feat(eventsource): Smart filtering with approvers#676
Merged
Conversation
rabbitstack
force-pushed
the
rule-approvers
branch
from
9e68445 to
c742242
Compare
CreateFile and RegOpenKey are amongst most voluminous events in the system. We pay for the allocation cost because the raw event record is transformed into typed Event structure. Additionally, there is also a processing penalty at the rule evaluation time. With approvers we can accept or reject events at the early stage of event processing, reducing both the pressure on the allocator and the rule engine as well.
As the approvers are now responsible for this task, we can offload IRP correlation via FileOpEnd events and get the CreateFile event with the create disposition.
With approvers many CreateFile events with OPEN disposition mask are rejected early. This allows us to dispatch all CreateFile events to the evasion scanners regardless of the file operation.
rabbitstack
force-pushed
the
rule-approvers
branch
from
c742242 to
1a057ad
Compare
At rule compilation time, the compiler traverses the AST tree and attempts to find event types for which approver predicates can be derived. Most notably, file and registry paths, file extensions, file base names and process executable paths are all candidates for approver predicates.
The new fs approver keeps in-flight CreateFile event records and attributes them to FileOpEnd events via IRP link. When the respective FileOpEnd event record arrives, we extract the create disposition and the system status attributes and attach them to the CreateFile event record by pushing synthethic extended items to the event record.
By leveraging the string builder and establishing the capacity of the underlying slice, we can reduce a few unnecessary allocations per event.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the purpose of this PR / why it is needed?
CreateFileandRegOpenKeyare among the most voluminous events in the system. We pay for the allocation cost because the raw event record is transformed into a typedEventstructure. Additionally, there is also a processing penalty at the rule evaluation time.With approvers, we can accept or reject events at the early stage of event processing, reducing both the pressure on the allocator and the rule engine as well.
What type of change does this PR introduce?
/kind feature (non-breaking change which adds functionality)
/kind improvement
Any specific area of the project related to this PR?
/area instrumentation
/area rule-engine
Special notes for the reviewer
Does this PR introduce a user-facing change?