From fff3b27a0c917e7e247d471790d2c6f03b5044f3 Mon Sep 17 00:00:00 2001 From: Ofek Shaked Date: Wed, 12 Nov 2025 16:16:18 +0200 Subject: [PATCH] Fix: "triggeredBy" was renamed to "detectedFrom" Support the new field name, and change the documentation and all internal variables names to reflect this change. --- docs/features.md | 2 +- plugins/epan/tracee-event/enrichments.c | 8 +-- plugins/epan/tracee-event/packet-tracee.c | 62 +++++++++++------------ 3 files changed, 36 insertions(+), 36 deletions(-) diff --git a/docs/features.md b/docs/features.md index 5749116..e8442a3 100644 --- a/docs/features.md +++ b/docs/features.md @@ -112,7 +112,7 @@ For an overview of display columns see [Columns](#columns). ### Signatures -Tracee signatures have some extra information in them, which can be seen in the dissection tree. The ***Triggered By*** tree contains the event which triggered the signature, together with its own arguments. The ***Metadata*** tree contains information about the signature, including its name, description, severity level, attack technique and more. +Tracee signatures have some extra information in them, which can be seen in the dissection tree. The ***Detected From*** tree contains the event which the signature was detected from, together with its own arguments. The ***Metadata*** tree contains information about the signature, including its name, description, severity level, attack technique and more. ![](img/signature.png) diff --git a/plugins/epan/tracee-event/enrichments.c b/plugins/epan/tracee-event/enrichments.c index 8463a2b..68fe32d 100644 --- a/plugins/epan/tracee-event/enrichments.c +++ b/plugins/epan/tracee-event/enrichments.c @@ -177,7 +177,7 @@ static int enrich_dynamic_code_loading(tvbuff_t *tvb _U_, packet_info *pinfo, pr const struct field_value *alert; const gchar *alert_str = NULL; - if ((alert = wanted_field_get_one("tracee.args.dynamic_code_loading.triggered_by.alert")) == NULL) + if ((alert = wanted_field_get_one("tracee.args.dynamic_code_loading.detected_from.alert")) == NULL) return 0; if (alert->type == FIELD_TYPE_STRING) @@ -193,7 +193,7 @@ static int enrich_dynamic_code_loading(tvbuff_t *tvb _U_, packet_info *pinfo, pr static int enrich_fileless_execution(tvbuff_t *tvb _U_, packet_info *pinfo, proto_tree *tree _U_, void *data _U_) { - const gchar *pathname = wanted_field_get_str("tracee.args.fileless_execution.triggered_by.pathname"); + const gchar *pathname = wanted_field_get_str("tracee.args.fileless_execution.detected_from.pathname"); if (pathname) col_append_fstr(pinfo->cinfo, COL_INFO, "Running from %s", pathname); @@ -518,10 +518,10 @@ static void register_wanted_fields(void) register_wanted_field("tracee.sockaddr.sun_path"); // needed for enrich_dynamic_code_loading - register_wanted_field("tracee.args.dynamic_code_loading.triggered_by.alert"); + register_wanted_field("tracee.args.dynamic_code_loading.detected_from.alert"); // needed for enrich_fileless_execution - register_wanted_field("tracee.args.fileless_execution.triggered_by.pathname"); + register_wanted_field("tracee.args.fileless_execution.detected_from.pathname"); // needed for enrich_stdio_over_socket register_wanted_field("tracee.args.stdio_over_socket.File_descriptor"); diff --git a/plugins/epan/tracee-event/packet-tracee.c b/plugins/epan/tracee-event/packet-tracee.c index 846d418..46c4e72 100644 --- a/plugins/epan/tracee-event/packet-tracee.c +++ b/plugins/epan/tracee-event/packet-tracee.c @@ -222,7 +222,7 @@ static gint ett_int_arr = -1; static gint ett_process_lineage = -1; static gint ett_process_lineage_process = -1; static gint ett_root_cause = -1; -static gint ett_triggered_by = -1; +static gint ett_detected_from = -1; static gint ett_arg_obj = -1; static gint ett_arg_obj_arr = -1; static gint ett_http_headers = -1; @@ -2084,45 +2084,45 @@ static gchar *dissect_hooked_symbol_data_arr(tvbuff_t *tvb, packet_info *pinfo, return dissect_object_array_arg(tvb, pinfo, tree, json_data, arg_tok, hf->hfinfo.name, do_dissect_hooked_symbol_data); } -static void dissect_triggered_by(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, +static void dissect_detected_from(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gchar *json_data, jsmntok_t *arg_tok, const gchar *event_name, struct tracee_dissector_data *data) { - proto_item *triggered_by_item; - proto_tree *triggered_by_tree; - jsmntok_t *triggered_by_tok; + proto_item *detected_from_item; + proto_tree *detected_from_tree; + jsmntok_t *detected_from_tok; gint64 tmp_int; gchar *tmp_str; - // create triggered by subtree - triggered_by_item = proto_tree_add_item(tree, proto_tracee, tvb, 0, 0, ENC_NA); - proto_item_set_text(triggered_by_item, "Triggered By"); - triggered_by_tree = proto_item_add_subtree(triggered_by_item, ett_triggered_by); + // create detected from subtree + detected_from_item = proto_tree_add_item(tree, proto_tracee, tvb, 0, 0, ENC_NA); + proto_item_set_text(detected_from_item, "Detected From"); + detected_from_tree = proto_item_add_subtree(detected_from_item, ett_detected_from); - // get triggered by object - DISSECTOR_ASSERT((triggered_by_tok = json_get_object(json_data, arg_tok, "value")) != NULL); + // get detected from object + DISSECTOR_ASSERT((detected_from_tok = json_get_object(json_data, arg_tok, "value")) != NULL); // add id - if (!json_get_int(json_data, triggered_by_tok, "id", &tmp_int)) { - DISSECTOR_ASSERT((tmp_str = json_get_string(json_data, triggered_by_tok, "id")) != NULL); + if (!json_get_int(json_data, detected_from_tok, "id", &tmp_int)) { + DISSECTOR_ASSERT((tmp_str = json_get_string(json_data, detected_from_tok, "id")) != NULL); errno = 0; tmp_int = strtoll(tmp_str, NULL, 10); DISSECTOR_ASSERT(errno == 0); } - proto_tree_add_int64(triggered_by_tree, hf_tiggered_by_id, tvb, 0, 0, tmp_int); + proto_tree_add_int64(detected_from_tree, hf_tiggered_by_id, tvb, 0, 0, tmp_int); // add name - DISSECTOR_ASSERT((tmp_str = json_get_string(json_data, triggered_by_tok, "name")) != NULL); - proto_tree_add_string(triggered_by_tree, hf_tiggered_by_name, tvb, 0, 0, tmp_str); + DISSECTOR_ASSERT((tmp_str = json_get_string(json_data, detected_from_tok, "name")) != NULL); + proto_tree_add_string(detected_from_tree, hf_tiggered_by_name, tvb, 0, 0, tmp_str); if (strlen(tmp_str) > 0) - proto_item_append_text(triggered_by_item, ": %s", tmp_str); + proto_item_append_text(detected_from_item, ": %s", tmp_str); // add return value - DISSECTOR_ASSERT(json_get_int(json_data, triggered_by_tok, "returnValue", &tmp_int)); - proto_tree_add_int64(triggered_by_tree, hf_tiggered_by_return_value, tvb, 0, 0, tmp_int); + DISSECTOR_ASSERT(json_get_int(json_data, detected_from_tok, "returnValue", &tmp_int)); + proto_tree_add_int64(detected_from_tree, hf_tiggered_by_return_value, tvb, 0, 0, tmp_int); // add args - dissect_arguments(tvb, pinfo, triggered_by_tree, json_data, triggered_by_tok, - wmem_strdup_printf(pinfo->pool, "%s.triggered_by", event_name), FALSE, data); + dissect_arguments(tvb, pinfo, detected_from_tree, json_data, detected_from_tok, + wmem_strdup_printf(pinfo->pool, "%s.detected_from", event_name), FALSE, data); } /** @@ -2178,10 +2178,10 @@ static void dissect_arguments(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tre // get hf for this argument hf = get_arg_hf(event_name, json_data, curr_arg); - // special case of trggieredBy argument which will recursively + // special case of triggeredBy/detectedFrom argument which will recursively // call back into dissect_arguments (needs extra parameters) - if (strcmp(arg_type, "unknown") == 0 && strcmp(hf->hfinfo.name, "triggeredBy") == 0) - dissect_triggered_by(tvb, pinfo, tree, json_data, curr_arg, event_name, data); + if (strcmp(arg_type, "unknown") == 0 && (strcmp(hf->hfinfo.name, "triggeredBy") == 0 || strcmp(hf->hfinfo.name, "detectedFrom") == 0)) + dissect_detected_from(tvb, pinfo, tree, json_data, curr_arg, event_name, data); // try dissecting this as a complex arg else if ((dissector = wmem_map_lookup(complex_type_dissectors, arg_type)) != NULL) @@ -2608,7 +2608,7 @@ void proto_register_tracee(void) &ett_process_lineage, &ett_process_lineage_process, &ett_root_cause, - &ett_triggered_by, + &ett_detected_from, &ett_arg_obj, &ett_arg_obj_arr, &ett_http_headers, @@ -2848,19 +2848,19 @@ void proto_register_tracee(void) NULL, HFILL } }, { &hf_tiggered_by_id, - { "Event ID", "tracee.triggered_by.id", + { "Event ID", "tracee.detected_from.id", FT_INT64, BASE_DEC, NULL, 0, - "ID of the event that triggered the signature", HFILL } + "ID of the event that the signature was detected from", HFILL } }, { &hf_tiggered_by_name, - { "Event Name", "tracee.triggered_by.name", + { "Event Name", "tracee.detected_from.name", FT_STRINGZ, BASE_NONE, NULL, 0, - "Name of the event that triggered the signature", HFILL } + "Name of the event that the signature was detected from", HFILL } }, { &hf_tiggered_by_return_value, - { "Return Value", "tracee.triggered_by.return_value", + { "Return Value", "tracee.detected_from.return_value", FT_INT64, BASE_DEC, NULL, 0, - "Return value of the event that triggered the signature", HFILL } + "Return value of the event that the signature was detected from", HFILL } }, { &hf_metadata_version, { "Version", "tracee.metadata.Version",