feat(events): create global event id enum #4053
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rscampos
commented
May 16, 2024
rscampos
force-pushed
the
1098_global_event_id_num
branch
from
a54a79c
to
1940176
Compare
rscampos
force-pushed
the
1098_global_event_id_num
branch
2 times, most recently
from
23bb9c0
to
01a4fa6
Compare
rscampos
force-pushed
the
1098_global_event_id_num
branch
from
01a4fa6
to
d7db4ce
Compare
rscampos
changed the title
yanivagman
reviewed
May 19, 2024
rscampos
force-pushed
the
1098_global_event_id_num
branch
2 times, most recently
from
b046e08
to
28bbed6
Compare
rscampos
force-pushed
the
1098_global_event_id_num
branch
from
28bbed6
to
b047d9d
Compare
yanivagman
reviewed
May 21, 2024
yanivagman
reviewed
May 21, 2024
yanivagman
reviewed
May 21, 2024
rscampos
force-pushed
the
1098_global_event_id_num
branch
from
b047d9d
to
e6391a2
Compare
geyslan
approved these changes
May 28, 2024
go.mod
Outdated
| @@ -45,6 +45,8 @@ require ( | |||
| sigs.k8s.io/controller-runtime v0.16.3 | |||
| ) | |||
|
|
|||
| replace github.com/aquasecurity/tracee/api => github.com/rscampos/tracee/api v0.0.0-20240520202449-d199291ce929 | |||
There was a problem hiding this comment.
don't forget to split this pr into 2, go.mod enters api first, main go.mod follows it.
There was a problem hiding this comment.
@geyslan splited the PR into 2, if you don't mind to do the last review, tks again :)
pkg/server/grpc/tracee.go
Outdated
| @@ -19,6 +19,574 @@ import ( | |||
| "github.com/aquasecurity/tracee/types/trace" | |||
| ) | |||
|
|
|||
| // EventTranslationTable - translate internal to external Event ID | |||
There was a problem hiding this comment.
nit:
Suggested change
| // EventTranslationTable - translate internal to external Event ID | |
| // EventTranslationTable translates internal to external protobuf Event Id |
rscampos
force-pushed
the
1098_global_event_id_num
branch
from
e6391a2
to
bc0055c
Compare
- create an array for translation internal ID to external ID; - External syscall event starts at 1; - External common event starts at 1000; - External originated from user-space event start at 2000.
rscampos
force-pushed
the
1098_global_event_id_num
branch
from
bc0055c
to
53d93ea
Compare
geyslan
approved these changes
May 31, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
1. Explain what the PR does
fix #1098
53d93ea fix(tests): event ID translation
4806e8a feat(events): create global event id enum
4806e8a feat(events): create global event id enum
2. Explain how to test it
3. Other comments