Add tetragon pipeline rules (#470)
* Add Tetragon pipeline rule to set process_id from exec_id * Add Tetragon pipeline rule to set process_id from parent with version constraint
taylor_socfortress committed
Jul 4, 2025 at 10:49 UTC
40e682bdce9336591eeed64abd0035aa66203574
1 file changed
+56
backend/app/stack_provisioning/graylog/templates/SOCFORTRESS_WAZUH_CONTENT_PACK.json
+56
@@ -4083,6 +4083,62 @@
4083
}
4084
]
4085
},
4086
+ {
4087
+ "v": "1",
4088
+ "type": {
4089
+ "name": "pipeline_rule",
4090
+ "version": "1"
4091
+ },
4092
+ "id": "273857f5-13cc-4845-8ba9-69fb4fe7bd15",
4093
+ "data": {
4094
+ "title": {
4095
+ "@type": "string",
4096
+ "@value": "Tetragon - Set process_id from exec_id"
4097
+ },
4098
+ "description": {
4099
+ "@type": "string",
4100
+ "@value": "Tetragon - Set process_id from exec_id"
4101
+ },
4102
+ "source": {
4103
+ "@type": "string",
4104
+ "@value": "rule \"Tetragon - Set process_id from exec_id\"\nwhen\n has_field(\"data_process_exec_process_exec_id\") &&\n (\n !has_field(\"data_process_exec_process_parent_exec_id\") ||\n to_string($message.data_process_exec_process_parent_exec_id) == \"\"\n )\nthen\n set_field(\"process_id\", to_string($message.data_process_exec_process_exec_id));\nend"
4105
+ }
4106
+ },
4107
+ "constraints": [
4108
+ {
4109
+ "type": "server-version",
4110
+ "version": ">=5.0.13+083613e"
4111
+ }
4112
+ ]
4113
+ },
4114
+ {
4115
+ "v": "1",
4116
+ "type": {
4117
+ "name": "pipeline_rule",
4118
+ "version": "1"
4119
+ },
4120
+ "id": "88483f85-30fe-47bf-b834-a72a6101d754",
4121
+ "data": {
4122
+ "title": {
4123
+ "@type": "string",
4124
+ "@value": "Tetragon - Set process_id from parent"
4125
+ },
4126
+ "description": {
4127
+ "@type": "string",
4128
+ "@value": "Tetragon - Set process_id from parent"
4129
+ },
4130
+ "source": {
4131
+ "@type": "string",
4132
+ "@value": "rule \"Tetragon - Set process_id from parent\"\nwhen\n has_field(\"data_process_exec_process_parent_exec_id\") &&\n to_string($message.data_process_exec_process_parent_exec_id) != \"\"\nthen\n set_field(\"process_id\", to_string($message.data_process_exec_process_parent_exec_id));\nend"
4133
+ }
4134
+ },
4135
+ "constraints": [
4136
+ {
4137
+ "type": "server-version",
4138
+ "version": ">=5.0.13+083613e"
4139
+ }
4140
+ ]
4141
+ },
4142
{
4143
"v": "1",
4144
"type": {