New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Tutorial: Correlate additional metadata with events #2030
Comments
@mtardy what is the next step for enhancement proposals such as this one; for instance, is a further review required? I'd be willing to work on an implementation (at as self-determined pace). |
You can work on this and propose a PR I think this can be valuable. As of this:
I would suggest using existing utilities like |
@mtardy thanks for your quick response and for assigning the issue. Regarding |
I was mainly suggesting that well-known well-tested binaries might already exist that do what you want to do instead of needing to rewrite one. |
@mtardy so yes, that's what I meant in the first list item above. From today's perspective, I should have some markdown to that effect ready soon. |
Is there an existing issue for this?
Is your feature request related to a problem?
From a practical perspective it would be helpful if Tetragon events could bear human-friendly usernames in addition to
uid
andauid
. However, it seems ill-advised to place the gathering of such usernames in Tetragon itself (includingtetra
). #2015 includes arguments to that effect. What could be helpful instead is a tutorial that sketches alternative approaches for achieving this practical goal.Describe the feature you would like
A new tutorials by the title Correlate additional metadata with events. It (its initial version) would lay out two ways of adding human-friendly usernames to Tetragon's events:
jq
andid
for achieving the correlation.libc
(from where it can "pull" usernames), and writes correlated events to a new JSON file.The title of the new tutorial is inspired by a sentence from the O'Reilly report Security Observability with eBPF that addresses roughly similar concerns:
Describe your proposed solution
We can implement this feature by:
docs/content/en/docs/tutorials/correlate-metadata.md
contrib/usernames/
(optional; perhaps in C)Code of Conduct
The text was updated successfully, but these errors were encountered: