func (cache *Cache) EnrichEvent(event model.ProbeEvent) bool {
	// Check if the cache entry has already been set by a previous round
	nsEntry := event.GetNamespaceCacheData()
	nsInCache := true
	if nsEntry == nil {
		// Find or create the container namespace cache entry
		nsEntry, nsInCache = cache.NamespaceCache.LookupNamespace(event.GetNetns(), event.GetTimestamp())
		event.SetNamespaceCacheData(nsEntry)
	}
	switch event.GetEventType() {
	case model.ContainerRunningEventType:
		containerEvt := event.(*model.ContainerEvent)
		// If this event is a container creation event, update the cache
		nsEntry.Lock()
		nsEntry.Name = containerEvt.ContainerName
		nsEntry.ID = containerEvt.ContainerID
		nsEntry.Base = containerEvt.Image
		nsEntry.Digest = containerEvt.Digest
		nsEntry.Pod = containerEvt.Labels["io.kubernetes.pod.name"]
		nsEntry.Namespace = containerEvt.Labels["io.kubernetes.pod.namespace"]
		nsEntry.Unlock()
		return true
	case model.ContainerDestroyedEventType:
		containerEvt := event.(*model.ContainerEvent)
		// If this event is a container deletion event, set the exit time in cache
		exitTime := containerEvt.FinishedAt
		nsEntry.Lock()
		nsEntry.ExitTime = &exitTime
		nsEntry.Unlock()
		return true
	default:
		// Check if the cache entry has already been set by a previous round
		pEntry := event.GetProcessCacheData()
		pInCache := true
		if pEntry == nil {
			// if this isn't a container related event, also grab the process cache entry
			var err error
			pEntry, pInCache, err = cache.ProcessCache.LookupPid(event.GetPid(), event.GetTimestamp())
			if err != nil {
				return false
			}
			event.SetProcessCacheData(pEntry)
		}
		switch event.GetEventType() {
		case model.ExecEventType:
			// If this event is a process exec event, update the cache
			pEvt := event.(*model.ExecEvent)
			ts := pEvt.Timestamp
			pEntry.Lock()
			pEntry.BinaryPath = pEvt.Path
			pEntry.ExecveTime = &ts
			pEntry.Pid = pEvt.Metadata.PID
			pEntry.TTYName = pEvt.TTYName
			if pEntry.ExitTime != nil {
				if pEntry.ExitTime.Before(ts) {
					// This can happen if the process just changed namespace
					pEntry.ExitTime = nil
				}
			}
			pEntry.Unlock()
			pInCache = true
		case model.ExitEventType:
			// If this event is a process exit event, set the exit time in cache
			pEvt := event.(*model.ExecEvent)
			ts := pEvt.Timestamp
			pEntry.Lock()
			if pEntry.ExecveTime != nil {
				if pEntry.ExecveTime.Before(ts) {
					// This opposite can happen if the process just changed namespace
					pEntry.ExitTime = &ts
				}
			}
			pEntry.Unlock()
		case model.ForkEventType:
			// If this event is a fork event, prepare cache for the child process
			pEvt := event.(*model.ForkEvent)
			if pEvt.IsNewProcess() {
				childEntry, _, err := cache.ProcessCache.LookupPid(pEvt.ChildPid, pEvt.GetTimestamp())
				if err == nil {
					childEntry.Lock()
					if childEntry.ExecveTime == nil || len(childEntry.BinaryPath) == 0 {
						childEntry.BinaryPath = pEntry.BinaryPath
						childEntry.ExecveTime = pEntry.ExecveTime
						childEntry.TTYName = pEntry.TTYName
					}
					childEntry.Pid = pEvt.ChildPid
					childEntry.Ppid = pEvt.Metadata.PID
					if pEntry.BinaryPath != "" {
						childEntry.Parent = pEntry
					}
					ts := pEvt.Timestamp
					childEntry.ForkTime = &ts
					childEntry.Unlock()
				}
			}
		}
		return nsInCache && pInCache
	}
}
// EnrichEvent - Enrich event with process and container data. This function will return false
// if either the namespace or the process weren't in cache, or if they were in cache but aren't
// linked to a container or a process yet. Whatever the initial state of the cache, when this
// function returns, a new entry in cache will be created and ready to be used.
Enrich event with process and container data. This function will return false
if either the namespace or the process weren't in cache, or if they were in cache but aren't
linked to a container or a process yet. Whatever the initial state of the cache, when this
function returns, a new entry in cache will be created and ready to be used.
// EnrichEvent - Enrich event with process and container data . This function will return false // if either the namespace or the process weren ' t in cache or if they were in cache but aren ' t // linked to a container or a process yet . Whatever the initial state of the cache when this // function returns a new entry in cache will be created and ready to be used .
func (cache *Cache) EnrichEvent(event model.ProbeEvent) bool {
	nsEntry := event.GetNamespaceCacheData()
	nsInCache := true
	if nsEntry == nil {
		nsEntry, nsInCache = cache.NamespaceCache.LookupNamespace(event.GetNetns(), event.GetTimestamp())
		event.SetNamespaceCacheData(nsEntry)
	}
	switch event.GetEventType() {
	case model.ContainerRunningEventType:
		containerEvt := event.(*model.ContainerEvent)
		nsEntry.Lock()
		nsEntry.Name = containerEvt.ContainerName
		nsEntry.ID = containerEvt.ContainerID
		nsEntry.Base = containerEvt.Image
		nsEntry.Digest = containerEvt.Digest
		nsEntry.Pod = containerEvt.Labels["io.kubernetes.pod.name"]
		nsEntry.Namespace = containerEvt.Labels["io.kubernetes.pod.namespace"]
		nsEntry.Unlock()
		return true
	case model.ContainerDestroyedEventType:
		containerEvt := event.(*model.ContainerEvent)
		exitTime := containerEvt.FinishedAt
		nsEntry.Lock()
		nsEntry.ExitTime = &exitTime
		nsEntry.Unlock()
		return true
	default:
		pEntry := event.GetProcessCacheData()
		pInCache := true
		if pEntry == nil {
			var err error
			pEntry, pInCache, err = cache.ProcessCache.LookupPid(event.GetPid(), event.GetTimestamp())
			if err != nil {
				return false
			}
			event.SetProcessCacheData(pEntry)
		}
		switch event.GetEventType() {
		case model.ExecEventType:
			pEvt := event.(*model.ExecEvent)
			ts := pEvt.Timestamp
			pEntry.Lock()
			pEntry.BinaryPath = pEvt.Path
			pEntry.ExecveTime = &ts
			pEntry.Pid = pEvt.Metadata.PID
			pEntry.TTYName = pEvt.TTYName
			if pEntry.ExitTime != nil {
				if pEntry.ExitTime.Before(ts) {
					pEntry.ExitTime = nil
				}
			}
			pEntry.Unlock()
			pInCache = true
		case model.ExitEventType:
			pEvt := event.(*model.ExecEvent)
			ts := pEvt.Timestamp
			pEntry.Lock()
			if pEntry.ExecveTime != nil {
				if pEntry.ExecveTime.Before(ts) {
					pEntry.ExitTime = &ts
				}
			}
			pEntry.Unlock()
		case model.ForkEventType:
			pEvt := event.(*model.ForkEvent)
			if pEvt.IsNewProcess() {
				childEntry, _, err := cache.ProcessCache.LookupPid(pEvt.ChildPid, pEvt.GetTimestamp())
				if err == nil {
					childEntry.Lock()
					if childEntry.ExecveTime == nil || len(childEntry.BinaryPath) == 0 {
						childEntry.BinaryPath = pEntry.BinaryPath
						childEntry.ExecveTime = pEntry.ExecveTime
						childEntry.TTYName = pEntry.TTYName
					}
					childEntry.Pid = pEvt.ChildPid
					childEntry.Ppid = pEvt.Metadata.PID
					if pEntry.BinaryPath != "" {
						childEntry.Parent = pEntry
					}
					ts := pEvt.Timestamp
					childEntry.ForkTime = &ts
					childEntry.Unlock()
				}
			}
		}
		return nsInCache && pInCache
	}
}
func ( cache * Cache ) EnrichEvent ( event model . ProbeEvent ) bool { nsEntry := event . GetNamespaceCacheData ( ) nsInCache := true if nsEntry == nil { nsEntry , nsInCache = cache . NamespaceCache . LookupNamespace ( event . GetNetns ( ) , event . GetTimestamp ( ) ) event . SetNamespaceCacheData ( nsEntry ) } switch event . GetEventType ( ) { case model . ContainerRunningEventType : containerEvt := event . ( * model . ContainerEvent ) nsEntry . Lock ( ) nsEntry . Name = containerEvt . ContainerName nsEntry . ID = containerEvt . ContainerID nsEntry . Base = containerEvt . Image nsEntry . Digest = containerEvt . Digest nsEntry . Pod = containerEvt . Labels [ " " ] nsEntry . Namespace = containerEvt . Labels [ " " ] nsEntry . Unlock ( ) return true case model . ContainerDestroyedEventType : containerEvt := event . ( * model . ContainerEvent ) exitTime := containerEvt . FinishedAt nsEntry . Lock ( ) nsEntry . ExitTime = & exitTime nsEntry . Unlock ( ) return true default : pEntry := event . GetProcessCacheData ( ) pInCache := true if pEntry == nil { var err error pEntry , pInCache , err = cache . ProcessCache . LookupPid ( event . GetPid ( ) , event . GetTimestamp ( ) ) if err != nil { return false } event . SetProcessCacheData ( pEntry ) } switch event . GetEventType ( ) { case model . ExecEventType : pEvt := event . ( * model . ExecEvent ) ts := pEvt . Timestamp pEntry . Lock ( ) pEntry . BinaryPath = pEvt . Path pEntry . ExecveTime = & ts pEntry . Pid = pEvt . Metadata . PID pEntry . TTYName = pEvt . TTYName if pEntry . ExitTime != nil { if pEntry . ExitTime . Before ( ts ) { pEntry . ExitTime = nil } } pEntry . Unlock ( ) pInCache = true case model . ExitEventType : pEvt := event . ( * model . ExecEvent ) ts := pEvt . Timestamp pEntry . Lock ( ) if pEntry . ExecveTime != nil { if pEntry . ExecveTime . Before ( ts ) { pEntry . ExitTime = & ts } } pEntry . Unlock ( ) case model . ForkEventType : pEvt := event . ( * model . ForkEvent ) if pEvt . IsNewProcess ( ) { childEntry , _ , err := cache . ProcessCache . LookupPid ( pEvt . ChildPid , pEvt . GetTimestamp ( ) ) if err == nil { childEntry . Lock ( ) if childEntry . ExecveTime == nil || len ( childEntry . BinaryPath ) == 0 { childEntry . BinaryPath = pEntry . BinaryPath childEntry . ExecveTime = pEntry . ExecveTime childEntry . TTYName = pEntry . TTYName } childEntry . Pid = pEvt . ChildPid childEntry . Ppid = pEvt . Metadata . PID if pEntry . BinaryPath != " " { childEntry . Parent = pEntry } ts := pEvt . Timestamp childEntry . ForkTime = & ts childEntry . Unlock ( ) } } } return nsInCache && pInCache } }
Enrich event with process and container data.
Enrich event with process and container data .
// Check if the cache entry has already been set by a previous round // Find or create the container namespace cache entry // If this event is a container creation event, update the cache // If this event is a container deletion event, set the exit time in cache // Check if the cache entry has already been set by a previous round // if this isn't a container related event, also grab the process cache entry // If this event is a process exec event, update the cache // This can happen if the process just changed namespace // If this event is a process exit event, set the exit time in cache // This opposite can happen if the process just changed namespace // If this event is a fork event, prepare cache for the child process