Skip to content

feat: custom detection rules#473

Open
rohan-stepsecurity wants to merge 9 commits intomainfrom
rp/cherry/cdr-rules
Open

feat: custom detection rules#473
rohan-stepsecurity wants to merge 9 commits intomainfrom
rp/cherry/cdr-rules

Conversation

@rohan-stepsecurity
Copy link
Member

No description provided.

(cherry picked from commit 378ef52)
- Added support for custom detection rules in the Armour integration.
- Introduced new functions to submit process, file, and network events to the detection manager.
- Updated the DNS proxy to submit DNS events when custom detection rules are enabled.
- Refactored the agent's DNS handling to ensure proper execution flow when Docker is uninstalled.

(cherry picked from commit 8192dfe)
- Introduced TelemetryURL in the ApiClient struct to allow separate telemetry endpoint usage.
- Updated the agent to utilize TelemetryURL for sending DNS records and network connections.
- Enhanced configuration handling to initialize TelemetryURL from the config file, defaulting to APIURL if not specified.

(cherry picked from commit 93e00d3)
- Eliminated the call to submitDNSEvent in the handleNetworkEvent function, streamlining the event handling process.

(cherry picked from commit a1eac7b)
- Added a new configuration option to enable custom detection rules in the agent's run function.

(cherry picked from commit 75a349e)
- Changed the assignment of OneTimeKey in the agent's run function to use apiclient.OneTimeKey.
- Updated the Armour dependency version from v1.1.3 to v1.2.0 in go.mod and go.sum.

(cherry picked from commit d4bfe1b)
…sys to v0.40.0

- Upgraded OpenTelemetry packages in go.mod and go.sum to version 1.40.0.
- Updated golang.org/x/sys dependency to version 0.40.0.

(cherry picked from commit 72f6f12)
- Moved the call to submitFileEvent to occur after unlocking the fileMutex, improving the event handling flow.

(cherry picked from commit 025b442)
@rohan-stepsecurity rohan-stepsecurity marked this pull request as ready for review March 26, 2026 15:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant