Report rule actions in events

DataDog · Nov 20, 2023 · 2064280 · 2064280
1 parent aaecb26
commit 2064280
Show file tree

Hide file tree

Showing 5 changed files with 117 additions and 7 deletions.
diff --git a/pkg/security/events/event.go b/pkg/security/events/event.go
@@ -13,13 +13,14 @@ import "github.com/DataDog/datadog-agent/pkg/security/secl/rules"
 // AgentContext serializes the agent context to JSON
 // easyjson:json
 type AgentContext struct {
-	RuleID        string `json:"rule_id"`
-	RuleVersion   string `json:"rule_version,omitempty"`
-	PolicyName    string `json:"policy_name,omitempty"`
-	PolicyVersion string `json:"policy_version,omitempty"`
-	Version       string `json:"version,omitempty"`
-	OS            string `json:"os,omitempty"`
-	Arch          string `json:"arch,omitempty"`
+	RuleID        string                   `json:"rule_id"`
+	RuleVersion   string                   `json:"rule_version,omitempty"`
+	RuleActions   []map[string]interface{} `json:"rule_actions,omitempty"`
+	PolicyName    string                   `json:"policy_name,omitempty"`
+	PolicyVersion string                   `json:"policy_version,omitempty"`
+	Version       string                   `json:"version,omitempty"`
+	OS            string                   `json:"os,omitempty"`
+	Arch          string                   `json:"arch,omitempty"`
 }
 
 // Signal - Rule event wrapper used to send an event to the backend

diff --git a/pkg/security/events/event_easyjson.go b/pkg/security/events/event_easyjson.go
diff --git a/pkg/security/module/server.go b/pkg/security/module/server.go
@@ -259,9 +259,33 @@ func (a *APIServer) GetConfig(ctx context.Context, params *api.GetConfigParams)
 
 // SendEvent forwards events sent by the runtime security module to Datadog
 func (a *APIServer) SendEvent(rule *rules.Rule, e events.Event, extTagsCb func() []string, service string) {
+	ruleActions := make([]map[string]interface{}, 0, len(rule.Definition.Actions))
+	for _, action := range rule.Definition.Actions {
+		switch {
+		case action.Kill != nil:
+			ruleActions = append(ruleActions, map[string]interface{}{"name": "kill", "signal": action.Kill.Signal})
+		case action.Set != nil:
+			ruleAction := map[string]interface{}{"name": "set"}
+			if action.Set.Value != nil {
+				ruleAction["value"] = action.Set.Value
+			}
+			if action.Set.Field != "" {
+				ruleAction["field"] = action.Set.Field
+			}
+			if action.Set.Append {
+				ruleAction["append"] = action.Set.Append
+			}
+			if action.Set.Scope != "" {
+				ruleAction["scope"] = string(action.Set.Scope)
+			}
+			ruleActions = append(ruleActions, ruleAction)
+		}
+	}
+
 	agentContext := events.AgentContext{
 		RuleID:      rule.Definition.ID,
 		RuleVersion: rule.Definition.Version,
+		RuleActions: ruleActions,
 		Version:     version.AgentVersion,
 		OS:          runtime.GOOS,
 		Arch:        utils.RuntimeArch(),

diff --git a/pkg/security/secl/model/model.go b/pkg/security/secl/model/model.go
@@ -375,6 +375,7 @@ type MatchedRule struct {
 	RuleID        string
 	RuleVersion   string
 	RuleTags      map[string]string
+	RuleActions   []map[string]interface{}
 	PolicyName    string
 	PolicyVersion string
 }

diff --git a/pkg/security/serializers/serializers_base.go b/pkg/security/serializers/serializers_base.go
@@ -166,6 +166,7 @@ func newMatchedRulesSerializer(r *model.MatchedRule) MatchedRuleSerializer {
 	for tagName, tagValue := range r.RuleTags {
 		mrs.Tags = append(mrs.Tags, tagName+":"+tagValue)
 	}
+
 	return mrs
 }
-Original file line number
+Diff line change
@@ Expand Up @@
     	for tagName, tagValue := range r.RuleTags {
     		mrs.Tags = append(mrs.Tags, tagName+":"+tagValue)
     	}
     	return mrs
     }
@@ Expand Down @@