File Integrity Monitoring | User Information - Linux | KProbe Backend

[Tacklebox]

This is a subtask of #7401 to track tasks related specifically to the KProbe backend for the FIM module in auditbeat

Targeting 8.13 FF

Tasks

Beta Give feedback

1. Implement tk-btf library to support generating kprobe strings from btf symbols
2. Implement runtime verification of probes for FIM
3. Implement in memory data structure to react and filter probe events and monitor the given paths from the auditbeat configuration
4. Align with ebpf implementation of FIM's ECS structure and implement events reader
5. Investigate e2e coverage and implement necessary tests to ensure end to end coverage
6. support reporting uid and gid of pid that caused the file event utilising the add_process_metadata processor
7. update auditbeat running on docker page to capture the requirements of FIM with kprobes backend
8. support input metrics [not required for completion]

[pkoutsovasilis]

all of the above tasks are captured in this PR.

[pkoutsovasilis]

PRs pending to be merged

• [Auditbeat] fim(ebpf): enrich file events with process data beats#38199
• [Auditbeat] fim(ebpf): enrich file events with container id beats#38328
• [Auditbeat] fim(kprobes): enrich file events by coupling add_process_metadata processor beats#38716
• Add backend configuration key to fim integration #8807

when all the above are merged FIM can report uid and gid for both ebpf and kprobes backends

[norrietaylor]

@pkoutsovasilis can we mark this as done?

[pkoutsovasilis]

@pkoutsovasilis can we mark this as done?

I think that yes; the metrics is something that we need to discuss whether it makes sense to have or not and how to make it for all FIM backends. Now about the docs we should do it but when the kprobes BE hits GA. Sounds good to you?

[norrietaylor]

marking done, tracking further work in parent epic.