luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): enrich snapshots with package ownership

Browse source
This commit is contained in:
Luna 2026-07-22 03:50:55 -07:00
parent 6355fb403d
commit 88d7a6e3b8
No known key found for this signature in database
8 changed files with 149 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

13
go-agent/internal/snapshot/store.go
View file

@ -21,6 +21,7 @@ import (
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/enrich"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/incident"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/provenance"
)
const Schema = "enodia.alert.snapshot.v1"
@ -289,7 +290,7 @@ func (s *Store) applySlowEnrichment(job slowJob) {
}
processes := enrichmentProcesses(report.Processes)
paths := enrichmentPaths(report.Enrichment)
updates := enrich.CollectSlow(processes, paths)
updates := enrich.CollectSlow(processes, paths, provenance.PackageOwner)
// All slow I/O has completed. Take the lock only to merge into the newest
// same-second report, so a concurrent alert capture never loses evidence.
@ -342,6 +343,7 @@ func mergeSlow(report *Report, updates enrich.SlowResult) {
pid, _ := item["pid"].(float64)
if update := updates.Processes[int(pid)]; update != nil {
item["exe_sha256"] = update["exe_sha256"]
item["package_owner"] = nullToNil(update["package_owner"])
}
}
}
@ -354,13 +356,20 @@ func mergeSlow(report *Report, updates enrich.SlowResult) {
path, _ := item["path"].(string)
if update := updates.Files[path]; update != nil {
for key, value := range update {
item[key] = value
item[key] = nullToNil(value)
}
}
}
}
}
func nullToNil(value any) any {
if owner, ok := value.(string); ok && owner == "" {
return nil
}
return value
}
func (s *Store) collectProcesses(alerts []model.Alert) []ProcessDetail {
pids := alertPIDs(alerts)
result := make([]ProcessDetail, 0, len(pids))