Repository navigation

Rebase sensor-base-0.7.0 onto upstream v0.76.7 - #149

Merged

djoreilly merged 144 commits into

SUSE:sensor-base-0.76.7from

djoreilly:sensor-base-0.76.7-PR

Aug 13, 2026

Merged

Rebase sensor-base-0.7.0 onto upstream v0.76.7#149
djoreilly merged 144 commits into
SUSE:sensor-base-0.76.7from
djoreilly:sensor-base-0.76.7-PR

Commits on Aug 10, 2026
- build: create magefiles/ directory
  
  jeffmahoney
  authored and
  djoreilly
  committed
  76c4fbd
- magefile.go: use current architecture for Linux builds
  
  jeffmahoney
  authored and
  djoreilly
  committed
  d7aab55
- Add systemd-dev as build dependency for github workflow
  
  jeffmahoney
  authored and
  djoreilly
  committed
  0236cd9
- github: run testcases on Linux builds in new workflow
  
  jeffmahoney
  authored and
  djoreilly
  committed
  7a331e5
- linux: add lsattr() function to enumerate file attributes
  
  lorddoskias
  authored and
  djoreilly
  committed
  a39a041
- Linux.Detection.ImmutableFiles: Enumerate immutable files under a path
  
  lorddoskias
  authored and
  djoreilly
  committed
  1ed6f51
- Add parser to read systemd journal on Linux
  
  jeffmahoney
  authored and
  djoreilly
  committed
  8dbef45
- Update the Linux.Syslog.SSHLogin artifact to scan the systemd journal
  
  jeffmahoney
  authored and
  djoreilly
  committed
  cd3a2c8
- Update the Linux.Events.SSHLogin artifact to scan the systemd journal
  
  jeffmahoney
  authored and
  djoreilly
  committed
  9e7b37f
- SUSE: Add SSHLogin artifacts
  
  jeffmahoney
  authored and
  djoreilly
  committed
  219ea9c
- SSHLogin: require _TRANSPORT != 'kernel' from watch_journal()
  
  jeffmahoney
  authored and
  djoreilly
  committed
  d1d74d2
- vql/linux/bpf: add support to add bpf plugins for Linux
  
  jeffmahoney
  authored and
  djoreilly
  committed
  a8e3296
- vql/linux/bpf/tcpsnoop: Add tcpsnoop plugin
  
  authored and
  djoreilly
  committed
  facf167
- vql/linux/bpf/dnssnoop: Add dnssnoop() plugin
  
  authored and
  djoreilly
  committed
  4d5fbfb
- vql/linux/bpf/chattrsnoop: Add plugin to catch changes to inode attributes
  
  authored and
  djoreilly
  committed
  b8455fc
- vql/linux/bpflib: add sample vmlinux.h includes for test builds
  
  jeffmahoney
  authored and
  djoreilly
  committed
  1fabe0a
- Add custom artifacts for login and logout attempts recorded by auditd
  
  guangyee
  authored and
  djoreilly
  committed
  e44b4d7
- Linux.Events.ProcessExecutions: catch 32-bit execve calls
  
  chajain
  authored and
  djoreilly
  committed
  3b478f1
- Add artifact to monitor user group updates (#24)
  
  guangyee
  authored and
  djoreilly
  committed
  585b0c9
- file_store/directory/buffer: add direct-serialized interface
  
  jeffmahoney
  authored and
  djoreilly
  committed
  cb36e7a
- utils/refcount: add simple refcount implementation
  
  jeffmahoney
  authored and
  djoreilly
  committed
  9ad0036
- file_store/directory/listener_bytes: Add listener to use serialized interface
  
  jeffmahoney
  authored and
  djoreilly
  committed
  ffdc649
- vql/linux/audit: use go-libaudit v2 for live audit message processing
  
  jeffmahoney
  authored and
  djoreilly
  committed
  7fb1398
- vql/linux/audit: rearchitect plugin for scalability
  
  jeffmahoney
  authored and
  djoreilly
  committed
  2132008
- Extend audit artifacts to use new interface
  
  chajain
  authored and
  djoreilly
  committed
  92ff36b
- vql/linux/cronsnoop: Add cronsnoop() plugin
  
  authored and
  djoreilly
  committed
  9a2bf08
- Updating the NewFiles and ProcessStatuses Artifacts
  
  chajain
  authored and
  djoreilly
  committed
  c1521e7
- Add Linux.Sys.Bash to Server.Monitor.Shell artifact
  
  jeffmahoney
  authored and
  djoreilly
  committed
  eff68c1
- rpm: introduce rpm vql plugin
  
  jeffmahoney
  authored and
  djoreilly
  committed
  665a94b
- vql/functions/hash: cache results on Linux
  
  jeffmahoney
  authored and
  djoreilly
  committed
  01f96ff
- hash: fix nil pointer dereference panic
  djoreilly
  committed
  c1e8ba7
- Fix shadowed variable in hash.go
  djoreilly
  committed
  d419180
- SUSE: add Docker files
  
  jeffmahoney
  authored and
  djoreilly
  committed
  8a80fce
- SUSE: Add docker-compose environment
  
  jeffmahoney
  authored and
  djoreilly
  committed
  d707236
- cronsnoop: fix panic when crontab has empty line
  djoreilly
  committed
  0620445
- vql/linux/audit: actually add test cases
  
  jeffmahoney
  authored and
  djoreilly
  committed
  4a99e88
- vql/linux/audit: don't overload EAGAIN
  
  jeffmahoney
  authored and
  djoreilly
  committed
  9462c0b
- vql/linux/audit: gofumpt -extra
  
  jeffmahoney
  authored and
  djoreilly
  committed
  d1c8776
- vql/linux/audit: fix staticcheck checks
  
  jeffmahoney
  authored and
  djoreilly
  committed
  5c2c0e7
- bpf: add libbpf/include/uapi to the include path for bpf.h
  
  jeffmahoney
  authored and
  djoreilly
  committed
  2e4118e
- bpf: only build libbpf in the go generate stage
  
  jeffmahoney
  authored and
  djoreilly
  committed
  c17443d
- vql/linux/audit: fix test suite handling
  
  jeffmahoney
  authored and
  djoreilly
  committed
  5bdc963
- vql/linux/audit: Clean up context handling in shutdown goroutine
  
  jeffmahoney
  authored and
  djoreilly
  committed
  51eb293
- vql/linux/audit: mainEventLoop shouldn't exit on canceled context
  
  jeffmahoney
  authored and
  djoreilly
  committed
  e5cddb0
- vql/linux/audit: Make messageQueue lifetime more apparent
  
  jeffmahoney
  authored and
  djoreilly
  committed
  6c72d03
- vql/linux/audit: limit messageQueue scope to within runService
  
  jeffmahoney
  authored and
  djoreilly
  committed
  ea01cde
- vql/linux/audit: Close reassembler if NewListenerBytes fails
  
  jeffmahoney
  authored and
  djoreilly
  committed
  2f193e8
- vql/linux/audit: Fix typo causing double-lock in notifyMissingRule
  
  jeffmahoney
  authored and
  djoreilly
  committed
  9b8565a
- vql/linux/audit: Fix DeleteRule in mock client
  
  jeffmahoney
  authored and
  djoreilly
  committed
  aa7a508
- vql/linux/audit: Change listener lifecycle to enable testing
  
  jeffmahoney
  authored and
  djoreilly
  committed
  02ed2fe
- vql/linux/audit: Fix audit client lifecycle
  
  jeffmahoney
  authored and
  djoreilly
  committed
  38cabe3
- vql/linux/audit: Add more client failure test cases
  
  jeffmahoney
  authored and
  djoreilly
  committed
  99bb05c
- vql/linux/audit: tests, check various rule scenarios
  
  jeffmahoney
  authored and
  djoreilly
  committed
  f946c70
- vql/linux/audit: simplify polling in listener
  
  jeffmahoney
  authored and
  djoreilly
  committed
  1b13e42
- vql/linux/audit: make stats reporting separate from debug prints
  
  jeffmahoney
  authored and
  djoreilly
  committed
  0baabee
- vql/linux/audit: make explicit that goroutines in the main errgroup don't return errors
  
  jeffmahoney
  authored and
  djoreilly
  committed
  8658023
- vql/linux/audit: handle top-level cancelation properly
  
  jeffmahoney
  authored and
  djoreilly
  committed
  9a5c39e
- vql/linux/audit: remove unused waitgroup from main event loop
  
  jeffmahoney
  authored and
  djoreilly
  committed
  d9965c7
- vql/linux/audit: remove unnecessary error handling for reassembler
  
  jeffmahoney
  authored and
  djoreilly
  committed
  30e072d
- vql/linux/audit: pull parts of shutdown into shutdown watcher
  
  jeffmahoney
  authored and
  djoreilly
  committed
  c5d9b7e
- vql/linux/audit: add auditService.Log()
  
  jeffmahoney
  authored and
  djoreilly
  committed
  605f957
- vql/linux/audit: limit messageQueue to within runService
  
  jeffmahoney
  authored and
  djoreilly
  committed
  cd7b837
- vql/linux/audit: fix goroutine lifetimes
  
  jeffmahoney
  authored and
  djoreilly
  committed
  96ddd4d
- vql/linux/audit: fix shutdown races
  
  jeffmahoney
  authored and
  djoreilly
  committed
  84d1f51
- vql/linux/sdjournal: Fix open/close lifetimes
  
  jeffmahoney
  authored and
  djoreilly
  committed
  c2364a5
- velociraptor: add dummy main function for mage
  
  jeffmahoney
  authored and
  djoreilly
  committed
  935c6c0
- sdjournal: Correctly seek to current tail
  
  xTeixeira
  authored and
  djoreilly
  committed
  7e0cb62
- Fix audit filter key typo in Linux.Events.NewFiles
  djoreilly
  committed
  3c0d4c9
- Move NewFiles artifact to SUSE
  djoreilly
  committed
  06c59ae
- Fix SystemLogins artifacts file extensions
  djoreilly
  committed
  a219387
- Fix absolute path case in ExecutableFiles artifact
  djoreilly
  committed
  88ebd52
- Add artifact to collect systemd service events
  djoreilly
  committed
  09f143a
- Add hash fields to Linux.Events.ProcessExecutions
  djoreilly
  committed
  5006a5d
- Add SUSE.Linux.Events.NewZeroSizeLogFile artifact
  djoreilly
  committed
  7f7d08f
- SUSE.Linux.Events.Crontab: Add task execution artifacts
  
  xTeixeira
  authored and
  djoreilly
  committed
  02b56d9
- Add artifact to monitor ssh authorized_keys files
  djoreilly
  committed
  03fc0a7
- Add SUSE.Linux.Events.Timers artifact
  
  xTeixeira
  authored and
  djoreilly
  committed
  5d033bf
- Fix Linux.Events.ImmutableFile not showing hash in GUI
  djoreilly
  committed
  e8e3a2e
- chattrsnoop: don't log.Fatal() on hash error
  djoreilly
  committed
  565be9b
- chattrsnoop: handle os.Stat() error properly
  djoreilly
  committed
  24f1c02
- chattrsnoop: include full error details in logs
  djoreilly
  committed
  b92bd88
- Make ImmutableFile artifact consistent with others
  djoreilly
  committed
  dcf6543
- Move ImmutableFile artifact to SUSE
  djoreilly
  committed
  692cf6e
- Add artifact to collect new hidden files
  djoreilly
  committed
  04e24fa
- Add server artifact to delete old client data on server
  djoreilly
  committed
  7779701
- Add client monitoring artifact for RPMs
  djoreilly
  committed
  6c7c41e
- Add SUSE.Linux.Sys.At artifact
  
  xTeixeira
  authored and
  djoreilly
  committed
  de3486b
- Raise client connection log level to ERROR
  djoreilly
  committed
  63d2a62
- Rename SUSE specific artifacts to have SUSE prefix
  djoreilly
  committed
  fe2cb89
- tcpsnoop: fix garbled results on s390
  djoreilly
  committed
  16b43af
- Add artifact to collect new files without owner
  djoreilly
  committed
  33a12bf
- bpf plugins: set a logger callback
  djoreilly
  committed
  4f4d634
- tcpsnoop: remove unused filtering code
  djoreilly
  committed
  a93252e
- chattrsnoop: fix bpf_probe_read for s390
  djoreilly
  committed
  a736fed
- chattrsnoop: fix immutable attribute set on s390
  djoreilly
  committed
  744c042
- dnssnoop: fix htons() so it works on s390 too
  djoreilly
  committed
  2f47cfd
- dnssnoop: fix loading protocol from ip header on s390
  djoreilly
  committed
  05afcc5
- chattrsnoop: replace global variables with locals
  djoreilly
  committed
  8d9ee9e
- Fix systemd Services artifact missing events
  djoreilly
  committed
  71866db
- Fix undefined binary.NativeEndian build errors
  djoreilly
  committed
  f07297f
- Fix services artifact symbol pid not found error
  djoreilly
  committed
  31392d2
- chattrsnoop: fix do_vfs_ioctl kprobe failure
  djoreilly
  committed
  133b31d
- chattrsnoop: fix wrong FS_IOC_SETFLAGS value for ppc
  djoreilly
  committed
  f7ef48d
- chattrsnoop: correct read size for flags
  djoreilly
  committed
  301d11c
- github: run linux unit tests
  djoreilly
  committed
  a26d279
- sdjournal: fix package causing test failures
  djoreilly
  committed
  c292c00
- audit: prevent Windows loading audit package
  djoreilly
  committed
  bbb769f
- audit: fix race in subscriber
  djoreilly
  committed
  db2e6b2
- audit: fix audit client data races
  djoreilly
  committed
  4cd015c
- github: fix deprecated upload artifact
  djoreilly
  committed
  4f155dc
- audit s390x: fix arch filter rules errors
  djoreilly
  committed
  f186a61
- rpm plugin: fix ndb magic error
  djoreilly
  committed
  ae30eda
- RPM artifact: start checks immediately on artifact load
  djoreilly
  committed
  4126ccd
- audit: fix auditBuf allocation and go vet warnings
  djoreilly
  committed
  5ce7cdd
- audit: reduce FileBufferLeaseSize to ease GC overhead
  djoreilly
  committed
  f094b81
- Linux.Events.ProcessExecutions: remove parent cmdline
  djoreilly
  committed
  970fa77
- tcpsnoop: fix missing ipv6 outbound connections
  djoreilly
  committed
  73434e7
- tcpsnoop: fix ipv6 local and remote addresses order
  djoreilly
  committed
  9984b5c
- chattrsnoop: move hashing from plugin to artifact
  djoreilly
  committed
  55c46e1
- chattrsnoop: fix files not getting closed
  djoreilly
  committed
  939efed
- bpf plugins: add context to error logs
  djoreilly
  committed
  7c1306e
- bpf plugins: remove depreciated libbpfgo calls
  djoreilly
  committed
  2b9ac3d
- tcpsnoop: move parsing to its own function
  djoreilly
  committed
  42d6d88
- bpf: fix plugins not stopping when context cancelled
  djoreilly
  committed
  2d802fb
- audit: update go-libaudit dependency for pcc64le arch filter fix
  djoreilly
  committed
  c8a5c8c
- Add execsnoop plugin to capture execve system calls
  djoreilly
  committed
  263c83b
- Use execsnoop plugin in artifacts when possible
  djoreilly
  committed
  001eec8
- audit: fix watch rules in artifacts
  djoreilly
  committed
  b608e4f
- Update go-rpmdb to fix panic
  djoreilly
  committed
  215ea21
- Add plugin and artifact for sending client events to rsyslog
  djoreilly
  committed
  e46e585
- Remove SHA1 file signatures
  djoreilly
  committed
  2468805
- Add machine-id to event artifacts
  djoreilly
  committed
  8b9d079
- Fix symbol not found errors from SUSE.Linux.Events.Services
  djoreilly
  committed
  17a4a6d
- Exclude velociraptor tracee ebpf from build
  djoreilly
  committed
  3b08cb1
- Fix artifacts for different VQL array() behaviour in v0.74+
  djoreilly
  committed
  ad18317
- Fix services artifact systemctl show parse errors
  djoreilly
  committed
  50b4d52
- Fix SshAuthorizedKeys artifact to work with v0.76
  djoreilly
  committed
  a4616ba
- Upgrade github.com/ProtonMail/gopenpgp to V3
  djoreilly
  committed
  80e1c93
- Update github.com/cloudflare/circl
  djoreilly
  committed
  7862dae
- Update golang.org/x/crypto
  djoreilly
  committed
  6240e08
- Don't create offline yaml tool dependencies
  djoreilly
  committed
  35aee9c
- github: remove windows and update linux
  djoreilly
  committed
  9027fd5
- Update golang.org/x/text
  djoreilly
  committed
  00e4d93
Commits on Aug 11, 2026
- Update brace-expansion npm
  djoreilly
  committed
  6479349

Commits

Commits on Aug 10, 2026

Commits on Aug 11, 2026