Add event-driven memory syscall telemetry

enodia_sentinel/events/syscall_event.py

@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""Security-relevant syscall event captured by the optional eBPF layer."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class SyscallEvent:
+    pid: int
+    ppid: int
+    uid: int
+    comm: str
+    syscall: str
+    arg0: int = 0
+    arg1: int = 0
+    arg2: int = 0
+    arg3: int = 0
+    arg4: int = 0
+    arg5: int = 0
+    text: str = ""
+
+    def to_dict(self) -> dict:
+        return {
+            "pid": self.pid,
+            "ppid": self.ppid,
+            "uid": self.uid,
+            "comm": self.comm,
+            "syscall": self.syscall,
+            "args": [self.arg0, self.arg1, self.arg2, self.arg3, self.arg4, self.arg5],
+            "text": self.text,
+        }