tetragon: better identification of kernel threads

[tixxdz]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem?

No response

Describe the feature you would like

Better identification of kernel threads in generated process events

Describe your proposed solution

• Document that pid 0 is auto generated to note kernel context
• Generate a test case to trigger kernel threads
• Ensure that all kernel threads have the auditd uid set to -1
  • Generated pid 0 proc: set auid to -1 for generated kernel pid 0 #2400
  • All the rest kernel threads
• Maybe add a flag to note kthread
• Ensure to collect comm for kernel threads and set it as binary name
• Investigate kernel threads hierarchy and note if we keep the hierarchy or if we should do something special

Code of Conduct

• I agree to follow this project's Code of Conduct