参照資料: 警告テンプレートのスキーマ

このセクションでは、警告テンプレートで使用する警告スキーマについて説明します。

「種類」列で定義されている種類は、ネイティブの Go の種類か、ソフォスが定義したカスタムの種類です。このドキュメントでは、ネイティブの Go の種類には小文字の名前を使用し、カスタムの種類には大文字の名前を使用します。以下で定義するカスタムの種類すべてに対して、独自のセクションがあります。「使用例」列には、コピーして、特定の使用例のテンプレートに貼り付けることができるテンプレートの例が表示されます。入れ子のフィールドの場合、アクセスに必要な親フィールドの名前が含まれています (例: {{.ProcessInfo.Program}})。スライスの場合、データには range アクションや index 関数 (例: {{range .Lineage}} {{.Program.Path}} {{end}}) を使用してアクセスできます。ここで紹介する使用例は、警告テンプレートで警告フィールドを使用する唯一の方法ではないことに注意してください。警告スキーマは、JSON 形式と警告テンプレート形式では異なります。そのため、このドキュメントを参照することが重要です。詳細は、警告設定テンプレートを参照してください。

警告

警告は、Sophos Linux Sensor の最上位レベルの警告の種類です。

Field	Type	Description	Usage Example
GroupID	string	The Unix group ID.	{{.GroupID}}
Timestamp	int64	The Unix timestamp of when the Alert was generated.	{{.Timestamp}}
Description	string	The description of the Alert from Policy.	{{.Description}}
Comments	string	The comments on the Alert from Policy.	{{.Comments}}
UUID	string	The Universally Unique ID for this Alert.	{{.UUID}}
AlertLabels	map[string]string	The Alert labels from Policy.	{{.AlertLabels}}
Priority	Priority	The Alert's priority.	{{.Priority}}
Confidence	Confidence	The confidence that the Alert is not a false positive.	{{.Confidence}}
Location	AlertLocation	The location of where the Alert was generated.	{{.Location}}
ProcessInfo	ProcessInfo	The information about the process that generated the Alert (if available).	{{.ProcessInfo}}
Lineage	[]ProcessInfo	The information about both the process and program's lineage (if enabled).	{{.Lineage}}
StrategyName	string	The name and release version of the Policy.	{{.StrategyName}}
PolicyType	Policy	The Policy's type (for example Program).	{{.PolicyType}}
Scope	Scope	The scope of the Alert's process.	{{.Scope}}
Notifications	[]AlertNotification	The notifications associated with the Alert and its response actions.	{{.Notifications}}
MatchedObjects	[]AlertFilterMatch	The objects that were matched that caused the Alert.	{{.MatchedObjects}}
MatchedRule	string	The policy rule that was matched that caused the Alert.	{{.MatchedRule}}
Metadata	map[string]string	The system metadata from the Alert process' host.	{{.Metadata}}
Categories	string	The MITRE categories this Alert belongs to.	{{.Categories}}

AlertLocation

AlertLocation には、警告の Location フィールドからアクセスできます。

Field	Type	Description	Usage Example
NodeName	string	Node name is the host name of the underlying node.	{{.Location.NodeName}}
PodName	string	Pod name from Kubernetes.	{{.Location.PodName}}
K8sNamespace	string	K8sNamespace is the kubernetes name space for the pod.	{{.Location.K8sNamespace}}
ContainerID	string	Unique Identifier for a running Container Instance.	{{.Location.ContainerID}}
ContainerName	string	Container Name a string name assigned to the container.	{{.Location.ContainerName}}
ImageID	string	Unique Image ID that the container was built from.	{{.Location.ImageID}}
ImageName	string	String name of the Image that the Container was built from.	{{.Location.ImageName}}
SensorID	string	The unique identifier for the sensor that this container is running on.	{{.Location.SensorID}}

AlertNotification

AlertNotification には、スライスである警告の Notifications フィールドからアクセスできます。

Field	Type	Description	Usage Example
Timestamp	int64	The timestamp of the notification.	{{range .Notifications}} {{.Timestamp}} {{end}}
Name	string	The name of the notification.	{{range .Notifications}} {{.Name}} {{end}}
ActorUUID	string	The UUID of the notification's actor.	{{range .Notifications}} {{.ActorUUID}} {{end}}
Message	string	The message associated with the notification.	{{range .Notifications}} {{.Message}} {{end}}
MessageFields	AlertMessageFields	The message fields associated with the notification.	{{range .Notifications}} {{.MessageFields}} {{end}}

AlertMessageFields

AlertMessageFields には、警告の Notification の MessageFields からアクセスできます。

Field	Type	Description	Usage Example
ActionType	string	The type of response action taken for example "kill" or "stop".	{{range .Notifications}} {{.MessageFields.ActionType}} {{end}}
ActionTargetType	string	The type of target a response action is being taken against for example "process" or "container".	{{range .Notifications}} {{.MessageFields.ActionTargetType}} {{end}}
ActionResult	string	The outcome of a given action for example "successful" or "unsuccessful".	{{range .Notifications}} {{.MessageFields.ActionResult}} {{end}}
ActionResultDetails	string	Additional messages about the action's outcome.	{{range .Notifications}} {{.MessageFields.ActionResultDetails}} {{end}}
ConnectionDirection	string	The inbound/outbound nature of a network event.	{{range .Notifications}} {{.MessageFields.ConnectionDirection}} {{end}}
DisabledMechanism	string	The disabled security mechanism referenced in an alert.	{{range .Notifications}} {{.MessageFields.DisabledMechanism}} {{end}}
FilePath	string	The file path in a relevant event.	{{range .Notifications}} {{.MessageFields.FilePath}} {{end}}
FileSHA256Hash	string	The calculated content hash of the file at FilePath.	{{range .Notifications}} {{.MessageFields.FileSHA256Hash}} {{end}}
SourceFilePath	string	The source file path that was linked or moved into FilePath in a relevant event.	{{range .Notifications}} {{.MessageFields.SourceFilePath}} {{end}}
InstanceCount	int32	The number of times the relevant event occurred.	{{range .Notifications}} {{.MessageFields.InstanceCount}} {{end}}
KernelFunction	string	The kernel function in a kernel payload event.	{{range .Notifications}} {{.MessageFields.KernelFunction}} {{end}}
LocalPort	uint16	The local port in a network event.	{{range .Notifications}} {{.MessageFields.LocalPort}} {{end}}
ModifiedCredentialFields	string	The lists cred struct members that changed.	{{range .Notifications}} {{.MessageFields.ModifiedCredentialFields}} {{end}}
ModuleName	string	The kernel module loaded.	{{range .Notifications}} {{.MessageFields.ModuleName}} {{end}}
NewPermissionsMask	string	The octal version of new file permissions.	{{range .Notifications}} {{.MessageFields.NewPermissionsMask}} {{end}}
NewPermissionsStrings	string	The string list of new file permissions.	{{range .Notifications}} {{.MessageFields.NewPermissionsStrings}} {{end}}
NewUid	int32	The newly assigned uid.	{{range .Notifications}} {{.MessageFields.NewUid}} {{end}}
NewEuid	int32	The newly assigned euid.	{{range .Notifications}} {{.MessageFields.NewEuid}} {{end}}
NewSuid	int32	The newly assigned suid.	{{range .Notifications}} {{.MessageFields.NewSuid}} {{end}}
NewFsuid	int32	The newly assigned fsuid.	{{range .Notifications}} {{.MessageFields.NewFsuid}} {{end}}
NewGid	int32	The newly assigned gid.	{{range .Notifications}} {{.MessageFields.NewGid}} {{end}}
NewEgid	int32	The newly assigned egid.	{{range .Notifications}} {{.MessageFields.NewEgid}} {{end}}
NewSgid	int32	The newly assigned sgid.	{{range .Notifications}} {{.MessageFields.NewSgid}} {{end}}
NewFsgid	int32	The newly assigned fsgid.	{{range .Notifications}} {{.MessageFields.NewFsgid}} {{end}}
PtraceAction	string	The ptrace method used against a process.	{{range .Notifications}} {{.MessageFields.PtraceAction}} {{end}}
RemoteHost	string	The remote host in a network event.	{{range .Notifications}} {{.MessageFields.RemoteHost}} {{end}}
RemotePort	uint16	The remote port in a network event.	{{range .Notifications}} {{.MessageFields.RemotePort}} {{end}}
SystemCall	string	The syscall name referenced in an alert.	{{range .Notifications}} {{.MessageFields.SystemCall}} {{end}}
DurationUnits	string	The time unit in which relevant events occurred.	{{range .Notifications}} {{.MessageFields.DurationUnits}} {{end}}
DurationValue	float64	The number of time units in which relevant events occurred.	{{range .Notifications}} {{.MessageFields.DurationValue}} {{end}}
ModifiedElements	[]ModifiedElement	A map of elements that have changed, along with their old and new values.	{{range .Notifications}} {{.MessageFields.ModifiedElements}} {{end}}
Operations	string	The list of operations that were performed during the event.	{{range .Notifications}} {{.MessageFields.Operations}} {{end}}

ModifiedElement

ModifiedElement には、スライスである警告の Notifications フィールドの MessageFields.ModifiedElements からアクセスできます。

Field	Type	Description	Usage Example
ElementName	string	The element's name.	{{range .Notifications}} {{range .MessageFields.ModifiedElements}} {{.ElementName}} {{end}} {{end}}
ExpectedValue	string	The "normal" value.	{{range .Notifications}} {{range .MessageFields.ModifiedElements}} {{.ExpectedValue}} {{end}} {{end}}
PreviousValue	string	The element's old value.	{{range .Notifications}} {{range .MessageFields.ModifiedElements}} {{.PreviousValue}} {{end}} {{end}}
NewValue	string	The element's new value.	{{range .Notifications}} {{range .MessageFields.ModifiedElements}} {{.NewValue}} {{end}} {{end}}

AlertFilterMatch

AlertFilterMatch には、スライスである警告の MatchedObjects フィールドからアクセスできます。

Field	Type	Description	Usage Example
MatchedField	string	The field name.	{{range .MatchedObjects}} {{.MatchedField}} {{end}}
MatchedValue	string	The field value.	{{range .MatchedObjects}} {{.MatchedValue}} {{end}}
MatchOperator	string	The operator used in the comparison.	{{range .MatchedObjects}} {{.MatchOperator}} {{end}}
MatchedPattern	string	What the field name was matched to.	{{range .MatchedObjects}} {{.MatchedPattern}} {{end}}
MatchedDescription	string	The user-supplied description of the pattern.	{{range .MatchedObjects}} {{.MatchedDescription}} {{end}}

ProcessInfo

ProcessInfo には、警告の ProcessInfo フィールドと、スライスである警告の Lineage フィールドからアクセスできます。

以下にある使用例は、警告の ProcessInfo フィールドを使用したより簡単なパスを示しています。

警告の Lineage フィールドを使用してアクセスするには、次の手順を実行します。

{{range .Lineage}} {{.$FIELD}} {{end}}

$FIELD は、任意のフィールド名 (例: Uuid) で置き換えてください。

Field	Type	Description	Usage Example
Uuid	string	The UUID of this process.	{{.ProcessInfo.Uuid}}
TimestampHostMono	uint64	The Unix timestamp fork mono, or first seen host mono for this process.	{{.ProcessInfo.TimestampHostMono}}
ThreadGroup	*ThreadGroupInfo	The process this thread belongs to	{{.ThreadGroup}}
Tgid	uint32	The process' ID in userland. same as .ThreadGroup.Tgid	{{.ProcessInfo.Tgid}}
Tid	uint32	The process' ID in kerneland	{{.ProcessInfo.Tid}}
Program	*ProgramInfo	The current program.	{{.ProcessInfo.Program}}
CurrentWorkingDirectory	string	The current working directory of this process.	{{.ProcessInfo.CurrentWorkingDirectory}}
Privileges	[]int	The process' privileges.	{{.ProcessInfo.Privileges}}
Username	string	The username for user ID of the task/thread.	{{.ProcessInfo.Username}}
Group	string	The group name for group ID of the task/thread.	{{.ProcessInfo.Group}}
EffectiveUsername	string	The effective username for user ID of the task/thread.	{{.ProcessInfo.EffectiveUsername}}
EffectiveGroup	string	The effective group for group ID of the task/thread.	{{.ProcessInfo.EffectiveGroup}}
SavedUsername	string	The saved username for saved user ID of the task/thread.	{{.ProcessInfo.SavedUsername}}
SavedGroupname	string	The saved group name for saved group ID of the task/thread.	{{.ProcessInfo.SavedGroupname}}
FileSystemUsername	string	The filesystem username for the FsUID of the task/thread.	{{.ProcessInfo.FileSystemUsername}}
FileSystemGroup	string	The filesystem group for the FsGID of the task/thread.	{{.ProcessInfo.FileSystemGroup}}
ExitTimestampHostMono	uint64	The time the process exited.	{{.ProcessInfo.ExitTimestampHostMono}}

ThreadGroupInfo

ThreadGroupInfo には、警告の ThreadGroupInfo フィールドと、警告の Lineage's の ThreadGroupInfo フィールドからアクセスできます。

以下にある使用例は、警告の ThreadGroupInfo フィールドを使用したより簡単なパスを示しています。

警告の Lineage フィールドを使用してアクセスするには、次の手順を実行します。

{{range .Lineage}} {{.ThreadGroupInfo.$FIELD}} {{end}}

$FIELD は、任意のフィールド名 (例: Parent) で置き換えてください。

Field	Type	Description	Usage Example
Uuid	string	The thread uuid of the thread group leader	{{.Uuid}}
TimestampHostMono	uint64	The Unix timestamp fork mono, or first seen host mono for this process.	{{.TimestampHostMono}}
Parent	*ThreadGroupInfo	The current parent, not necessarily creator	{{.Parent}}
PreviousState	*ThreadGroupInfo	The possible previous state of this process (for example before an execve(2)).	{{.PreviousState}}
Tgid	uint32	The process' ID in userland	{{.Tgid}}
Leader	*ProcessInfo	The leading thread	{{.Leader}}
Program	*ProgramInfo	The current program.	{{.ProcessInfo.Program}}

ProgramInfo

ProgramInfo には、警告の ProcessInfo フィールドと、警告の Lineage's の ProcessInfo フィールドからアクセスできます。

以下にある使用例は、警告の ProcessInfo フィールドを使用したより簡単なパスを示しています。

警告の Lineage フィールドを使用してアクセスするには、次の手順を実行します。

{{range .Lineage}} {{.Program.$FIELD}} {{end}}

$FIELD は、任意のフィールド名 (例: Path) で置き換えてください。

Field	Type	Description	Usage Example
Path	string	The path to the program's executable.	{{.Program.Path}}
CmdLine	string	The command line.	{{.Program.CmdLine}}
Arguments	[]string	The program's arguments.	{{.Program.Arguments}}
TimestampHostMono	uint64	The timestamp of exec or first seen program event time.	{{.Program.TimestampHostMono}}
Complete	bool	Determines if the program exec event was not observed such as if this program existed before program tracking began.	{{.Program.Complete}}

Enum の種類

Priority

文字列	整数
Unknown	0
Info	1
Low	2
Medium	3
High	4

Confidence

文字列	整数
Zero	0
Low	1
MediumLow	2
MediumHigh	4
High	5
Max	6

PolicyType

文字列	整数
AppArmor	0
BPFExec	1
Chmod	2
接続	3
ContainerEscape	4
CloudMetadata	5
File	6
FileMonitor	7
FileAccess	8
Filter	9
InteractiveShell	10
KernelPayload	11
LoadKernelModule	12
MemoryProtection	13
NewFileExec	14
UnauthorizedKernelCredentialChange	15
Program	16
Ptrace	17
RemoteInteractiveShell	18
Segfault	19
SELinux	20
Sendto	21
SetPrivilege	22
Setrlimit	23
SmepSmap	24
SpectreMeltdown	25
StackPivotDetection	26
NetworkService	27
YaraScan	28
UserFaultFD	29
ShellCommand	30
Heartbeat	31
CoverageDrop	32
Kprobe	33
TagEvent	34
Uprobe	35

スコープ

文字列	整数
Other	0
Process	1
RootProcess	2
Container	3
Node	4
Subnet	5
Socket	6

GroupingScope

文字列	整数
None	0
Process	1
ParentProcess	2
Container	3
Host	4