package runtime.v1

Get desktop application:
View/edit binary Protocol Buffers messages

RuntimeSecurityAgentAPI is used in kvisord. Should be mirrored.

• rpc GetConfiguration (GetConfigurationRequest, GetConfigurationResponse)

  runtime_agent_api.proto:12

  message GetConfigurationRequest

  runtime_agent_api.proto:42

  • oneof current_config

    • bytes controller = 3

    • bytes agent = 4

  message GetConfigurationResponse

  runtime_agent_api.proto:50

  • optional Configuration config = 1

• rpc GetSyncState (GetSyncStateRequest, GetSyncStateResponse)

  runtime_agent_api.proto:18

  message GetSyncStateRequest

  runtime_agent_api.proto:187

  • repeated string image_ids = 1

  message GetSyncStateResponse

  runtime_agent_api.proto:190

  • optional ImagesSyncState images = 1

• rpc ImageMetadataIngest (ImageMetadata, ImageMetadataIngestResponse)

  runtime_agent_api.proto:21

  message ImageMetadata

  runtime_agent_api.proto:169

  • string image_name = 1

  • string image_id = 2

  • string image_digest = 3

  • string index_digest = 13

  • string architecture = 5

    used as fallback, in case image manifest doesn't have architecture set

  • string os_name = 6

  • optional google.protobuf.Timestamp created_at = 7

  • repeated string resource_ids = 8

  • bytes packages = 9

    JSON containing []github.com/aquasecurity/trivy/pkg/fanal/types.BlobInfo type.

  • bytes manifest = 10

    JSON containing github.com/google/go-containerregistry/pkg/v1.Manifest type.

  • bytes index = 11

    JSON containing github.com/google/go-containerregistry/pkg/v1.IndexManifest type.

  • bytes config_file = 12

    JSON containing github.com/google/go-containerregistry/pkg/v1.ConfigFile type.

  message ImageMetadataIngestResponse

  runtime_agent_api.proto:185

  (message has no fields)

• rpc KubeBenchReportIngest (KubeBenchReport, KubeBenchReportIngestResponse)

  runtime_agent_api.proto:22

  message KubeBenchReport

  runtime_agent_api.proto:222

  • repeated KubeBenchControls controls = 1

  • optional KubeBenchNode node = 2

  message KubeBenchReportIngestResponse

  runtime_agent_api.proto:226

  (message has no fields)

• rpc KubeLinterReportIngest (KubeLinterReport, KubeLinterReportIngestResponse)

  runtime_agent_api.proto:23

  message KubeLinterReport

  runtime_agent_api.proto:249

  • repeated KubeLinterCheck checks = 1

  message KubeLinterReportIngestResponse

  runtime_agent_api.proto:252

  (message has no fields)

• rpc LogsWriteStream (stream LogEvent, WriteStreamResponse)

  runtime_agent_api.proto:14

  message LogEvent

  common.proto:62

  • int32 level = 1

  • string msg = 2

  message WriteStreamResponse

  runtime_agent_api.proto:133

  (message has no fields)

• rpc UpdateSyncState (UpdateSyncStateRequest, UpdateSyncStateResponse)

  runtime_agent_api.proto:19

  message UpdateSyncStateRequest

  runtime_agent_api.proto:215

  • bool full_snapshot = 1

  • repeated Image images = 2

  message UpdateSyncStateResponse

  runtime_agent_api.proto:220

  (message has no fields)

• rpc WriteDataBatch (WriteDataBatchRequest, WriteDataBatchResponse)

  runtime_agent_api.proto:16

  message WriteDataBatchRequest

  runtime_agent_api.proto:26

  • repeated DataBatchItem items = 10

  message WriteDataBatchResponse

  runtime_agent_api.proto:30

  (message has no fields)

Used in: ContainerEvent

• uint32 event_id = 1

• uint32 syscall = 2

• bytes data = 3

Used in: GetConfigurationResponse

(message has no fields)

Used in: ContainerEvents

• EventType event_type = 1

• uint64 timestamp = 2

• uint64 process_start_time = 4

• uint32 host_pid = 5

• uint32 pid = 6

• uint32 ppid = 7

• uint64 process_parent_start_time = 8

• string process_name = 9

• oneof data

  • Exec exec = 21

  • DNS dns = 22

  • File file = 23

  • Tuple tuple = 24

  • SignatureEvent signature = 25

  • Any any = 26

  • StdioViaSocketFinding stdio_via_socket = 27

  • SSHData ssh = 28

  • ProcessFork process_fork = 29

  • ProcessExit process_exit = 30

Used in: DataBatchItem

• string node_name = 1

• string namespace = 2

• string workload_name = 3

• string workload_uid = 4

• WorkloadKind workload_kind = 5

• string pod_name = 6

• string container_name = 7

• string container_id = 8

• string pod_uid = 9

• string image_digest = 14

• map<string, string> object_labels = 10

• map<string, string> object_annotations = 11

• uint64 cgroup_id = 12

• repeated ContainerEvent items = 13

Used in: DataBatchItem

• string namespace = 1

• string pod_name = 2

• string container_name = 3

• string workload_name = 4

• string workload_kind = 7

• string pod_uid = 5

• string container_id = 6

• string node_name = 8

• string workload_uid = 9

• string image_digest = 11

• uint64 cgroup_id = 10

• optional CpuStats cpu_stats = 21

• optional MemoryStats memory_stats = 22

• optional PidsStats pids_stats = 23

• optional IOStats io_stats = 24

• optional FilesAccessStats files_access_stats = 25

Used in: ContainerStats, NodeStats

• uint64 total_usage = 1

  Total CPU time consumed. Units: nanoseconds.

• uint64 usage_in_kernelmode = 2

  Time spent by tasks of the cgroup in kernel mode. Units: nanoseconds.

• uint64 usage_in_usermode = 3

  Time spent by tasks of the cgroup in user mode. Units: nanoseconds.

• uint64 throttled_periods = 4

  Number of periods when the container hit its throttling limit.

• uint64 throttled_time = 5

  Aggregate time the container was throttled for in nanoseconds.

• optional PSIStats psi = 6

Used in: ContainerEvent

• string DNSQuestionDomain = 1

• repeated DNSAnswers answers = 2

• FlowDirection flow_direction = 3

• optional Tuple tuple = 4

Used in: DNS

• uint32 type = 1

• uint32 class = 2

• uint32 ttl = 3

• string name = 4

• bytes ip = 5

• string cname = 6

Used in: WriteDataBatchRequest

• oneof data

  • ContainerStats container_stats = 10

  • NodeStats node_stats = 11

  • ContainerEvents container_events = 12

  • Netflow netflow = 13

  • ProcessTreeEvent process_tree = 14

Used in: ContainerEvent

• UNKNOWN = 0

• EVENT_EXEC = 1

• EVENT_DNS = 2

• EVENT_TCP_CONNECT = 3

• EVENT_TCP_CONNECT_ERROR = 4

• EVENT_TCP_LISTEN = 5

• EVENT_FILE_CHANGE = 6

• EVENT_PROCESS_OOM = 7

• EVENT_MAGIC_WRITE = 8

• EVENT_SIGNATURE = 9

• EVENT_TTY_WRITE = 10

• EVENT_STDIO_VIA_SOCKET = 11

• EVENT_SSH = 12

• EVENT_PROCESS_FORK = 13

• EVENT_PROCESS_EXIT = 14

• EVENT_FILE_OPEN = 15

• EVENT_ANY = 999

Used in: ContainerEvent

• string path = 1

• repeated string args = 2

• bytes hash_sha256 = 3

• uint32 flags = 4

Used in: ContainerEvent

• string path = 1

• bytes hash_sha256 = 2

Used in: ContainerStats

• repeated string paths = 1

• repeated uint32 reads = 2

Used in: DNS, SOCKS5DetectedFinding, SSHData

• FLOW_UNKNOWN = 0

• FLOW_INGRESS = 1

• FLOW_EGRESS = 2

Used in: SignatureFinding

• GitCloneRemoteType type = 1

• string full_repo = 2

• string server = 3

• string repo_path = 4

Used in: GitCloneDetectedFinding

• GIT_REMOTE_UNKNOWN = 0

• GIT_REMOTE_SSH = 1

• GIT_REMOTE_GIT = 2

• GIT_REMOTE_HTTP = 3

• GIT_REMOTE_HTTPS = 4

• GIT_REMOTE_FTP = 5

• GIT_REMOTE_FTPS = 6

• GIT_REMOTE_LOCAL = 7

Used in: ContainerStats, NodeStats

• optional PSIStats psi = 1

Used in: ImagesSyncState, UpdateSyncStateRequest

• string id = 1

• string name = 2

• string architecture = 3

• repeated string resource_ids = 4

• ImageScanStatus scan_status = 5

• string scan_error = 6

Used in: Image

• IMAGE_SCAN_STATUS_UNKNOWN = 0

• IMAGE_SCAN_STATUS_SCANNED = 1

• IMAGE_SCAN_STATUS_PENDING = 2

• IMAGE_SCAN_STATUS_SCAN_ERROR = 3

Used in: GetSyncStateResponse

• bool full_resync_required = 1

• repeated Image images = 2

Used in: SignatureFinding

(message has no fields)

Used in: KubeBenchGroup

• string id = 1

• string text = 2

• repeated string test_info = 3

• string state = 4

Used in: KubeBenchReport

• string version = 1

• repeated KubeBenchGroup groups = 2

Used in: KubeBenchControls

• repeated KubeBenchCheck checks = 1

Used in: KubeBenchReport

• string node_name = 1

• string resource_uid = 2

Used in: KubeLinterReport

• string resource_uid = 1

• uint64 passed = 2

  Represented as bitmasks of passed checks.

• uint64 failed = 3

  Represented as bitmasks of failed checks.

Used in: MemoryStats

• uint64 usage = 1

• uint64 limit = 2

Used in: ContainerStats, NodeStats

• uint64 cache = 1

• optional MemoryData usage = 2

• optional MemoryData swap_only_usage = 4

• optional PSIStats psi = 8

Used in: DataBatchItem

• uint64 timestamp = 1

  Stored as unix timestamp in nanoseconds.

• string process_name = 2

• string namespace = 3

• string pod_name = 4

• string container_name = 5

• string workload_name = 6

• string workload_kind = 7

• string zone = 8

• string region = 16

• string node_name = 13

• bytes addr = 9

• uint32 port = 10

• uint32 pid = 14

• uint64 process_start_time = 15

• NetflowProtocol protocol = 11

• repeated NetflowDestination destinations = 12

Used in: Netflow

• string namespace = 1

• string pod_name = 2

• string workload_name = 3

• string workload_kind = 4

• string zone = 5

• string region = 15

• string dns_question = 6

• string node_name = 14

• bytes addr = 8

• uint32 port = 9

• uint64 tx_bytes = 10

• uint64 rx_bytes = 11

• uint64 tx_packets = 12

• uint64 rx_packets = 13

Used in: Netflow

• NETFLOW_PROTOCOL_UNKNOWN = 0

• NETFLOW_PROTOCOL_TCP = 1

• NETFLOW_PROTOCOL_UDP = 2

Used in: DataBatchItem

• string node_name = 1

• optional CpuStats cpu_stats = 21

• optional MemoryStats memory_stats = 22

• optional IOStats io_stats = 23

Used in: PSIStats

• uint64 total = 1

Used in: CpuStats, IOStats, MemoryStats

• optional PSIData some = 1

• optional PSIData full = 2

Used in: ContainerStats

• uint64 current = 1

  number of pids in the cgroup

• uint64 limit = 2

  active pids hard limit

Used in: ProcessEvent

• uint32 pid = 1

• uint32 ppid = 2

• uint64 start_time = 3

• uint64 parent_start_time = 4

• repeated string args = 5

• string filepath = 6

• uint64 exit_time = 7

Used in: ProcessEvent

• PROCESS_ACTION_UNKNOWN = 0

• PROCESS_ACTION_EXEC = 1

• PROCESS_ACTION_FORK = 2

• PROCESS_ACTION_EXIT = 3

Used in: ProcessTreeEvent

• uint64 timestamp = 1

  Stored as unix timestamp in nanoseconds.

• string container_id = 2

• optional Process process = 3

• ProcessAction action = 4

Used in: ContainerEvent

• int64 exit_code = 1

Used in: ContainerEvent

(message has no fields)

• uint32 pid = 1

• uint64 start_time = 2

Used in: DataBatchItem

• bool initial = 1

• repeated ProcessEvent events = 2

Used in: SOCKS5DetectedFinding

• SOCKS5_ADDRESS_TYPE_UNKNOWN = 0

• SOCKS5_ADDRESS_TYPE_IPv4 = 1

• SOCKS5_ADDRESS_TYPE_DOMAIN_NAME = 3

• SOCKS5_ADDRESS_TYPE_IPv6 = 4

Used in: SignatureFinding

• SOCKS5Role role = 1

• FlowDirection flow_direction = 2

• uint32 cmd_or_reply = 3

• SOCKS5AddressType address_type = 4

• bytes address = 5

• uint32 port = 6

Used in: SOCKS5DetectedFinding

• SOCKS5_ROLE_UNKNOWN = 0

• SOCKS5_ROLE_CLIENT = 1

• SOCKS5_ROLE_SERVER = 2

Used in: ContainerEvent

• FlowDirection flow_direction = 1

• string version = 2

• string comments = 3

• optional Tuple tuple = 4

(message has no fields)

Used in: ContainerEvent

• optional SignatureMetadata metadata = 1

• optional SignatureFinding finding = 2

Used in: SignatureMetadata

• SIGNATURE_UNKNOWN = 0

• SIGNATURE_STDIO_VIA_SOCKET = 1

• SIGNATURE_TTY_DETECTED = 2

• SIGNATURE_SOCKS5_DETECTED = 3

• SIGNATURE_GIT_CLONE_DETECTED = 4

• SIGNATURE_INGRESS_NIGHTMARE_EXPLOIT_DETECTED = 5

Used in: SignatureEvent

• oneof data

  • StdioViaSocketFinding stdio_via_socket = 1

  • TtyDetectedFinding tty_detected = 2

  • SOCKS5DetectedFinding socks5_detected = 3

  • GitCloneDetectedFinding git_clone_detected = 4

  • IngressNightmareExploitDetectedFinding ingress_nightmare_exploit_detected = 5

Used in: SignatureEvent

• SignatureEventID id = 1

• string version = 2

Used in: ContainerEvent, SignatureFinding

• bytes ip = 1

• uint32 port = 2

• int32 socketfd = 3

Used in: SignatureFinding

• string path = 1

Used in: ContainerEvent, DNS, SSHData

• bytes src_ip = 1

• bytes dst_ip = 2

• uint32 src_port = 3

• uint32 dst_port = 4

• string dns_question = 5

Used in: ContainerEvents

• WORKLOAD_KIND_UNKNOWN = 0

• WORKLOAD_KIND_DEPLOYMENT = 1

• WORKLOAD_KIND_REPLICA_SET = 2

• WORKLOAD_KIND_STATEFUL_SET = 3

• WORKLOAD_KIND_JOB = 4

• WORKLOAD_KIND_CRONJOB = 5

• WORKLOAD_KIND_POD = 6