Skip to content

Rules engine multi-language support - #54

Merged
araujof merged 50 commits into
masterfrom
dev
Sep 6, 2023
Merged

Rules engine multi-language support#54
araujof merged 50 commits into
masterfrom
dev

Conversation

@araujof

@araujofaraujof commented Sep 6, 2023

Copy link
Copy Markdown
Member

No description provided.

teryltand others added 30 commits April 19, 2022 11:09
@terylt
feat(core): added multi-driver support to the processor
f3e18e5
Signed-off-by: Teryl Taylor <teryl.taylor@gmail.com>
@araujof
feat(go): upgrade to go 1.19 compat
7ec1213
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@terylt@araujof
feat(core): added multi-driver support to the processor
97603b5
Signed-off-by: Teryl Taylor <teryl.taylor@gmail.com>
@araujof
Merge branch 'multi_driver' of github.com:sysflow-telemetry/sf-proces…
9f73140
…sor into multi_driver
@araujof
feat(core): initial refactoring to support multi-language policy engine
b7afe11
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
refactor(core): refactor policy monitor; add default creation for int…
14d0f43
…erpreter members; enabled interpreter unit tests
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(core): fix remaining issues with exporter encoders after refactor…
84afd21
…ing the policy engine
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(core): add regexp operation
f63fbec
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(core): sigma frontend with transformers
2ff68ec
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(core): working version of the sigma compiler, supporting fieldma…
5d1d556
…ppings
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
refactor(core): introduce generilized operators for string and intege…
bd48294
…r comparisons
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(core): refactored operators
abdf6ca
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(core): add transformer support for sigma and warning/handling of…
168c7ce
… keyword search
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(core): add regexp operation for sysflow flatrecords
8133742
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(core): add recursive reading of input policies; fix recursive lo…
523c149
…op in NOT predicates
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(core): modify operations interface to return errors
991dafd
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(core): add String() method to Operator type
88a863d
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(resources): add process_creation sigma rules for Linux (for tests)
0f48104
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(README): fix build shield URL
d0ef6cc
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(core): fix logical conjunction predicate in selections of field maps
0b441fe
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
tests(core): add tests for compilers
ffb675a
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(ci): bump linter and golang versions
90cf5bb
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(core): add missing copyright headers
f58e450
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@san-zrl
Migrated plugins to new arch and added make plugins target
6e29484
@san-zrl
Merge branch 'go1.19-sigma' of github.com:sysflow-telemetry/sf-proces…
3ead78a
…sor into go1.19-sigma
@san-zrl
added make plugins target
72dffb3
@terylt
update(operators): added operator functions for slices and ipv6 data …
0eb10e7
…types
Signed-off-by: TPT <terylt@ibm.com>
@terylt
Merge branch 'go1.19-sigma' of github.com:/sysflow-telemetry/sf-proce…
6fb7495
…ssor into go1.19-sigma
@araujof
feat(core, resources): add additional sysflow sigma mappings, a few c…
939cf64
…leanups
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
new(resources): add sample trace for shellshock attack
a506fc9
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
teryltand others added 20 commits February 17, 2023 21:25
@terylt
feat(source): updated processor to support compiling in other data so…
df56e6a
…urces
Signed-off-by: TPT <terylt@ibm.com>
@araujof
tests(core|driver): add perf logging and event rate measurement
707d88b
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(tests): add bench pipeline configs
135a9bf
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
new(resources): add k8s traces
b16054b
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
new(tests): add summarization script for benchmarks
5561cdc
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(tests): new benchmark scripts
867a9de
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
refactor(core): add benchmark options
be366c5
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
test(scripts): update summarize script
568a17d
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(core,driver): updated go mod and sum
2798f9a
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(ci,core,driver): fix lint issues and deprecated Go features
5b60115
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(core,plugins): track newest sf-apis; fix example plugins to work…
a223356
… with new APIs
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(merge): fix merge conflicts with dev branch
20dde65
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(merge): fix remaining merge conflicts
f504d18
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
Merge pull request#49from sysflow-telemetry/go1.19-sigma
3d54fd4
Go1.19 sigma
@araujof
chore(ci): removed deprecated set-output commands
4b5b7b8
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
chore(ci): update deprecated actions
4d2b925
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
feat(manifest): bumped UBI to 8.8-1032.1692772289
2d51a16
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(ci): fix plugin builder tags
416acd3
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(ci): fix plugin builder action
849b115
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
fix(ci): fix regression error in CI
d329715
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
@araujof
araujof merged commit 11f8140 into masterSep 6, 2023
@araujofaraujof changed the title DevRules engine refactoring for multi-language supportSep 23, 2023
@araujofaraujof changed the title Rules engine refactoring for multi-language supportRules engine multi-language supportSep 23, 2023
araujof added a commit that referenced this pull request Jan 15, 2025
@araujof
Merge pull request#54from sysflow-telemetry/dev
c137150
Dev
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@araujofaraujof

@teryltterylt

Labels

None yet

Projects

No open projects
0.6.0
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@araujof@terylt@san-zrl