[CWS] Use ProcessCacheEntry cgroup context as event cgroup context (#…

…31553)
DataDog · Nov 28, 2024 · fc3a485 · fc3a485
1 parent 5782113
commit fc3a485
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/pkg/security/probe/probe_ebpf.go b/pkg/security/probe/probe_ebpf.go
@@ -685,6 +685,9 @@ func (p *EBPFProbe) setProcessContext(eventType model.EventType, event *model.Ev
 		panic("should always return a process context")
 	}
 
+	// do the same with cgroup context
+	event.CGroupContext = event.ProcessCacheEntry.CGroup
+
 	if process.IsKThread(event.ProcessContext.PPid, event.ProcessContext.Pid) {
 		return false
 	}