty"`
7052
// Native/Source code
7153
NativeCode *bool `json:"nativeCode,omitempty" bson:"nativeCode,omitempty"`
7254
}
@@ -126,7 +108,13 @@ type RuleAlert struct {
126108
}
127109

128110
type MalwareAlert struct {
129-
MalwareDescription string `json:"malwareDescription,omitempty" bson:"malwareDescription,omitempty"`
111+
MalwareFile File `json:"malwareFile,omitempty" bson:"malwareFile,omitempty"`
112+
Aliases []string `json:"aliases,omitempty" bson:"aliases,omitempty"`
113+
Family string `json:"family,omitempty" bson:"family,omitempty"`
114+
Action string `json:"action,omitempty" bson:"action,omitempty"`
115+
DetectionMethod string `json:"detectionMethod,omitempty" bson:"detectionMethod,omitempty"`
116+
MalwareDescription string `json:"malwareDescription,omitempty" bson:"malwareDescription,omitempty"`
117+
ProcessTree ProcessTree `json:"processTree,omitempty" bson:"processTree,omitempty"`
130118
}
131119

132120
type HttpRuleAlert struct {
@@ -165,7 +153,7 @@ type AdmissionAlert struct {
165153
}
166154

167155
type RuntimeAlertK8sDetails struct {
168-
ClusterName string `json:"clusterName" bson:"clusterName"`
156+
ClusterName string `json:"clusterName,omitempty" bson:"clusterName,omitempty"`
169157
ContainerName string `json:"containerName,omitempty" bson:"containerName,omitempty"`
170158
HostNetwork *bool `json:"hostNetwork,omitempty" bson:"hostNetwork,omitempty"`
171159
OldImage string `json:"oldImage,omitempty" bson:"oldImage,omitempty"`
@@ -177,9 +165,9 @@ type RuntimeAlertK8sDetails struct {
177165
PodName string `json:"podName,omitempty" bson:"podName,omitempty"`
178166
PodNamespace string `json:"podNamespace,omitempty" bson:"podNamespace,omitempty"`
179167
PodLabels map[string]string `json:"podLabels,omitempty" bson:"podLabels,omitempty"`
180-
WorkloadName string `json:"workloadName" bson:"workloadName"`
168+
WorkloadName string `json:"workloadName,omitempty" bson:"workloadName,omitempty"`
181169
WorkloadNamespace string `json:"workloadNamespace,omitempty" bson:"workloadNamespace,omitempty"`
182-
WorkloadKind string `json:"workloadKind" bson:"workloadKind"`
170+
WorkloadKind string `json:"workloadKind,omitempty" bson:"workloadKind,omitempty"`
183171
}
184172

185173
type RuntimeAlert struct {
@@ -188,7 +176,7 @@ type RuntimeAlert struct {
188176
MalwareAlert `json:",inline" bson:"inline"`
189177
AdmissionAlert `json:",inline" bson:"inline"`
190178
RuntimeAlertK8sDetails `json:",inline" bson:"inline"`
191-
cdr.CdrAlert `json:"cdrevent" bson:"cdrevent"`
179+
cdr.CdrAlert `json:"cdrevent,omitempty" bson:"cdrevent"`
192180
HttpRuleAlert `json:",inline" bson:"inline"`
193181
AlertType AlertType `json:"alertType" bson:"alertType"`
194182
// Rule ID
@@ -200,8 +188,8 @@ type RuntimeAlert struct {
200188

201189
type ProcessTree struct {
202190
ProcessTree Process `json:"processTree" bson:"processTree"`
203-
UniqueID uint32 `json:"uniqueID" bson:"uniqueID"`
204-
ContainerID string `json:"containerID" bson:"containerID"`
191+
UniqueID uint32 `json:"uniqueID,omitempty" bson:"uniqueID,omitempty"`
192+
ContainerID string `json:"containerID,omitempty" bson:"containerID,omitempty"`
205193
}
206194

207195
type KDRMonitoredEntitiesCounters struct {

0 commit comments

Comments
 (0)