Open configures and starts traces and event consumers.
(config *config.Config)
| 118 | |
| 119 | // Open configures and starts traces and event consumers. |
| 120 | func (e *EventSource) Open(config *config.Config) error { |
| 121 | // set up drop masks if the rule engine |
| 122 | // is enabled. For any event not present |
| 123 | // in the rule set, the drop mask instructs |
| 124 | // to reject the event as soon as it is consumed |
| 125 | // from the session buffer. Config value takes |
| 126 | // precedence over rules compile result flag. |
| 127 | // For example, if the CreateThread event is |
| 128 | // used by the rules, but thread events are |
| 129 | // disabled in the config, then thread events |
| 130 | // are not captured |
| 131 | if e.r != nil { |
| 132 | config.EventSource.EnableThreadEvents = config.EventSource.EnableThreadEvents && e.r.HasThreadEvents |
| 133 | config.EventSource.EnableModuleEvents = config.EventSource.EnableModuleEvents && e.r.HasModuleEvents |
| 134 | config.EventSource.EnableNetEvents = config.EventSource.EnableNetEvents && e.r.HasNetworkEvents |
| 135 | config.EventSource.EnableRegistryEvents = config.EventSource.EnableRegistryEvents && (e.r.HasRegistryEvents || (config.Yara.Enabled && !config.Yara.SkipRegistry)) |
| 136 | config.EventSource.EnableFileIOEvents = config.EventSource.EnableFileIOEvents && (e.r.HasFileEvents || (config.Yara.Enabled && !config.Yara.SkipFiles)) |
| 137 | config.EventSource.EnableVAMapEvents = config.EventSource.EnableVAMapEvents && (e.r.HasVAMapEvents || (config.Yara.Enabled && !config.Yara.SkipMmaps)) |
| 138 | config.EventSource.EnableMemEvents = config.EventSource.EnableMemEvents && (e.r.HasMemEvents || (config.Yara.Enabled && !config.Yara.SkipAllocs)) |
| 139 | config.EventSource.EnableDNSEvents = config.EventSource.EnableDNSEvents && e.r.HasDNSEvents |
| 140 | config.EventSource.EnableAuditAPIEvents = config.EventSource.EnableAuditAPIEvents && e.r.HasAuditAPIEvents |
| 141 | config.EventSource.EnableThreadpoolEvents = config.EventSource.EnableThreadpoolEvents && e.r.HasThreadpoolEvents |
| 142 | for _, typ := range event.All() { |
| 143 | if typ == event.CreateProcess || typ == event.TerminateProcess || |
| 144 | typ == event.LoadModule || typ == event.UnloadModule { |
| 145 | // always allow fundamental events |
| 146 | continue |
| 147 | } |
| 148 | |
| 149 | // allow events required for memory/file scanning |
| 150 | if typ == event.MapViewFile && config.Yara.Enabled && !config.Yara.SkipMmaps { |
| 151 | continue |
| 152 | } |
| 153 | if typ == event.VirtualAlloc && config.Yara.Enabled && !config.Yara.SkipAllocs { |
| 154 | continue |
| 155 | } |
| 156 | if typ == event.CreateFile && config.Yara.Enabled && !config.Yara.SkipFiles { |
| 157 | continue |
| 158 | } |
| 159 | if typ == event.RegSetValue && config.Yara.Enabled && !config.Yara.SkipRegistry { |
| 160 | continue |
| 161 | } |
| 162 | |
| 163 | if !e.r.ContainsEvent(typ) { |
| 164 | config.EventSource.SetDropMask(typ) |
| 165 | } |
| 166 | } |
| 167 | } |
| 168 | |
| 169 | // security telemetry trace hosts all ETW providers but NT Kernel Logger |
| 170 | trace := NewTrace(etw.SecurityTelemetrySession, config) |
| 171 | |
| 172 | // Windows Kernel Process session permits enriching event state with |
| 173 | // additional attributes and guaranteeing that any event published by |
| 174 | // the security telemetry session doesn't miss its respective process |
| 175 | // from the snapshotter |
| 176 | trace.AddProvider(etw.WindowsKernelProcessGUID, false, WithKeywords(etw.ProcessKeyword|etw.ImageKeyword), WithCaptureState()) |
| 177 |