Protocol Documentation

proto/config.proto
Scalar Value Types

proto/config.proto

CapFilter

Capabilities filter

Field	Type	Label	Description
effective	string	repeated	List of effective Capabilities. Special name ANY means if any cap is in effective cap set.
deny_list	bool	optional	if true acts like deny list

ConnectionsControl

Connections control

Field	Type	Description
enabled	bool	Load eBPF programs
ipv4_filter	IpFilter	Ipv4 filter connections
ipv6_filter	IpFilter	Ipv6 filter connections

CredFilter

Filter Events using Cred information. Pattern uid_filter || cap_filter.

Field	Type	Label	Description
uid_filter	UidFilter		Filter by uids (euid, TODO: uid, fsuid).
cap_filter	CapFilter		Filter by caps (effective, TODO: permited, inheritable).

FileHookConfig

FileMon hook configuration

Field	Type	Label	Description
enabled	bool		Load eBPF programs
path_filter	PathFilter	optional	Filter event by Path

FileMonConfig

Configuration file for FileMon detector.

Field	Type	Description
file_open	FileHookConfig	security_file_open config.
path_truncate	FileHookConfig	security_path_truncate config.
path_unlink	FileHookConfig	security_path_unlink config.
path_chmod	FileHookConfig	security_path_chmod config.
path_chown	FileHookConfig	security_path_chown config.
sb_mount	FileHookConfig	security_sb_mount config.
mmap_file	FileHookConfig	security_mmap_file config.
file_ioctl	FileHookConfig	security_file_ioctl config.
process_filter	ProcessFilter	Filter File events by Process information.

GTFOBinsConfig

Configuration file for GTFOBinsDetector.

Field	Type	Label	Description
enforce	bool		Block execution of GTFOBins binaries.
gtfobins	string	repeated	GTFOBins executables names.

IOUringMonConfig

Configuration file for IOUringMon detector.

Field	Type	Label	Description
process_filter	ProcessFilter		Filter io_uring events by Process information.

IpFilter

IP filter configuration

Field	Type	Label	Description
src_ip	string	repeated	Source IP list
dst_ip	string	repeated	Destination IP list
deny_list	bool		deny_list

NetMonConfig

Configuration file for NetMon detector.

Field	Type	Description
process_filter	ProcessFilter	Filter Network events by Process information.
ingress	ConnectionsControl	Ingress traffic connections
egress	ConnectionsControl	Egress traffic connections

PathFilter

Path filtering args

Field	Type	Label	Description
name	string	repeated	List of executables names to filter.
path	string	repeated	List of full executable paths to filter.
prefix	string	repeated	List of executable path prefixes to filter.

ProcHookConfig

ProcMon hook configuration

Field	Type	Label	Description
enabled	bool		Load eBPF programs
cred_filter	CredFilter		Filter by Cred

ProcMonConfig

Configuration file for ProcMon detector

Field	Type	Label	Description
setuid	ProcHookConfig		setuid hook config.
capset	ProcHookConfig		capset hook config.
prctl	ProcHookConfig		prctl hook config.
create_user_ns	ProcHookConfig		create_user_ns hook config.
ptrace_access_check	ProcHookConfig		ptrace_attach hook config.
process_filter	ProcessFilter		Process Filter Configuration.
ima_hash	bool	optional	Collect IMA hashes for executed binaries.
gc_period	uint64	optional	GC period for PROCMON_PROC_MAP default 30 sec.

Filter Events using process information. Filtering is based on pattern: uid AND euid AND auid AND (binary.name OR binary.prefix OR binary.path). All variables in the pattern are optional. if deny_list is true filter acts as a deny list, otherwise it is an allow list.

Field	Type	Label	Description
uid	uint32	repeated	List of UID's to filter.
euid	uint32	repeated	List of EUID's to filter.
auid	uint32	repeated	List of AUID's (login uid) to filter.
binary	PathFilter		Binary filter args
deny_list	bool		if true acts like deny list

UidFilter

UID filter

Field	Type	Label	Description
euid	uint32	repeated	effective UID

Scalar Value Types

.proto Type	Notes	C++	Java	Python	Go	C#	PHP	Ruby
double		double	double	float	float64	double	float	Float
float		float	float	float	float32	float	float	Float
int32	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
int64	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead.	int64	long	int/long	int64	long	integer/string	Bignum
uint32	Uses variable-length encoding.	uint32	int	int/long	uint32	uint	integer	Bignum or Fixnum (as required)
uint64	Uses variable-length encoding.	uint64	long	int/long	uint64	ulong	integer/string	Bignum or Fixnum (as required)
sint32	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sint64	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s.	int64	long	int/long	int64	long	integer/string	Bignum
fixed32	Always four bytes. More efficient than uint32 if values are often greater than 2^28.	uint32	int	int	uint32	uint	integer	Bignum or Fixnum (as required)
fixed64	Always eight bytes. More efficient than uint64 if values are often greater than 2^56.	uint64	long	int/long	uint64	ulong	integer/string	Bignum
sfixed32	Always four bytes.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sfixed64	Always eight bytes.	int64	long	int/long	int64	long	integer/string	Bignum
bool		bool	boolean	boolean	bool	bool	boolean	TrueClass/FalseClass
string	A string must always contain UTF-8 encoded or 7-bit ASCII text.	string	String	str/unicode	string	string	string	String (UTF-8)
bytes	May contain any arbitrary sequence of bytes.	string	ByteString	str	[]byte	ByteString	string	String (ASCII-8BIT)

Bombini: eBPF-based Security Monitoring Agent