Skip to content

Fix: "triggeredBy" was renamed to "detectedFrom" #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oshaked1 merged 1 commit into from
Nov 13, 2025
Merged

Fix: "triggeredBy" was renamed to "detectedFrom" #67

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/features.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,7 @@ For an overview of display columns see [Columns](#columns).

### Signatures

Tracee signatures have some extra information in them, which can be seen in the dissection tree. The ***Triggered By*** tree contains the event which triggered the signature, together with its own arguments. The ***Metadata*** tree contains information about the signature, including its name, description, severity level, attack technique and more.
Tracee signatures have some extra information in them, which can be seen in the dissection tree. The ***Detected From*** tree contains the event which the signature was detected from, together with its own arguments. The ***Metadata*** tree contains information about the signature, including its name, description, severity level, attack technique and more.

![](img/signature.png)

Expand Down
8 changes: 4 additions & 4 deletions plugins/epan/tracee-event/enrichments.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ static int enrich_dynamic_code_loading(tvbuff_t *tvb _U_, packet_info *pinfo, pr
const struct field_value *alert;
const gchar *alert_str = NULL;

if ((alert = wanted_field_get_one("tracee.args.dynamic_code_loading.triggered_by.alert")) == NULL)
if ((alert = wanted_field_get_one("tracee.args.dynamic_code_loading.detected_from.alert")) == NULL)
return 0;

if (alert->type == FIELD_TYPE_STRING)
Expand All @@ -193,7 +193,7 @@ static int enrich_dynamic_code_loading(tvbuff_t *tvb _U_, packet_info *pinfo, pr

static int enrich_fileless_execution(tvbuff_t *tvb _U_, packet_info *pinfo, proto_tree *tree _U_, void *data _U_)
{
const gchar *pathname = wanted_field_get_str("tracee.args.fileless_execution.triggered_by.pathname");
const gchar *pathname = wanted_field_get_str("tracee.args.fileless_execution.detected_from.pathname");

if (pathname)
col_append_fstr(pinfo->cinfo, COL_INFO, "Running from %s", pathname);
Expand Down Expand Up @@ -518,10 +518,10 @@ static void register_wanted_fields(void)
register_wanted_field("tracee.sockaddr.sun_path");

// needed for enrich_dynamic_code_loading
register_wanted_field("tracee.args.dynamic_code_loading.triggered_by.alert");
register_wanted_field("tracee.args.dynamic_code_loading.detected_from.alert");

// needed for enrich_fileless_execution
register_wanted_field("tracee.args.fileless_execution.triggered_by.pathname");
register_wanted_field("tracee.args.fileless_execution.detected_from.pathname");

// needed for enrich_stdio_over_socket
register_wanted_field("tracee.args.stdio_over_socket.File_descriptor");
Expand Down
62 changes: 31 additions & 31 deletions plugins/epan/tracee-event/packet-tracee.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,7 +222,7 @@ static gint ett_int_arr = -1;
static gint ett_process_lineage = -1;
static gint ett_process_lineage_process = -1;
static gint ett_root_cause = -1;
static gint ett_triggered_by = -1;
static gint ett_detected_from = -1;
static gint ett_arg_obj = -1;
static gint ett_arg_obj_arr = -1;
static gint ett_http_headers = -1;
Expand Down Expand Up @@ -2084,45 +2084,45 @@ static gchar *dissect_hooked_symbol_data_arr(tvbuff_t *tvb, packet_info *pinfo,
return dissect_object_array_arg(tvb, pinfo, tree, json_data, arg_tok, hf->hfinfo.name, do_dissect_hooked_symbol_data);
}

static void dissect_triggered_by(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
static void dissect_detected_from(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
gchar *json_data, jsmntok_t *arg_tok, const gchar *event_name, struct tracee_dissector_data *data)
{
proto_item *triggered_by_item;
proto_tree *triggered_by_tree;
jsmntok_t *triggered_by_tok;
proto_item *detected_from_item;
proto_tree *detected_from_tree;
jsmntok_t *detected_from_tok;
gint64 tmp_int;
gchar *tmp_str;

// create triggered by subtree
triggered_by_item = proto_tree_add_item(tree, proto_tracee, tvb, 0, 0, ENC_NA);
proto_item_set_text(triggered_by_item, "Triggered By");
triggered_by_tree = proto_item_add_subtree(triggered_by_item, ett_triggered_by);
// create detected from subtree
detected_from_item = proto_tree_add_item(tree, proto_tracee, tvb, 0, 0, ENC_NA);
proto_item_set_text(detected_from_item, "Detected From");
detected_from_tree = proto_item_add_subtree(detected_from_item, ett_detected_from);

// get triggered by object
DISSECTOR_ASSERT((triggered_by_tok = json_get_object(json_data, arg_tok, "value")) != NULL);
// get detected from object
DISSECTOR_ASSERT((detected_from_tok = json_get_object(json_data, arg_tok, "value")) != NULL);

// add id
if (!json_get_int(json_data, triggered_by_tok, "id", &tmp_int)) {
DISSECTOR_ASSERT((tmp_str = json_get_string(json_data, triggered_by_tok, "id")) != NULL);
if (!json_get_int(json_data, detected_from_tok, "id", &tmp_int)) {
DISSECTOR_ASSERT((tmp_str = json_get_string(json_data, detected_from_tok, "id")) != NULL);
errno = 0;
tmp_int = strtoll(tmp_str, NULL, 10);
DISSECTOR_ASSERT(errno == 0);
}
proto_tree_add_int64(triggered_by_tree, hf_tiggered_by_id, tvb, 0, 0, tmp_int);
proto_tree_add_int64(detected_from_tree, hf_tiggered_by_id, tvb, 0, 0, tmp_int);

// add name
DISSECTOR_ASSERT((tmp_str = json_get_string(json_data, triggered_by_tok, "name")) != NULL);
proto_tree_add_string(triggered_by_tree, hf_tiggered_by_name, tvb, 0, 0, tmp_str);
DISSECTOR_ASSERT((tmp_str = json_get_string(json_data, detected_from_tok, "name")) != NULL);
proto_tree_add_string(detected_from_tree, hf_tiggered_by_name, tvb, 0, 0, tmp_str);
if (strlen(tmp_str) > 0)
proto_item_append_text(triggered_by_item, ": %s", tmp_str);
proto_item_append_text(detected_from_item, ": %s", tmp_str);

// add return value
DISSECTOR_ASSERT(json_get_int(json_data, triggered_by_tok, "returnValue", &tmp_int));
proto_tree_add_int64(triggered_by_tree, hf_tiggered_by_return_value, tvb, 0, 0, tmp_int);
DISSECTOR_ASSERT(json_get_int(json_data, detected_from_tok, "returnValue", &tmp_int));
proto_tree_add_int64(detected_from_tree, hf_tiggered_by_return_value, tvb, 0, 0, tmp_int);

// add args
dissect_arguments(tvb, pinfo, triggered_by_tree, json_data, triggered_by_tok,
wmem_strdup_printf(pinfo->pool, "%s.triggered_by", event_name), FALSE, data);
dissect_arguments(tvb, pinfo, detected_from_tree, json_data, detected_from_tok,
wmem_strdup_printf(pinfo->pool, "%s.detected_from", event_name), FALSE, data);
}

/**
Expand Down Expand Up @@ -2178,10 +2178,10 @@ static void dissect_arguments(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tre
// get hf for this argument
hf = get_arg_hf(event_name, json_data, curr_arg);

// special case of trggieredBy argument which will recursively
// special case of triggeredBy/detectedFrom argument which will recursively
// call back into dissect_arguments (needs extra parameters)
if (strcmp(arg_type, "unknown") == 0 && strcmp(hf->hfinfo.name, "triggeredBy") == 0)
dissect_triggered_by(tvb, pinfo, tree, json_data, curr_arg, event_name, data);
if (strcmp(arg_type, "unknown") == 0 && (strcmp(hf->hfinfo.name, "triggeredBy") == 0 || strcmp(hf->hfinfo.name, "detectedFrom") == 0))
dissect_detected_from(tvb, pinfo, tree, json_data, curr_arg, event_name, data);

// try dissecting this as a complex arg
else if ((dissector = wmem_map_lookup(complex_type_dissectors, arg_type)) != NULL)
Expand Down Expand Up @@ -2608,7 +2608,7 @@ void proto_register_tracee(void)
&ett_process_lineage,
&ett_process_lineage_process,
&ett_root_cause,
&ett_triggered_by,
&ett_detected_from,
&ett_arg_obj,
&ett_arg_obj_arr,
&ett_http_headers,
Expand Down Expand Up @@ -2848,19 +2848,19 @@ void proto_register_tracee(void)
NULL, HFILL }
},
{ &hf_tiggered_by_id,
{ "Event ID", "tracee.triggered_by.id",
{ "Event ID", "tracee.detected_from.id",
FT_INT64, BASE_DEC, NULL, 0,
"ID of the event that triggered the signature", HFILL }
"ID of the event that the signature was detected from", HFILL }
},
{ &hf_tiggered_by_name,
{ "Event Name", "tracee.triggered_by.name",
{ "Event Name", "tracee.detected_from.name",
FT_STRINGZ, BASE_NONE, NULL, 0,
"Name of the event that triggered the signature", HFILL }
"Name of the event that the signature was detected from", HFILL }
},
{ &hf_tiggered_by_return_value,
{ "Return Value", "tracee.triggered_by.return_value",
{ "Return Value", "tracee.detected_from.return_value",
FT_INT64, BASE_DEC, NULL, 0,
"Return value of the event that triggered the signature", HFILL }
"Return value of the event that the signature was detected from", HFILL }
},
{ &hf_metadata_version,
{ "Version", "tracee.metadata.Version",
Expand Down
Loading