Linux Agent attributes and helpers

Linux Agent attributes and helpers

This documentation describes Linux attributes and helpers of the Datadog’s Security Language (SECL).

Rules using Linux attributes and helpers must include an OS rule filter field as follows.

id:[...]expression:[...]filters:- os == "linux"

Triggers

Triggers are events that correspond to types of activity seen by the system. The currently supported set of triggers is:

FIM triggers

In addition to regular triggers, fim.write.file.* fields allow to write rules that fire on all file events.

For example, the following rule:

(fim.write.file.path == "/tmp/test" || fim.write.file.name == "abc")
 && process.file.name == "def"
 && container.id != ""

will expand into the following rules under the hood:

open: ((open.file.path == "/tmp/test" || open.file.name == "abc")
 && open.flags & (O_CREAT|O_TRUNC|O_APPEND|O_RDWR|O_WRONLY) > 0
 && process.file.name == "def"
 && container.id != "")
chmod: (chmod.file.path == "/tmp/test" || chmod.file.name == "abc")
 && process.file.name == "def"
 && container.id != ""
chown: (chown.file.path == "/tmp/test" || chown.file.name == "abc")
 && process.file.name == "def"
 && container.id != ""
link: (link.file.path == "/tmp/test" || link.file.name == "abc")
 && process.file.name == "def"
 && container.id != ""
rename: (rename.file.path == "/tmp/test" || rename.file.name == "abc")
 && process.file.name == "def"
 && container.id != ""
rename: (rename.file.destination.path == "/tmp/test" || rename.file.destination.name == "abc")
 && process.file.name == "def"
 && container.id != ""
unlink: (unlink.file.path == "/tmp/test" || unlink.file.name == "abc")
 && process.file.name == "def"
 && container.id != ""
utimes: (utimes.file.path == "/tmp/test" || utimes.file.name == "abc")
 && process.file.name == "def"
 && container.id != ""

and match on all file-related events matching the path provided in the rule. Common fields are retained across all expanded rules.

Variables

SECL variables are predefined variables that can be used as values or as part of values.

For example, rule using a process.pid variable looks like this:

open.file.path == "/proc/${process.pid}/maps"

List of the available variables:

CIDR and IP range

CIDR and IP matching is possible in SECL. One can use operators such as in, not in, or allin combined with CIDR or IP notations.

Such rules can be written as follows:

dns.question.name == "example.com" && network.destination.ip in [192.168.1.25, 10.0.0.0/24]

Helpers

Helpers exist in SECL that enable users to write advanced rules without needing to rely on generic techniques such as regex.

Command line arguments

The args_flags and args_options are helpers to ease the writing of CSM Threats rules based on command line arguments.

args_flags is used to catch arguments that start with either one or two hyphen characters but do not accept any associated value.

Examples:

• version is part of args_flags for the command cat --version
• l and n both are in args_flags for the command netstat -ln

args_options is used to catch arguments that start with either one or two hyphen characters and accepts a value either specified as the same argument but separated by the ‘=’ character or specified as the next argument.

Examples:

• T=8 and width=8 both are in args_options for the command ls -T 8 --width=8
• exec.args_options in [ r"s=.*\\" ] can be used to detect sudoedit was launched with -s argument and a command that ends with a \

File rights

The file.rights attribute can now be used in addition to file.mode. file.mode can hold values set by the kernel, while the file.rights only holds the values set by the user. These rights may be more familiar because they are in the chmod commands.

Event attributes

Common to all event types

Event accept

An accept was executed

Event bind

A bind was executed

Event bpf

A BPF command was executed

Event capabilities

This event type is experimental and may change in the future.

A process used some capabilities

Event capset

A process changed its capacity set

Event cgroup_write

A process migrated another process to a cgroup

Event chdir

This event type is experimental and may change in the future.

A process changed the current directory

Event chmod

A file’s permissions were changed

Event chown

A file’s owner was changed

Event connect

A connect was executed

Event dns

A DNS request was sent

Event exec

A process was executed (does not trigger on fork syscalls).