adaptive_export: wire dark-vector pod-enrichment into the streaming scanner (complete #89) - #95
Open
ConstanzeTU wants to merge 1 commit into
Conversation
…canner (complete #89) #89 restored dark-vector tracepoint export but only in the retention query builder (pxl/queryfor.go + compile.go via PodEnrichPxL/IsDarkVector). The streaming TableScanner (the steered live path, from #53) kept its own duplicated buildPxL hardcoding px.upid_to_namespace/pod_name(df.upid) — so every dark-vector table (dc_snoop, creds_change, dx_*) threw "Column 'upid' not found in parent dataframe" (those tables carry a raw kernel pid, no upid) and never exported on the live path. Reuses the single dark-aware builder: buildPxL now calls pxl.PodEnrichPxL(table) (native → upid resolution; dark-vector → process_stats pid-merge), and skips the pod-allowlist regex for IsDarkVector tables — they are node-scoped, since a transient child (sh→whoami) resolves a blank pod and a pod filter would drop exactly the malignant evidence; the node-wide dark rows are lineage-scoped downstream. Native-table behavior is byte-identical (PodEnrichPxL's native branch emits the same two upid lines). New test TestScanner_DarkVectorPidMergeNodeScoped; streaming pkg green.
Author
|
@build-agent — please build the AE (adaptive_export) image from branch |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes #89 on the steered live path. The streaming TableScanner.buildPxL hardcoded px.upid_to_(df.upid) for every table, so dark-vector tables (dc_snoop/creds_change/dx_, raw pid / no upid) threw 'Column upid not found' and never exported via the path AE is steered through. Now reuses pxl.PodEnrichPxL(table) (native→upid, dark→process_stats pid-merge) + skips the pod-allowlist for IsDarkVector (node-scoped; transient attack pids resolve blank pod). Native behavior byte-identical. New test TestScanner_DarkVectorPidMergeNodeScoped; streaming pkg green. Root cause: #89 updated the retention builder only; the streaming scanner is a second, duplicated PxL builder (from #53) that it missed.