Protocol Documentation

proto/config.proto
Scalar Value Types

proto/config.proto

FileMonConfig

Configuration file for FileMon detector.

Field	Type	Description
file_open	HookConfig	security_file_open config.
path_truncate	HookConfig	security_path_truncate config.
path_unlink	HookConfig	security_path_unlink config.
path_symlink	HookConfig	security_path_symlink config.
path_chmod	HookConfig	security_path_chmod config.
path_chown	HookConfig	security_path_chown config.
sb_mount	HookConfig	security_sb_mount config.
mmap_file	HookConfig	security_mmap_file config.
file_ioctl	HookConfig	security_file_ioctl config.

GTFOBinsConfig

Configuration file for GTFOBinsDetector.

Field	Type	Label	Description
enforce	bool		Block execution of GTFOBins binaries.
gtfobins	string	repeated	GTFOBins executables names.

HookConfig

Hook or group of hooks configuration

Field	Type	Label	Description
enabled	bool		Load eBPF programs
sandbox	SandboxMode		Sandbox capabilities.
rules	Rule	repeated	Filtering rules

NetMonConfig

Configuration file for NetMon detector.

Field	Type	Label	Description
ingress	HookConfig		Ingress traffic connections
egress	HookConfig		Egress traffic connections

ProcMonConfig

Configuration file for ProcMon detector

Field	Type	Label	Description
setuid	HookConfig		setuid hook config.
capset	HookConfig		capset hook config.
prctl	HookConfig		prctl hook config.
create_user_ns	HookConfig		create_user_ns hook config.
ptrace_access_check	HookConfig		ptrace_attach hook config.
setgid	HookConfig		setgid hook config.
bprm_check	HookConfig		bprm_check hook config.
ima_hash	bool	optional	Collect IMA hashes for executed binaries.
gc_period	uint64	optional	GC period for PROCMON_PROC_MAP default 30 sec.

Rule

Rule definition. Scope and event predicates are used as logical conjunction.

Field	Type	Description
name	string	Name of the rule.
scope	string	Logical predicate describes scope this rule will be applied, e.g. process, container.
event	string	Logical predicate for describes event rule will be applied

SandboxMode

Sandbox parameters.

Field	Type	Label	Description
enabled	bool		Enable sandbox mode.
deny_list	bool		Consider rules as deny list.

Scalar Value Types

.proto Type	Notes	C++	Java	Python	Go	C#	PHP	Ruby
double		double	double	float	float64	double	float	Float
float		float	float	float	float32	float	float	Float
int32	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
int64	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead.	int64	long	int/long	int64	long	integer/string	Bignum
uint32	Uses variable-length encoding.	uint32	int	int/long	uint32	uint	integer	Bignum or Fixnum (as required)
uint64	Uses variable-length encoding.	uint64	long	int/long	uint64	ulong	integer/string	Bignum or Fixnum (as required)
sint32	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sint64	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s.	int64	long	int/long	int64	long	integer/string	Bignum
fixed32	Always four bytes. More efficient than uint32 if values are often greater than 2^28.	uint32	int	int	uint32	uint	integer	Bignum or Fixnum (as required)
fixed64	Always eight bytes. More efficient than uint64 if values are often greater than 2^56.	uint64	long	int/long	uint64	ulong	integer/string	Bignum
sfixed32	Always four bytes.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sfixed64	Always eight bytes.	int64	long	int/long	int64	long	integer/string	Bignum
bool		bool	boolean	boolean	bool	bool	boolean	TrueClass/FalseClass
string	A string must always contain UTF-8 encoded or 7-bit ASCII text.	string	String	str/unicode	string	string	string	String (UTF-8)
bytes	May contain any arbitrary sequence of bytes.	string	ByteString	str	[]byte	ByteString	string	String (ASCII-8BIT)

Bombini: eBPF-based Security Monitoring and Sandboxing Agent