Support for running Sysmon from CLI/interactive inside a container or AKS cluster
@MarioHewardt is already working on this.
Since Nov 7, 2023.
Assessment
This issue has not been assessed yet.
Description
Sysmon helps to extract a lot of information using EBPF. This also could work inside your Kubernetes (AKS Support) cluster. Currently the blocking issue is that we need to install sysmon with '-i' which tries to configure systemd. Systemd is not available in Docker.
It would be better to execute it as a CLI interactive tool, so we can run this inside a container, so we potentially can use this as daemonset on the AKS worker nodes to extract information what happens inside the cluster. Familiar use case is implemented within Falco.
- Dominant language
- C
- Stars
- 2.2k
- Forks
- 220
- Avg merge
- 11d 22h
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/SysmonForLinux
-
microsoft/SysmonForLinux#238 · 1 assignee ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
microsoft/SysmonForLinux#233 ·
-
microsoft/SysmonForLinux#230 · 1 assignee ·
-
microsoft/SysmonForLinux#226 · 1 assignee ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
microsoft/SysmonForLinux#220 · 2 reactions ·
All issues in microsoft/SysmonForLinux
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
kovidgoyal/kitty#10516 ·
-
libc
Difficulty 2/5 1-2 days Newbie friendliness 76/100
llvm/llvm-project#225506 · 1 comment ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Status: Waiting triage Type: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
nanoframework/Home#1857 ·
-
bug
Difficulty 2/5 Half a day Newbie friendliness 82/100