aquasecurity/tracee

Add required dependency flag to signature selectors

Opened this issue · 0 comments

Requirement

Signature event selectors currently serve de-facto as a "event dependency" mechanism similar to the one in the event definitions. There is a need to allow signatures to define selectors which do not automatically load the selected event (for example signatures which consume various optional signatures).

Solution

Option 1 - Discarded

Event dependencies have a required flag which indicates wether tracee should fail when the event is not available. A similar flag can be used here. In the context of signatures this will indicate that the signature can function without input from the selected event.

Option 2 - Selector Semantics Expansion

This cannot use the same semantics as required because required implies the necessary loading of the dependent. The semantics implied by this requirements are a "class of events which stream", somewhat similar to the selector semantics already existing. This implies to me that selector semantics should be expanded and fit for use also in derived events.

For example in our known case the particular selector required is "severity". This implies that selectors should in a sense just be context filters...