thor-object-reference/docs/ebpf-program.yml at main · RuneCode14/thor-object-reference · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: eBPF program
schema: https://github.com/NextronSystems/jsonlog/thorlog/v3/ebpf-program
fields:
- sigma_name: ATTACH_TARGET
  json_name: attach_target
  type: object
  required: true
  description: ''
  nested:
  - sigma_name: PATH
    json_name: path
    type: string
  - sigma_name: PID
    json_name: pid
    type: integer
  - sigma_name: SYMBOLS
    json_name: symbols
    type: array of string
  - sigma_name: INTERFACE
    json_name: interface
    type: string
  - sigma_name: OBJECT_ID
    json_name: object_id
    type: integer
  - sigma_name: PROTOCOL
    json_name: protocol
    type: string
  - sigma_name: HOOK
    json_name: hook
    type: string
  - sigma_name: PRIORITY
    json_name: priority
    type: integer
- sigma_name: CONTENT
  json_name: content
  type: object
  required: false
  description: ''
  nested:
  - sigma_name: TYPE
    json_name: type
    type: string
  - sigma_name: ELEMENTS
    json_name: elements
    type: array | null
  - sigma_name: LENGTH
    json_name: length
    type: integer
- sigma_name: FUNCTIONS
  json_name: functions
  type: array of string
  required: true
  description: ''
- sigma_name: LINK_TYPE
  json_name: link_type
  type: string
  required: true
  description: ''
- sigma_name: LOAD_TIME
  json_name: load_time
  type: string (date-time)
  required: true
  description: ''
- sigma_name: MAPS
  json_name: maps
  type: array of string
  required: true
  description: ''
- sigma_name: MEMORY_LOCKED
  json_name: memory_locked
  type: integer
  required: true
  description: ''
- sigma_name: NAME
  json_name: name
  type: string
  required: true
  description: ''
- sigma_name: PROGRAM_TYPE
  json_name: program_type
  type: string
  required: true
  description: ''
- sigma_name: SIZE
  json_name: size
  type: integer
  required: true
  description: ''
- sigma_name: TAG
  json_name: tag
  type: string
  required: true
  description: ''
- sigma_name: TYPE
  json_name: type
  type: string
  required: true
  description: ''
- sigma_name: USER
  json_name: user
  type: string
  required: true
  description: ''