github.com/DataDog/datadog-agent/pkg/security/secl@v0.55.0-devel.0.20240517055856-10c4965fea94/model/field_accessors_unix.go (about) 1 // Unless explicitly stated otherwise all files in this repository are licensed 2 // under the Apache License Version 2.0. 3 // This product includes software developed at Datadog (https://www.datadoghq.com/). 4 // Copyright 2022-present Datadog, Inc. 5 // Code generated - DO NOT EDIT. 6 7 //go:build unix 8 9 package model 10 11 import ( 12 "github.com/DataDog/datadog-agent/pkg/security/secl/compiler/eval" 13 "net" 14 "time" 15 ) 16 17 // GetBindAddrFamily returns the value of the field, resolving if necessary 18 func (ev *Event) GetBindAddrFamily() uint16 { 19 if ev.GetEventType().String() != "bind" { 20 return uint16(0) 21 } 22 return ev.Bind.AddrFamily 23 } 24 25 // GetBindAddrIp returns the value of the field, resolving if necessary 26 func (ev *Event) GetBindAddrIp() net.IPNet { 27 if ev.GetEventType().String() != "bind" { 28 return net.IPNet{} 29 } 30 return ev.Bind.Addr.IPNet 31 } 32 33 // GetBindAddrPort returns the value of the field, resolving if necessary 34 func (ev *Event) GetBindAddrPort() uint16 { 35 if ev.GetEventType().String() != "bind" { 36 return uint16(0) 37 } 38 return ev.Bind.Addr.Port 39 } 40 41 // GetBindRetval returns the value of the field, resolving if necessary 42 func (ev *Event) GetBindRetval() int64 { 43 if ev.GetEventType().String() != "bind" { 44 return int64(0) 45 } 46 return ev.Bind.SyscallEvent.Retval 47 } 48 49 // GetBpfCmd returns the value of the field, resolving if necessary 50 func (ev *Event) GetBpfCmd() uint32 { 51 if ev.GetEventType().String() != "bpf" { 52 return uint32(0) 53 } 54 return ev.BPF.Cmd 55 } 56 57 // GetBpfMapName returns the value of the field, resolving if necessary 58 func (ev *Event) GetBpfMapName() string { 59 if ev.GetEventType().String() != "bpf" { 60 return "" 61 } 62 return ev.BPF.Map.Name 63 } 64 65 // GetBpfMapType returns the value of the field, resolving if necessary 66 func (ev *Event) GetBpfMapType() uint32 { 67 if ev.GetEventType().String() != "bpf" { 68 return uint32(0) 69 } 70 return ev.BPF.Map.Type 71 } 72 73 // GetBpfProgAttachType returns the value of the field, resolving if necessary 74 func (ev *Event) GetBpfProgAttachType() uint32 { 75 if ev.GetEventType().String() != "bpf" { 76 return uint32(0) 77 } 78 return ev.BPF.Program.AttachType 79 } 80 81 // GetBpfProgHelpers returns the value of the field, resolving if necessary 82 func (ev *Event) GetBpfProgHelpers() []uint32 { 83 if ev.GetEventType().String() != "bpf" { 84 return []uint32{} 85 } 86 return ev.BPF.Program.Helpers 87 } 88 89 // GetBpfProgName returns the value of the field, resolving if necessary 90 func (ev *Event) GetBpfProgName() string { 91 if ev.GetEventType().String() != "bpf" { 92 return "" 93 } 94 return ev.BPF.Program.Name 95 } 96 97 // GetBpfProgTag returns the value of the field, resolving if necessary 98 func (ev *Event) GetBpfProgTag() string { 99 if ev.GetEventType().String() != "bpf" { 100 return "" 101 } 102 return ev.BPF.Program.Tag 103 } 104 105 // GetBpfProgType returns the value of the field, resolving if necessary 106 func (ev *Event) GetBpfProgType() uint32 { 107 if ev.GetEventType().String() != "bpf" { 108 return uint32(0) 109 } 110 return ev.BPF.Program.Type 111 } 112 113 // GetBpfRetval returns the value of the field, resolving if necessary 114 func (ev *Event) GetBpfRetval() int64 { 115 if ev.GetEventType().String() != "bpf" { 116 return int64(0) 117 } 118 return ev.BPF.SyscallEvent.Retval 119 } 120 121 // GetCapsetCapEffective returns the value of the field, resolving if necessary 122 func (ev *Event) GetCapsetCapEffective() uint64 { 123 if ev.GetEventType().String() != "capset" { 124 return uint64(0) 125 } 126 return ev.Capset.CapEffective 127 } 128 129 // GetCapsetCapPermitted returns the value of the field, resolving if necessary 130 func (ev *Event) GetCapsetCapPermitted() uint64 { 131 if ev.GetEventType().String() != "capset" { 132 return uint64(0) 133 } 134 return ev.Capset.CapPermitted 135 } 136 137 // GetChdirFileChangeTime returns the value of the field, resolving if necessary 138 func (ev *Event) GetChdirFileChangeTime() uint64 { 139 if ev.GetEventType().String() != "chdir" { 140 return uint64(0) 141 } 142 return ev.Chdir.File.FileFields.CTime 143 } 144 145 // GetChdirFileFilesystem returns the value of the field, resolving if necessary 146 func (ev *Event) GetChdirFileFilesystem() string { 147 if ev.GetEventType().String() != "chdir" { 148 return "" 149 } 150 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Chdir.File) 151 } 152 153 // GetChdirFileGid returns the value of the field, resolving if necessary 154 func (ev *Event) GetChdirFileGid() uint32 { 155 if ev.GetEventType().String() != "chdir" { 156 return uint32(0) 157 } 158 return ev.Chdir.File.FileFields.GID 159 } 160 161 // GetChdirFileGroup returns the value of the field, resolving if necessary 162 func (ev *Event) GetChdirFileGroup() string { 163 if ev.GetEventType().String() != "chdir" { 164 return "" 165 } 166 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Chdir.File.FileFields) 167 } 168 169 // GetChdirFileHashes returns the value of the field, resolving if necessary 170 func (ev *Event) GetChdirFileHashes() []string { 171 if ev.GetEventType().String() != "chdir" { 172 return []string{} 173 } 174 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Chdir.File) 175 } 176 177 // GetChdirFileInUpperLayer returns the value of the field, resolving if necessary 178 func (ev *Event) GetChdirFileInUpperLayer() bool { 179 if ev.GetEventType().String() != "chdir" { 180 return false 181 } 182 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Chdir.File.FileFields) 183 } 184 185 // GetChdirFileInode returns the value of the field, resolving if necessary 186 func (ev *Event) GetChdirFileInode() uint64 { 187 if ev.GetEventType().String() != "chdir" { 188 return uint64(0) 189 } 190 return ev.Chdir.File.FileFields.PathKey.Inode 191 } 192 193 // GetChdirFileMode returns the value of the field, resolving if necessary 194 func (ev *Event) GetChdirFileMode() uint16 { 195 if ev.GetEventType().String() != "chdir" { 196 return uint16(0) 197 } 198 return ev.Chdir.File.FileFields.Mode 199 } 200 201 // GetChdirFileModificationTime returns the value of the field, resolving if necessary 202 func (ev *Event) GetChdirFileModificationTime() uint64 { 203 if ev.GetEventType().String() != "chdir" { 204 return uint64(0) 205 } 206 return ev.Chdir.File.FileFields.MTime 207 } 208 209 // GetChdirFileMountId returns the value of the field, resolving if necessary 210 func (ev *Event) GetChdirFileMountId() uint32 { 211 if ev.GetEventType().String() != "chdir" { 212 return uint32(0) 213 } 214 return ev.Chdir.File.FileFields.PathKey.MountID 215 } 216 217 // GetChdirFileName returns the value of the field, resolving if necessary 218 func (ev *Event) GetChdirFileName() string { 219 if ev.GetEventType().String() != "chdir" { 220 return "" 221 } 222 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Chdir.File) 223 } 224 225 // GetChdirFileNameLength returns the value of the field, resolving if necessary 226 func (ev *Event) GetChdirFileNameLength() int { 227 if ev.GetEventType().String() != "chdir" { 228 return 0 229 } 230 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Chdir.File)) 231 } 232 233 // GetChdirFilePackageName returns the value of the field, resolving if necessary 234 func (ev *Event) GetChdirFilePackageName() string { 235 if ev.GetEventType().String() != "chdir" { 236 return "" 237 } 238 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Chdir.File) 239 } 240 241 // GetChdirFilePackageSourceVersion returns the value of the field, resolving if necessary 242 func (ev *Event) GetChdirFilePackageSourceVersion() string { 243 if ev.GetEventType().String() != "chdir" { 244 return "" 245 } 246 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Chdir.File) 247 } 248 249 // GetChdirFilePackageVersion returns the value of the field, resolving if necessary 250 func (ev *Event) GetChdirFilePackageVersion() string { 251 if ev.GetEventType().String() != "chdir" { 252 return "" 253 } 254 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Chdir.File) 255 } 256 257 // GetChdirFilePath returns the value of the field, resolving if necessary 258 func (ev *Event) GetChdirFilePath() string { 259 if ev.GetEventType().String() != "chdir" { 260 return "" 261 } 262 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Chdir.File) 263 } 264 265 // GetChdirFilePathLength returns the value of the field, resolving if necessary 266 func (ev *Event) GetChdirFilePathLength() int { 267 if ev.GetEventType().String() != "chdir" { 268 return 0 269 } 270 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Chdir.File)) 271 } 272 273 // GetChdirFileRights returns the value of the field, resolving if necessary 274 func (ev *Event) GetChdirFileRights() int { 275 if ev.GetEventType().String() != "chdir" { 276 return 0 277 } 278 return ev.FieldHandlers.ResolveRights(ev, &ev.Chdir.File.FileFields) 279 } 280 281 // GetChdirFileUid returns the value of the field, resolving if necessary 282 func (ev *Event) GetChdirFileUid() uint32 { 283 if ev.GetEventType().String() != "chdir" { 284 return uint32(0) 285 } 286 return ev.Chdir.File.FileFields.UID 287 } 288 289 // GetChdirFileUser returns the value of the field, resolving if necessary 290 func (ev *Event) GetChdirFileUser() string { 291 if ev.GetEventType().String() != "chdir" { 292 return "" 293 } 294 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Chdir.File.FileFields) 295 } 296 297 // GetChdirRetval returns the value of the field, resolving if necessary 298 func (ev *Event) GetChdirRetval() int64 { 299 if ev.GetEventType().String() != "chdir" { 300 return int64(0) 301 } 302 return ev.Chdir.SyscallEvent.Retval 303 } 304 305 // GetChmodFileChangeTime returns the value of the field, resolving if necessary 306 func (ev *Event) GetChmodFileChangeTime() uint64 { 307 if ev.GetEventType().String() != "chmod" { 308 return uint64(0) 309 } 310 return ev.Chmod.File.FileFields.CTime 311 } 312 313 // GetChmodFileDestinationMode returns the value of the field, resolving if necessary 314 func (ev *Event) GetChmodFileDestinationMode() uint32 { 315 if ev.GetEventType().String() != "chmod" { 316 return uint32(0) 317 } 318 return ev.Chmod.Mode 319 } 320 321 // GetChmodFileDestinationRights returns the value of the field, resolving if necessary 322 func (ev *Event) GetChmodFileDestinationRights() uint32 { 323 if ev.GetEventType().String() != "chmod" { 324 return uint32(0) 325 } 326 return ev.Chmod.Mode 327 } 328 329 // GetChmodFileFilesystem returns the value of the field, resolving if necessary 330 func (ev *Event) GetChmodFileFilesystem() string { 331 if ev.GetEventType().String() != "chmod" { 332 return "" 333 } 334 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Chmod.File) 335 } 336 337 // GetChmodFileGid returns the value of the field, resolving if necessary 338 func (ev *Event) GetChmodFileGid() uint32 { 339 if ev.GetEventType().String() != "chmod" { 340 return uint32(0) 341 } 342 return ev.Chmod.File.FileFields.GID 343 } 344 345 // GetChmodFileGroup returns the value of the field, resolving if necessary 346 func (ev *Event) GetChmodFileGroup() string { 347 if ev.GetEventType().String() != "chmod" { 348 return "" 349 } 350 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Chmod.File.FileFields) 351 } 352 353 // GetChmodFileHashes returns the value of the field, resolving if necessary 354 func (ev *Event) GetChmodFileHashes() []string { 355 if ev.GetEventType().String() != "chmod" { 356 return []string{} 357 } 358 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Chmod.File) 359 } 360 361 // GetChmodFileInUpperLayer returns the value of the field, resolving if necessary 362 func (ev *Event) GetChmodFileInUpperLayer() bool { 363 if ev.GetEventType().String() != "chmod" { 364 return false 365 } 366 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Chmod.File.FileFields) 367 } 368 369 // GetChmodFileInode returns the value of the field, resolving if necessary 370 func (ev *Event) GetChmodFileInode() uint64 { 371 if ev.GetEventType().String() != "chmod" { 372 return uint64(0) 373 } 374 return ev.Chmod.File.FileFields.PathKey.Inode 375 } 376 377 // GetChmodFileMode returns the value of the field, resolving if necessary 378 func (ev *Event) GetChmodFileMode() uint16 { 379 if ev.GetEventType().String() != "chmod" { 380 return uint16(0) 381 } 382 return ev.Chmod.File.FileFields.Mode 383 } 384 385 // GetChmodFileModificationTime returns the value of the field, resolving if necessary 386 func (ev *Event) GetChmodFileModificationTime() uint64 { 387 if ev.GetEventType().String() != "chmod" { 388 return uint64(0) 389 } 390 return ev.Chmod.File.FileFields.MTime 391 } 392 393 // GetChmodFileMountId returns the value of the field, resolving if necessary 394 func (ev *Event) GetChmodFileMountId() uint32 { 395 if ev.GetEventType().String() != "chmod" { 396 return uint32(0) 397 } 398 return ev.Chmod.File.FileFields.PathKey.MountID 399 } 400 401 // GetChmodFileName returns the value of the field, resolving if necessary 402 func (ev *Event) GetChmodFileName() string { 403 if ev.GetEventType().String() != "chmod" { 404 return "" 405 } 406 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Chmod.File) 407 } 408 409 // GetChmodFileNameLength returns the value of the field, resolving if necessary 410 func (ev *Event) GetChmodFileNameLength() int { 411 if ev.GetEventType().String() != "chmod" { 412 return 0 413 } 414 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Chmod.File)) 415 } 416 417 // GetChmodFilePackageName returns the value of the field, resolving if necessary 418 func (ev *Event) GetChmodFilePackageName() string { 419 if ev.GetEventType().String() != "chmod" { 420 return "" 421 } 422 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Chmod.File) 423 } 424 425 // GetChmodFilePackageSourceVersion returns the value of the field, resolving if necessary 426 func (ev *Event) GetChmodFilePackageSourceVersion() string { 427 if ev.GetEventType().String() != "chmod" { 428 return "" 429 } 430 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Chmod.File) 431 } 432 433 // GetChmodFilePackageVersion returns the value of the field, resolving if necessary 434 func (ev *Event) GetChmodFilePackageVersion() string { 435 if ev.GetEventType().String() != "chmod" { 436 return "" 437 } 438 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Chmod.File) 439 } 440 441 // GetChmodFilePath returns the value of the field, resolving if necessary 442 func (ev *Event) GetChmodFilePath() string { 443 if ev.GetEventType().String() != "chmod" { 444 return "" 445 } 446 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Chmod.File) 447 } 448 449 // GetChmodFilePathLength returns the value of the field, resolving if necessary 450 func (ev *Event) GetChmodFilePathLength() int { 451 if ev.GetEventType().String() != "chmod" { 452 return 0 453 } 454 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Chmod.File)) 455 } 456 457 // GetChmodFileRights returns the value of the field, resolving if necessary 458 func (ev *Event) GetChmodFileRights() int { 459 if ev.GetEventType().String() != "chmod" { 460 return 0 461 } 462 return ev.FieldHandlers.ResolveRights(ev, &ev.Chmod.File.FileFields) 463 } 464 465 // GetChmodFileUid returns the value of the field, resolving if necessary 466 func (ev *Event) GetChmodFileUid() uint32 { 467 if ev.GetEventType().String() != "chmod" { 468 return uint32(0) 469 } 470 return ev.Chmod.File.FileFields.UID 471 } 472 473 // GetChmodFileUser returns the value of the field, resolving if necessary 474 func (ev *Event) GetChmodFileUser() string { 475 if ev.GetEventType().String() != "chmod" { 476 return "" 477 } 478 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Chmod.File.FileFields) 479 } 480 481 // GetChmodRetval returns the value of the field, resolving if necessary 482 func (ev *Event) GetChmodRetval() int64 { 483 if ev.GetEventType().String() != "chmod" { 484 return int64(0) 485 } 486 return ev.Chmod.SyscallEvent.Retval 487 } 488 489 // GetChownFileChangeTime returns the value of the field, resolving if necessary 490 func (ev *Event) GetChownFileChangeTime() uint64 { 491 if ev.GetEventType().String() != "chown" { 492 return uint64(0) 493 } 494 return ev.Chown.File.FileFields.CTime 495 } 496 497 // GetChownFileDestinationGid returns the value of the field, resolving if necessary 498 func (ev *Event) GetChownFileDestinationGid() int64 { 499 if ev.GetEventType().String() != "chown" { 500 return int64(0) 501 } 502 return ev.Chown.GID 503 } 504 505 // GetChownFileDestinationGroup returns the value of the field, resolving if necessary 506 func (ev *Event) GetChownFileDestinationGroup() string { 507 if ev.GetEventType().String() != "chown" { 508 return "" 509 } 510 return ev.FieldHandlers.ResolveChownGID(ev, &ev.Chown) 511 } 512 513 // GetChownFileDestinationUid returns the value of the field, resolving if necessary 514 func (ev *Event) GetChownFileDestinationUid() int64 { 515 if ev.GetEventType().String() != "chown" { 516 return int64(0) 517 } 518 return ev.Chown.UID 519 } 520 521 // GetChownFileDestinationUser returns the value of the field, resolving if necessary 522 func (ev *Event) GetChownFileDestinationUser() string { 523 if ev.GetEventType().String() != "chown" { 524 return "" 525 } 526 return ev.FieldHandlers.ResolveChownUID(ev, &ev.Chown) 527 } 528 529 // GetChownFileFilesystem returns the value of the field, resolving if necessary 530 func (ev *Event) GetChownFileFilesystem() string { 531 if ev.GetEventType().String() != "chown" { 532 return "" 533 } 534 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Chown.File) 535 } 536 537 // GetChownFileGid returns the value of the field, resolving if necessary 538 func (ev *Event) GetChownFileGid() uint32 { 539 if ev.GetEventType().String() != "chown" { 540 return uint32(0) 541 } 542 return ev.Chown.File.FileFields.GID 543 } 544 545 // GetChownFileGroup returns the value of the field, resolving if necessary 546 func (ev *Event) GetChownFileGroup() string { 547 if ev.GetEventType().String() != "chown" { 548 return "" 549 } 550 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Chown.File.FileFields) 551 } 552 553 // GetChownFileHashes returns the value of the field, resolving if necessary 554 func (ev *Event) GetChownFileHashes() []string { 555 if ev.GetEventType().String() != "chown" { 556 return []string{} 557 } 558 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Chown.File) 559 } 560 561 // GetChownFileInUpperLayer returns the value of the field, resolving if necessary 562 func (ev *Event) GetChownFileInUpperLayer() bool { 563 if ev.GetEventType().String() != "chown" { 564 return false 565 } 566 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Chown.File.FileFields) 567 } 568 569 // GetChownFileInode returns the value of the field, resolving if necessary 570 func (ev *Event) GetChownFileInode() uint64 { 571 if ev.GetEventType().String() != "chown" { 572 return uint64(0) 573 } 574 return ev.Chown.File.FileFields.PathKey.Inode 575 } 576 577 // GetChownFileMode returns the value of the field, resolving if necessary 578 func (ev *Event) GetChownFileMode() uint16 { 579 if ev.GetEventType().String() != "chown" { 580 return uint16(0) 581 } 582 return ev.Chown.File.FileFields.Mode 583 } 584 585 // GetChownFileModificationTime returns the value of the field, resolving if necessary 586 func (ev *Event) GetChownFileModificationTime() uint64 { 587 if ev.GetEventType().String() != "chown" { 588 return uint64(0) 589 } 590 return ev.Chown.File.FileFields.MTime 591 } 592 593 // GetChownFileMountId returns the value of the field, resolving if necessary 594 func (ev *Event) GetChownFileMountId() uint32 { 595 if ev.GetEventType().String() != "chown" { 596 return uint32(0) 597 } 598 return ev.Chown.File.FileFields.PathKey.MountID 599 } 600 601 // GetChownFileName returns the value of the field, resolving if necessary 602 func (ev *Event) GetChownFileName() string { 603 if ev.GetEventType().String() != "chown" { 604 return "" 605 } 606 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Chown.File) 607 } 608 609 // GetChownFileNameLength returns the value of the field, resolving if necessary 610 func (ev *Event) GetChownFileNameLength() int { 611 if ev.GetEventType().String() != "chown" { 612 return 0 613 } 614 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Chown.File)) 615 } 616 617 // GetChownFilePackageName returns the value of the field, resolving if necessary 618 func (ev *Event) GetChownFilePackageName() string { 619 if ev.GetEventType().String() != "chown" { 620 return "" 621 } 622 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Chown.File) 623 } 624 625 // GetChownFilePackageSourceVersion returns the value of the field, resolving if necessary 626 func (ev *Event) GetChownFilePackageSourceVersion() string { 627 if ev.GetEventType().String() != "chown" { 628 return "" 629 } 630 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Chown.File) 631 } 632 633 // GetChownFilePackageVersion returns the value of the field, resolving if necessary 634 func (ev *Event) GetChownFilePackageVersion() string { 635 if ev.GetEventType().String() != "chown" { 636 return "" 637 } 638 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Chown.File) 639 } 640 641 // GetChownFilePath returns the value of the field, resolving if necessary 642 func (ev *Event) GetChownFilePath() string { 643 if ev.GetEventType().String() != "chown" { 644 return "" 645 } 646 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Chown.File) 647 } 648 649 // GetChownFilePathLength returns the value of the field, resolving if necessary 650 func (ev *Event) GetChownFilePathLength() int { 651 if ev.GetEventType().String() != "chown" { 652 return 0 653 } 654 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Chown.File)) 655 } 656 657 // GetChownFileRights returns the value of the field, resolving if necessary 658 func (ev *Event) GetChownFileRights() int { 659 if ev.GetEventType().String() != "chown" { 660 return 0 661 } 662 return ev.FieldHandlers.ResolveRights(ev, &ev.Chown.File.FileFields) 663 } 664 665 // GetChownFileUid returns the value of the field, resolving if necessary 666 func (ev *Event) GetChownFileUid() uint32 { 667 if ev.GetEventType().String() != "chown" { 668 return uint32(0) 669 } 670 return ev.Chown.File.FileFields.UID 671 } 672 673 // GetChownFileUser returns the value of the field, resolving if necessary 674 func (ev *Event) GetChownFileUser() string { 675 if ev.GetEventType().String() != "chown" { 676 return "" 677 } 678 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Chown.File.FileFields) 679 } 680 681 // GetChownRetval returns the value of the field, resolving if necessary 682 func (ev *Event) GetChownRetval() int64 { 683 if ev.GetEventType().String() != "chown" { 684 return int64(0) 685 } 686 return ev.Chown.SyscallEvent.Retval 687 } 688 689 // GetContainerCreatedAt returns the value of the field, resolving if necessary 690 func (ev *Event) GetContainerCreatedAt() int { 691 if ev.BaseEvent.ContainerContext == nil { 692 return 0 693 } 694 return ev.FieldHandlers.ResolveContainerCreatedAt(ev, ev.BaseEvent.ContainerContext) 695 } 696 697 // GetContainerId returns the value of the field, resolving if necessary 698 func (ev *Event) GetContainerId() string { 699 if ev.BaseEvent.ContainerContext == nil { 700 return "" 701 } 702 return ev.FieldHandlers.ResolveContainerID(ev, ev.BaseEvent.ContainerContext) 703 } 704 705 // GetContainerTags returns the value of the field, resolving if necessary 706 func (ev *Event) GetContainerTags() []string { 707 if ev.BaseEvent.ContainerContext == nil { 708 return []string{} 709 } 710 return ev.FieldHandlers.ResolveContainerTags(ev, ev.BaseEvent.ContainerContext) 711 } 712 713 // GetDnsId returns the value of the field, resolving if necessary 714 func (ev *Event) GetDnsId() uint16 { 715 if ev.GetEventType().String() != "dns" { 716 return uint16(0) 717 } 718 return ev.DNS.ID 719 } 720 721 // GetDnsQuestionClass returns the value of the field, resolving if necessary 722 func (ev *Event) GetDnsQuestionClass() uint16 { 723 if ev.GetEventType().String() != "dns" { 724 return uint16(0) 725 } 726 return ev.DNS.Class 727 } 728 729 // GetDnsQuestionCount returns the value of the field, resolving if necessary 730 func (ev *Event) GetDnsQuestionCount() uint16 { 731 if ev.GetEventType().String() != "dns" { 732 return uint16(0) 733 } 734 return ev.DNS.Count 735 } 736 737 // GetDnsQuestionLength returns the value of the field, resolving if necessary 738 func (ev *Event) GetDnsQuestionLength() uint16 { 739 if ev.GetEventType().String() != "dns" { 740 return uint16(0) 741 } 742 return ev.DNS.Size 743 } 744 745 // GetDnsQuestionName returns the value of the field, resolving if necessary 746 func (ev *Event) GetDnsQuestionName() string { 747 if ev.GetEventType().String() != "dns" { 748 return "" 749 } 750 return ev.DNS.Name 751 } 752 753 // GetDnsQuestionNameLength returns the value of the field, resolving if necessary 754 func (ev *Event) GetDnsQuestionNameLength() int { 755 if ev.GetEventType().String() != "dns" { 756 return 0 757 } 758 return len(ev.DNS.Name) 759 } 760 761 // GetDnsQuestionType returns the value of the field, resolving if necessary 762 func (ev *Event) GetDnsQuestionType() uint16 { 763 if ev.GetEventType().String() != "dns" { 764 return uint16(0) 765 } 766 return ev.DNS.Type 767 } 768 769 // GetEventAsync returns the value of the field, resolving if necessary 770 func (ev *Event) GetEventAsync() bool { 771 return ev.FieldHandlers.ResolveAsync(ev) 772 } 773 774 // GetEventOrigin returns the value of the field, resolving if necessary 775 func (ev *Event) GetEventOrigin() string { 776 return ev.BaseEvent.Origin 777 } 778 779 // GetEventOs returns the value of the field, resolving if necessary 780 func (ev *Event) GetEventOs() string { 781 return ev.BaseEvent.Os 782 } 783 784 // GetEventService returns the value of the field, resolving if necessary 785 func (ev *Event) GetEventService() string { 786 return ev.FieldHandlers.ResolveService(ev, &ev.BaseEvent) 787 } 788 789 // GetEventTimestamp returns the value of the field, resolving if necessary 790 func (ev *Event) GetEventTimestamp() int { 791 return ev.FieldHandlers.ResolveEventTimestamp(ev, &ev.BaseEvent) 792 } 793 794 // GetExecArgs returns the value of the field, resolving if necessary 795 func (ev *Event) GetExecArgs() string { 796 if ev.GetEventType().String() != "exec" { 797 return "" 798 } 799 if ev.Exec.Process == nil { 800 return "" 801 } 802 return ev.FieldHandlers.ResolveProcessArgs(ev, ev.Exec.Process) 803 } 804 805 // GetExecArgsFlags returns the value of the field, resolving if necessary 806 func (ev *Event) GetExecArgsFlags() []string { 807 if ev.GetEventType().String() != "exec" { 808 return []string{} 809 } 810 if ev.Exec.Process == nil { 811 return []string{} 812 } 813 return ev.FieldHandlers.ResolveProcessArgsFlags(ev, ev.Exec.Process) 814 } 815 816 // GetExecArgsOptions returns the value of the field, resolving if necessary 817 func (ev *Event) GetExecArgsOptions() []string { 818 if ev.GetEventType().String() != "exec" { 819 return []string{} 820 } 821 if ev.Exec.Process == nil { 822 return []string{} 823 } 824 return ev.FieldHandlers.ResolveProcessArgsOptions(ev, ev.Exec.Process) 825 } 826 827 // GetExecArgsScrubbed returns the value of the field, resolving if necessary 828 func (ev *Event) GetExecArgsScrubbed() string { 829 if ev.GetEventType().String() != "exec" { 830 return "" 831 } 832 if ev.Exec.Process == nil { 833 return "" 834 } 835 return ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, ev.Exec.Process) 836 } 837 838 // GetExecArgsTruncated returns the value of the field, resolving if necessary 839 func (ev *Event) GetExecArgsTruncated() bool { 840 if ev.GetEventType().String() != "exec" { 841 return false 842 } 843 if ev.Exec.Process == nil { 844 return false 845 } 846 return ev.FieldHandlers.ResolveProcessArgsTruncated(ev, ev.Exec.Process) 847 } 848 849 // GetExecArgv returns the value of the field, resolving if necessary 850 func (ev *Event) GetExecArgv() []string { 851 if ev.GetEventType().String() != "exec" { 852 return []string{} 853 } 854 if ev.Exec.Process == nil { 855 return []string{} 856 } 857 return ev.FieldHandlers.ResolveProcessArgv(ev, ev.Exec.Process) 858 } 859 860 // GetExecArgv0 returns the value of the field, resolving if necessary 861 func (ev *Event) GetExecArgv0() string { 862 if ev.GetEventType().String() != "exec" { 863 return "" 864 } 865 if ev.Exec.Process == nil { 866 return "" 867 } 868 return ev.FieldHandlers.ResolveProcessArgv0(ev, ev.Exec.Process) 869 } 870 871 // GetExecArgvScrubbed returns the value of the field, resolving if necessary 872 func (ev *Event) GetExecArgvScrubbed() []string { 873 if ev.GetEventType().String() != "exec" { 874 return []string{} 875 } 876 if ev.Exec.Process == nil { 877 return []string{} 878 } 879 return ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, ev.Exec.Process) 880 } 881 882 // GetExecCapEffective returns the value of the field, resolving if necessary 883 func (ev *Event) GetExecCapEffective() uint64 { 884 if ev.GetEventType().String() != "exec" { 885 return uint64(0) 886 } 887 if ev.Exec.Process == nil { 888 return uint64(0) 889 } 890 return ev.Exec.Process.Credentials.CapEffective 891 } 892 893 // GetExecCapPermitted returns the value of the field, resolving if necessary 894 func (ev *Event) GetExecCapPermitted() uint64 { 895 if ev.GetEventType().String() != "exec" { 896 return uint64(0) 897 } 898 if ev.Exec.Process == nil { 899 return uint64(0) 900 } 901 return ev.Exec.Process.Credentials.CapPermitted 902 } 903 904 // GetExecCmdargv returns the value of the field, resolving if necessary 905 func (ev *Event) GetExecCmdargv() []string { 906 if ev.GetEventType().String() != "exec" { 907 return []string{} 908 } 909 if ev.Exec.Process == nil { 910 return []string{} 911 } 912 return ev.FieldHandlers.ResolveProcessCmdArgv(ev, ev.Exec.Process) 913 } 914 915 // GetExecComm returns the value of the field, resolving if necessary 916 func (ev *Event) GetExecComm() string { 917 if ev.GetEventType().String() != "exec" { 918 return "" 919 } 920 if ev.Exec.Process == nil { 921 return "" 922 } 923 return ev.Exec.Process.Comm 924 } 925 926 // GetExecContainerId returns the value of the field, resolving if necessary 927 func (ev *Event) GetExecContainerId() string { 928 if ev.GetEventType().String() != "exec" { 929 return "" 930 } 931 if ev.Exec.Process == nil { 932 return "" 933 } 934 return ev.Exec.Process.ContainerID 935 } 936 937 // GetExecCreatedAt returns the value of the field, resolving if necessary 938 func (ev *Event) GetExecCreatedAt() int { 939 if ev.GetEventType().String() != "exec" { 940 return 0 941 } 942 if ev.Exec.Process == nil { 943 return 0 944 } 945 return ev.FieldHandlers.ResolveProcessCreatedAt(ev, ev.Exec.Process) 946 } 947 948 // GetExecEgid returns the value of the field, resolving if necessary 949 func (ev *Event) GetExecEgid() uint32 { 950 if ev.GetEventType().String() != "exec" { 951 return uint32(0) 952 } 953 if ev.Exec.Process == nil { 954 return uint32(0) 955 } 956 return ev.Exec.Process.Credentials.EGID 957 } 958 959 // GetExecEgroup returns the value of the field, resolving if necessary 960 func (ev *Event) GetExecEgroup() string { 961 if ev.GetEventType().String() != "exec" { 962 return "" 963 } 964 if ev.Exec.Process == nil { 965 return "" 966 } 967 return ev.Exec.Process.Credentials.EGroup 968 } 969 970 // GetExecEnvp returns the value of the field, resolving if necessary 971 func (ev *Event) GetExecEnvp() []string { 972 if ev.GetEventType().String() != "exec" { 973 return []string{} 974 } 975 if ev.Exec.Process == nil { 976 return []string{} 977 } 978 return ev.FieldHandlers.ResolveProcessEnvp(ev, ev.Exec.Process) 979 } 980 981 // GetExecEnvs returns the value of the field, resolving if necessary 982 func (ev *Event) GetExecEnvs() []string { 983 if ev.GetEventType().String() != "exec" { 984 return []string{} 985 } 986 if ev.Exec.Process == nil { 987 return []string{} 988 } 989 return ev.FieldHandlers.ResolveProcessEnvs(ev, ev.Exec.Process) 990 } 991 992 // GetExecEnvsTruncated returns the value of the field, resolving if necessary 993 func (ev *Event) GetExecEnvsTruncated() bool { 994 if ev.GetEventType().String() != "exec" { 995 return false 996 } 997 if ev.Exec.Process == nil { 998 return false 999 } 1000 return ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, ev.Exec.Process) 1001 } 1002 1003 // GetExecEuid returns the value of the field, resolving if necessary 1004 func (ev *Event) GetExecEuid() uint32 { 1005 if ev.GetEventType().String() != "exec" { 1006 return uint32(0) 1007 } 1008 if ev.Exec.Process == nil { 1009 return uint32(0) 1010 } 1011 return ev.Exec.Process.Credentials.EUID 1012 } 1013 1014 // GetExecEuser returns the value of the field, resolving if necessary 1015 func (ev *Event) GetExecEuser() string { 1016 if ev.GetEventType().String() != "exec" { 1017 return "" 1018 } 1019 if ev.Exec.Process == nil { 1020 return "" 1021 } 1022 return ev.Exec.Process.Credentials.EUser 1023 } 1024 1025 // GetExecExecTime returns the value of the field, resolving if necessary 1026 func (ev *Event) GetExecExecTime() time.Time { 1027 if ev.GetEventType().String() != "exec" { 1028 return time.Time{} 1029 } 1030 if ev.Exec.Process == nil { 1031 return time.Time{} 1032 } 1033 return ev.Exec.Process.ExecTime 1034 } 1035 1036 // GetExecExitTime returns the value of the field, resolving if necessary 1037 func (ev *Event) GetExecExitTime() time.Time { 1038 if ev.GetEventType().String() != "exec" { 1039 return time.Time{} 1040 } 1041 if ev.Exec.Process == nil { 1042 return time.Time{} 1043 } 1044 return ev.Exec.Process.ExitTime 1045 } 1046 1047 // GetExecFileChangeTime returns the value of the field, resolving if necessary 1048 func (ev *Event) GetExecFileChangeTime() uint64 { 1049 if ev.GetEventType().String() != "exec" { 1050 return uint64(0) 1051 } 1052 if ev.Exec.Process == nil { 1053 return uint64(0) 1054 } 1055 if !ev.Exec.Process.IsNotKworker() { 1056 return uint64(0) 1057 } 1058 return ev.Exec.Process.FileEvent.FileFields.CTime 1059 } 1060 1061 // GetExecFileFilesystem returns the value of the field, resolving if necessary 1062 func (ev *Event) GetExecFileFilesystem() string { 1063 if ev.GetEventType().String() != "exec" { 1064 return "" 1065 } 1066 if ev.Exec.Process == nil { 1067 return "" 1068 } 1069 if !ev.Exec.Process.IsNotKworker() { 1070 return "" 1071 } 1072 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Exec.Process.FileEvent) 1073 } 1074 1075 // GetExecFileGid returns the value of the field, resolving if necessary 1076 func (ev *Event) GetExecFileGid() uint32 { 1077 if ev.GetEventType().String() != "exec" { 1078 return uint32(0) 1079 } 1080 if ev.Exec.Process == nil { 1081 return uint32(0) 1082 } 1083 if !ev.Exec.Process.IsNotKworker() { 1084 return uint32(0) 1085 } 1086 return ev.Exec.Process.FileEvent.FileFields.GID 1087 } 1088 1089 // GetExecFileGroup returns the value of the field, resolving if necessary 1090 func (ev *Event) GetExecFileGroup() string { 1091 if ev.GetEventType().String() != "exec" { 1092 return "" 1093 } 1094 if ev.Exec.Process == nil { 1095 return "" 1096 } 1097 if !ev.Exec.Process.IsNotKworker() { 1098 return "" 1099 } 1100 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Exec.Process.FileEvent.FileFields) 1101 } 1102 1103 // GetExecFileHashes returns the value of the field, resolving if necessary 1104 func (ev *Event) GetExecFileHashes() []string { 1105 if ev.GetEventType().String() != "exec" { 1106 return []string{} 1107 } 1108 if ev.Exec.Process == nil { 1109 return []string{} 1110 } 1111 if !ev.Exec.Process.IsNotKworker() { 1112 return []string{} 1113 } 1114 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Exec.Process.FileEvent) 1115 } 1116 1117 // GetExecFileInUpperLayer returns the value of the field, resolving if necessary 1118 func (ev *Event) GetExecFileInUpperLayer() bool { 1119 if ev.GetEventType().String() != "exec" { 1120 return false 1121 } 1122 if ev.Exec.Process == nil { 1123 return false 1124 } 1125 if !ev.Exec.Process.IsNotKworker() { 1126 return false 1127 } 1128 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Exec.Process.FileEvent.FileFields) 1129 } 1130 1131 // GetExecFileInode returns the value of the field, resolving if necessary 1132 func (ev *Event) GetExecFileInode() uint64 { 1133 if ev.GetEventType().String() != "exec" { 1134 return uint64(0) 1135 } 1136 if ev.Exec.Process == nil { 1137 return uint64(0) 1138 } 1139 if !ev.Exec.Process.IsNotKworker() { 1140 return uint64(0) 1141 } 1142 return ev.Exec.Process.FileEvent.FileFields.PathKey.Inode 1143 } 1144 1145 // GetExecFileMode returns the value of the field, resolving if necessary 1146 func (ev *Event) GetExecFileMode() uint16 { 1147 if ev.GetEventType().String() != "exec" { 1148 return uint16(0) 1149 } 1150 if ev.Exec.Process == nil { 1151 return uint16(0) 1152 } 1153 if !ev.Exec.Process.IsNotKworker() { 1154 return uint16(0) 1155 } 1156 return ev.Exec.Process.FileEvent.FileFields.Mode 1157 } 1158 1159 // GetExecFileModificationTime returns the value of the field, resolving if necessary 1160 func (ev *Event) GetExecFileModificationTime() uint64 { 1161 if ev.GetEventType().String() != "exec" { 1162 return uint64(0) 1163 } 1164 if ev.Exec.Process == nil { 1165 return uint64(0) 1166 } 1167 if !ev.Exec.Process.IsNotKworker() { 1168 return uint64(0) 1169 } 1170 return ev.Exec.Process.FileEvent.FileFields.MTime 1171 } 1172 1173 // GetExecFileMountId returns the value of the field, resolving if necessary 1174 func (ev *Event) GetExecFileMountId() uint32 { 1175 if ev.GetEventType().String() != "exec" { 1176 return uint32(0) 1177 } 1178 if ev.Exec.Process == nil { 1179 return uint32(0) 1180 } 1181 if !ev.Exec.Process.IsNotKworker() { 1182 return uint32(0) 1183 } 1184 return ev.Exec.Process.FileEvent.FileFields.PathKey.MountID 1185 } 1186 1187 // GetExecFileName returns the value of the field, resolving if necessary 1188 func (ev *Event) GetExecFileName() string { 1189 if ev.GetEventType().String() != "exec" { 1190 return "" 1191 } 1192 if ev.Exec.Process == nil { 1193 return "" 1194 } 1195 if !ev.Exec.Process.IsNotKworker() { 1196 return "" 1197 } 1198 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Exec.Process.FileEvent) 1199 } 1200 1201 // GetExecFileNameLength returns the value of the field, resolving if necessary 1202 func (ev *Event) GetExecFileNameLength() int { 1203 if ev.GetEventType().String() != "exec" { 1204 return 0 1205 } 1206 if ev.Exec.Process == nil { 1207 return 0 1208 } 1209 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Exec.Process.FileEvent)) 1210 } 1211 1212 // GetExecFilePackageName returns the value of the field, resolving if necessary 1213 func (ev *Event) GetExecFilePackageName() string { 1214 if ev.GetEventType().String() != "exec" { 1215 return "" 1216 } 1217 if ev.Exec.Process == nil { 1218 return "" 1219 } 1220 if !ev.Exec.Process.IsNotKworker() { 1221 return "" 1222 } 1223 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Exec.Process.FileEvent) 1224 } 1225 1226 // GetExecFilePackageSourceVersion returns the value of the field, resolving if necessary 1227 func (ev *Event) GetExecFilePackageSourceVersion() string { 1228 if ev.GetEventType().String() != "exec" { 1229 return "" 1230 } 1231 if ev.Exec.Process == nil { 1232 return "" 1233 } 1234 if !ev.Exec.Process.IsNotKworker() { 1235 return "" 1236 } 1237 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Exec.Process.FileEvent) 1238 } 1239 1240 // GetExecFilePackageVersion returns the value of the field, resolving if necessary 1241 func (ev *Event) GetExecFilePackageVersion() string { 1242 if ev.GetEventType().String() != "exec" { 1243 return "" 1244 } 1245 if ev.Exec.Process == nil { 1246 return "" 1247 } 1248 if !ev.Exec.Process.IsNotKworker() { 1249 return "" 1250 } 1251 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Exec.Process.FileEvent) 1252 } 1253 1254 // GetExecFilePath returns the value of the field, resolving if necessary 1255 func (ev *Event) GetExecFilePath() string { 1256 if ev.GetEventType().String() != "exec" { 1257 return "" 1258 } 1259 if ev.Exec.Process == nil { 1260 return "" 1261 } 1262 if !ev.Exec.Process.IsNotKworker() { 1263 return "" 1264 } 1265 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Exec.Process.FileEvent) 1266 } 1267 1268 // GetExecFilePathLength returns the value of the field, resolving if necessary 1269 func (ev *Event) GetExecFilePathLength() int { 1270 if ev.GetEventType().String() != "exec" { 1271 return 0 1272 } 1273 if ev.Exec.Process == nil { 1274 return 0 1275 } 1276 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Exec.Process.FileEvent)) 1277 } 1278 1279 // GetExecFileRights returns the value of the field, resolving if necessary 1280 func (ev *Event) GetExecFileRights() int { 1281 if ev.GetEventType().String() != "exec" { 1282 return 0 1283 } 1284 if ev.Exec.Process == nil { 1285 return 0 1286 } 1287 if !ev.Exec.Process.IsNotKworker() { 1288 return 0 1289 } 1290 return ev.FieldHandlers.ResolveRights(ev, &ev.Exec.Process.FileEvent.FileFields) 1291 } 1292 1293 // GetExecFileUid returns the value of the field, resolving if necessary 1294 func (ev *Event) GetExecFileUid() uint32 { 1295 if ev.GetEventType().String() != "exec" { 1296 return uint32(0) 1297 } 1298 if ev.Exec.Process == nil { 1299 return uint32(0) 1300 } 1301 if !ev.Exec.Process.IsNotKworker() { 1302 return uint32(0) 1303 } 1304 return ev.Exec.Process.FileEvent.FileFields.UID 1305 } 1306 1307 // GetExecFileUser returns the value of the field, resolving if necessary 1308 func (ev *Event) GetExecFileUser() string { 1309 if ev.GetEventType().String() != "exec" { 1310 return "" 1311 } 1312 if ev.Exec.Process == nil { 1313 return "" 1314 } 1315 if !ev.Exec.Process.IsNotKworker() { 1316 return "" 1317 } 1318 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Exec.Process.FileEvent.FileFields) 1319 } 1320 1321 // GetExecForkTime returns the value of the field, resolving if necessary 1322 func (ev *Event) GetExecForkTime() time.Time { 1323 if ev.GetEventType().String() != "exec" { 1324 return time.Time{} 1325 } 1326 if ev.Exec.Process == nil { 1327 return time.Time{} 1328 } 1329 return ev.Exec.Process.ForkTime 1330 } 1331 1332 // GetExecFsgid returns the value of the field, resolving if necessary 1333 func (ev *Event) GetExecFsgid() uint32 { 1334 if ev.GetEventType().String() != "exec" { 1335 return uint32(0) 1336 } 1337 if ev.Exec.Process == nil { 1338 return uint32(0) 1339 } 1340 return ev.Exec.Process.Credentials.FSGID 1341 } 1342 1343 // GetExecFsgroup returns the value of the field, resolving if necessary 1344 func (ev *Event) GetExecFsgroup() string { 1345 if ev.GetEventType().String() != "exec" { 1346 return "" 1347 } 1348 if ev.Exec.Process == nil { 1349 return "" 1350 } 1351 return ev.Exec.Process.Credentials.FSGroup 1352 } 1353 1354 // GetExecFsuid returns the value of the field, resolving if necessary 1355 func (ev *Event) GetExecFsuid() uint32 { 1356 if ev.GetEventType().String() != "exec" { 1357 return uint32(0) 1358 } 1359 if ev.Exec.Process == nil { 1360 return uint32(0) 1361 } 1362 return ev.Exec.Process.Credentials.FSUID 1363 } 1364 1365 // GetExecFsuser returns the value of the field, resolving if necessary 1366 func (ev *Event) GetExecFsuser() string { 1367 if ev.GetEventType().String() != "exec" { 1368 return "" 1369 } 1370 if ev.Exec.Process == nil { 1371 return "" 1372 } 1373 return ev.Exec.Process.Credentials.FSUser 1374 } 1375 1376 // GetExecGid returns the value of the field, resolving if necessary 1377 func (ev *Event) GetExecGid() uint32 { 1378 if ev.GetEventType().String() != "exec" { 1379 return uint32(0) 1380 } 1381 if ev.Exec.Process == nil { 1382 return uint32(0) 1383 } 1384 return ev.Exec.Process.Credentials.GID 1385 } 1386 1387 // GetExecGroup returns the value of the field, resolving if necessary 1388 func (ev *Event) GetExecGroup() string { 1389 if ev.GetEventType().String() != "exec" { 1390 return "" 1391 } 1392 if ev.Exec.Process == nil { 1393 return "" 1394 } 1395 return ev.Exec.Process.Credentials.Group 1396 } 1397 1398 // GetExecInterpreterFileChangeTime returns the value of the field, resolving if necessary 1399 func (ev *Event) GetExecInterpreterFileChangeTime() uint64 { 1400 if ev.GetEventType().String() != "exec" { 1401 return uint64(0) 1402 } 1403 if ev.Exec.Process == nil { 1404 return uint64(0) 1405 } 1406 if !ev.Exec.Process.HasInterpreter() { 1407 return uint64(0) 1408 } 1409 return ev.Exec.Process.LinuxBinprm.FileEvent.FileFields.CTime 1410 } 1411 1412 // GetExecInterpreterFileFilesystem returns the value of the field, resolving if necessary 1413 func (ev *Event) GetExecInterpreterFileFilesystem() string { 1414 if ev.GetEventType().String() != "exec" { 1415 return "" 1416 } 1417 if ev.Exec.Process == nil { 1418 return "" 1419 } 1420 if !ev.Exec.Process.HasInterpreter() { 1421 return "" 1422 } 1423 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Exec.Process.LinuxBinprm.FileEvent) 1424 } 1425 1426 // GetExecInterpreterFileGid returns the value of the field, resolving if necessary 1427 func (ev *Event) GetExecInterpreterFileGid() uint32 { 1428 if ev.GetEventType().String() != "exec" { 1429 return uint32(0) 1430 } 1431 if ev.Exec.Process == nil { 1432 return uint32(0) 1433 } 1434 if !ev.Exec.Process.HasInterpreter() { 1435 return uint32(0) 1436 } 1437 return ev.Exec.Process.LinuxBinprm.FileEvent.FileFields.GID 1438 } 1439 1440 // GetExecInterpreterFileGroup returns the value of the field, resolving if necessary 1441 func (ev *Event) GetExecInterpreterFileGroup() string { 1442 if ev.GetEventType().String() != "exec" { 1443 return "" 1444 } 1445 if ev.Exec.Process == nil { 1446 return "" 1447 } 1448 if !ev.Exec.Process.HasInterpreter() { 1449 return "" 1450 } 1451 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Exec.Process.LinuxBinprm.FileEvent.FileFields) 1452 } 1453 1454 // GetExecInterpreterFileHashes returns the value of the field, resolving if necessary 1455 func (ev *Event) GetExecInterpreterFileHashes() []string { 1456 if ev.GetEventType().String() != "exec" { 1457 return []string{} 1458 } 1459 if ev.Exec.Process == nil { 1460 return []string{} 1461 } 1462 if !ev.Exec.Process.HasInterpreter() { 1463 return []string{} 1464 } 1465 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Exec.Process.LinuxBinprm.FileEvent) 1466 } 1467 1468 // GetExecInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 1469 func (ev *Event) GetExecInterpreterFileInUpperLayer() bool { 1470 if ev.GetEventType().String() != "exec" { 1471 return false 1472 } 1473 if ev.Exec.Process == nil { 1474 return false 1475 } 1476 if !ev.Exec.Process.HasInterpreter() { 1477 return false 1478 } 1479 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Exec.Process.LinuxBinprm.FileEvent.FileFields) 1480 } 1481 1482 // GetExecInterpreterFileInode returns the value of the field, resolving if necessary 1483 func (ev *Event) GetExecInterpreterFileInode() uint64 { 1484 if ev.GetEventType().String() != "exec" { 1485 return uint64(0) 1486 } 1487 if ev.Exec.Process == nil { 1488 return uint64(0) 1489 } 1490 if !ev.Exec.Process.HasInterpreter() { 1491 return uint64(0) 1492 } 1493 return ev.Exec.Process.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 1494 } 1495 1496 // GetExecInterpreterFileMode returns the value of the field, resolving if necessary 1497 func (ev *Event) GetExecInterpreterFileMode() uint16 { 1498 if ev.GetEventType().String() != "exec" { 1499 return uint16(0) 1500 } 1501 if ev.Exec.Process == nil { 1502 return uint16(0) 1503 } 1504 if !ev.Exec.Process.HasInterpreter() { 1505 return uint16(0) 1506 } 1507 return ev.Exec.Process.LinuxBinprm.FileEvent.FileFields.Mode 1508 } 1509 1510 // GetExecInterpreterFileModificationTime returns the value of the field, resolving if necessary 1511 func (ev *Event) GetExecInterpreterFileModificationTime() uint64 { 1512 if ev.GetEventType().String() != "exec" { 1513 return uint64(0) 1514 } 1515 if ev.Exec.Process == nil { 1516 return uint64(0) 1517 } 1518 if !ev.Exec.Process.HasInterpreter() { 1519 return uint64(0) 1520 } 1521 return ev.Exec.Process.LinuxBinprm.FileEvent.FileFields.MTime 1522 } 1523 1524 // GetExecInterpreterFileMountId returns the value of the field, resolving if necessary 1525 func (ev *Event) GetExecInterpreterFileMountId() uint32 { 1526 if ev.GetEventType().String() != "exec" { 1527 return uint32(0) 1528 } 1529 if ev.Exec.Process == nil { 1530 return uint32(0) 1531 } 1532 if !ev.Exec.Process.HasInterpreter() { 1533 return uint32(0) 1534 } 1535 return ev.Exec.Process.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 1536 } 1537 1538 // GetExecInterpreterFileName returns the value of the field, resolving if necessary 1539 func (ev *Event) GetExecInterpreterFileName() string { 1540 if ev.GetEventType().String() != "exec" { 1541 return "" 1542 } 1543 if ev.Exec.Process == nil { 1544 return "" 1545 } 1546 if !ev.Exec.Process.HasInterpreter() { 1547 return "" 1548 } 1549 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Exec.Process.LinuxBinprm.FileEvent) 1550 } 1551 1552 // GetExecInterpreterFileNameLength returns the value of the field, resolving if necessary 1553 func (ev *Event) GetExecInterpreterFileNameLength() int { 1554 if ev.GetEventType().String() != "exec" { 1555 return 0 1556 } 1557 if ev.Exec.Process == nil { 1558 return 0 1559 } 1560 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Exec.Process.LinuxBinprm.FileEvent)) 1561 } 1562 1563 // GetExecInterpreterFilePackageName returns the value of the field, resolving if necessary 1564 func (ev *Event) GetExecInterpreterFilePackageName() string { 1565 if ev.GetEventType().String() != "exec" { 1566 return "" 1567 } 1568 if ev.Exec.Process == nil { 1569 return "" 1570 } 1571 if !ev.Exec.Process.HasInterpreter() { 1572 return "" 1573 } 1574 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Exec.Process.LinuxBinprm.FileEvent) 1575 } 1576 1577 // GetExecInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 1578 func (ev *Event) GetExecInterpreterFilePackageSourceVersion() string { 1579 if ev.GetEventType().String() != "exec" { 1580 return "" 1581 } 1582 if ev.Exec.Process == nil { 1583 return "" 1584 } 1585 if !ev.Exec.Process.HasInterpreter() { 1586 return "" 1587 } 1588 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Exec.Process.LinuxBinprm.FileEvent) 1589 } 1590 1591 // GetExecInterpreterFilePackageVersion returns the value of the field, resolving if necessary 1592 func (ev *Event) GetExecInterpreterFilePackageVersion() string { 1593 if ev.GetEventType().String() != "exec" { 1594 return "" 1595 } 1596 if ev.Exec.Process == nil { 1597 return "" 1598 } 1599 if !ev.Exec.Process.HasInterpreter() { 1600 return "" 1601 } 1602 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Exec.Process.LinuxBinprm.FileEvent) 1603 } 1604 1605 // GetExecInterpreterFilePath returns the value of the field, resolving if necessary 1606 func (ev *Event) GetExecInterpreterFilePath() string { 1607 if ev.GetEventType().String() != "exec" { 1608 return "" 1609 } 1610 if ev.Exec.Process == nil { 1611 return "" 1612 } 1613 if !ev.Exec.Process.HasInterpreter() { 1614 return "" 1615 } 1616 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Exec.Process.LinuxBinprm.FileEvent) 1617 } 1618 1619 // GetExecInterpreterFilePathLength returns the value of the field, resolving if necessary 1620 func (ev *Event) GetExecInterpreterFilePathLength() int { 1621 if ev.GetEventType().String() != "exec" { 1622 return 0 1623 } 1624 if ev.Exec.Process == nil { 1625 return 0 1626 } 1627 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Exec.Process.LinuxBinprm.FileEvent)) 1628 } 1629 1630 // GetExecInterpreterFileRights returns the value of the field, resolving if necessary 1631 func (ev *Event) GetExecInterpreterFileRights() int { 1632 if ev.GetEventType().String() != "exec" { 1633 return 0 1634 } 1635 if ev.Exec.Process == nil { 1636 return 0 1637 } 1638 if !ev.Exec.Process.HasInterpreter() { 1639 return 0 1640 } 1641 return ev.FieldHandlers.ResolveRights(ev, &ev.Exec.Process.LinuxBinprm.FileEvent.FileFields) 1642 } 1643 1644 // GetExecInterpreterFileUid returns the value of the field, resolving if necessary 1645 func (ev *Event) GetExecInterpreterFileUid() uint32 { 1646 if ev.GetEventType().String() != "exec" { 1647 return uint32(0) 1648 } 1649 if ev.Exec.Process == nil { 1650 return uint32(0) 1651 } 1652 if !ev.Exec.Process.HasInterpreter() { 1653 return uint32(0) 1654 } 1655 return ev.Exec.Process.LinuxBinprm.FileEvent.FileFields.UID 1656 } 1657 1658 // GetExecInterpreterFileUser returns the value of the field, resolving if necessary 1659 func (ev *Event) GetExecInterpreterFileUser() string { 1660 if ev.GetEventType().String() != "exec" { 1661 return "" 1662 } 1663 if ev.Exec.Process == nil { 1664 return "" 1665 } 1666 if !ev.Exec.Process.HasInterpreter() { 1667 return "" 1668 } 1669 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Exec.Process.LinuxBinprm.FileEvent.FileFields) 1670 } 1671 1672 // GetExecIsKworker returns the value of the field, resolving if necessary 1673 func (ev *Event) GetExecIsKworker() bool { 1674 if ev.GetEventType().String() != "exec" { 1675 return false 1676 } 1677 if ev.Exec.Process == nil { 1678 return false 1679 } 1680 return ev.Exec.Process.PIDContext.IsKworker 1681 } 1682 1683 // GetExecIsThread returns the value of the field, resolving if necessary 1684 func (ev *Event) GetExecIsThread() bool { 1685 if ev.GetEventType().String() != "exec" { 1686 return false 1687 } 1688 if ev.Exec.Process == nil { 1689 return false 1690 } 1691 return ev.Exec.Process.IsThread 1692 } 1693 1694 // GetExecPid returns the value of the field, resolving if necessary 1695 func (ev *Event) GetExecPid() uint32 { 1696 if ev.GetEventType().String() != "exec" { 1697 return uint32(0) 1698 } 1699 if ev.Exec.Process == nil { 1700 return uint32(0) 1701 } 1702 return ev.Exec.Process.PIDContext.Pid 1703 } 1704 1705 // GetExecPpid returns the value of the field, resolving if necessary 1706 func (ev *Event) GetExecPpid() uint32 { 1707 if ev.GetEventType().String() != "exec" { 1708 return uint32(0) 1709 } 1710 if ev.Exec.Process == nil { 1711 return uint32(0) 1712 } 1713 return ev.Exec.Process.PPid 1714 } 1715 1716 // GetExecTid returns the value of the field, resolving if necessary 1717 func (ev *Event) GetExecTid() uint32 { 1718 if ev.GetEventType().String() != "exec" { 1719 return uint32(0) 1720 } 1721 if ev.Exec.Process == nil { 1722 return uint32(0) 1723 } 1724 return ev.Exec.Process.PIDContext.Tid 1725 } 1726 1727 // GetExecTtyName returns the value of the field, resolving if necessary 1728 func (ev *Event) GetExecTtyName() string { 1729 if ev.GetEventType().String() != "exec" { 1730 return "" 1731 } 1732 if ev.Exec.Process == nil { 1733 return "" 1734 } 1735 return ev.Exec.Process.TTYName 1736 } 1737 1738 // GetExecUid returns the value of the field, resolving if necessary 1739 func (ev *Event) GetExecUid() uint32 { 1740 if ev.GetEventType().String() != "exec" { 1741 return uint32(0) 1742 } 1743 if ev.Exec.Process == nil { 1744 return uint32(0) 1745 } 1746 return ev.Exec.Process.Credentials.UID 1747 } 1748 1749 // GetExecUser returns the value of the field, resolving if necessary 1750 func (ev *Event) GetExecUser() string { 1751 if ev.GetEventType().String() != "exec" { 1752 return "" 1753 } 1754 if ev.Exec.Process == nil { 1755 return "" 1756 } 1757 return ev.Exec.Process.Credentials.User 1758 } 1759 1760 // GetExecUserSessionK8sGroups returns the value of the field, resolving if necessary 1761 func (ev *Event) GetExecUserSessionK8sGroups() []string { 1762 if ev.GetEventType().String() != "exec" { 1763 return []string{} 1764 } 1765 if ev.Exec.Process == nil { 1766 return []string{} 1767 } 1768 return ev.FieldHandlers.ResolveK8SGroups(ev, &ev.Exec.Process.UserSession) 1769 } 1770 1771 // GetExecUserSessionK8sUid returns the value of the field, resolving if necessary 1772 func (ev *Event) GetExecUserSessionK8sUid() string { 1773 if ev.GetEventType().String() != "exec" { 1774 return "" 1775 } 1776 if ev.Exec.Process == nil { 1777 return "" 1778 } 1779 return ev.FieldHandlers.ResolveK8SUID(ev, &ev.Exec.Process.UserSession) 1780 } 1781 1782 // GetExecUserSessionK8sUsername returns the value of the field, resolving if necessary 1783 func (ev *Event) GetExecUserSessionK8sUsername() string { 1784 if ev.GetEventType().String() != "exec" { 1785 return "" 1786 } 1787 if ev.Exec.Process == nil { 1788 return "" 1789 } 1790 return ev.FieldHandlers.ResolveK8SUsername(ev, &ev.Exec.Process.UserSession) 1791 } 1792 1793 // GetExitArgs returns the value of the field, resolving if necessary 1794 func (ev *Event) GetExitArgs() string { 1795 if ev.GetEventType().String() != "exit" { 1796 return "" 1797 } 1798 if ev.Exit.Process == nil { 1799 return "" 1800 } 1801 return ev.FieldHandlers.ResolveProcessArgs(ev, ev.Exit.Process) 1802 } 1803 1804 // GetExitArgsFlags returns the value of the field, resolving if necessary 1805 func (ev *Event) GetExitArgsFlags() []string { 1806 if ev.GetEventType().String() != "exit" { 1807 return []string{} 1808 } 1809 if ev.Exit.Process == nil { 1810 return []string{} 1811 } 1812 return ev.FieldHandlers.ResolveProcessArgsFlags(ev, ev.Exit.Process) 1813 } 1814 1815 // GetExitArgsOptions returns the value of the field, resolving if necessary 1816 func (ev *Event) GetExitArgsOptions() []string { 1817 if ev.GetEventType().String() != "exit" { 1818 return []string{} 1819 } 1820 if ev.Exit.Process == nil { 1821 return []string{} 1822 } 1823 return ev.FieldHandlers.ResolveProcessArgsOptions(ev, ev.Exit.Process) 1824 } 1825 1826 // GetExitArgsScrubbed returns the value of the field, resolving if necessary 1827 func (ev *Event) GetExitArgsScrubbed() string { 1828 if ev.GetEventType().String() != "exit" { 1829 return "" 1830 } 1831 if ev.Exit.Process == nil { 1832 return "" 1833 } 1834 return ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, ev.Exit.Process) 1835 } 1836 1837 // GetExitArgsTruncated returns the value of the field, resolving if necessary 1838 func (ev *Event) GetExitArgsTruncated() bool { 1839 if ev.GetEventType().String() != "exit" { 1840 return false 1841 } 1842 if ev.Exit.Process == nil { 1843 return false 1844 } 1845 return ev.FieldHandlers.ResolveProcessArgsTruncated(ev, ev.Exit.Process) 1846 } 1847 1848 // GetExitArgv returns the value of the field, resolving if necessary 1849 func (ev *Event) GetExitArgv() []string { 1850 if ev.GetEventType().String() != "exit" { 1851 return []string{} 1852 } 1853 if ev.Exit.Process == nil { 1854 return []string{} 1855 } 1856 return ev.FieldHandlers.ResolveProcessArgv(ev, ev.Exit.Process) 1857 } 1858 1859 // GetExitArgv0 returns the value of the field, resolving if necessary 1860 func (ev *Event) GetExitArgv0() string { 1861 if ev.GetEventType().String() != "exit" { 1862 return "" 1863 } 1864 if ev.Exit.Process == nil { 1865 return "" 1866 } 1867 return ev.FieldHandlers.ResolveProcessArgv0(ev, ev.Exit.Process) 1868 } 1869 1870 // GetExitArgvScrubbed returns the value of the field, resolving if necessary 1871 func (ev *Event) GetExitArgvScrubbed() []string { 1872 if ev.GetEventType().String() != "exit" { 1873 return []string{} 1874 } 1875 if ev.Exit.Process == nil { 1876 return []string{} 1877 } 1878 return ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, ev.Exit.Process) 1879 } 1880 1881 // GetExitCapEffective returns the value of the field, resolving if necessary 1882 func (ev *Event) GetExitCapEffective() uint64 { 1883 if ev.GetEventType().String() != "exit" { 1884 return uint64(0) 1885 } 1886 if ev.Exit.Process == nil { 1887 return uint64(0) 1888 } 1889 return ev.Exit.Process.Credentials.CapEffective 1890 } 1891 1892 // GetExitCapPermitted returns the value of the field, resolving if necessary 1893 func (ev *Event) GetExitCapPermitted() uint64 { 1894 if ev.GetEventType().String() != "exit" { 1895 return uint64(0) 1896 } 1897 if ev.Exit.Process == nil { 1898 return uint64(0) 1899 } 1900 return ev.Exit.Process.Credentials.CapPermitted 1901 } 1902 1903 // GetExitCause returns the value of the field, resolving if necessary 1904 func (ev *Event) GetExitCause() uint32 { 1905 if ev.GetEventType().String() != "exit" { 1906 return uint32(0) 1907 } 1908 return ev.Exit.Cause 1909 } 1910 1911 // GetExitCmdargv returns the value of the field, resolving if necessary 1912 func (ev *Event) GetExitCmdargv() []string { 1913 if ev.GetEventType().String() != "exit" { 1914 return []string{} 1915 } 1916 if ev.Exit.Process == nil { 1917 return []string{} 1918 } 1919 return ev.FieldHandlers.ResolveProcessCmdArgv(ev, ev.Exit.Process) 1920 } 1921 1922 // GetExitCode returns the value of the field, resolving if necessary 1923 func (ev *Event) GetExitCode() uint32 { 1924 if ev.GetEventType().String() != "exit" { 1925 return uint32(0) 1926 } 1927 return ev.Exit.Code 1928 } 1929 1930 // GetExitComm returns the value of the field, resolving if necessary 1931 func (ev *Event) GetExitComm() string { 1932 if ev.GetEventType().String() != "exit" { 1933 return "" 1934 } 1935 if ev.Exit.Process == nil { 1936 return "" 1937 } 1938 return ev.Exit.Process.Comm 1939 } 1940 1941 // GetExitContainerId returns the value of the field, resolving if necessary 1942 func (ev *Event) GetExitContainerId() string { 1943 if ev.GetEventType().String() != "exit" { 1944 return "" 1945 } 1946 if ev.Exit.Process == nil { 1947 return "" 1948 } 1949 return ev.Exit.Process.ContainerID 1950 } 1951 1952 // GetExitCreatedAt returns the value of the field, resolving if necessary 1953 func (ev *Event) GetExitCreatedAt() int { 1954 if ev.GetEventType().String() != "exit" { 1955 return 0 1956 } 1957 if ev.Exit.Process == nil { 1958 return 0 1959 } 1960 return ev.FieldHandlers.ResolveProcessCreatedAt(ev, ev.Exit.Process) 1961 } 1962 1963 // GetExitEgid returns the value of the field, resolving if necessary 1964 func (ev *Event) GetExitEgid() uint32 { 1965 if ev.GetEventType().String() != "exit" { 1966 return uint32(0) 1967 } 1968 if ev.Exit.Process == nil { 1969 return uint32(0) 1970 } 1971 return ev.Exit.Process.Credentials.EGID 1972 } 1973 1974 // GetExitEgroup returns the value of the field, resolving if necessary 1975 func (ev *Event) GetExitEgroup() string { 1976 if ev.GetEventType().String() != "exit" { 1977 return "" 1978 } 1979 if ev.Exit.Process == nil { 1980 return "" 1981 } 1982 return ev.Exit.Process.Credentials.EGroup 1983 } 1984 1985 // GetExitEnvp returns the value of the field, resolving if necessary 1986 func (ev *Event) GetExitEnvp() []string { 1987 if ev.GetEventType().String() != "exit" { 1988 return []string{} 1989 } 1990 if ev.Exit.Process == nil { 1991 return []string{} 1992 } 1993 return ev.FieldHandlers.ResolveProcessEnvp(ev, ev.Exit.Process) 1994 } 1995 1996 // GetExitEnvs returns the value of the field, resolving if necessary 1997 func (ev *Event) GetExitEnvs() []string { 1998 if ev.GetEventType().String() != "exit" { 1999 return []string{} 2000 } 2001 if ev.Exit.Process == nil { 2002 return []string{} 2003 } 2004 return ev.FieldHandlers.ResolveProcessEnvs(ev, ev.Exit.Process) 2005 } 2006 2007 // GetExitEnvsTruncated returns the value of the field, resolving if necessary 2008 func (ev *Event) GetExitEnvsTruncated() bool { 2009 if ev.GetEventType().String() != "exit" { 2010 return false 2011 } 2012 if ev.Exit.Process == nil { 2013 return false 2014 } 2015 return ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, ev.Exit.Process) 2016 } 2017 2018 // GetExitEuid returns the value of the field, resolving if necessary 2019 func (ev *Event) GetExitEuid() uint32 { 2020 if ev.GetEventType().String() != "exit" { 2021 return uint32(0) 2022 } 2023 if ev.Exit.Process == nil { 2024 return uint32(0) 2025 } 2026 return ev.Exit.Process.Credentials.EUID 2027 } 2028 2029 // GetExitEuser returns the value of the field, resolving if necessary 2030 func (ev *Event) GetExitEuser() string { 2031 if ev.GetEventType().String() != "exit" { 2032 return "" 2033 } 2034 if ev.Exit.Process == nil { 2035 return "" 2036 } 2037 return ev.Exit.Process.Credentials.EUser 2038 } 2039 2040 // GetExitExecTime returns the value of the field, resolving if necessary 2041 func (ev *Event) GetExitExecTime() time.Time { 2042 if ev.GetEventType().String() != "exit" { 2043 return time.Time{} 2044 } 2045 if ev.Exit.Process == nil { 2046 return time.Time{} 2047 } 2048 return ev.Exit.Process.ExecTime 2049 } 2050 2051 // GetExitExitTime returns the value of the field, resolving if necessary 2052 func (ev *Event) GetExitExitTime() time.Time { 2053 if ev.GetEventType().String() != "exit" { 2054 return time.Time{} 2055 } 2056 if ev.Exit.Process == nil { 2057 return time.Time{} 2058 } 2059 return ev.Exit.Process.ExitTime 2060 } 2061 2062 // GetExitFileChangeTime returns the value of the field, resolving if necessary 2063 func (ev *Event) GetExitFileChangeTime() uint64 { 2064 if ev.GetEventType().String() != "exit" { 2065 return uint64(0) 2066 } 2067 if ev.Exit.Process == nil { 2068 return uint64(0) 2069 } 2070 if !ev.Exit.Process.IsNotKworker() { 2071 return uint64(0) 2072 } 2073 return ev.Exit.Process.FileEvent.FileFields.CTime 2074 } 2075 2076 // GetExitFileFilesystem returns the value of the field, resolving if necessary 2077 func (ev *Event) GetExitFileFilesystem() string { 2078 if ev.GetEventType().String() != "exit" { 2079 return "" 2080 } 2081 if ev.Exit.Process == nil { 2082 return "" 2083 } 2084 if !ev.Exit.Process.IsNotKworker() { 2085 return "" 2086 } 2087 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Exit.Process.FileEvent) 2088 } 2089 2090 // GetExitFileGid returns the value of the field, resolving if necessary 2091 func (ev *Event) GetExitFileGid() uint32 { 2092 if ev.GetEventType().String() != "exit" { 2093 return uint32(0) 2094 } 2095 if ev.Exit.Process == nil { 2096 return uint32(0) 2097 } 2098 if !ev.Exit.Process.IsNotKworker() { 2099 return uint32(0) 2100 } 2101 return ev.Exit.Process.FileEvent.FileFields.GID 2102 } 2103 2104 // GetExitFileGroup returns the value of the field, resolving if necessary 2105 func (ev *Event) GetExitFileGroup() string { 2106 if ev.GetEventType().String() != "exit" { 2107 return "" 2108 } 2109 if ev.Exit.Process == nil { 2110 return "" 2111 } 2112 if !ev.Exit.Process.IsNotKworker() { 2113 return "" 2114 } 2115 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Exit.Process.FileEvent.FileFields) 2116 } 2117 2118 // GetExitFileHashes returns the value of the field, resolving if necessary 2119 func (ev *Event) GetExitFileHashes() []string { 2120 if ev.GetEventType().String() != "exit" { 2121 return []string{} 2122 } 2123 if ev.Exit.Process == nil { 2124 return []string{} 2125 } 2126 if !ev.Exit.Process.IsNotKworker() { 2127 return []string{} 2128 } 2129 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Exit.Process.FileEvent) 2130 } 2131 2132 // GetExitFileInUpperLayer returns the value of the field, resolving if necessary 2133 func (ev *Event) GetExitFileInUpperLayer() bool { 2134 if ev.GetEventType().String() != "exit" { 2135 return false 2136 } 2137 if ev.Exit.Process == nil { 2138 return false 2139 } 2140 if !ev.Exit.Process.IsNotKworker() { 2141 return false 2142 } 2143 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Exit.Process.FileEvent.FileFields) 2144 } 2145 2146 // GetExitFileInode returns the value of the field, resolving if necessary 2147 func (ev *Event) GetExitFileInode() uint64 { 2148 if ev.GetEventType().String() != "exit" { 2149 return uint64(0) 2150 } 2151 if ev.Exit.Process == nil { 2152 return uint64(0) 2153 } 2154 if !ev.Exit.Process.IsNotKworker() { 2155 return uint64(0) 2156 } 2157 return ev.Exit.Process.FileEvent.FileFields.PathKey.Inode 2158 } 2159 2160 // GetExitFileMode returns the value of the field, resolving if necessary 2161 func (ev *Event) GetExitFileMode() uint16 { 2162 if ev.GetEventType().String() != "exit" { 2163 return uint16(0) 2164 } 2165 if ev.Exit.Process == nil { 2166 return uint16(0) 2167 } 2168 if !ev.Exit.Process.IsNotKworker() { 2169 return uint16(0) 2170 } 2171 return ev.Exit.Process.FileEvent.FileFields.Mode 2172 } 2173 2174 // GetExitFileModificationTime returns the value of the field, resolving if necessary 2175 func (ev *Event) GetExitFileModificationTime() uint64 { 2176 if ev.GetEventType().String() != "exit" { 2177 return uint64(0) 2178 } 2179 if ev.Exit.Process == nil { 2180 return uint64(0) 2181 } 2182 if !ev.Exit.Process.IsNotKworker() { 2183 return uint64(0) 2184 } 2185 return ev.Exit.Process.FileEvent.FileFields.MTime 2186 } 2187 2188 // GetExitFileMountId returns the value of the field, resolving if necessary 2189 func (ev *Event) GetExitFileMountId() uint32 { 2190 if ev.GetEventType().String() != "exit" { 2191 return uint32(0) 2192 } 2193 if ev.Exit.Process == nil { 2194 return uint32(0) 2195 } 2196 if !ev.Exit.Process.IsNotKworker() { 2197 return uint32(0) 2198 } 2199 return ev.Exit.Process.FileEvent.FileFields.PathKey.MountID 2200 } 2201 2202 // GetExitFileName returns the value of the field, resolving if necessary 2203 func (ev *Event) GetExitFileName() string { 2204 if ev.GetEventType().String() != "exit" { 2205 return "" 2206 } 2207 if ev.Exit.Process == nil { 2208 return "" 2209 } 2210 if !ev.Exit.Process.IsNotKworker() { 2211 return "" 2212 } 2213 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Exit.Process.FileEvent) 2214 } 2215 2216 // GetExitFileNameLength returns the value of the field, resolving if necessary 2217 func (ev *Event) GetExitFileNameLength() int { 2218 if ev.GetEventType().String() != "exit" { 2219 return 0 2220 } 2221 if ev.Exit.Process == nil { 2222 return 0 2223 } 2224 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Exit.Process.FileEvent)) 2225 } 2226 2227 // GetExitFilePackageName returns the value of the field, resolving if necessary 2228 func (ev *Event) GetExitFilePackageName() string { 2229 if ev.GetEventType().String() != "exit" { 2230 return "" 2231 } 2232 if ev.Exit.Process == nil { 2233 return "" 2234 } 2235 if !ev.Exit.Process.IsNotKworker() { 2236 return "" 2237 } 2238 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Exit.Process.FileEvent) 2239 } 2240 2241 // GetExitFilePackageSourceVersion returns the value of the field, resolving if necessary 2242 func (ev *Event) GetExitFilePackageSourceVersion() string { 2243 if ev.GetEventType().String() != "exit" { 2244 return "" 2245 } 2246 if ev.Exit.Process == nil { 2247 return "" 2248 } 2249 if !ev.Exit.Process.IsNotKworker() { 2250 return "" 2251 } 2252 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Exit.Process.FileEvent) 2253 } 2254 2255 // GetExitFilePackageVersion returns the value of the field, resolving if necessary 2256 func (ev *Event) GetExitFilePackageVersion() string { 2257 if ev.GetEventType().String() != "exit" { 2258 return "" 2259 } 2260 if ev.Exit.Process == nil { 2261 return "" 2262 } 2263 if !ev.Exit.Process.IsNotKworker() { 2264 return "" 2265 } 2266 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Exit.Process.FileEvent) 2267 } 2268 2269 // GetExitFilePath returns the value of the field, resolving if necessary 2270 func (ev *Event) GetExitFilePath() string { 2271 if ev.GetEventType().String() != "exit" { 2272 return "" 2273 } 2274 if ev.Exit.Process == nil { 2275 return "" 2276 } 2277 if !ev.Exit.Process.IsNotKworker() { 2278 return "" 2279 } 2280 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Exit.Process.FileEvent) 2281 } 2282 2283 // GetExitFilePathLength returns the value of the field, resolving if necessary 2284 func (ev *Event) GetExitFilePathLength() int { 2285 if ev.GetEventType().String() != "exit" { 2286 return 0 2287 } 2288 if ev.Exit.Process == nil { 2289 return 0 2290 } 2291 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Exit.Process.FileEvent)) 2292 } 2293 2294 // GetExitFileRights returns the value of the field, resolving if necessary 2295 func (ev *Event) GetExitFileRights() int { 2296 if ev.GetEventType().String() != "exit" { 2297 return 0 2298 } 2299 if ev.Exit.Process == nil { 2300 return 0 2301 } 2302 if !ev.Exit.Process.IsNotKworker() { 2303 return 0 2304 } 2305 return ev.FieldHandlers.ResolveRights(ev, &ev.Exit.Process.FileEvent.FileFields) 2306 } 2307 2308 // GetExitFileUid returns the value of the field, resolving if necessary 2309 func (ev *Event) GetExitFileUid() uint32 { 2310 if ev.GetEventType().String() != "exit" { 2311 return uint32(0) 2312 } 2313 if ev.Exit.Process == nil { 2314 return uint32(0) 2315 } 2316 if !ev.Exit.Process.IsNotKworker() { 2317 return uint32(0) 2318 } 2319 return ev.Exit.Process.FileEvent.FileFields.UID 2320 } 2321 2322 // GetExitFileUser returns the value of the field, resolving if necessary 2323 func (ev *Event) GetExitFileUser() string { 2324 if ev.GetEventType().String() != "exit" { 2325 return "" 2326 } 2327 if ev.Exit.Process == nil { 2328 return "" 2329 } 2330 if !ev.Exit.Process.IsNotKworker() { 2331 return "" 2332 } 2333 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Exit.Process.FileEvent.FileFields) 2334 } 2335 2336 // GetExitForkTime returns the value of the field, resolving if necessary 2337 func (ev *Event) GetExitForkTime() time.Time { 2338 if ev.GetEventType().String() != "exit" { 2339 return time.Time{} 2340 } 2341 if ev.Exit.Process == nil { 2342 return time.Time{} 2343 } 2344 return ev.Exit.Process.ForkTime 2345 } 2346 2347 // GetExitFsgid returns the value of the field, resolving if necessary 2348 func (ev *Event) GetExitFsgid() uint32 { 2349 if ev.GetEventType().String() != "exit" { 2350 return uint32(0) 2351 } 2352 if ev.Exit.Process == nil { 2353 return uint32(0) 2354 } 2355 return ev.Exit.Process.Credentials.FSGID 2356 } 2357 2358 // GetExitFsgroup returns the value of the field, resolving if necessary 2359 func (ev *Event) GetExitFsgroup() string { 2360 if ev.GetEventType().String() != "exit" { 2361 return "" 2362 } 2363 if ev.Exit.Process == nil { 2364 return "" 2365 } 2366 return ev.Exit.Process.Credentials.FSGroup 2367 } 2368 2369 // GetExitFsuid returns the value of the field, resolving if necessary 2370 func (ev *Event) GetExitFsuid() uint32 { 2371 if ev.GetEventType().String() != "exit" { 2372 return uint32(0) 2373 } 2374 if ev.Exit.Process == nil { 2375 return uint32(0) 2376 } 2377 return ev.Exit.Process.Credentials.FSUID 2378 } 2379 2380 // GetExitFsuser returns the value of the field, resolving if necessary 2381 func (ev *Event) GetExitFsuser() string { 2382 if ev.GetEventType().String() != "exit" { 2383 return "" 2384 } 2385 if ev.Exit.Process == nil { 2386 return "" 2387 } 2388 return ev.Exit.Process.Credentials.FSUser 2389 } 2390 2391 // GetExitGid returns the value of the field, resolving if necessary 2392 func (ev *Event) GetExitGid() uint32 { 2393 if ev.GetEventType().String() != "exit" { 2394 return uint32(0) 2395 } 2396 if ev.Exit.Process == nil { 2397 return uint32(0) 2398 } 2399 return ev.Exit.Process.Credentials.GID 2400 } 2401 2402 // GetExitGroup returns the value of the field, resolving if necessary 2403 func (ev *Event) GetExitGroup() string { 2404 if ev.GetEventType().String() != "exit" { 2405 return "" 2406 } 2407 if ev.Exit.Process == nil { 2408 return "" 2409 } 2410 return ev.Exit.Process.Credentials.Group 2411 } 2412 2413 // GetExitInterpreterFileChangeTime returns the value of the field, resolving if necessary 2414 func (ev *Event) GetExitInterpreterFileChangeTime() uint64 { 2415 if ev.GetEventType().String() != "exit" { 2416 return uint64(0) 2417 } 2418 if ev.Exit.Process == nil { 2419 return uint64(0) 2420 } 2421 if !ev.Exit.Process.HasInterpreter() { 2422 return uint64(0) 2423 } 2424 return ev.Exit.Process.LinuxBinprm.FileEvent.FileFields.CTime 2425 } 2426 2427 // GetExitInterpreterFileFilesystem returns the value of the field, resolving if necessary 2428 func (ev *Event) GetExitInterpreterFileFilesystem() string { 2429 if ev.GetEventType().String() != "exit" { 2430 return "" 2431 } 2432 if ev.Exit.Process == nil { 2433 return "" 2434 } 2435 if !ev.Exit.Process.HasInterpreter() { 2436 return "" 2437 } 2438 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Exit.Process.LinuxBinprm.FileEvent) 2439 } 2440 2441 // GetExitInterpreterFileGid returns the value of the field, resolving if necessary 2442 func (ev *Event) GetExitInterpreterFileGid() uint32 { 2443 if ev.GetEventType().String() != "exit" { 2444 return uint32(0) 2445 } 2446 if ev.Exit.Process == nil { 2447 return uint32(0) 2448 } 2449 if !ev.Exit.Process.HasInterpreter() { 2450 return uint32(0) 2451 } 2452 return ev.Exit.Process.LinuxBinprm.FileEvent.FileFields.GID 2453 } 2454 2455 // GetExitInterpreterFileGroup returns the value of the field, resolving if necessary 2456 func (ev *Event) GetExitInterpreterFileGroup() string { 2457 if ev.GetEventType().String() != "exit" { 2458 return "" 2459 } 2460 if ev.Exit.Process == nil { 2461 return "" 2462 } 2463 if !ev.Exit.Process.HasInterpreter() { 2464 return "" 2465 } 2466 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Exit.Process.LinuxBinprm.FileEvent.FileFields) 2467 } 2468 2469 // GetExitInterpreterFileHashes returns the value of the field, resolving if necessary 2470 func (ev *Event) GetExitInterpreterFileHashes() []string { 2471 if ev.GetEventType().String() != "exit" { 2472 return []string{} 2473 } 2474 if ev.Exit.Process == nil { 2475 return []string{} 2476 } 2477 if !ev.Exit.Process.HasInterpreter() { 2478 return []string{} 2479 } 2480 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Exit.Process.LinuxBinprm.FileEvent) 2481 } 2482 2483 // GetExitInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 2484 func (ev *Event) GetExitInterpreterFileInUpperLayer() bool { 2485 if ev.GetEventType().String() != "exit" { 2486 return false 2487 } 2488 if ev.Exit.Process == nil { 2489 return false 2490 } 2491 if !ev.Exit.Process.HasInterpreter() { 2492 return false 2493 } 2494 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Exit.Process.LinuxBinprm.FileEvent.FileFields) 2495 } 2496 2497 // GetExitInterpreterFileInode returns the value of the field, resolving if necessary 2498 func (ev *Event) GetExitInterpreterFileInode() uint64 { 2499 if ev.GetEventType().String() != "exit" { 2500 return uint64(0) 2501 } 2502 if ev.Exit.Process == nil { 2503 return uint64(0) 2504 } 2505 if !ev.Exit.Process.HasInterpreter() { 2506 return uint64(0) 2507 } 2508 return ev.Exit.Process.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 2509 } 2510 2511 // GetExitInterpreterFileMode returns the value of the field, resolving if necessary 2512 func (ev *Event) GetExitInterpreterFileMode() uint16 { 2513 if ev.GetEventType().String() != "exit" { 2514 return uint16(0) 2515 } 2516 if ev.Exit.Process == nil { 2517 return uint16(0) 2518 } 2519 if !ev.Exit.Process.HasInterpreter() { 2520 return uint16(0) 2521 } 2522 return ev.Exit.Process.LinuxBinprm.FileEvent.FileFields.Mode 2523 } 2524 2525 // GetExitInterpreterFileModificationTime returns the value of the field, resolving if necessary 2526 func (ev *Event) GetExitInterpreterFileModificationTime() uint64 { 2527 if ev.GetEventType().String() != "exit" { 2528 return uint64(0) 2529 } 2530 if ev.Exit.Process == nil { 2531 return uint64(0) 2532 } 2533 if !ev.Exit.Process.HasInterpreter() { 2534 return uint64(0) 2535 } 2536 return ev.Exit.Process.LinuxBinprm.FileEvent.FileFields.MTime 2537 } 2538 2539 // GetExitInterpreterFileMountId returns the value of the field, resolving if necessary 2540 func (ev *Event) GetExitInterpreterFileMountId() uint32 { 2541 if ev.GetEventType().String() != "exit" { 2542 return uint32(0) 2543 } 2544 if ev.Exit.Process == nil { 2545 return uint32(0) 2546 } 2547 if !ev.Exit.Process.HasInterpreter() { 2548 return uint32(0) 2549 } 2550 return ev.Exit.Process.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 2551 } 2552 2553 // GetExitInterpreterFileName returns the value of the field, resolving if necessary 2554 func (ev *Event) GetExitInterpreterFileName() string { 2555 if ev.GetEventType().String() != "exit" { 2556 return "" 2557 } 2558 if ev.Exit.Process == nil { 2559 return "" 2560 } 2561 if !ev.Exit.Process.HasInterpreter() { 2562 return "" 2563 } 2564 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Exit.Process.LinuxBinprm.FileEvent) 2565 } 2566 2567 // GetExitInterpreterFileNameLength returns the value of the field, resolving if necessary 2568 func (ev *Event) GetExitInterpreterFileNameLength() int { 2569 if ev.GetEventType().String() != "exit" { 2570 return 0 2571 } 2572 if ev.Exit.Process == nil { 2573 return 0 2574 } 2575 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Exit.Process.LinuxBinprm.FileEvent)) 2576 } 2577 2578 // GetExitInterpreterFilePackageName returns the value of the field, resolving if necessary 2579 func (ev *Event) GetExitInterpreterFilePackageName() string { 2580 if ev.GetEventType().String() != "exit" { 2581 return "" 2582 } 2583 if ev.Exit.Process == nil { 2584 return "" 2585 } 2586 if !ev.Exit.Process.HasInterpreter() { 2587 return "" 2588 } 2589 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Exit.Process.LinuxBinprm.FileEvent) 2590 } 2591 2592 // GetExitInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 2593 func (ev *Event) GetExitInterpreterFilePackageSourceVersion() string { 2594 if ev.GetEventType().String() != "exit" { 2595 return "" 2596 } 2597 if ev.Exit.Process == nil { 2598 return "" 2599 } 2600 if !ev.Exit.Process.HasInterpreter() { 2601 return "" 2602 } 2603 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Exit.Process.LinuxBinprm.FileEvent) 2604 } 2605 2606 // GetExitInterpreterFilePackageVersion returns the value of the field, resolving if necessary 2607 func (ev *Event) GetExitInterpreterFilePackageVersion() string { 2608 if ev.GetEventType().String() != "exit" { 2609 return "" 2610 } 2611 if ev.Exit.Process == nil { 2612 return "" 2613 } 2614 if !ev.Exit.Process.HasInterpreter() { 2615 return "" 2616 } 2617 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Exit.Process.LinuxBinprm.FileEvent) 2618 } 2619 2620 // GetExitInterpreterFilePath returns the value of the field, resolving if necessary 2621 func (ev *Event) GetExitInterpreterFilePath() string { 2622 if ev.GetEventType().String() != "exit" { 2623 return "" 2624 } 2625 if ev.Exit.Process == nil { 2626 return "" 2627 } 2628 if !ev.Exit.Process.HasInterpreter() { 2629 return "" 2630 } 2631 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Exit.Process.LinuxBinprm.FileEvent) 2632 } 2633 2634 // GetExitInterpreterFilePathLength returns the value of the field, resolving if necessary 2635 func (ev *Event) GetExitInterpreterFilePathLength() int { 2636 if ev.GetEventType().String() != "exit" { 2637 return 0 2638 } 2639 if ev.Exit.Process == nil { 2640 return 0 2641 } 2642 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Exit.Process.LinuxBinprm.FileEvent)) 2643 } 2644 2645 // GetExitInterpreterFileRights returns the value of the field, resolving if necessary 2646 func (ev *Event) GetExitInterpreterFileRights() int { 2647 if ev.GetEventType().String() != "exit" { 2648 return 0 2649 } 2650 if ev.Exit.Process == nil { 2651 return 0 2652 } 2653 if !ev.Exit.Process.HasInterpreter() { 2654 return 0 2655 } 2656 return ev.FieldHandlers.ResolveRights(ev, &ev.Exit.Process.LinuxBinprm.FileEvent.FileFields) 2657 } 2658 2659 // GetExitInterpreterFileUid returns the value of the field, resolving if necessary 2660 func (ev *Event) GetExitInterpreterFileUid() uint32 { 2661 if ev.GetEventType().String() != "exit" { 2662 return uint32(0) 2663 } 2664 if ev.Exit.Process == nil { 2665 return uint32(0) 2666 } 2667 if !ev.Exit.Process.HasInterpreter() { 2668 return uint32(0) 2669 } 2670 return ev.Exit.Process.LinuxBinprm.FileEvent.FileFields.UID 2671 } 2672 2673 // GetExitInterpreterFileUser returns the value of the field, resolving if necessary 2674 func (ev *Event) GetExitInterpreterFileUser() string { 2675 if ev.GetEventType().String() != "exit" { 2676 return "" 2677 } 2678 if ev.Exit.Process == nil { 2679 return "" 2680 } 2681 if !ev.Exit.Process.HasInterpreter() { 2682 return "" 2683 } 2684 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Exit.Process.LinuxBinprm.FileEvent.FileFields) 2685 } 2686 2687 // GetExitIsKworker returns the value of the field, resolving if necessary 2688 func (ev *Event) GetExitIsKworker() bool { 2689 if ev.GetEventType().String() != "exit" { 2690 return false 2691 } 2692 if ev.Exit.Process == nil { 2693 return false 2694 } 2695 return ev.Exit.Process.PIDContext.IsKworker 2696 } 2697 2698 // GetExitIsThread returns the value of the field, resolving if necessary 2699 func (ev *Event) GetExitIsThread() bool { 2700 if ev.GetEventType().String() != "exit" { 2701 return false 2702 } 2703 if ev.Exit.Process == nil { 2704 return false 2705 } 2706 return ev.Exit.Process.IsThread 2707 } 2708 2709 // GetExitPid returns the value of the field, resolving if necessary 2710 func (ev *Event) GetExitPid() uint32 { 2711 if ev.GetEventType().String() != "exit" { 2712 return uint32(0) 2713 } 2714 if ev.Exit.Process == nil { 2715 return uint32(0) 2716 } 2717 return ev.Exit.Process.PIDContext.Pid 2718 } 2719 2720 // GetExitPpid returns the value of the field, resolving if necessary 2721 func (ev *Event) GetExitPpid() uint32 { 2722 if ev.GetEventType().String() != "exit" { 2723 return uint32(0) 2724 } 2725 if ev.Exit.Process == nil { 2726 return uint32(0) 2727 } 2728 return ev.Exit.Process.PPid 2729 } 2730 2731 // GetExitTid returns the value of the field, resolving if necessary 2732 func (ev *Event) GetExitTid() uint32 { 2733 if ev.GetEventType().String() != "exit" { 2734 return uint32(0) 2735 } 2736 if ev.Exit.Process == nil { 2737 return uint32(0) 2738 } 2739 return ev.Exit.Process.PIDContext.Tid 2740 } 2741 2742 // GetExitTtyName returns the value of the field, resolving if necessary 2743 func (ev *Event) GetExitTtyName() string { 2744 if ev.GetEventType().String() != "exit" { 2745 return "" 2746 } 2747 if ev.Exit.Process == nil { 2748 return "" 2749 } 2750 return ev.Exit.Process.TTYName 2751 } 2752 2753 // GetExitUid returns the value of the field, resolving if necessary 2754 func (ev *Event) GetExitUid() uint32 { 2755 if ev.GetEventType().String() != "exit" { 2756 return uint32(0) 2757 } 2758 if ev.Exit.Process == nil { 2759 return uint32(0) 2760 } 2761 return ev.Exit.Process.Credentials.UID 2762 } 2763 2764 // GetExitUser returns the value of the field, resolving if necessary 2765 func (ev *Event) GetExitUser() string { 2766 if ev.GetEventType().String() != "exit" { 2767 return "" 2768 } 2769 if ev.Exit.Process == nil { 2770 return "" 2771 } 2772 return ev.Exit.Process.Credentials.User 2773 } 2774 2775 // GetExitUserSessionK8sGroups returns the value of the field, resolving if necessary 2776 func (ev *Event) GetExitUserSessionK8sGroups() []string { 2777 if ev.GetEventType().String() != "exit" { 2778 return []string{} 2779 } 2780 if ev.Exit.Process == nil { 2781 return []string{} 2782 } 2783 return ev.FieldHandlers.ResolveK8SGroups(ev, &ev.Exit.Process.UserSession) 2784 } 2785 2786 // GetExitUserSessionK8sUid returns the value of the field, resolving if necessary 2787 func (ev *Event) GetExitUserSessionK8sUid() string { 2788 if ev.GetEventType().String() != "exit" { 2789 return "" 2790 } 2791 if ev.Exit.Process == nil { 2792 return "" 2793 } 2794 return ev.FieldHandlers.ResolveK8SUID(ev, &ev.Exit.Process.UserSession) 2795 } 2796 2797 // GetExitUserSessionK8sUsername returns the value of the field, resolving if necessary 2798 func (ev *Event) GetExitUserSessionK8sUsername() string { 2799 if ev.GetEventType().String() != "exit" { 2800 return "" 2801 } 2802 if ev.Exit.Process == nil { 2803 return "" 2804 } 2805 return ev.FieldHandlers.ResolveK8SUsername(ev, &ev.Exit.Process.UserSession) 2806 } 2807 2808 // GetLinkFileChangeTime returns the value of the field, resolving if necessary 2809 func (ev *Event) GetLinkFileChangeTime() uint64 { 2810 if ev.GetEventType().String() != "link" { 2811 return uint64(0) 2812 } 2813 return ev.Link.Source.FileFields.CTime 2814 } 2815 2816 // GetLinkFileDestinationChangeTime returns the value of the field, resolving if necessary 2817 func (ev *Event) GetLinkFileDestinationChangeTime() uint64 { 2818 if ev.GetEventType().String() != "link" { 2819 return uint64(0) 2820 } 2821 return ev.Link.Target.FileFields.CTime 2822 } 2823 2824 // GetLinkFileDestinationFilesystem returns the value of the field, resolving if necessary 2825 func (ev *Event) GetLinkFileDestinationFilesystem() string { 2826 if ev.GetEventType().String() != "link" { 2827 return "" 2828 } 2829 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Link.Target) 2830 } 2831 2832 // GetLinkFileDestinationGid returns the value of the field, resolving if necessary 2833 func (ev *Event) GetLinkFileDestinationGid() uint32 { 2834 if ev.GetEventType().String() != "link" { 2835 return uint32(0) 2836 } 2837 return ev.Link.Target.FileFields.GID 2838 } 2839 2840 // GetLinkFileDestinationGroup returns the value of the field, resolving if necessary 2841 func (ev *Event) GetLinkFileDestinationGroup() string { 2842 if ev.GetEventType().String() != "link" { 2843 return "" 2844 } 2845 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Link.Target.FileFields) 2846 } 2847 2848 // GetLinkFileDestinationHashes returns the value of the field, resolving if necessary 2849 func (ev *Event) GetLinkFileDestinationHashes() []string { 2850 if ev.GetEventType().String() != "link" { 2851 return []string{} 2852 } 2853 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Link.Target) 2854 } 2855 2856 // GetLinkFileDestinationInUpperLayer returns the value of the field, resolving if necessary 2857 func (ev *Event) GetLinkFileDestinationInUpperLayer() bool { 2858 if ev.GetEventType().String() != "link" { 2859 return false 2860 } 2861 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Link.Target.FileFields) 2862 } 2863 2864 // GetLinkFileDestinationInode returns the value of the field, resolving if necessary 2865 func (ev *Event) GetLinkFileDestinationInode() uint64 { 2866 if ev.GetEventType().String() != "link" { 2867 return uint64(0) 2868 } 2869 return ev.Link.Target.FileFields.PathKey.Inode 2870 } 2871 2872 // GetLinkFileDestinationMode returns the value of the field, resolving if necessary 2873 func (ev *Event) GetLinkFileDestinationMode() uint16 { 2874 if ev.GetEventType().String() != "link" { 2875 return uint16(0) 2876 } 2877 return ev.Link.Target.FileFields.Mode 2878 } 2879 2880 // GetLinkFileDestinationModificationTime returns the value of the field, resolving if necessary 2881 func (ev *Event) GetLinkFileDestinationModificationTime() uint64 { 2882 if ev.GetEventType().String() != "link" { 2883 return uint64(0) 2884 } 2885 return ev.Link.Target.FileFields.MTime 2886 } 2887 2888 // GetLinkFileDestinationMountId returns the value of the field, resolving if necessary 2889 func (ev *Event) GetLinkFileDestinationMountId() uint32 { 2890 if ev.GetEventType().String() != "link" { 2891 return uint32(0) 2892 } 2893 return ev.Link.Target.FileFields.PathKey.MountID 2894 } 2895 2896 // GetLinkFileDestinationName returns the value of the field, resolving if necessary 2897 func (ev *Event) GetLinkFileDestinationName() string { 2898 if ev.GetEventType().String() != "link" { 2899 return "" 2900 } 2901 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Link.Target) 2902 } 2903 2904 // GetLinkFileDestinationNameLength returns the value of the field, resolving if necessary 2905 func (ev *Event) GetLinkFileDestinationNameLength() int { 2906 if ev.GetEventType().String() != "link" { 2907 return 0 2908 } 2909 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Link.Target)) 2910 } 2911 2912 // GetLinkFileDestinationPackageName returns the value of the field, resolving if necessary 2913 func (ev *Event) GetLinkFileDestinationPackageName() string { 2914 if ev.GetEventType().String() != "link" { 2915 return "" 2916 } 2917 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Link.Target) 2918 } 2919 2920 // GetLinkFileDestinationPackageSourceVersion returns the value of the field, resolving if necessary 2921 func (ev *Event) GetLinkFileDestinationPackageSourceVersion() string { 2922 if ev.GetEventType().String() != "link" { 2923 return "" 2924 } 2925 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Link.Target) 2926 } 2927 2928 // GetLinkFileDestinationPackageVersion returns the value of the field, resolving if necessary 2929 func (ev *Event) GetLinkFileDestinationPackageVersion() string { 2930 if ev.GetEventType().String() != "link" { 2931 return "" 2932 } 2933 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Link.Target) 2934 } 2935 2936 // GetLinkFileDestinationPath returns the value of the field, resolving if necessary 2937 func (ev *Event) GetLinkFileDestinationPath() string { 2938 if ev.GetEventType().String() != "link" { 2939 return "" 2940 } 2941 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Link.Target) 2942 } 2943 2944 // GetLinkFileDestinationPathLength returns the value of the field, resolving if necessary 2945 func (ev *Event) GetLinkFileDestinationPathLength() int { 2946 if ev.GetEventType().String() != "link" { 2947 return 0 2948 } 2949 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Link.Target)) 2950 } 2951 2952 // GetLinkFileDestinationRights returns the value of the field, resolving if necessary 2953 func (ev *Event) GetLinkFileDestinationRights() int { 2954 if ev.GetEventType().String() != "link" { 2955 return 0 2956 } 2957 return ev.FieldHandlers.ResolveRights(ev, &ev.Link.Target.FileFields) 2958 } 2959 2960 // GetLinkFileDestinationUid returns the value of the field, resolving if necessary 2961 func (ev *Event) GetLinkFileDestinationUid() uint32 { 2962 if ev.GetEventType().String() != "link" { 2963 return uint32(0) 2964 } 2965 return ev.Link.Target.FileFields.UID 2966 } 2967 2968 // GetLinkFileDestinationUser returns the value of the field, resolving if necessary 2969 func (ev *Event) GetLinkFileDestinationUser() string { 2970 if ev.GetEventType().String() != "link" { 2971 return "" 2972 } 2973 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Link.Target.FileFields) 2974 } 2975 2976 // GetLinkFileFilesystem returns the value of the field, resolving if necessary 2977 func (ev *Event) GetLinkFileFilesystem() string { 2978 if ev.GetEventType().String() != "link" { 2979 return "" 2980 } 2981 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Link.Source) 2982 } 2983 2984 // GetLinkFileGid returns the value of the field, resolving if necessary 2985 func (ev *Event) GetLinkFileGid() uint32 { 2986 if ev.GetEventType().String() != "link" { 2987 return uint32(0) 2988 } 2989 return ev.Link.Source.FileFields.GID 2990 } 2991 2992 // GetLinkFileGroup returns the value of the field, resolving if necessary 2993 func (ev *Event) GetLinkFileGroup() string { 2994 if ev.GetEventType().String() != "link" { 2995 return "" 2996 } 2997 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Link.Source.FileFields) 2998 } 2999 3000 // GetLinkFileHashes returns the value of the field, resolving if necessary 3001 func (ev *Event) GetLinkFileHashes() []string { 3002 if ev.GetEventType().String() != "link" { 3003 return []string{} 3004 } 3005 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Link.Source) 3006 } 3007 3008 // GetLinkFileInUpperLayer returns the value of the field, resolving if necessary 3009 func (ev *Event) GetLinkFileInUpperLayer() bool { 3010 if ev.GetEventType().String() != "link" { 3011 return false 3012 } 3013 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Link.Source.FileFields) 3014 } 3015 3016 // GetLinkFileInode returns the value of the field, resolving if necessary 3017 func (ev *Event) GetLinkFileInode() uint64 { 3018 if ev.GetEventType().String() != "link" { 3019 return uint64(0) 3020 } 3021 return ev.Link.Source.FileFields.PathKey.Inode 3022 } 3023 3024 // GetLinkFileMode returns the value of the field, resolving if necessary 3025 func (ev *Event) GetLinkFileMode() uint16 { 3026 if ev.GetEventType().String() != "link" { 3027 return uint16(0) 3028 } 3029 return ev.Link.Source.FileFields.Mode 3030 } 3031 3032 // GetLinkFileModificationTime returns the value of the field, resolving if necessary 3033 func (ev *Event) GetLinkFileModificationTime() uint64 { 3034 if ev.GetEventType().String() != "link" { 3035 return uint64(0) 3036 } 3037 return ev.Link.Source.FileFields.MTime 3038 } 3039 3040 // GetLinkFileMountId returns the value of the field, resolving if necessary 3041 func (ev *Event) GetLinkFileMountId() uint32 { 3042 if ev.GetEventType().String() != "link" { 3043 return uint32(0) 3044 } 3045 return ev.Link.Source.FileFields.PathKey.MountID 3046 } 3047 3048 // GetLinkFileName returns the value of the field, resolving if necessary 3049 func (ev *Event) GetLinkFileName() string { 3050 if ev.GetEventType().String() != "link" { 3051 return "" 3052 } 3053 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Link.Source) 3054 } 3055 3056 // GetLinkFileNameLength returns the value of the field, resolving if necessary 3057 func (ev *Event) GetLinkFileNameLength() int { 3058 if ev.GetEventType().String() != "link" { 3059 return 0 3060 } 3061 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Link.Source)) 3062 } 3063 3064 // GetLinkFilePackageName returns the value of the field, resolving if necessary 3065 func (ev *Event) GetLinkFilePackageName() string { 3066 if ev.GetEventType().String() != "link" { 3067 return "" 3068 } 3069 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Link.Source) 3070 } 3071 3072 // GetLinkFilePackageSourceVersion returns the value of the field, resolving if necessary 3073 func (ev *Event) GetLinkFilePackageSourceVersion() string { 3074 if ev.GetEventType().String() != "link" { 3075 return "" 3076 } 3077 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Link.Source) 3078 } 3079 3080 // GetLinkFilePackageVersion returns the value of the field, resolving if necessary 3081 func (ev *Event) GetLinkFilePackageVersion() string { 3082 if ev.GetEventType().String() != "link" { 3083 return "" 3084 } 3085 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Link.Source) 3086 } 3087 3088 // GetLinkFilePath returns the value of the field, resolving if necessary 3089 func (ev *Event) GetLinkFilePath() string { 3090 if ev.GetEventType().String() != "link" { 3091 return "" 3092 } 3093 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Link.Source) 3094 } 3095 3096 // GetLinkFilePathLength returns the value of the field, resolving if necessary 3097 func (ev *Event) GetLinkFilePathLength() int { 3098 if ev.GetEventType().String() != "link" { 3099 return 0 3100 } 3101 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Link.Source)) 3102 } 3103 3104 // GetLinkFileRights returns the value of the field, resolving if necessary 3105 func (ev *Event) GetLinkFileRights() int { 3106 if ev.GetEventType().String() != "link" { 3107 return 0 3108 } 3109 return ev.FieldHandlers.ResolveRights(ev, &ev.Link.Source.FileFields) 3110 } 3111 3112 // GetLinkFileUid returns the value of the field, resolving if necessary 3113 func (ev *Event) GetLinkFileUid() uint32 { 3114 if ev.GetEventType().String() != "link" { 3115 return uint32(0) 3116 } 3117 return ev.Link.Source.FileFields.UID 3118 } 3119 3120 // GetLinkFileUser returns the value of the field, resolving if necessary 3121 func (ev *Event) GetLinkFileUser() string { 3122 if ev.GetEventType().String() != "link" { 3123 return "" 3124 } 3125 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Link.Source.FileFields) 3126 } 3127 3128 // GetLinkRetval returns the value of the field, resolving if necessary 3129 func (ev *Event) GetLinkRetval() int64 { 3130 if ev.GetEventType().String() != "link" { 3131 return int64(0) 3132 } 3133 return ev.Link.SyscallEvent.Retval 3134 } 3135 3136 // GetLoadModuleArgs returns the value of the field, resolving if necessary 3137 func (ev *Event) GetLoadModuleArgs() string { 3138 if ev.GetEventType().String() != "load_module" { 3139 return "" 3140 } 3141 return ev.FieldHandlers.ResolveModuleArgs(ev, &ev.LoadModule) 3142 } 3143 3144 // GetLoadModuleArgsTruncated returns the value of the field, resolving if necessary 3145 func (ev *Event) GetLoadModuleArgsTruncated() bool { 3146 if ev.GetEventType().String() != "load_module" { 3147 return false 3148 } 3149 return ev.LoadModule.ArgsTruncated 3150 } 3151 3152 // GetLoadModuleArgv returns the value of the field, resolving if necessary 3153 func (ev *Event) GetLoadModuleArgv() []string { 3154 if ev.GetEventType().String() != "load_module" { 3155 return []string{} 3156 } 3157 return ev.FieldHandlers.ResolveModuleArgv(ev, &ev.LoadModule) 3158 } 3159 3160 // GetLoadModuleFileChangeTime returns the value of the field, resolving if necessary 3161 func (ev *Event) GetLoadModuleFileChangeTime() uint64 { 3162 if ev.GetEventType().String() != "load_module" { 3163 return uint64(0) 3164 } 3165 return ev.LoadModule.File.FileFields.CTime 3166 } 3167 3168 // GetLoadModuleFileFilesystem returns the value of the field, resolving if necessary 3169 func (ev *Event) GetLoadModuleFileFilesystem() string { 3170 if ev.GetEventType().String() != "load_module" { 3171 return "" 3172 } 3173 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.LoadModule.File) 3174 } 3175 3176 // GetLoadModuleFileGid returns the value of the field, resolving if necessary 3177 func (ev *Event) GetLoadModuleFileGid() uint32 { 3178 if ev.GetEventType().String() != "load_module" { 3179 return uint32(0) 3180 } 3181 return ev.LoadModule.File.FileFields.GID 3182 } 3183 3184 // GetLoadModuleFileGroup returns the value of the field, resolving if necessary 3185 func (ev *Event) GetLoadModuleFileGroup() string { 3186 if ev.GetEventType().String() != "load_module" { 3187 return "" 3188 } 3189 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.LoadModule.File.FileFields) 3190 } 3191 3192 // GetLoadModuleFileHashes returns the value of the field, resolving if necessary 3193 func (ev *Event) GetLoadModuleFileHashes() []string { 3194 if ev.GetEventType().String() != "load_module" { 3195 return []string{} 3196 } 3197 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.LoadModule.File) 3198 } 3199 3200 // GetLoadModuleFileInUpperLayer returns the value of the field, resolving if necessary 3201 func (ev *Event) GetLoadModuleFileInUpperLayer() bool { 3202 if ev.GetEventType().String() != "load_module" { 3203 return false 3204 } 3205 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.LoadModule.File.FileFields) 3206 } 3207 3208 // GetLoadModuleFileInode returns the value of the field, resolving if necessary 3209 func (ev *Event) GetLoadModuleFileInode() uint64 { 3210 if ev.GetEventType().String() != "load_module" { 3211 return uint64(0) 3212 } 3213 return ev.LoadModule.File.FileFields.PathKey.Inode 3214 } 3215 3216 // GetLoadModuleFileMode returns the value of the field, resolving if necessary 3217 func (ev *Event) GetLoadModuleFileMode() uint16 { 3218 if ev.GetEventType().String() != "load_module" { 3219 return uint16(0) 3220 } 3221 return ev.LoadModule.File.FileFields.Mode 3222 } 3223 3224 // GetLoadModuleFileModificationTime returns the value of the field, resolving if necessary 3225 func (ev *Event) GetLoadModuleFileModificationTime() uint64 { 3226 if ev.GetEventType().String() != "load_module" { 3227 return uint64(0) 3228 } 3229 return ev.LoadModule.File.FileFields.MTime 3230 } 3231 3232 // GetLoadModuleFileMountId returns the value of the field, resolving if necessary 3233 func (ev *Event) GetLoadModuleFileMountId() uint32 { 3234 if ev.GetEventType().String() != "load_module" { 3235 return uint32(0) 3236 } 3237 return ev.LoadModule.File.FileFields.PathKey.MountID 3238 } 3239 3240 // GetLoadModuleFileName returns the value of the field, resolving if necessary 3241 func (ev *Event) GetLoadModuleFileName() string { 3242 if ev.GetEventType().String() != "load_module" { 3243 return "" 3244 } 3245 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.LoadModule.File) 3246 } 3247 3248 // GetLoadModuleFileNameLength returns the value of the field, resolving if necessary 3249 func (ev *Event) GetLoadModuleFileNameLength() int { 3250 if ev.GetEventType().String() != "load_module" { 3251 return 0 3252 } 3253 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.LoadModule.File)) 3254 } 3255 3256 // GetLoadModuleFilePackageName returns the value of the field, resolving if necessary 3257 func (ev *Event) GetLoadModuleFilePackageName() string { 3258 if ev.GetEventType().String() != "load_module" { 3259 return "" 3260 } 3261 return ev.FieldHandlers.ResolvePackageName(ev, &ev.LoadModule.File) 3262 } 3263 3264 // GetLoadModuleFilePackageSourceVersion returns the value of the field, resolving if necessary 3265 func (ev *Event) GetLoadModuleFilePackageSourceVersion() string { 3266 if ev.GetEventType().String() != "load_module" { 3267 return "" 3268 } 3269 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.LoadModule.File) 3270 } 3271 3272 // GetLoadModuleFilePackageVersion returns the value of the field, resolving if necessary 3273 func (ev *Event) GetLoadModuleFilePackageVersion() string { 3274 if ev.GetEventType().String() != "load_module" { 3275 return "" 3276 } 3277 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.LoadModule.File) 3278 } 3279 3280 // GetLoadModuleFilePath returns the value of the field, resolving if necessary 3281 func (ev *Event) GetLoadModuleFilePath() string { 3282 if ev.GetEventType().String() != "load_module" { 3283 return "" 3284 } 3285 return ev.FieldHandlers.ResolveFilePath(ev, &ev.LoadModule.File) 3286 } 3287 3288 // GetLoadModuleFilePathLength returns the value of the field, resolving if necessary 3289 func (ev *Event) GetLoadModuleFilePathLength() int { 3290 if ev.GetEventType().String() != "load_module" { 3291 return 0 3292 } 3293 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.LoadModule.File)) 3294 } 3295 3296 // GetLoadModuleFileRights returns the value of the field, resolving if necessary 3297 func (ev *Event) GetLoadModuleFileRights() int { 3298 if ev.GetEventType().String() != "load_module" { 3299 return 0 3300 } 3301 return ev.FieldHandlers.ResolveRights(ev, &ev.LoadModule.File.FileFields) 3302 } 3303 3304 // GetLoadModuleFileUid returns the value of the field, resolving if necessary 3305 func (ev *Event) GetLoadModuleFileUid() uint32 { 3306 if ev.GetEventType().String() != "load_module" { 3307 return uint32(0) 3308 } 3309 return ev.LoadModule.File.FileFields.UID 3310 } 3311 3312 // GetLoadModuleFileUser returns the value of the field, resolving if necessary 3313 func (ev *Event) GetLoadModuleFileUser() string { 3314 if ev.GetEventType().String() != "load_module" { 3315 return "" 3316 } 3317 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.LoadModule.File.FileFields) 3318 } 3319 3320 // GetLoadModuleLoadedFromMemory returns the value of the field, resolving if necessary 3321 func (ev *Event) GetLoadModuleLoadedFromMemory() bool { 3322 if ev.GetEventType().String() != "load_module" { 3323 return false 3324 } 3325 return ev.LoadModule.LoadedFromMemory 3326 } 3327 3328 // GetLoadModuleName returns the value of the field, resolving if necessary 3329 func (ev *Event) GetLoadModuleName() string { 3330 if ev.GetEventType().String() != "load_module" { 3331 return "" 3332 } 3333 return ev.LoadModule.Name 3334 } 3335 3336 // GetLoadModuleRetval returns the value of the field, resolving if necessary 3337 func (ev *Event) GetLoadModuleRetval() int64 { 3338 if ev.GetEventType().String() != "load_module" { 3339 return int64(0) 3340 } 3341 return ev.LoadModule.SyscallEvent.Retval 3342 } 3343 3344 // GetMkdirFileChangeTime returns the value of the field, resolving if necessary 3345 func (ev *Event) GetMkdirFileChangeTime() uint64 { 3346 if ev.GetEventType().String() != "mkdir" { 3347 return uint64(0) 3348 } 3349 return ev.Mkdir.File.FileFields.CTime 3350 } 3351 3352 // GetMkdirFileDestinationMode returns the value of the field, resolving if necessary 3353 func (ev *Event) GetMkdirFileDestinationMode() uint32 { 3354 if ev.GetEventType().String() != "mkdir" { 3355 return uint32(0) 3356 } 3357 return ev.Mkdir.Mode 3358 } 3359 3360 // GetMkdirFileDestinationRights returns the value of the field, resolving if necessary 3361 func (ev *Event) GetMkdirFileDestinationRights() uint32 { 3362 if ev.GetEventType().String() != "mkdir" { 3363 return uint32(0) 3364 } 3365 return ev.Mkdir.Mode 3366 } 3367 3368 // GetMkdirFileFilesystem returns the value of the field, resolving if necessary 3369 func (ev *Event) GetMkdirFileFilesystem() string { 3370 if ev.GetEventType().String() != "mkdir" { 3371 return "" 3372 } 3373 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Mkdir.File) 3374 } 3375 3376 // GetMkdirFileGid returns the value of the field, resolving if necessary 3377 func (ev *Event) GetMkdirFileGid() uint32 { 3378 if ev.GetEventType().String() != "mkdir" { 3379 return uint32(0) 3380 } 3381 return ev.Mkdir.File.FileFields.GID 3382 } 3383 3384 // GetMkdirFileGroup returns the value of the field, resolving if necessary 3385 func (ev *Event) GetMkdirFileGroup() string { 3386 if ev.GetEventType().String() != "mkdir" { 3387 return "" 3388 } 3389 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Mkdir.File.FileFields) 3390 } 3391 3392 // GetMkdirFileHashes returns the value of the field, resolving if necessary 3393 func (ev *Event) GetMkdirFileHashes() []string { 3394 if ev.GetEventType().String() != "mkdir" { 3395 return []string{} 3396 } 3397 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Mkdir.File) 3398 } 3399 3400 // GetMkdirFileInUpperLayer returns the value of the field, resolving if necessary 3401 func (ev *Event) GetMkdirFileInUpperLayer() bool { 3402 if ev.GetEventType().String() != "mkdir" { 3403 return false 3404 } 3405 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Mkdir.File.FileFields) 3406 } 3407 3408 // GetMkdirFileInode returns the value of the field, resolving if necessary 3409 func (ev *Event) GetMkdirFileInode() uint64 { 3410 if ev.GetEventType().String() != "mkdir" { 3411 return uint64(0) 3412 } 3413 return ev.Mkdir.File.FileFields.PathKey.Inode 3414 } 3415 3416 // GetMkdirFileMode returns the value of the field, resolving if necessary 3417 func (ev *Event) GetMkdirFileMode() uint16 { 3418 if ev.GetEventType().String() != "mkdir" { 3419 return uint16(0) 3420 } 3421 return ev.Mkdir.File.FileFields.Mode 3422 } 3423 3424 // GetMkdirFileModificationTime returns the value of the field, resolving if necessary 3425 func (ev *Event) GetMkdirFileModificationTime() uint64 { 3426 if ev.GetEventType().String() != "mkdir" { 3427 return uint64(0) 3428 } 3429 return ev.Mkdir.File.FileFields.MTime 3430 } 3431 3432 // GetMkdirFileMountId returns the value of the field, resolving if necessary 3433 func (ev *Event) GetMkdirFileMountId() uint32 { 3434 if ev.GetEventType().String() != "mkdir" { 3435 return uint32(0) 3436 } 3437 return ev.Mkdir.File.FileFields.PathKey.MountID 3438 } 3439 3440 // GetMkdirFileName returns the value of the field, resolving if necessary 3441 func (ev *Event) GetMkdirFileName() string { 3442 if ev.GetEventType().String() != "mkdir" { 3443 return "" 3444 } 3445 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Mkdir.File) 3446 } 3447 3448 // GetMkdirFileNameLength returns the value of the field, resolving if necessary 3449 func (ev *Event) GetMkdirFileNameLength() int { 3450 if ev.GetEventType().String() != "mkdir" { 3451 return 0 3452 } 3453 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Mkdir.File)) 3454 } 3455 3456 // GetMkdirFilePackageName returns the value of the field, resolving if necessary 3457 func (ev *Event) GetMkdirFilePackageName() string { 3458 if ev.GetEventType().String() != "mkdir" { 3459 return "" 3460 } 3461 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Mkdir.File) 3462 } 3463 3464 // GetMkdirFilePackageSourceVersion returns the value of the field, resolving if necessary 3465 func (ev *Event) GetMkdirFilePackageSourceVersion() string { 3466 if ev.GetEventType().String() != "mkdir" { 3467 return "" 3468 } 3469 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Mkdir.File) 3470 } 3471 3472 // GetMkdirFilePackageVersion returns the value of the field, resolving if necessary 3473 func (ev *Event) GetMkdirFilePackageVersion() string { 3474 if ev.GetEventType().String() != "mkdir" { 3475 return "" 3476 } 3477 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Mkdir.File) 3478 } 3479 3480 // GetMkdirFilePath returns the value of the field, resolving if necessary 3481 func (ev *Event) GetMkdirFilePath() string { 3482 if ev.GetEventType().String() != "mkdir" { 3483 return "" 3484 } 3485 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Mkdir.File) 3486 } 3487 3488 // GetMkdirFilePathLength returns the value of the field, resolving if necessary 3489 func (ev *Event) GetMkdirFilePathLength() int { 3490 if ev.GetEventType().String() != "mkdir" { 3491 return 0 3492 } 3493 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Mkdir.File)) 3494 } 3495 3496 // GetMkdirFileRights returns the value of the field, resolving if necessary 3497 func (ev *Event) GetMkdirFileRights() int { 3498 if ev.GetEventType().String() != "mkdir" { 3499 return 0 3500 } 3501 return ev.FieldHandlers.ResolveRights(ev, &ev.Mkdir.File.FileFields) 3502 } 3503 3504 // GetMkdirFileUid returns the value of the field, resolving if necessary 3505 func (ev *Event) GetMkdirFileUid() uint32 { 3506 if ev.GetEventType().String() != "mkdir" { 3507 return uint32(0) 3508 } 3509 return ev.Mkdir.File.FileFields.UID 3510 } 3511 3512 // GetMkdirFileUser returns the value of the field, resolving if necessary 3513 func (ev *Event) GetMkdirFileUser() string { 3514 if ev.GetEventType().String() != "mkdir" { 3515 return "" 3516 } 3517 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Mkdir.File.FileFields) 3518 } 3519 3520 // GetMkdirRetval returns the value of the field, resolving if necessary 3521 func (ev *Event) GetMkdirRetval() int64 { 3522 if ev.GetEventType().String() != "mkdir" { 3523 return int64(0) 3524 } 3525 return ev.Mkdir.SyscallEvent.Retval 3526 } 3527 3528 // GetMmapFileChangeTime returns the value of the field, resolving if necessary 3529 func (ev *Event) GetMmapFileChangeTime() uint64 { 3530 if ev.GetEventType().String() != "mmap" { 3531 return uint64(0) 3532 } 3533 return ev.MMap.File.FileFields.CTime 3534 } 3535 3536 // GetMmapFileFilesystem returns the value of the field, resolving if necessary 3537 func (ev *Event) GetMmapFileFilesystem() string { 3538 if ev.GetEventType().String() != "mmap" { 3539 return "" 3540 } 3541 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.MMap.File) 3542 } 3543 3544 // GetMmapFileGid returns the value of the field, resolving if necessary 3545 func (ev *Event) GetMmapFileGid() uint32 { 3546 if ev.GetEventType().String() != "mmap" { 3547 return uint32(0) 3548 } 3549 return ev.MMap.File.FileFields.GID 3550 } 3551 3552 // GetMmapFileGroup returns the value of the field, resolving if necessary 3553 func (ev *Event) GetMmapFileGroup() string { 3554 if ev.GetEventType().String() != "mmap" { 3555 return "" 3556 } 3557 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.MMap.File.FileFields) 3558 } 3559 3560 // GetMmapFileHashes returns the value of the field, resolving if necessary 3561 func (ev *Event) GetMmapFileHashes() []string { 3562 if ev.GetEventType().String() != "mmap" { 3563 return []string{} 3564 } 3565 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.MMap.File) 3566 } 3567 3568 // GetMmapFileInUpperLayer returns the value of the field, resolving if necessary 3569 func (ev *Event) GetMmapFileInUpperLayer() bool { 3570 if ev.GetEventType().String() != "mmap" { 3571 return false 3572 } 3573 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.MMap.File.FileFields) 3574 } 3575 3576 // GetMmapFileInode returns the value of the field, resolving if necessary 3577 func (ev *Event) GetMmapFileInode() uint64 { 3578 if ev.GetEventType().String() != "mmap" { 3579 return uint64(0) 3580 } 3581 return ev.MMap.File.FileFields.PathKey.Inode 3582 } 3583 3584 // GetMmapFileMode returns the value of the field, resolving if necessary 3585 func (ev *Event) GetMmapFileMode() uint16 { 3586 if ev.GetEventType().String() != "mmap" { 3587 return uint16(0) 3588 } 3589 return ev.MMap.File.FileFields.Mode 3590 } 3591 3592 // GetMmapFileModificationTime returns the value of the field, resolving if necessary 3593 func (ev *Event) GetMmapFileModificationTime() uint64 { 3594 if ev.GetEventType().String() != "mmap" { 3595 return uint64(0) 3596 } 3597 return ev.MMap.File.FileFields.MTime 3598 } 3599 3600 // GetMmapFileMountId returns the value of the field, resolving if necessary 3601 func (ev *Event) GetMmapFileMountId() uint32 { 3602 if ev.GetEventType().String() != "mmap" { 3603 return uint32(0) 3604 } 3605 return ev.MMap.File.FileFields.PathKey.MountID 3606 } 3607 3608 // GetMmapFileName returns the value of the field, resolving if necessary 3609 func (ev *Event) GetMmapFileName() string { 3610 if ev.GetEventType().String() != "mmap" { 3611 return "" 3612 } 3613 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.MMap.File) 3614 } 3615 3616 // GetMmapFileNameLength returns the value of the field, resolving if necessary 3617 func (ev *Event) GetMmapFileNameLength() int { 3618 if ev.GetEventType().String() != "mmap" { 3619 return 0 3620 } 3621 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.MMap.File)) 3622 } 3623 3624 // GetMmapFilePackageName returns the value of the field, resolving if necessary 3625 func (ev *Event) GetMmapFilePackageName() string { 3626 if ev.GetEventType().String() != "mmap" { 3627 return "" 3628 } 3629 return ev.FieldHandlers.ResolvePackageName(ev, &ev.MMap.File) 3630 } 3631 3632 // GetMmapFilePackageSourceVersion returns the value of the field, resolving if necessary 3633 func (ev *Event) GetMmapFilePackageSourceVersion() string { 3634 if ev.GetEventType().String() != "mmap" { 3635 return "" 3636 } 3637 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.MMap.File) 3638 } 3639 3640 // GetMmapFilePackageVersion returns the value of the field, resolving if necessary 3641 func (ev *Event) GetMmapFilePackageVersion() string { 3642 if ev.GetEventType().String() != "mmap" { 3643 return "" 3644 } 3645 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.MMap.File) 3646 } 3647 3648 // GetMmapFilePath returns the value of the field, resolving if necessary 3649 func (ev *Event) GetMmapFilePath() string { 3650 if ev.GetEventType().String() != "mmap" { 3651 return "" 3652 } 3653 return ev.FieldHandlers.ResolveFilePath(ev, &ev.MMap.File) 3654 } 3655 3656 // GetMmapFilePathLength returns the value of the field, resolving if necessary 3657 func (ev *Event) GetMmapFilePathLength() int { 3658 if ev.GetEventType().String() != "mmap" { 3659 return 0 3660 } 3661 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.MMap.File)) 3662 } 3663 3664 // GetMmapFileRights returns the value of the field, resolving if necessary 3665 func (ev *Event) GetMmapFileRights() int { 3666 if ev.GetEventType().String() != "mmap" { 3667 return 0 3668 } 3669 return ev.FieldHandlers.ResolveRights(ev, &ev.MMap.File.FileFields) 3670 } 3671 3672 // GetMmapFileUid returns the value of the field, resolving if necessary 3673 func (ev *Event) GetMmapFileUid() uint32 { 3674 if ev.GetEventType().String() != "mmap" { 3675 return uint32(0) 3676 } 3677 return ev.MMap.File.FileFields.UID 3678 } 3679 3680 // GetMmapFileUser returns the value of the field, resolving if necessary 3681 func (ev *Event) GetMmapFileUser() string { 3682 if ev.GetEventType().String() != "mmap" { 3683 return "" 3684 } 3685 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.MMap.File.FileFields) 3686 } 3687 3688 // GetMmapFlags returns the value of the field, resolving if necessary 3689 func (ev *Event) GetMmapFlags() uint64 { 3690 if ev.GetEventType().String() != "mmap" { 3691 return uint64(0) 3692 } 3693 return ev.MMap.Flags 3694 } 3695 3696 // GetMmapProtection returns the value of the field, resolving if necessary 3697 func (ev *Event) GetMmapProtection() uint64 { 3698 if ev.GetEventType().String() != "mmap" { 3699 return uint64(0) 3700 } 3701 return ev.MMap.Protection 3702 } 3703 3704 // GetMmapRetval returns the value of the field, resolving if necessary 3705 func (ev *Event) GetMmapRetval() int64 { 3706 if ev.GetEventType().String() != "mmap" { 3707 return int64(0) 3708 } 3709 return ev.MMap.SyscallEvent.Retval 3710 } 3711 3712 // GetMountFsType returns the value of the field, resolving if necessary 3713 func (ev *Event) GetMountFsType() string { 3714 if ev.GetEventType().String() != "mount" { 3715 return "" 3716 } 3717 return ev.Mount.Mount.FSType 3718 } 3719 3720 // GetMountMountpointPath returns the value of the field, resolving if necessary 3721 func (ev *Event) GetMountMountpointPath() string { 3722 if ev.GetEventType().String() != "mount" { 3723 return "" 3724 } 3725 return ev.FieldHandlers.ResolveMountPointPath(ev, &ev.Mount) 3726 } 3727 3728 // GetMountRetval returns the value of the field, resolving if necessary 3729 func (ev *Event) GetMountRetval() int64 { 3730 if ev.GetEventType().String() != "mount" { 3731 return int64(0) 3732 } 3733 return ev.Mount.SyscallEvent.Retval 3734 } 3735 3736 // GetMountRootPath returns the value of the field, resolving if necessary 3737 func (ev *Event) GetMountRootPath() string { 3738 if ev.GetEventType().String() != "mount" { 3739 return "" 3740 } 3741 return ev.FieldHandlers.ResolveMountRootPath(ev, &ev.Mount) 3742 } 3743 3744 // GetMountSourcePath returns the value of the field, resolving if necessary 3745 func (ev *Event) GetMountSourcePath() string { 3746 if ev.GetEventType().String() != "mount" { 3747 return "" 3748 } 3749 return ev.FieldHandlers.ResolveMountSourcePath(ev, &ev.Mount) 3750 } 3751 3752 // GetMprotectReqProtection returns the value of the field, resolving if necessary 3753 func (ev *Event) GetMprotectReqProtection() int { 3754 if ev.GetEventType().String() != "mprotect" { 3755 return 0 3756 } 3757 return ev.MProtect.ReqProtection 3758 } 3759 3760 // GetMprotectRetval returns the value of the field, resolving if necessary 3761 func (ev *Event) GetMprotectRetval() int64 { 3762 if ev.GetEventType().String() != "mprotect" { 3763 return int64(0) 3764 } 3765 return ev.MProtect.SyscallEvent.Retval 3766 } 3767 3768 // GetMprotectVmProtection returns the value of the field, resolving if necessary 3769 func (ev *Event) GetMprotectVmProtection() int { 3770 if ev.GetEventType().String() != "mprotect" { 3771 return 0 3772 } 3773 return ev.MProtect.VMProtection 3774 } 3775 3776 // GetNetworkDestinationIp returns the value of the field, resolving if necessary 3777 func (ev *Event) GetNetworkDestinationIp() net.IPNet { 3778 if ev.GetEventType().String() != "dns" { 3779 return net.IPNet{} 3780 } 3781 return ev.NetworkContext.Destination.IPNet 3782 } 3783 3784 // GetNetworkDestinationPort returns the value of the field, resolving if necessary 3785 func (ev *Event) GetNetworkDestinationPort() uint16 { 3786 if ev.GetEventType().String() != "dns" { 3787 return uint16(0) 3788 } 3789 return ev.NetworkContext.Destination.Port 3790 } 3791 3792 // GetNetworkDeviceIfindex returns the value of the field, resolving if necessary 3793 func (ev *Event) GetNetworkDeviceIfindex() uint32 { 3794 if ev.GetEventType().String() != "dns" { 3795 return uint32(0) 3796 } 3797 return ev.NetworkContext.Device.IfIndex 3798 } 3799 3800 // GetNetworkDeviceIfname returns the value of the field, resolving if necessary 3801 func (ev *Event) GetNetworkDeviceIfname() string { 3802 if ev.GetEventType().String() != "dns" { 3803 return "" 3804 } 3805 return ev.FieldHandlers.ResolveNetworkDeviceIfName(ev, &ev.NetworkContext.Device) 3806 } 3807 3808 // GetNetworkL3Protocol returns the value of the field, resolving if necessary 3809 func (ev *Event) GetNetworkL3Protocol() uint16 { 3810 if ev.GetEventType().String() != "dns" { 3811 return uint16(0) 3812 } 3813 return ev.NetworkContext.L3Protocol 3814 } 3815 3816 // GetNetworkL4Protocol returns the value of the field, resolving if necessary 3817 func (ev *Event) GetNetworkL4Protocol() uint16 { 3818 if ev.GetEventType().String() != "dns" { 3819 return uint16(0) 3820 } 3821 return ev.NetworkContext.L4Protocol 3822 } 3823 3824 // GetNetworkSize returns the value of the field, resolving if necessary 3825 func (ev *Event) GetNetworkSize() uint32 { 3826 if ev.GetEventType().String() != "dns" { 3827 return uint32(0) 3828 } 3829 return ev.NetworkContext.Size 3830 } 3831 3832 // GetNetworkSourceIp returns the value of the field, resolving if necessary 3833 func (ev *Event) GetNetworkSourceIp() net.IPNet { 3834 if ev.GetEventType().String() != "dns" { 3835 return net.IPNet{} 3836 } 3837 return ev.NetworkContext.Source.IPNet 3838 } 3839 3840 // GetNetworkSourcePort returns the value of the field, resolving if necessary 3841 func (ev *Event) GetNetworkSourcePort() uint16 { 3842 if ev.GetEventType().String() != "dns" { 3843 return uint16(0) 3844 } 3845 return ev.NetworkContext.Source.Port 3846 } 3847 3848 // GetOpenFileChangeTime returns the value of the field, resolving if necessary 3849 func (ev *Event) GetOpenFileChangeTime() uint64 { 3850 if ev.GetEventType().String() != "open" { 3851 return uint64(0) 3852 } 3853 return ev.Open.File.FileFields.CTime 3854 } 3855 3856 // GetOpenFileDestinationMode returns the value of the field, resolving if necessary 3857 func (ev *Event) GetOpenFileDestinationMode() uint32 { 3858 if ev.GetEventType().String() != "open" { 3859 return uint32(0) 3860 } 3861 return ev.Open.Mode 3862 } 3863 3864 // GetOpenFileFilesystem returns the value of the field, resolving if necessary 3865 func (ev *Event) GetOpenFileFilesystem() string { 3866 if ev.GetEventType().String() != "open" { 3867 return "" 3868 } 3869 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Open.File) 3870 } 3871 3872 // GetOpenFileGid returns the value of the field, resolving if necessary 3873 func (ev *Event) GetOpenFileGid() uint32 { 3874 if ev.GetEventType().String() != "open" { 3875 return uint32(0) 3876 } 3877 return ev.Open.File.FileFields.GID 3878 } 3879 3880 // GetOpenFileGroup returns the value of the field, resolving if necessary 3881 func (ev *Event) GetOpenFileGroup() string { 3882 if ev.GetEventType().String() != "open" { 3883 return "" 3884 } 3885 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Open.File.FileFields) 3886 } 3887 3888 // GetOpenFileHashes returns the value of the field, resolving if necessary 3889 func (ev *Event) GetOpenFileHashes() []string { 3890 if ev.GetEventType().String() != "open" { 3891 return []string{} 3892 } 3893 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Open.File) 3894 } 3895 3896 // GetOpenFileInUpperLayer returns the value of the field, resolving if necessary 3897 func (ev *Event) GetOpenFileInUpperLayer() bool { 3898 if ev.GetEventType().String() != "open" { 3899 return false 3900 } 3901 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Open.File.FileFields) 3902 } 3903 3904 // GetOpenFileInode returns the value of the field, resolving if necessary 3905 func (ev *Event) GetOpenFileInode() uint64 { 3906 if ev.GetEventType().String() != "open" { 3907 return uint64(0) 3908 } 3909 return ev.Open.File.FileFields.PathKey.Inode 3910 } 3911 3912 // GetOpenFileMode returns the value of the field, resolving if necessary 3913 func (ev *Event) GetOpenFileMode() uint16 { 3914 if ev.GetEventType().String() != "open" { 3915 return uint16(0) 3916 } 3917 return ev.Open.File.FileFields.Mode 3918 } 3919 3920 // GetOpenFileModificationTime returns the value of the field, resolving if necessary 3921 func (ev *Event) GetOpenFileModificationTime() uint64 { 3922 if ev.GetEventType().String() != "open" { 3923 return uint64(0) 3924 } 3925 return ev.Open.File.FileFields.MTime 3926 } 3927 3928 // GetOpenFileMountId returns the value of the field, resolving if necessary 3929 func (ev *Event) GetOpenFileMountId() uint32 { 3930 if ev.GetEventType().String() != "open" { 3931 return uint32(0) 3932 } 3933 return ev.Open.File.FileFields.PathKey.MountID 3934 } 3935 3936 // GetOpenFileName returns the value of the field, resolving if necessary 3937 func (ev *Event) GetOpenFileName() string { 3938 if ev.GetEventType().String() != "open" { 3939 return "" 3940 } 3941 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Open.File) 3942 } 3943 3944 // GetOpenFileNameLength returns the value of the field, resolving if necessary 3945 func (ev *Event) GetOpenFileNameLength() int { 3946 if ev.GetEventType().String() != "open" { 3947 return 0 3948 } 3949 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Open.File)) 3950 } 3951 3952 // GetOpenFilePackageName returns the value of the field, resolving if necessary 3953 func (ev *Event) GetOpenFilePackageName() string { 3954 if ev.GetEventType().String() != "open" { 3955 return "" 3956 } 3957 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Open.File) 3958 } 3959 3960 // GetOpenFilePackageSourceVersion returns the value of the field, resolving if necessary 3961 func (ev *Event) GetOpenFilePackageSourceVersion() string { 3962 if ev.GetEventType().String() != "open" { 3963 return "" 3964 } 3965 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Open.File) 3966 } 3967 3968 // GetOpenFilePackageVersion returns the value of the field, resolving if necessary 3969 func (ev *Event) GetOpenFilePackageVersion() string { 3970 if ev.GetEventType().String() != "open" { 3971 return "" 3972 } 3973 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Open.File) 3974 } 3975 3976 // GetOpenFilePath returns the value of the field, resolving if necessary 3977 func (ev *Event) GetOpenFilePath() string { 3978 if ev.GetEventType().String() != "open" { 3979 return "" 3980 } 3981 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Open.File) 3982 } 3983 3984 // GetOpenFilePathLength returns the value of the field, resolving if necessary 3985 func (ev *Event) GetOpenFilePathLength() int { 3986 if ev.GetEventType().String() != "open" { 3987 return 0 3988 } 3989 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Open.File)) 3990 } 3991 3992 // GetOpenFileRights returns the value of the field, resolving if necessary 3993 func (ev *Event) GetOpenFileRights() int { 3994 if ev.GetEventType().String() != "open" { 3995 return 0 3996 } 3997 return ev.FieldHandlers.ResolveRights(ev, &ev.Open.File.FileFields) 3998 } 3999 4000 // GetOpenFileUid returns the value of the field, resolving if necessary 4001 func (ev *Event) GetOpenFileUid() uint32 { 4002 if ev.GetEventType().String() != "open" { 4003 return uint32(0) 4004 } 4005 return ev.Open.File.FileFields.UID 4006 } 4007 4008 // GetOpenFileUser returns the value of the field, resolving if necessary 4009 func (ev *Event) GetOpenFileUser() string { 4010 if ev.GetEventType().String() != "open" { 4011 return "" 4012 } 4013 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Open.File.FileFields) 4014 } 4015 4016 // GetOpenFlags returns the value of the field, resolving if necessary 4017 func (ev *Event) GetOpenFlags() uint32 { 4018 if ev.GetEventType().String() != "open" { 4019 return uint32(0) 4020 } 4021 return ev.Open.Flags 4022 } 4023 4024 // GetOpenRetval returns the value of the field, resolving if necessary 4025 func (ev *Event) GetOpenRetval() int64 { 4026 if ev.GetEventType().String() != "open" { 4027 return int64(0) 4028 } 4029 return ev.Open.SyscallEvent.Retval 4030 } 4031 4032 // GetProcessAncestorsArgs returns the value of the field, resolving if necessary 4033 func (ev *Event) GetProcessAncestorsArgs() []string { 4034 if ev.BaseEvent.ProcessContext == nil { 4035 return []string{} 4036 } 4037 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4038 return []string{} 4039 } 4040 var values []string 4041 ctx := eval.NewContext(ev) 4042 iterator := &ProcessAncestorsIterator{} 4043 ptr := iterator.Front(ctx) 4044 for ptr != nil { 4045 element := (*ProcessCacheEntry)(ptr) 4046 result := ev.FieldHandlers.ResolveProcessArgs(ev, &element.ProcessContext.Process) 4047 values = append(values, result) 4048 ptr = iterator.Next() 4049 } 4050 return values 4051 } 4052 4053 // GetProcessAncestorsArgsFlags returns the value of the field, resolving if necessary 4054 func (ev *Event) GetProcessAncestorsArgsFlags() []string { 4055 if ev.BaseEvent.ProcessContext == nil { 4056 return []string{} 4057 } 4058 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4059 return []string{} 4060 } 4061 var values []string 4062 ctx := eval.NewContext(ev) 4063 iterator := &ProcessAncestorsIterator{} 4064 ptr := iterator.Front(ctx) 4065 for ptr != nil { 4066 element := (*ProcessCacheEntry)(ptr) 4067 result := ev.FieldHandlers.ResolveProcessArgsFlags(ev, &element.ProcessContext.Process) 4068 values = append(values, result...) 4069 ptr = iterator.Next() 4070 } 4071 return values 4072 } 4073 4074 // GetProcessAncestorsArgsOptions returns the value of the field, resolving if necessary 4075 func (ev *Event) GetProcessAncestorsArgsOptions() []string { 4076 if ev.BaseEvent.ProcessContext == nil { 4077 return []string{} 4078 } 4079 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4080 return []string{} 4081 } 4082 var values []string 4083 ctx := eval.NewContext(ev) 4084 iterator := &ProcessAncestorsIterator{} 4085 ptr := iterator.Front(ctx) 4086 for ptr != nil { 4087 element := (*ProcessCacheEntry)(ptr) 4088 result := ev.FieldHandlers.ResolveProcessArgsOptions(ev, &element.ProcessContext.Process) 4089 values = append(values, result...) 4090 ptr = iterator.Next() 4091 } 4092 return values 4093 } 4094 4095 // GetProcessAncestorsArgsScrubbed returns the value of the field, resolving if necessary 4096 func (ev *Event) GetProcessAncestorsArgsScrubbed() []string { 4097 if ev.BaseEvent.ProcessContext == nil { 4098 return []string{} 4099 } 4100 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4101 return []string{} 4102 } 4103 var values []string 4104 ctx := eval.NewContext(ev) 4105 iterator := &ProcessAncestorsIterator{} 4106 ptr := iterator.Front(ctx) 4107 for ptr != nil { 4108 element := (*ProcessCacheEntry)(ptr) 4109 result := ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, &element.ProcessContext.Process) 4110 values = append(values, result) 4111 ptr = iterator.Next() 4112 } 4113 return values 4114 } 4115 4116 // GetProcessAncestorsArgsTruncated returns the value of the field, resolving if necessary 4117 func (ev *Event) GetProcessAncestorsArgsTruncated() []bool { 4118 if ev.BaseEvent.ProcessContext == nil { 4119 return []bool{} 4120 } 4121 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4122 return []bool{} 4123 } 4124 var values []bool 4125 ctx := eval.NewContext(ev) 4126 iterator := &ProcessAncestorsIterator{} 4127 ptr := iterator.Front(ctx) 4128 for ptr != nil { 4129 element := (*ProcessCacheEntry)(ptr) 4130 result := ev.FieldHandlers.ResolveProcessArgsTruncated(ev, &element.ProcessContext.Process) 4131 values = append(values, result) 4132 ptr = iterator.Next() 4133 } 4134 return values 4135 } 4136 4137 // GetProcessAncestorsArgv returns the value of the field, resolving if necessary 4138 func (ev *Event) GetProcessAncestorsArgv() []string { 4139 if ev.BaseEvent.ProcessContext == nil { 4140 return []string{} 4141 } 4142 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4143 return []string{} 4144 } 4145 var values []string 4146 ctx := eval.NewContext(ev) 4147 iterator := &ProcessAncestorsIterator{} 4148 ptr := iterator.Front(ctx) 4149 for ptr != nil { 4150 element := (*ProcessCacheEntry)(ptr) 4151 result := ev.FieldHandlers.ResolveProcessArgv(ev, &element.ProcessContext.Process) 4152 values = append(values, result...) 4153 ptr = iterator.Next() 4154 } 4155 return values 4156 } 4157 4158 // GetProcessAncestorsArgv0 returns the value of the field, resolving if necessary 4159 func (ev *Event) GetProcessAncestorsArgv0() []string { 4160 if ev.BaseEvent.ProcessContext == nil { 4161 return []string{} 4162 } 4163 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4164 return []string{} 4165 } 4166 var values []string 4167 ctx := eval.NewContext(ev) 4168 iterator := &ProcessAncestorsIterator{} 4169 ptr := iterator.Front(ctx) 4170 for ptr != nil { 4171 element := (*ProcessCacheEntry)(ptr) 4172 result := ev.FieldHandlers.ResolveProcessArgv0(ev, &element.ProcessContext.Process) 4173 values = append(values, result) 4174 ptr = iterator.Next() 4175 } 4176 return values 4177 } 4178 4179 // GetProcessAncestorsArgvScrubbed returns the value of the field, resolving if necessary 4180 func (ev *Event) GetProcessAncestorsArgvScrubbed() []string { 4181 if ev.BaseEvent.ProcessContext == nil { 4182 return []string{} 4183 } 4184 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4185 return []string{} 4186 } 4187 var values []string 4188 ctx := eval.NewContext(ev) 4189 iterator := &ProcessAncestorsIterator{} 4190 ptr := iterator.Front(ctx) 4191 for ptr != nil { 4192 element := (*ProcessCacheEntry)(ptr) 4193 result := ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, &element.ProcessContext.Process) 4194 values = append(values, result...) 4195 ptr = iterator.Next() 4196 } 4197 return values 4198 } 4199 4200 // GetProcessAncestorsCapEffective returns the value of the field, resolving if necessary 4201 func (ev *Event) GetProcessAncestorsCapEffective() []uint64 { 4202 if ev.BaseEvent.ProcessContext == nil { 4203 return []uint64{} 4204 } 4205 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4206 return []uint64{} 4207 } 4208 var values []uint64 4209 ctx := eval.NewContext(ev) 4210 iterator := &ProcessAncestorsIterator{} 4211 ptr := iterator.Front(ctx) 4212 for ptr != nil { 4213 element := (*ProcessCacheEntry)(ptr) 4214 result := element.ProcessContext.Process.Credentials.CapEffective 4215 values = append(values, result) 4216 ptr = iterator.Next() 4217 } 4218 return values 4219 } 4220 4221 // GetProcessAncestorsCapPermitted returns the value of the field, resolving if necessary 4222 func (ev *Event) GetProcessAncestorsCapPermitted() []uint64 { 4223 if ev.BaseEvent.ProcessContext == nil { 4224 return []uint64{} 4225 } 4226 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4227 return []uint64{} 4228 } 4229 var values []uint64 4230 ctx := eval.NewContext(ev) 4231 iterator := &ProcessAncestorsIterator{} 4232 ptr := iterator.Front(ctx) 4233 for ptr != nil { 4234 element := (*ProcessCacheEntry)(ptr) 4235 result := element.ProcessContext.Process.Credentials.CapPermitted 4236 values = append(values, result) 4237 ptr = iterator.Next() 4238 } 4239 return values 4240 } 4241 4242 // GetProcessAncestorsCmdargv returns the value of the field, resolving if necessary 4243 func (ev *Event) GetProcessAncestorsCmdargv() []string { 4244 if ev.BaseEvent.ProcessContext == nil { 4245 return []string{} 4246 } 4247 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4248 return []string{} 4249 } 4250 var values []string 4251 ctx := eval.NewContext(ev) 4252 iterator := &ProcessAncestorsIterator{} 4253 ptr := iterator.Front(ctx) 4254 for ptr != nil { 4255 element := (*ProcessCacheEntry)(ptr) 4256 result := ev.FieldHandlers.ResolveProcessCmdArgv(ev, &element.ProcessContext.Process) 4257 values = append(values, result...) 4258 ptr = iterator.Next() 4259 } 4260 return values 4261 } 4262 4263 // GetProcessAncestorsComm returns the value of the field, resolving if necessary 4264 func (ev *Event) GetProcessAncestorsComm() []string { 4265 if ev.BaseEvent.ProcessContext == nil { 4266 return []string{} 4267 } 4268 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4269 return []string{} 4270 } 4271 var values []string 4272 ctx := eval.NewContext(ev) 4273 iterator := &ProcessAncestorsIterator{} 4274 ptr := iterator.Front(ctx) 4275 for ptr != nil { 4276 element := (*ProcessCacheEntry)(ptr) 4277 result := element.ProcessContext.Process.Comm 4278 values = append(values, result) 4279 ptr = iterator.Next() 4280 } 4281 return values 4282 } 4283 4284 // GetProcessAncestorsContainerId returns the value of the field, resolving if necessary 4285 func (ev *Event) GetProcessAncestorsContainerId() []string { 4286 if ev.BaseEvent.ProcessContext == nil { 4287 return []string{} 4288 } 4289 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4290 return []string{} 4291 } 4292 var values []string 4293 ctx := eval.NewContext(ev) 4294 iterator := &ProcessAncestorsIterator{} 4295 ptr := iterator.Front(ctx) 4296 for ptr != nil { 4297 element := (*ProcessCacheEntry)(ptr) 4298 result := element.ProcessContext.Process.ContainerID 4299 values = append(values, result) 4300 ptr = iterator.Next() 4301 } 4302 return values 4303 } 4304 4305 // GetProcessAncestorsCreatedAt returns the value of the field, resolving if necessary 4306 func (ev *Event) GetProcessAncestorsCreatedAt() []int { 4307 if ev.BaseEvent.ProcessContext == nil { 4308 return []int{} 4309 } 4310 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4311 return []int{} 4312 } 4313 var values []int 4314 ctx := eval.NewContext(ev) 4315 iterator := &ProcessAncestorsIterator{} 4316 ptr := iterator.Front(ctx) 4317 for ptr != nil { 4318 element := (*ProcessCacheEntry)(ptr) 4319 result := int(ev.FieldHandlers.ResolveProcessCreatedAt(ev, &element.ProcessContext.Process)) 4320 values = append(values, result) 4321 ptr = iterator.Next() 4322 } 4323 return values 4324 } 4325 4326 // GetProcessAncestorsEgid returns the value of the field, resolving if necessary 4327 func (ev *Event) GetProcessAncestorsEgid() []uint32 { 4328 if ev.BaseEvent.ProcessContext == nil { 4329 return []uint32{} 4330 } 4331 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4332 return []uint32{} 4333 } 4334 var values []uint32 4335 ctx := eval.NewContext(ev) 4336 iterator := &ProcessAncestorsIterator{} 4337 ptr := iterator.Front(ctx) 4338 for ptr != nil { 4339 element := (*ProcessCacheEntry)(ptr) 4340 result := element.ProcessContext.Process.Credentials.EGID 4341 values = append(values, result) 4342 ptr = iterator.Next() 4343 } 4344 return values 4345 } 4346 4347 // GetProcessAncestorsEgroup returns the value of the field, resolving if necessary 4348 func (ev *Event) GetProcessAncestorsEgroup() []string { 4349 if ev.BaseEvent.ProcessContext == nil { 4350 return []string{} 4351 } 4352 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4353 return []string{} 4354 } 4355 var values []string 4356 ctx := eval.NewContext(ev) 4357 iterator := &ProcessAncestorsIterator{} 4358 ptr := iterator.Front(ctx) 4359 for ptr != nil { 4360 element := (*ProcessCacheEntry)(ptr) 4361 result := element.ProcessContext.Process.Credentials.EGroup 4362 values = append(values, result) 4363 ptr = iterator.Next() 4364 } 4365 return values 4366 } 4367 4368 // GetProcessAncestorsEnvp returns the value of the field, resolving if necessary 4369 func (ev *Event) GetProcessAncestorsEnvp() []string { 4370 if ev.BaseEvent.ProcessContext == nil { 4371 return []string{} 4372 } 4373 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4374 return []string{} 4375 } 4376 var values []string 4377 ctx := eval.NewContext(ev) 4378 iterator := &ProcessAncestorsIterator{} 4379 ptr := iterator.Front(ctx) 4380 for ptr != nil { 4381 element := (*ProcessCacheEntry)(ptr) 4382 result := ev.FieldHandlers.ResolveProcessEnvp(ev, &element.ProcessContext.Process) 4383 values = append(values, result...) 4384 ptr = iterator.Next() 4385 } 4386 return values 4387 } 4388 4389 // GetProcessAncestorsEnvs returns the value of the field, resolving if necessary 4390 func (ev *Event) GetProcessAncestorsEnvs() []string { 4391 if ev.BaseEvent.ProcessContext == nil { 4392 return []string{} 4393 } 4394 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4395 return []string{} 4396 } 4397 var values []string 4398 ctx := eval.NewContext(ev) 4399 iterator := &ProcessAncestorsIterator{} 4400 ptr := iterator.Front(ctx) 4401 for ptr != nil { 4402 element := (*ProcessCacheEntry)(ptr) 4403 result := ev.FieldHandlers.ResolveProcessEnvs(ev, &element.ProcessContext.Process) 4404 values = append(values, result...) 4405 ptr = iterator.Next() 4406 } 4407 return values 4408 } 4409 4410 // GetProcessAncestorsEnvsTruncated returns the value of the field, resolving if necessary 4411 func (ev *Event) GetProcessAncestorsEnvsTruncated() []bool { 4412 if ev.BaseEvent.ProcessContext == nil { 4413 return []bool{} 4414 } 4415 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4416 return []bool{} 4417 } 4418 var values []bool 4419 ctx := eval.NewContext(ev) 4420 iterator := &ProcessAncestorsIterator{} 4421 ptr := iterator.Front(ctx) 4422 for ptr != nil { 4423 element := (*ProcessCacheEntry)(ptr) 4424 result := ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, &element.ProcessContext.Process) 4425 values = append(values, result) 4426 ptr = iterator.Next() 4427 } 4428 return values 4429 } 4430 4431 // GetProcessAncestorsEuid returns the value of the field, resolving if necessary 4432 func (ev *Event) GetProcessAncestorsEuid() []uint32 { 4433 if ev.BaseEvent.ProcessContext == nil { 4434 return []uint32{} 4435 } 4436 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4437 return []uint32{} 4438 } 4439 var values []uint32 4440 ctx := eval.NewContext(ev) 4441 iterator := &ProcessAncestorsIterator{} 4442 ptr := iterator.Front(ctx) 4443 for ptr != nil { 4444 element := (*ProcessCacheEntry)(ptr) 4445 result := element.ProcessContext.Process.Credentials.EUID 4446 values = append(values, result) 4447 ptr = iterator.Next() 4448 } 4449 return values 4450 } 4451 4452 // GetProcessAncestorsEuser returns the value of the field, resolving if necessary 4453 func (ev *Event) GetProcessAncestorsEuser() []string { 4454 if ev.BaseEvent.ProcessContext == nil { 4455 return []string{} 4456 } 4457 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4458 return []string{} 4459 } 4460 var values []string 4461 ctx := eval.NewContext(ev) 4462 iterator := &ProcessAncestorsIterator{} 4463 ptr := iterator.Front(ctx) 4464 for ptr != nil { 4465 element := (*ProcessCacheEntry)(ptr) 4466 result := element.ProcessContext.Process.Credentials.EUser 4467 values = append(values, result) 4468 ptr = iterator.Next() 4469 } 4470 return values 4471 } 4472 4473 // GetProcessAncestorsFileChangeTime returns the value of the field, resolving if necessary 4474 func (ev *Event) GetProcessAncestorsFileChangeTime() []uint64 { 4475 if ev.BaseEvent.ProcessContext == nil { 4476 return []uint64{} 4477 } 4478 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4479 return []uint64{} 4480 } 4481 var values []uint64 4482 ctx := eval.NewContext(ev) 4483 iterator := &ProcessAncestorsIterator{} 4484 ptr := iterator.Front(ctx) 4485 for ptr != nil { 4486 element := (*ProcessCacheEntry)(ptr) 4487 result := element.ProcessContext.Process.FileEvent.FileFields.CTime 4488 values = append(values, result) 4489 ptr = iterator.Next() 4490 } 4491 return values 4492 } 4493 4494 // GetProcessAncestorsFileFilesystem returns the value of the field, resolving if necessary 4495 func (ev *Event) GetProcessAncestorsFileFilesystem() []string { 4496 if ev.BaseEvent.ProcessContext == nil { 4497 return []string{} 4498 } 4499 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4500 return []string{} 4501 } 4502 var values []string 4503 ctx := eval.NewContext(ev) 4504 iterator := &ProcessAncestorsIterator{} 4505 ptr := iterator.Front(ctx) 4506 for ptr != nil { 4507 element := (*ProcessCacheEntry)(ptr) 4508 result := ev.FieldHandlers.ResolveFileFilesystem(ev, &element.ProcessContext.Process.FileEvent) 4509 values = append(values, result) 4510 ptr = iterator.Next() 4511 } 4512 return values 4513 } 4514 4515 // GetProcessAncestorsFileGid returns the value of the field, resolving if necessary 4516 func (ev *Event) GetProcessAncestorsFileGid() []uint32 { 4517 if ev.BaseEvent.ProcessContext == nil { 4518 return []uint32{} 4519 } 4520 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4521 return []uint32{} 4522 } 4523 var values []uint32 4524 ctx := eval.NewContext(ev) 4525 iterator := &ProcessAncestorsIterator{} 4526 ptr := iterator.Front(ctx) 4527 for ptr != nil { 4528 element := (*ProcessCacheEntry)(ptr) 4529 result := element.ProcessContext.Process.FileEvent.FileFields.GID 4530 values = append(values, result) 4531 ptr = iterator.Next() 4532 } 4533 return values 4534 } 4535 4536 // GetProcessAncestorsFileGroup returns the value of the field, resolving if necessary 4537 func (ev *Event) GetProcessAncestorsFileGroup() []string { 4538 if ev.BaseEvent.ProcessContext == nil { 4539 return []string{} 4540 } 4541 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4542 return []string{} 4543 } 4544 var values []string 4545 ctx := eval.NewContext(ev) 4546 iterator := &ProcessAncestorsIterator{} 4547 ptr := iterator.Front(ctx) 4548 for ptr != nil { 4549 element := (*ProcessCacheEntry)(ptr) 4550 result := ev.FieldHandlers.ResolveFileFieldsGroup(ev, &element.ProcessContext.Process.FileEvent.FileFields) 4551 values = append(values, result) 4552 ptr = iterator.Next() 4553 } 4554 return values 4555 } 4556 4557 // GetProcessAncestorsFileHashes returns the value of the field, resolving if necessary 4558 func (ev *Event) GetProcessAncestorsFileHashes() []string { 4559 if ev.BaseEvent.ProcessContext == nil { 4560 return []string{} 4561 } 4562 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4563 return []string{} 4564 } 4565 var values []string 4566 ctx := eval.NewContext(ev) 4567 iterator := &ProcessAncestorsIterator{} 4568 ptr := iterator.Front(ctx) 4569 for ptr != nil { 4570 element := (*ProcessCacheEntry)(ptr) 4571 result := ev.FieldHandlers.ResolveHashesFromEvent(ev, &element.ProcessContext.Process.FileEvent) 4572 values = append(values, result...) 4573 ptr = iterator.Next() 4574 } 4575 return values 4576 } 4577 4578 // GetProcessAncestorsFileInUpperLayer returns the value of the field, resolving if necessary 4579 func (ev *Event) GetProcessAncestorsFileInUpperLayer() []bool { 4580 if ev.BaseEvent.ProcessContext == nil { 4581 return []bool{} 4582 } 4583 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4584 return []bool{} 4585 } 4586 var values []bool 4587 ctx := eval.NewContext(ev) 4588 iterator := &ProcessAncestorsIterator{} 4589 ptr := iterator.Front(ctx) 4590 for ptr != nil { 4591 element := (*ProcessCacheEntry)(ptr) 4592 result := ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &element.ProcessContext.Process.FileEvent.FileFields) 4593 values = append(values, result) 4594 ptr = iterator.Next() 4595 } 4596 return values 4597 } 4598 4599 // GetProcessAncestorsFileInode returns the value of the field, resolving if necessary 4600 func (ev *Event) GetProcessAncestorsFileInode() []uint64 { 4601 if ev.BaseEvent.ProcessContext == nil { 4602 return []uint64{} 4603 } 4604 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4605 return []uint64{} 4606 } 4607 var values []uint64 4608 ctx := eval.NewContext(ev) 4609 iterator := &ProcessAncestorsIterator{} 4610 ptr := iterator.Front(ctx) 4611 for ptr != nil { 4612 element := (*ProcessCacheEntry)(ptr) 4613 result := element.ProcessContext.Process.FileEvent.FileFields.PathKey.Inode 4614 values = append(values, result) 4615 ptr = iterator.Next() 4616 } 4617 return values 4618 } 4619 4620 // GetProcessAncestorsFileMode returns the value of the field, resolving if necessary 4621 func (ev *Event) GetProcessAncestorsFileMode() []uint16 { 4622 if ev.BaseEvent.ProcessContext == nil { 4623 return []uint16{} 4624 } 4625 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4626 return []uint16{} 4627 } 4628 var values []uint16 4629 ctx := eval.NewContext(ev) 4630 iterator := &ProcessAncestorsIterator{} 4631 ptr := iterator.Front(ctx) 4632 for ptr != nil { 4633 element := (*ProcessCacheEntry)(ptr) 4634 result := element.ProcessContext.Process.FileEvent.FileFields.Mode 4635 values = append(values, result) 4636 ptr = iterator.Next() 4637 } 4638 return values 4639 } 4640 4641 // GetProcessAncestorsFileModificationTime returns the value of the field, resolving if necessary 4642 func (ev *Event) GetProcessAncestorsFileModificationTime() []uint64 { 4643 if ev.BaseEvent.ProcessContext == nil { 4644 return []uint64{} 4645 } 4646 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4647 return []uint64{} 4648 } 4649 var values []uint64 4650 ctx := eval.NewContext(ev) 4651 iterator := &ProcessAncestorsIterator{} 4652 ptr := iterator.Front(ctx) 4653 for ptr != nil { 4654 element := (*ProcessCacheEntry)(ptr) 4655 result := element.ProcessContext.Process.FileEvent.FileFields.MTime 4656 values = append(values, result) 4657 ptr = iterator.Next() 4658 } 4659 return values 4660 } 4661 4662 // GetProcessAncestorsFileMountId returns the value of the field, resolving if necessary 4663 func (ev *Event) GetProcessAncestorsFileMountId() []uint32 { 4664 if ev.BaseEvent.ProcessContext == nil { 4665 return []uint32{} 4666 } 4667 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4668 return []uint32{} 4669 } 4670 var values []uint32 4671 ctx := eval.NewContext(ev) 4672 iterator := &ProcessAncestorsIterator{} 4673 ptr := iterator.Front(ctx) 4674 for ptr != nil { 4675 element := (*ProcessCacheEntry)(ptr) 4676 result := element.ProcessContext.Process.FileEvent.FileFields.PathKey.MountID 4677 values = append(values, result) 4678 ptr = iterator.Next() 4679 } 4680 return values 4681 } 4682 4683 // GetProcessAncestorsFileName returns the value of the field, resolving if necessary 4684 func (ev *Event) GetProcessAncestorsFileName() []string { 4685 if ev.BaseEvent.ProcessContext == nil { 4686 return []string{} 4687 } 4688 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4689 return []string{} 4690 } 4691 var values []string 4692 ctx := eval.NewContext(ev) 4693 iterator := &ProcessAncestorsIterator{} 4694 ptr := iterator.Front(ctx) 4695 for ptr != nil { 4696 element := (*ProcessCacheEntry)(ptr) 4697 result := ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.FileEvent) 4698 values = append(values, result) 4699 ptr = iterator.Next() 4700 } 4701 return values 4702 } 4703 4704 // GetProcessAncestorsFileNameLength returns the value of the field, resolving if necessary 4705 func (ev *Event) GetProcessAncestorsFileNameLength() []int { 4706 if ev.BaseEvent.ProcessContext == nil { 4707 return []int{} 4708 } 4709 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4710 return []int{} 4711 } 4712 var values []int 4713 ctx := eval.NewContext(ev) 4714 iterator := &ProcessAncestorsIterator{} 4715 ptr := iterator.Front(ctx) 4716 for ptr != nil { 4717 element := (*ProcessCacheEntry)(ptr) 4718 result := len(ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.FileEvent)) 4719 values = append(values, result) 4720 ptr = iterator.Next() 4721 } 4722 return values 4723 } 4724 4725 // GetProcessAncestorsFilePackageName returns the value of the field, resolving if necessary 4726 func (ev *Event) GetProcessAncestorsFilePackageName() []string { 4727 if ev.BaseEvent.ProcessContext == nil { 4728 return []string{} 4729 } 4730 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4731 return []string{} 4732 } 4733 var values []string 4734 ctx := eval.NewContext(ev) 4735 iterator := &ProcessAncestorsIterator{} 4736 ptr := iterator.Front(ctx) 4737 for ptr != nil { 4738 element := (*ProcessCacheEntry)(ptr) 4739 result := ev.FieldHandlers.ResolvePackageName(ev, &element.ProcessContext.Process.FileEvent) 4740 values = append(values, result) 4741 ptr = iterator.Next() 4742 } 4743 return values 4744 } 4745 4746 // GetProcessAncestorsFilePackageSourceVersion returns the value of the field, resolving if necessary 4747 func (ev *Event) GetProcessAncestorsFilePackageSourceVersion() []string { 4748 if ev.BaseEvent.ProcessContext == nil { 4749 return []string{} 4750 } 4751 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4752 return []string{} 4753 } 4754 var values []string 4755 ctx := eval.NewContext(ev) 4756 iterator := &ProcessAncestorsIterator{} 4757 ptr := iterator.Front(ctx) 4758 for ptr != nil { 4759 element := (*ProcessCacheEntry)(ptr) 4760 result := ev.FieldHandlers.ResolvePackageSourceVersion(ev, &element.ProcessContext.Process.FileEvent) 4761 values = append(values, result) 4762 ptr = iterator.Next() 4763 } 4764 return values 4765 } 4766 4767 // GetProcessAncestorsFilePackageVersion returns the value of the field, resolving if necessary 4768 func (ev *Event) GetProcessAncestorsFilePackageVersion() []string { 4769 if ev.BaseEvent.ProcessContext == nil { 4770 return []string{} 4771 } 4772 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4773 return []string{} 4774 } 4775 var values []string 4776 ctx := eval.NewContext(ev) 4777 iterator := &ProcessAncestorsIterator{} 4778 ptr := iterator.Front(ctx) 4779 for ptr != nil { 4780 element := (*ProcessCacheEntry)(ptr) 4781 result := ev.FieldHandlers.ResolvePackageVersion(ev, &element.ProcessContext.Process.FileEvent) 4782 values = append(values, result) 4783 ptr = iterator.Next() 4784 } 4785 return values 4786 } 4787 4788 // GetProcessAncestorsFilePath returns the value of the field, resolving if necessary 4789 func (ev *Event) GetProcessAncestorsFilePath() []string { 4790 if ev.BaseEvent.ProcessContext == nil { 4791 return []string{} 4792 } 4793 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4794 return []string{} 4795 } 4796 var values []string 4797 ctx := eval.NewContext(ev) 4798 iterator := &ProcessAncestorsIterator{} 4799 ptr := iterator.Front(ctx) 4800 for ptr != nil { 4801 element := (*ProcessCacheEntry)(ptr) 4802 result := ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.FileEvent) 4803 values = append(values, result) 4804 ptr = iterator.Next() 4805 } 4806 return values 4807 } 4808 4809 // GetProcessAncestorsFilePathLength returns the value of the field, resolving if necessary 4810 func (ev *Event) GetProcessAncestorsFilePathLength() []int { 4811 if ev.BaseEvent.ProcessContext == nil { 4812 return []int{} 4813 } 4814 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4815 return []int{} 4816 } 4817 var values []int 4818 ctx := eval.NewContext(ev) 4819 iterator := &ProcessAncestorsIterator{} 4820 ptr := iterator.Front(ctx) 4821 for ptr != nil { 4822 element := (*ProcessCacheEntry)(ptr) 4823 result := len(ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.FileEvent)) 4824 values = append(values, result) 4825 ptr = iterator.Next() 4826 } 4827 return values 4828 } 4829 4830 // GetProcessAncestorsFileRights returns the value of the field, resolving if necessary 4831 func (ev *Event) GetProcessAncestorsFileRights() []int { 4832 if ev.BaseEvent.ProcessContext == nil { 4833 return []int{} 4834 } 4835 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4836 return []int{} 4837 } 4838 var values []int 4839 ctx := eval.NewContext(ev) 4840 iterator := &ProcessAncestorsIterator{} 4841 ptr := iterator.Front(ctx) 4842 for ptr != nil { 4843 element := (*ProcessCacheEntry)(ptr) 4844 result := int(ev.FieldHandlers.ResolveRights(ev, &element.ProcessContext.Process.FileEvent.FileFields)) 4845 values = append(values, result) 4846 ptr = iterator.Next() 4847 } 4848 return values 4849 } 4850 4851 // GetProcessAncestorsFileUid returns the value of the field, resolving if necessary 4852 func (ev *Event) GetProcessAncestorsFileUid() []uint32 { 4853 if ev.BaseEvent.ProcessContext == nil { 4854 return []uint32{} 4855 } 4856 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4857 return []uint32{} 4858 } 4859 var values []uint32 4860 ctx := eval.NewContext(ev) 4861 iterator := &ProcessAncestorsIterator{} 4862 ptr := iterator.Front(ctx) 4863 for ptr != nil { 4864 element := (*ProcessCacheEntry)(ptr) 4865 result := element.ProcessContext.Process.FileEvent.FileFields.UID 4866 values = append(values, result) 4867 ptr = iterator.Next() 4868 } 4869 return values 4870 } 4871 4872 // GetProcessAncestorsFileUser returns the value of the field, resolving if necessary 4873 func (ev *Event) GetProcessAncestorsFileUser() []string { 4874 if ev.BaseEvent.ProcessContext == nil { 4875 return []string{} 4876 } 4877 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4878 return []string{} 4879 } 4880 var values []string 4881 ctx := eval.NewContext(ev) 4882 iterator := &ProcessAncestorsIterator{} 4883 ptr := iterator.Front(ctx) 4884 for ptr != nil { 4885 element := (*ProcessCacheEntry)(ptr) 4886 result := ev.FieldHandlers.ResolveFileFieldsUser(ev, &element.ProcessContext.Process.FileEvent.FileFields) 4887 values = append(values, result) 4888 ptr = iterator.Next() 4889 } 4890 return values 4891 } 4892 4893 // GetProcessAncestorsFsgid returns the value of the field, resolving if necessary 4894 func (ev *Event) GetProcessAncestorsFsgid() []uint32 { 4895 if ev.BaseEvent.ProcessContext == nil { 4896 return []uint32{} 4897 } 4898 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4899 return []uint32{} 4900 } 4901 var values []uint32 4902 ctx := eval.NewContext(ev) 4903 iterator := &ProcessAncestorsIterator{} 4904 ptr := iterator.Front(ctx) 4905 for ptr != nil { 4906 element := (*ProcessCacheEntry)(ptr) 4907 result := element.ProcessContext.Process.Credentials.FSGID 4908 values = append(values, result) 4909 ptr = iterator.Next() 4910 } 4911 return values 4912 } 4913 4914 // GetProcessAncestorsFsgroup returns the value of the field, resolving if necessary 4915 func (ev *Event) GetProcessAncestorsFsgroup() []string { 4916 if ev.BaseEvent.ProcessContext == nil { 4917 return []string{} 4918 } 4919 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4920 return []string{} 4921 } 4922 var values []string 4923 ctx := eval.NewContext(ev) 4924 iterator := &ProcessAncestorsIterator{} 4925 ptr := iterator.Front(ctx) 4926 for ptr != nil { 4927 element := (*ProcessCacheEntry)(ptr) 4928 result := element.ProcessContext.Process.Credentials.FSGroup 4929 values = append(values, result) 4930 ptr = iterator.Next() 4931 } 4932 return values 4933 } 4934 4935 // GetProcessAncestorsFsuid returns the value of the field, resolving if necessary 4936 func (ev *Event) GetProcessAncestorsFsuid() []uint32 { 4937 if ev.BaseEvent.ProcessContext == nil { 4938 return []uint32{} 4939 } 4940 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4941 return []uint32{} 4942 } 4943 var values []uint32 4944 ctx := eval.NewContext(ev) 4945 iterator := &ProcessAncestorsIterator{} 4946 ptr := iterator.Front(ctx) 4947 for ptr != nil { 4948 element := (*ProcessCacheEntry)(ptr) 4949 result := element.ProcessContext.Process.Credentials.FSUID 4950 values = append(values, result) 4951 ptr = iterator.Next() 4952 } 4953 return values 4954 } 4955 4956 // GetProcessAncestorsFsuser returns the value of the field, resolving if necessary 4957 func (ev *Event) GetProcessAncestorsFsuser() []string { 4958 if ev.BaseEvent.ProcessContext == nil { 4959 return []string{} 4960 } 4961 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4962 return []string{} 4963 } 4964 var values []string 4965 ctx := eval.NewContext(ev) 4966 iterator := &ProcessAncestorsIterator{} 4967 ptr := iterator.Front(ctx) 4968 for ptr != nil { 4969 element := (*ProcessCacheEntry)(ptr) 4970 result := element.ProcessContext.Process.Credentials.FSUser 4971 values = append(values, result) 4972 ptr = iterator.Next() 4973 } 4974 return values 4975 } 4976 4977 // GetProcessAncestorsGid returns the value of the field, resolving if necessary 4978 func (ev *Event) GetProcessAncestorsGid() []uint32 { 4979 if ev.BaseEvent.ProcessContext == nil { 4980 return []uint32{} 4981 } 4982 if ev.BaseEvent.ProcessContext.Ancestor == nil { 4983 return []uint32{} 4984 } 4985 var values []uint32 4986 ctx := eval.NewContext(ev) 4987 iterator := &ProcessAncestorsIterator{} 4988 ptr := iterator.Front(ctx) 4989 for ptr != nil { 4990 element := (*ProcessCacheEntry)(ptr) 4991 result := element.ProcessContext.Process.Credentials.GID 4992 values = append(values, result) 4993 ptr = iterator.Next() 4994 } 4995 return values 4996 } 4997 4998 // GetProcessAncestorsGroup returns the value of the field, resolving if necessary 4999 func (ev *Event) GetProcessAncestorsGroup() []string { 5000 if ev.BaseEvent.ProcessContext == nil { 5001 return []string{} 5002 } 5003 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5004 return []string{} 5005 } 5006 var values []string 5007 ctx := eval.NewContext(ev) 5008 iterator := &ProcessAncestorsIterator{} 5009 ptr := iterator.Front(ctx) 5010 for ptr != nil { 5011 element := (*ProcessCacheEntry)(ptr) 5012 result := element.ProcessContext.Process.Credentials.Group 5013 values = append(values, result) 5014 ptr = iterator.Next() 5015 } 5016 return values 5017 } 5018 5019 // GetProcessAncestorsInterpreterFileChangeTime returns the value of the field, resolving if necessary 5020 func (ev *Event) GetProcessAncestorsInterpreterFileChangeTime() []uint64 { 5021 if ev.BaseEvent.ProcessContext == nil { 5022 return []uint64{} 5023 } 5024 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5025 return []uint64{} 5026 } 5027 var values []uint64 5028 ctx := eval.NewContext(ev) 5029 iterator := &ProcessAncestorsIterator{} 5030 ptr := iterator.Front(ctx) 5031 for ptr != nil { 5032 element := (*ProcessCacheEntry)(ptr) 5033 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.CTime 5034 values = append(values, result) 5035 ptr = iterator.Next() 5036 } 5037 return values 5038 } 5039 5040 // GetProcessAncestorsInterpreterFileFilesystem returns the value of the field, resolving if necessary 5041 func (ev *Event) GetProcessAncestorsInterpreterFileFilesystem() []string { 5042 if ev.BaseEvent.ProcessContext == nil { 5043 return []string{} 5044 } 5045 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5046 return []string{} 5047 } 5048 var values []string 5049 ctx := eval.NewContext(ev) 5050 iterator := &ProcessAncestorsIterator{} 5051 ptr := iterator.Front(ctx) 5052 for ptr != nil { 5053 element := (*ProcessCacheEntry)(ptr) 5054 result := ev.FieldHandlers.ResolveFileFilesystem(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 5055 values = append(values, result) 5056 ptr = iterator.Next() 5057 } 5058 return values 5059 } 5060 5061 // GetProcessAncestorsInterpreterFileGid returns the value of the field, resolving if necessary 5062 func (ev *Event) GetProcessAncestorsInterpreterFileGid() []uint32 { 5063 if ev.BaseEvent.ProcessContext == nil { 5064 return []uint32{} 5065 } 5066 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5067 return []uint32{} 5068 } 5069 var values []uint32 5070 ctx := eval.NewContext(ev) 5071 iterator := &ProcessAncestorsIterator{} 5072 ptr := iterator.Front(ctx) 5073 for ptr != nil { 5074 element := (*ProcessCacheEntry)(ptr) 5075 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.GID 5076 values = append(values, result) 5077 ptr = iterator.Next() 5078 } 5079 return values 5080 } 5081 5082 // GetProcessAncestorsInterpreterFileGroup returns the value of the field, resolving if necessary 5083 func (ev *Event) GetProcessAncestorsInterpreterFileGroup() []string { 5084 if ev.BaseEvent.ProcessContext == nil { 5085 return []string{} 5086 } 5087 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5088 return []string{} 5089 } 5090 var values []string 5091 ctx := eval.NewContext(ev) 5092 iterator := &ProcessAncestorsIterator{} 5093 ptr := iterator.Front(ctx) 5094 for ptr != nil { 5095 element := (*ProcessCacheEntry)(ptr) 5096 result := ev.FieldHandlers.ResolveFileFieldsGroup(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 5097 values = append(values, result) 5098 ptr = iterator.Next() 5099 } 5100 return values 5101 } 5102 5103 // GetProcessAncestorsInterpreterFileHashes returns the value of the field, resolving if necessary 5104 func (ev *Event) GetProcessAncestorsInterpreterFileHashes() []string { 5105 if ev.BaseEvent.ProcessContext == nil { 5106 return []string{} 5107 } 5108 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5109 return []string{} 5110 } 5111 var values []string 5112 ctx := eval.NewContext(ev) 5113 iterator := &ProcessAncestorsIterator{} 5114 ptr := iterator.Front(ctx) 5115 for ptr != nil { 5116 element := (*ProcessCacheEntry)(ptr) 5117 result := ev.FieldHandlers.ResolveHashesFromEvent(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 5118 values = append(values, result...) 5119 ptr = iterator.Next() 5120 } 5121 return values 5122 } 5123 5124 // GetProcessAncestorsInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 5125 func (ev *Event) GetProcessAncestorsInterpreterFileInUpperLayer() []bool { 5126 if ev.BaseEvent.ProcessContext == nil { 5127 return []bool{} 5128 } 5129 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5130 return []bool{} 5131 } 5132 var values []bool 5133 ctx := eval.NewContext(ev) 5134 iterator := &ProcessAncestorsIterator{} 5135 ptr := iterator.Front(ctx) 5136 for ptr != nil { 5137 element := (*ProcessCacheEntry)(ptr) 5138 result := ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 5139 values = append(values, result) 5140 ptr = iterator.Next() 5141 } 5142 return values 5143 } 5144 5145 // GetProcessAncestorsInterpreterFileInode returns the value of the field, resolving if necessary 5146 func (ev *Event) GetProcessAncestorsInterpreterFileInode() []uint64 { 5147 if ev.BaseEvent.ProcessContext == nil { 5148 return []uint64{} 5149 } 5150 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5151 return []uint64{} 5152 } 5153 var values []uint64 5154 ctx := eval.NewContext(ev) 5155 iterator := &ProcessAncestorsIterator{} 5156 ptr := iterator.Front(ctx) 5157 for ptr != nil { 5158 element := (*ProcessCacheEntry)(ptr) 5159 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 5160 values = append(values, result) 5161 ptr = iterator.Next() 5162 } 5163 return values 5164 } 5165 5166 // GetProcessAncestorsInterpreterFileMode returns the value of the field, resolving if necessary 5167 func (ev *Event) GetProcessAncestorsInterpreterFileMode() []uint16 { 5168 if ev.BaseEvent.ProcessContext == nil { 5169 return []uint16{} 5170 } 5171 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5172 return []uint16{} 5173 } 5174 var values []uint16 5175 ctx := eval.NewContext(ev) 5176 iterator := &ProcessAncestorsIterator{} 5177 ptr := iterator.Front(ctx) 5178 for ptr != nil { 5179 element := (*ProcessCacheEntry)(ptr) 5180 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.Mode 5181 values = append(values, result) 5182 ptr = iterator.Next() 5183 } 5184 return values 5185 } 5186 5187 // GetProcessAncestorsInterpreterFileModificationTime returns the value of the field, resolving if necessary 5188 func (ev *Event) GetProcessAncestorsInterpreterFileModificationTime() []uint64 { 5189 if ev.BaseEvent.ProcessContext == nil { 5190 return []uint64{} 5191 } 5192 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5193 return []uint64{} 5194 } 5195 var values []uint64 5196 ctx := eval.NewContext(ev) 5197 iterator := &ProcessAncestorsIterator{} 5198 ptr := iterator.Front(ctx) 5199 for ptr != nil { 5200 element := (*ProcessCacheEntry)(ptr) 5201 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.MTime 5202 values = append(values, result) 5203 ptr = iterator.Next() 5204 } 5205 return values 5206 } 5207 5208 // GetProcessAncestorsInterpreterFileMountId returns the value of the field, resolving if necessary 5209 func (ev *Event) GetProcessAncestorsInterpreterFileMountId() []uint32 { 5210 if ev.BaseEvent.ProcessContext == nil { 5211 return []uint32{} 5212 } 5213 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5214 return []uint32{} 5215 } 5216 var values []uint32 5217 ctx := eval.NewContext(ev) 5218 iterator := &ProcessAncestorsIterator{} 5219 ptr := iterator.Front(ctx) 5220 for ptr != nil { 5221 element := (*ProcessCacheEntry)(ptr) 5222 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 5223 values = append(values, result) 5224 ptr = iterator.Next() 5225 } 5226 return values 5227 } 5228 5229 // GetProcessAncestorsInterpreterFileName returns the value of the field, resolving if necessary 5230 func (ev *Event) GetProcessAncestorsInterpreterFileName() []string { 5231 if ev.BaseEvent.ProcessContext == nil { 5232 return []string{} 5233 } 5234 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5235 return []string{} 5236 } 5237 var values []string 5238 ctx := eval.NewContext(ev) 5239 iterator := &ProcessAncestorsIterator{} 5240 ptr := iterator.Front(ctx) 5241 for ptr != nil { 5242 element := (*ProcessCacheEntry)(ptr) 5243 result := ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 5244 values = append(values, result) 5245 ptr = iterator.Next() 5246 } 5247 return values 5248 } 5249 5250 // GetProcessAncestorsInterpreterFileNameLength returns the value of the field, resolving if necessary 5251 func (ev *Event) GetProcessAncestorsInterpreterFileNameLength() []int { 5252 if ev.BaseEvent.ProcessContext == nil { 5253 return []int{} 5254 } 5255 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5256 return []int{} 5257 } 5258 var values []int 5259 ctx := eval.NewContext(ev) 5260 iterator := &ProcessAncestorsIterator{} 5261 ptr := iterator.Front(ctx) 5262 for ptr != nil { 5263 element := (*ProcessCacheEntry)(ptr) 5264 result := len(ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent)) 5265 values = append(values, result) 5266 ptr = iterator.Next() 5267 } 5268 return values 5269 } 5270 5271 // GetProcessAncestorsInterpreterFilePackageName returns the value of the field, resolving if necessary 5272 func (ev *Event) GetProcessAncestorsInterpreterFilePackageName() []string { 5273 if ev.BaseEvent.ProcessContext == nil { 5274 return []string{} 5275 } 5276 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5277 return []string{} 5278 } 5279 var values []string 5280 ctx := eval.NewContext(ev) 5281 iterator := &ProcessAncestorsIterator{} 5282 ptr := iterator.Front(ctx) 5283 for ptr != nil { 5284 element := (*ProcessCacheEntry)(ptr) 5285 result := ev.FieldHandlers.ResolvePackageName(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 5286 values = append(values, result) 5287 ptr = iterator.Next() 5288 } 5289 return values 5290 } 5291 5292 // GetProcessAncestorsInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 5293 func (ev *Event) GetProcessAncestorsInterpreterFilePackageSourceVersion() []string { 5294 if ev.BaseEvent.ProcessContext == nil { 5295 return []string{} 5296 } 5297 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5298 return []string{} 5299 } 5300 var values []string 5301 ctx := eval.NewContext(ev) 5302 iterator := &ProcessAncestorsIterator{} 5303 ptr := iterator.Front(ctx) 5304 for ptr != nil { 5305 element := (*ProcessCacheEntry)(ptr) 5306 result := ev.FieldHandlers.ResolvePackageSourceVersion(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 5307 values = append(values, result) 5308 ptr = iterator.Next() 5309 } 5310 return values 5311 } 5312 5313 // GetProcessAncestorsInterpreterFilePackageVersion returns the value of the field, resolving if necessary 5314 func (ev *Event) GetProcessAncestorsInterpreterFilePackageVersion() []string { 5315 if ev.BaseEvent.ProcessContext == nil { 5316 return []string{} 5317 } 5318 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5319 return []string{} 5320 } 5321 var values []string 5322 ctx := eval.NewContext(ev) 5323 iterator := &ProcessAncestorsIterator{} 5324 ptr := iterator.Front(ctx) 5325 for ptr != nil { 5326 element := (*ProcessCacheEntry)(ptr) 5327 result := ev.FieldHandlers.ResolvePackageVersion(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 5328 values = append(values, result) 5329 ptr = iterator.Next() 5330 } 5331 return values 5332 } 5333 5334 // GetProcessAncestorsInterpreterFilePath returns the value of the field, resolving if necessary 5335 func (ev *Event) GetProcessAncestorsInterpreterFilePath() []string { 5336 if ev.BaseEvent.ProcessContext == nil { 5337 return []string{} 5338 } 5339 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5340 return []string{} 5341 } 5342 var values []string 5343 ctx := eval.NewContext(ev) 5344 iterator := &ProcessAncestorsIterator{} 5345 ptr := iterator.Front(ctx) 5346 for ptr != nil { 5347 element := (*ProcessCacheEntry)(ptr) 5348 result := ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 5349 values = append(values, result) 5350 ptr = iterator.Next() 5351 } 5352 return values 5353 } 5354 5355 // GetProcessAncestorsInterpreterFilePathLength returns the value of the field, resolving if necessary 5356 func (ev *Event) GetProcessAncestorsInterpreterFilePathLength() []int { 5357 if ev.BaseEvent.ProcessContext == nil { 5358 return []int{} 5359 } 5360 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5361 return []int{} 5362 } 5363 var values []int 5364 ctx := eval.NewContext(ev) 5365 iterator := &ProcessAncestorsIterator{} 5366 ptr := iterator.Front(ctx) 5367 for ptr != nil { 5368 element := (*ProcessCacheEntry)(ptr) 5369 result := len(ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent)) 5370 values = append(values, result) 5371 ptr = iterator.Next() 5372 } 5373 return values 5374 } 5375 5376 // GetProcessAncestorsInterpreterFileRights returns the value of the field, resolving if necessary 5377 func (ev *Event) GetProcessAncestorsInterpreterFileRights() []int { 5378 if ev.BaseEvent.ProcessContext == nil { 5379 return []int{} 5380 } 5381 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5382 return []int{} 5383 } 5384 var values []int 5385 ctx := eval.NewContext(ev) 5386 iterator := &ProcessAncestorsIterator{} 5387 ptr := iterator.Front(ctx) 5388 for ptr != nil { 5389 element := (*ProcessCacheEntry)(ptr) 5390 result := int(ev.FieldHandlers.ResolveRights(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields)) 5391 values = append(values, result) 5392 ptr = iterator.Next() 5393 } 5394 return values 5395 } 5396 5397 // GetProcessAncestorsInterpreterFileUid returns the value of the field, resolving if necessary 5398 func (ev *Event) GetProcessAncestorsInterpreterFileUid() []uint32 { 5399 if ev.BaseEvent.ProcessContext == nil { 5400 return []uint32{} 5401 } 5402 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5403 return []uint32{} 5404 } 5405 var values []uint32 5406 ctx := eval.NewContext(ev) 5407 iterator := &ProcessAncestorsIterator{} 5408 ptr := iterator.Front(ctx) 5409 for ptr != nil { 5410 element := (*ProcessCacheEntry)(ptr) 5411 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.UID 5412 values = append(values, result) 5413 ptr = iterator.Next() 5414 } 5415 return values 5416 } 5417 5418 // GetProcessAncestorsInterpreterFileUser returns the value of the field, resolving if necessary 5419 func (ev *Event) GetProcessAncestorsInterpreterFileUser() []string { 5420 if ev.BaseEvent.ProcessContext == nil { 5421 return []string{} 5422 } 5423 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5424 return []string{} 5425 } 5426 var values []string 5427 ctx := eval.NewContext(ev) 5428 iterator := &ProcessAncestorsIterator{} 5429 ptr := iterator.Front(ctx) 5430 for ptr != nil { 5431 element := (*ProcessCacheEntry)(ptr) 5432 result := ev.FieldHandlers.ResolveFileFieldsUser(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 5433 values = append(values, result) 5434 ptr = iterator.Next() 5435 } 5436 return values 5437 } 5438 5439 // GetProcessAncestorsIsKworker returns the value of the field, resolving if necessary 5440 func (ev *Event) GetProcessAncestorsIsKworker() []bool { 5441 if ev.BaseEvent.ProcessContext == nil { 5442 return []bool{} 5443 } 5444 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5445 return []bool{} 5446 } 5447 var values []bool 5448 ctx := eval.NewContext(ev) 5449 iterator := &ProcessAncestorsIterator{} 5450 ptr := iterator.Front(ctx) 5451 for ptr != nil { 5452 element := (*ProcessCacheEntry)(ptr) 5453 result := element.ProcessContext.Process.PIDContext.IsKworker 5454 values = append(values, result) 5455 ptr = iterator.Next() 5456 } 5457 return values 5458 } 5459 5460 // GetProcessAncestorsIsThread returns the value of the field, resolving if necessary 5461 func (ev *Event) GetProcessAncestorsIsThread() []bool { 5462 if ev.BaseEvent.ProcessContext == nil { 5463 return []bool{} 5464 } 5465 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5466 return []bool{} 5467 } 5468 var values []bool 5469 ctx := eval.NewContext(ev) 5470 iterator := &ProcessAncestorsIterator{} 5471 ptr := iterator.Front(ctx) 5472 for ptr != nil { 5473 element := (*ProcessCacheEntry)(ptr) 5474 result := element.ProcessContext.Process.IsThread 5475 values = append(values, result) 5476 ptr = iterator.Next() 5477 } 5478 return values 5479 } 5480 5481 // GetProcessAncestorsPid returns the value of the field, resolving if necessary 5482 func (ev *Event) GetProcessAncestorsPid() []uint32 { 5483 if ev.BaseEvent.ProcessContext == nil { 5484 return []uint32{} 5485 } 5486 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5487 return []uint32{} 5488 } 5489 var values []uint32 5490 ctx := eval.NewContext(ev) 5491 iterator := &ProcessAncestorsIterator{} 5492 ptr := iterator.Front(ctx) 5493 for ptr != nil { 5494 element := (*ProcessCacheEntry)(ptr) 5495 result := element.ProcessContext.Process.PIDContext.Pid 5496 values = append(values, result) 5497 ptr = iterator.Next() 5498 } 5499 return values 5500 } 5501 5502 // GetProcessAncestorsPpid returns the value of the field, resolving if necessary 5503 func (ev *Event) GetProcessAncestorsPpid() []uint32 { 5504 if ev.BaseEvent.ProcessContext == nil { 5505 return []uint32{} 5506 } 5507 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5508 return []uint32{} 5509 } 5510 var values []uint32 5511 ctx := eval.NewContext(ev) 5512 iterator := &ProcessAncestorsIterator{} 5513 ptr := iterator.Front(ctx) 5514 for ptr != nil { 5515 element := (*ProcessCacheEntry)(ptr) 5516 result := element.ProcessContext.Process.PPid 5517 values = append(values, result) 5518 ptr = iterator.Next() 5519 } 5520 return values 5521 } 5522 5523 // GetProcessAncestorsTid returns the value of the field, resolving if necessary 5524 func (ev *Event) GetProcessAncestorsTid() []uint32 { 5525 if ev.BaseEvent.ProcessContext == nil { 5526 return []uint32{} 5527 } 5528 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5529 return []uint32{} 5530 } 5531 var values []uint32 5532 ctx := eval.NewContext(ev) 5533 iterator := &ProcessAncestorsIterator{} 5534 ptr := iterator.Front(ctx) 5535 for ptr != nil { 5536 element := (*ProcessCacheEntry)(ptr) 5537 result := element.ProcessContext.Process.PIDContext.Tid 5538 values = append(values, result) 5539 ptr = iterator.Next() 5540 } 5541 return values 5542 } 5543 5544 // GetProcessAncestorsTtyName returns the value of the field, resolving if necessary 5545 func (ev *Event) GetProcessAncestorsTtyName() []string { 5546 if ev.BaseEvent.ProcessContext == nil { 5547 return []string{} 5548 } 5549 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5550 return []string{} 5551 } 5552 var values []string 5553 ctx := eval.NewContext(ev) 5554 iterator := &ProcessAncestorsIterator{} 5555 ptr := iterator.Front(ctx) 5556 for ptr != nil { 5557 element := (*ProcessCacheEntry)(ptr) 5558 result := element.ProcessContext.Process.TTYName 5559 values = append(values, result) 5560 ptr = iterator.Next() 5561 } 5562 return values 5563 } 5564 5565 // GetProcessAncestorsUid returns the value of the field, resolving if necessary 5566 func (ev *Event) GetProcessAncestorsUid() []uint32 { 5567 if ev.BaseEvent.ProcessContext == nil { 5568 return []uint32{} 5569 } 5570 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5571 return []uint32{} 5572 } 5573 var values []uint32 5574 ctx := eval.NewContext(ev) 5575 iterator := &ProcessAncestorsIterator{} 5576 ptr := iterator.Front(ctx) 5577 for ptr != nil { 5578 element := (*ProcessCacheEntry)(ptr) 5579 result := element.ProcessContext.Process.Credentials.UID 5580 values = append(values, result) 5581 ptr = iterator.Next() 5582 } 5583 return values 5584 } 5585 5586 // GetProcessAncestorsUser returns the value of the field, resolving if necessary 5587 func (ev *Event) GetProcessAncestorsUser() []string { 5588 if ev.BaseEvent.ProcessContext == nil { 5589 return []string{} 5590 } 5591 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5592 return []string{} 5593 } 5594 var values []string 5595 ctx := eval.NewContext(ev) 5596 iterator := &ProcessAncestorsIterator{} 5597 ptr := iterator.Front(ctx) 5598 for ptr != nil { 5599 element := (*ProcessCacheEntry)(ptr) 5600 result := element.ProcessContext.Process.Credentials.User 5601 values = append(values, result) 5602 ptr = iterator.Next() 5603 } 5604 return values 5605 } 5606 5607 // GetProcessAncestorsUserSessionK8sGroups returns the value of the field, resolving if necessary 5608 func (ev *Event) GetProcessAncestorsUserSessionK8sGroups() []string { 5609 if ev.BaseEvent.ProcessContext == nil { 5610 return []string{} 5611 } 5612 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5613 return []string{} 5614 } 5615 var values []string 5616 ctx := eval.NewContext(ev) 5617 iterator := &ProcessAncestorsIterator{} 5618 ptr := iterator.Front(ctx) 5619 for ptr != nil { 5620 element := (*ProcessCacheEntry)(ptr) 5621 result := ev.FieldHandlers.ResolveK8SGroups(ev, &element.ProcessContext.Process.UserSession) 5622 values = append(values, result...) 5623 ptr = iterator.Next() 5624 } 5625 return values 5626 } 5627 5628 // GetProcessAncestorsUserSessionK8sUid returns the value of the field, resolving if necessary 5629 func (ev *Event) GetProcessAncestorsUserSessionK8sUid() []string { 5630 if ev.BaseEvent.ProcessContext == nil { 5631 return []string{} 5632 } 5633 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5634 return []string{} 5635 } 5636 var values []string 5637 ctx := eval.NewContext(ev) 5638 iterator := &ProcessAncestorsIterator{} 5639 ptr := iterator.Front(ctx) 5640 for ptr != nil { 5641 element := (*ProcessCacheEntry)(ptr) 5642 result := ev.FieldHandlers.ResolveK8SUID(ev, &element.ProcessContext.Process.UserSession) 5643 values = append(values, result) 5644 ptr = iterator.Next() 5645 } 5646 return values 5647 } 5648 5649 // GetProcessAncestorsUserSessionK8sUsername returns the value of the field, resolving if necessary 5650 func (ev *Event) GetProcessAncestorsUserSessionK8sUsername() []string { 5651 if ev.BaseEvent.ProcessContext == nil { 5652 return []string{} 5653 } 5654 if ev.BaseEvent.ProcessContext.Ancestor == nil { 5655 return []string{} 5656 } 5657 var values []string 5658 ctx := eval.NewContext(ev) 5659 iterator := &ProcessAncestorsIterator{} 5660 ptr := iterator.Front(ctx) 5661 for ptr != nil { 5662 element := (*ProcessCacheEntry)(ptr) 5663 result := ev.FieldHandlers.ResolveK8SUsername(ev, &element.ProcessContext.Process.UserSession) 5664 values = append(values, result) 5665 ptr = iterator.Next() 5666 } 5667 return values 5668 } 5669 5670 // GetProcessArgs returns the value of the field, resolving if necessary 5671 func (ev *Event) GetProcessArgs() string { 5672 if ev.BaseEvent.ProcessContext == nil { 5673 return "" 5674 } 5675 return ev.FieldHandlers.ResolveProcessArgs(ev, &ev.BaseEvent.ProcessContext.Process) 5676 } 5677 5678 // GetProcessArgsFlags returns the value of the field, resolving if necessary 5679 func (ev *Event) GetProcessArgsFlags() []string { 5680 if ev.BaseEvent.ProcessContext == nil { 5681 return []string{} 5682 } 5683 return ev.FieldHandlers.ResolveProcessArgsFlags(ev, &ev.BaseEvent.ProcessContext.Process) 5684 } 5685 5686 // GetProcessArgsOptions returns the value of the field, resolving if necessary 5687 func (ev *Event) GetProcessArgsOptions() []string { 5688 if ev.BaseEvent.ProcessContext == nil { 5689 return []string{} 5690 } 5691 return ev.FieldHandlers.ResolveProcessArgsOptions(ev, &ev.BaseEvent.ProcessContext.Process) 5692 } 5693 5694 // GetProcessArgsScrubbed returns the value of the field, resolving if necessary 5695 func (ev *Event) GetProcessArgsScrubbed() string { 5696 if ev.BaseEvent.ProcessContext == nil { 5697 return "" 5698 } 5699 return ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, &ev.BaseEvent.ProcessContext.Process) 5700 } 5701 5702 // GetProcessArgsTruncated returns the value of the field, resolving if necessary 5703 func (ev *Event) GetProcessArgsTruncated() bool { 5704 if ev.BaseEvent.ProcessContext == nil { 5705 return false 5706 } 5707 return ev.FieldHandlers.ResolveProcessArgsTruncated(ev, &ev.BaseEvent.ProcessContext.Process) 5708 } 5709 5710 // GetProcessArgv returns the value of the field, resolving if necessary 5711 func (ev *Event) GetProcessArgv() []string { 5712 if ev.BaseEvent.ProcessContext == nil { 5713 return []string{} 5714 } 5715 return ev.FieldHandlers.ResolveProcessArgv(ev, &ev.BaseEvent.ProcessContext.Process) 5716 } 5717 5718 // GetProcessArgv0 returns the value of the field, resolving if necessary 5719 func (ev *Event) GetProcessArgv0() string { 5720 if ev.BaseEvent.ProcessContext == nil { 5721 return "" 5722 } 5723 return ev.FieldHandlers.ResolveProcessArgv0(ev, &ev.BaseEvent.ProcessContext.Process) 5724 } 5725 5726 // GetProcessArgvScrubbed returns the value of the field, resolving if necessary 5727 func (ev *Event) GetProcessArgvScrubbed() []string { 5728 if ev.BaseEvent.ProcessContext == nil { 5729 return []string{} 5730 } 5731 return ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, &ev.BaseEvent.ProcessContext.Process) 5732 } 5733 5734 // GetProcessCapEffective returns the value of the field, resolving if necessary 5735 func (ev *Event) GetProcessCapEffective() uint64 { 5736 if ev.BaseEvent.ProcessContext == nil { 5737 return uint64(0) 5738 } 5739 return ev.BaseEvent.ProcessContext.Process.Credentials.CapEffective 5740 } 5741 5742 // GetProcessCapPermitted returns the value of the field, resolving if necessary 5743 func (ev *Event) GetProcessCapPermitted() uint64 { 5744 if ev.BaseEvent.ProcessContext == nil { 5745 return uint64(0) 5746 } 5747 return ev.BaseEvent.ProcessContext.Process.Credentials.CapPermitted 5748 } 5749 5750 // GetProcessCmdargv returns the value of the field, resolving if necessary 5751 func (ev *Event) GetProcessCmdargv() []string { 5752 if ev.BaseEvent.ProcessContext == nil { 5753 return []string{} 5754 } 5755 return ev.FieldHandlers.ResolveProcessCmdArgv(ev, &ev.BaseEvent.ProcessContext.Process) 5756 } 5757 5758 // GetProcessComm returns the value of the field, resolving if necessary 5759 func (ev *Event) GetProcessComm() string { 5760 if ev.BaseEvent.ProcessContext == nil { 5761 return "" 5762 } 5763 return ev.BaseEvent.ProcessContext.Process.Comm 5764 } 5765 5766 // GetProcessContainerId returns the value of the field, resolving if necessary 5767 func (ev *Event) GetProcessContainerId() string { 5768 if ev.BaseEvent.ProcessContext == nil { 5769 return "" 5770 } 5771 return ev.BaseEvent.ProcessContext.Process.ContainerID 5772 } 5773 5774 // GetProcessCreatedAt returns the value of the field, resolving if necessary 5775 func (ev *Event) GetProcessCreatedAt() int { 5776 if ev.BaseEvent.ProcessContext == nil { 5777 return 0 5778 } 5779 return ev.FieldHandlers.ResolveProcessCreatedAt(ev, &ev.BaseEvent.ProcessContext.Process) 5780 } 5781 5782 // GetProcessEgid returns the value of the field, resolving if necessary 5783 func (ev *Event) GetProcessEgid() uint32 { 5784 if ev.BaseEvent.ProcessContext == nil { 5785 return uint32(0) 5786 } 5787 return ev.BaseEvent.ProcessContext.Process.Credentials.EGID 5788 } 5789 5790 // GetProcessEgroup returns the value of the field, resolving if necessary 5791 func (ev *Event) GetProcessEgroup() string { 5792 if ev.BaseEvent.ProcessContext == nil { 5793 return "" 5794 } 5795 return ev.BaseEvent.ProcessContext.Process.Credentials.EGroup 5796 } 5797 5798 // GetProcessEnvp returns the value of the field, resolving if necessary 5799 func (ev *Event) GetProcessEnvp() []string { 5800 if ev.BaseEvent.ProcessContext == nil { 5801 return []string{} 5802 } 5803 return ev.FieldHandlers.ResolveProcessEnvp(ev, &ev.BaseEvent.ProcessContext.Process) 5804 } 5805 5806 // GetProcessEnvs returns the value of the field, resolving if necessary 5807 func (ev *Event) GetProcessEnvs() []string { 5808 if ev.BaseEvent.ProcessContext == nil { 5809 return []string{} 5810 } 5811 return ev.FieldHandlers.ResolveProcessEnvs(ev, &ev.BaseEvent.ProcessContext.Process) 5812 } 5813 5814 // GetProcessEnvsTruncated returns the value of the field, resolving if necessary 5815 func (ev *Event) GetProcessEnvsTruncated() bool { 5816 if ev.BaseEvent.ProcessContext == nil { 5817 return false 5818 } 5819 return ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, &ev.BaseEvent.ProcessContext.Process) 5820 } 5821 5822 // GetProcessEuid returns the value of the field, resolving if necessary 5823 func (ev *Event) GetProcessEuid() uint32 { 5824 if ev.BaseEvent.ProcessContext == nil { 5825 return uint32(0) 5826 } 5827 return ev.BaseEvent.ProcessContext.Process.Credentials.EUID 5828 } 5829 5830 // GetProcessEuser returns the value of the field, resolving if necessary 5831 func (ev *Event) GetProcessEuser() string { 5832 if ev.BaseEvent.ProcessContext == nil { 5833 return "" 5834 } 5835 return ev.BaseEvent.ProcessContext.Process.Credentials.EUser 5836 } 5837 5838 // GetProcessExecTime returns the value of the field, resolving if necessary 5839 func (ev *Event) GetProcessExecTime() time.Time { 5840 if ev.BaseEvent.ProcessContext == nil { 5841 return time.Time{} 5842 } 5843 return ev.BaseEvent.ProcessContext.Process.ExecTime 5844 } 5845 5846 // GetProcessExitTime returns the value of the field, resolving if necessary 5847 func (ev *Event) GetProcessExitTime() time.Time { 5848 if ev.BaseEvent.ProcessContext == nil { 5849 return time.Time{} 5850 } 5851 return ev.BaseEvent.ProcessContext.Process.ExitTime 5852 } 5853 5854 // GetProcessFileChangeTime returns the value of the field, resolving if necessary 5855 func (ev *Event) GetProcessFileChangeTime() uint64 { 5856 if ev.BaseEvent.ProcessContext == nil { 5857 return uint64(0) 5858 } 5859 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5860 return uint64(0) 5861 } 5862 return ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields.CTime 5863 } 5864 5865 // GetProcessFileFilesystem returns the value of the field, resolving if necessary 5866 func (ev *Event) GetProcessFileFilesystem() string { 5867 if ev.BaseEvent.ProcessContext == nil { 5868 return "" 5869 } 5870 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5871 return "" 5872 } 5873 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent) 5874 } 5875 5876 // GetProcessFileGid returns the value of the field, resolving if necessary 5877 func (ev *Event) GetProcessFileGid() uint32 { 5878 if ev.BaseEvent.ProcessContext == nil { 5879 return uint32(0) 5880 } 5881 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5882 return uint32(0) 5883 } 5884 return ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields.GID 5885 } 5886 5887 // GetProcessFileGroup returns the value of the field, resolving if necessary 5888 func (ev *Event) GetProcessFileGroup() string { 5889 if ev.BaseEvent.ProcessContext == nil { 5890 return "" 5891 } 5892 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5893 return "" 5894 } 5895 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields) 5896 } 5897 5898 // GetProcessFileHashes returns the value of the field, resolving if necessary 5899 func (ev *Event) GetProcessFileHashes() []string { 5900 if ev.BaseEvent.ProcessContext == nil { 5901 return []string{} 5902 } 5903 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5904 return []string{} 5905 } 5906 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent) 5907 } 5908 5909 // GetProcessFileInUpperLayer returns the value of the field, resolving if necessary 5910 func (ev *Event) GetProcessFileInUpperLayer() bool { 5911 if ev.BaseEvent.ProcessContext == nil { 5912 return false 5913 } 5914 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5915 return false 5916 } 5917 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields) 5918 } 5919 5920 // GetProcessFileInode returns the value of the field, resolving if necessary 5921 func (ev *Event) GetProcessFileInode() uint64 { 5922 if ev.BaseEvent.ProcessContext == nil { 5923 return uint64(0) 5924 } 5925 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5926 return uint64(0) 5927 } 5928 return ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields.PathKey.Inode 5929 } 5930 5931 // GetProcessFileMode returns the value of the field, resolving if necessary 5932 func (ev *Event) GetProcessFileMode() uint16 { 5933 if ev.BaseEvent.ProcessContext == nil { 5934 return uint16(0) 5935 } 5936 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5937 return uint16(0) 5938 } 5939 return ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields.Mode 5940 } 5941 5942 // GetProcessFileModificationTime returns the value of the field, resolving if necessary 5943 func (ev *Event) GetProcessFileModificationTime() uint64 { 5944 if ev.BaseEvent.ProcessContext == nil { 5945 return uint64(0) 5946 } 5947 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5948 return uint64(0) 5949 } 5950 return ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields.MTime 5951 } 5952 5953 // GetProcessFileMountId returns the value of the field, resolving if necessary 5954 func (ev *Event) GetProcessFileMountId() uint32 { 5955 if ev.BaseEvent.ProcessContext == nil { 5956 return uint32(0) 5957 } 5958 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5959 return uint32(0) 5960 } 5961 return ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields.PathKey.MountID 5962 } 5963 5964 // GetProcessFileName returns the value of the field, resolving if necessary 5965 func (ev *Event) GetProcessFileName() string { 5966 if ev.BaseEvent.ProcessContext == nil { 5967 return "" 5968 } 5969 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5970 return "" 5971 } 5972 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent) 5973 } 5974 5975 // GetProcessFileNameLength returns the value of the field, resolving if necessary 5976 func (ev *Event) GetProcessFileNameLength() int { 5977 if ev.BaseEvent.ProcessContext == nil { 5978 return 0 5979 } 5980 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent)) 5981 } 5982 5983 // GetProcessFilePackageName returns the value of the field, resolving if necessary 5984 func (ev *Event) GetProcessFilePackageName() string { 5985 if ev.BaseEvent.ProcessContext == nil { 5986 return "" 5987 } 5988 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 5989 return "" 5990 } 5991 return ev.FieldHandlers.ResolvePackageName(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent) 5992 } 5993 5994 // GetProcessFilePackageSourceVersion returns the value of the field, resolving if necessary 5995 func (ev *Event) GetProcessFilePackageSourceVersion() string { 5996 if ev.BaseEvent.ProcessContext == nil { 5997 return "" 5998 } 5999 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 6000 return "" 6001 } 6002 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent) 6003 } 6004 6005 // GetProcessFilePackageVersion returns the value of the field, resolving if necessary 6006 func (ev *Event) GetProcessFilePackageVersion() string { 6007 if ev.BaseEvent.ProcessContext == nil { 6008 return "" 6009 } 6010 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 6011 return "" 6012 } 6013 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent) 6014 } 6015 6016 // GetProcessFilePath returns the value of the field, resolving if necessary 6017 func (ev *Event) GetProcessFilePath() string { 6018 if ev.BaseEvent.ProcessContext == nil { 6019 return "" 6020 } 6021 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 6022 return "" 6023 } 6024 return ev.FieldHandlers.ResolveFilePath(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent) 6025 } 6026 6027 // GetProcessFilePathLength returns the value of the field, resolving if necessary 6028 func (ev *Event) GetProcessFilePathLength() int { 6029 if ev.BaseEvent.ProcessContext == nil { 6030 return 0 6031 } 6032 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent)) 6033 } 6034 6035 // GetProcessFileRights returns the value of the field, resolving if necessary 6036 func (ev *Event) GetProcessFileRights() int { 6037 if ev.BaseEvent.ProcessContext == nil { 6038 return 0 6039 } 6040 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 6041 return 0 6042 } 6043 return ev.FieldHandlers.ResolveRights(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields) 6044 } 6045 6046 // GetProcessFileUid returns the value of the field, resolving if necessary 6047 func (ev *Event) GetProcessFileUid() uint32 { 6048 if ev.BaseEvent.ProcessContext == nil { 6049 return uint32(0) 6050 } 6051 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 6052 return uint32(0) 6053 } 6054 return ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields.UID 6055 } 6056 6057 // GetProcessFileUser returns the value of the field, resolving if necessary 6058 func (ev *Event) GetProcessFileUser() string { 6059 if ev.BaseEvent.ProcessContext == nil { 6060 return "" 6061 } 6062 if !ev.BaseEvent.ProcessContext.Process.IsNotKworker() { 6063 return "" 6064 } 6065 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.BaseEvent.ProcessContext.Process.FileEvent.FileFields) 6066 } 6067 6068 // GetProcessForkTime returns the value of the field, resolving if necessary 6069 func (ev *Event) GetProcessForkTime() time.Time { 6070 if ev.BaseEvent.ProcessContext == nil { 6071 return time.Time{} 6072 } 6073 return ev.BaseEvent.ProcessContext.Process.ForkTime 6074 } 6075 6076 // GetProcessFsgid returns the value of the field, resolving if necessary 6077 func (ev *Event) GetProcessFsgid() uint32 { 6078 if ev.BaseEvent.ProcessContext == nil { 6079 return uint32(0) 6080 } 6081 return ev.BaseEvent.ProcessContext.Process.Credentials.FSGID 6082 } 6083 6084 // GetProcessFsgroup returns the value of the field, resolving if necessary 6085 func (ev *Event) GetProcessFsgroup() string { 6086 if ev.BaseEvent.ProcessContext == nil { 6087 return "" 6088 } 6089 return ev.BaseEvent.ProcessContext.Process.Credentials.FSGroup 6090 } 6091 6092 // GetProcessFsuid returns the value of the field, resolving if necessary 6093 func (ev *Event) GetProcessFsuid() uint32 { 6094 if ev.BaseEvent.ProcessContext == nil { 6095 return uint32(0) 6096 } 6097 return ev.BaseEvent.ProcessContext.Process.Credentials.FSUID 6098 } 6099 6100 // GetProcessFsuser returns the value of the field, resolving if necessary 6101 func (ev *Event) GetProcessFsuser() string { 6102 if ev.BaseEvent.ProcessContext == nil { 6103 return "" 6104 } 6105 return ev.BaseEvent.ProcessContext.Process.Credentials.FSUser 6106 } 6107 6108 // GetProcessGid returns the value of the field, resolving if necessary 6109 func (ev *Event) GetProcessGid() uint32 { 6110 if ev.BaseEvent.ProcessContext == nil { 6111 return uint32(0) 6112 } 6113 return ev.BaseEvent.ProcessContext.Process.Credentials.GID 6114 } 6115 6116 // GetProcessGroup returns the value of the field, resolving if necessary 6117 func (ev *Event) GetProcessGroup() string { 6118 if ev.BaseEvent.ProcessContext == nil { 6119 return "" 6120 } 6121 return ev.BaseEvent.ProcessContext.Process.Credentials.Group 6122 } 6123 6124 // GetProcessInterpreterFileChangeTime returns the value of the field, resolving if necessary 6125 func (ev *Event) GetProcessInterpreterFileChangeTime() uint64 { 6126 if ev.BaseEvent.ProcessContext == nil { 6127 return uint64(0) 6128 } 6129 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6130 return uint64(0) 6131 } 6132 return ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.CTime 6133 } 6134 6135 // GetProcessInterpreterFileFilesystem returns the value of the field, resolving if necessary 6136 func (ev *Event) GetProcessInterpreterFileFilesystem() string { 6137 if ev.BaseEvent.ProcessContext == nil { 6138 return "" 6139 } 6140 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6141 return "" 6142 } 6143 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent) 6144 } 6145 6146 // GetProcessInterpreterFileGid returns the value of the field, resolving if necessary 6147 func (ev *Event) GetProcessInterpreterFileGid() uint32 { 6148 if ev.BaseEvent.ProcessContext == nil { 6149 return uint32(0) 6150 } 6151 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6152 return uint32(0) 6153 } 6154 return ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.GID 6155 } 6156 6157 // GetProcessInterpreterFileGroup returns the value of the field, resolving if necessary 6158 func (ev *Event) GetProcessInterpreterFileGroup() string { 6159 if ev.BaseEvent.ProcessContext == nil { 6160 return "" 6161 } 6162 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6163 return "" 6164 } 6165 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 6166 } 6167 6168 // GetProcessInterpreterFileHashes returns the value of the field, resolving if necessary 6169 func (ev *Event) GetProcessInterpreterFileHashes() []string { 6170 if ev.BaseEvent.ProcessContext == nil { 6171 return []string{} 6172 } 6173 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6174 return []string{} 6175 } 6176 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent) 6177 } 6178 6179 // GetProcessInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 6180 func (ev *Event) GetProcessInterpreterFileInUpperLayer() bool { 6181 if ev.BaseEvent.ProcessContext == nil { 6182 return false 6183 } 6184 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6185 return false 6186 } 6187 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 6188 } 6189 6190 // GetProcessInterpreterFileInode returns the value of the field, resolving if necessary 6191 func (ev *Event) GetProcessInterpreterFileInode() uint64 { 6192 if ev.BaseEvent.ProcessContext == nil { 6193 return uint64(0) 6194 } 6195 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6196 return uint64(0) 6197 } 6198 return ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 6199 } 6200 6201 // GetProcessInterpreterFileMode returns the value of the field, resolving if necessary 6202 func (ev *Event) GetProcessInterpreterFileMode() uint16 { 6203 if ev.BaseEvent.ProcessContext == nil { 6204 return uint16(0) 6205 } 6206 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6207 return uint16(0) 6208 } 6209 return ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.Mode 6210 } 6211 6212 // GetProcessInterpreterFileModificationTime returns the value of the field, resolving if necessary 6213 func (ev *Event) GetProcessInterpreterFileModificationTime() uint64 { 6214 if ev.BaseEvent.ProcessContext == nil { 6215 return uint64(0) 6216 } 6217 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6218 return uint64(0) 6219 } 6220 return ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.MTime 6221 } 6222 6223 // GetProcessInterpreterFileMountId returns the value of the field, resolving if necessary 6224 func (ev *Event) GetProcessInterpreterFileMountId() uint32 { 6225 if ev.BaseEvent.ProcessContext == nil { 6226 return uint32(0) 6227 } 6228 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6229 return uint32(0) 6230 } 6231 return ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 6232 } 6233 6234 // GetProcessInterpreterFileName returns the value of the field, resolving if necessary 6235 func (ev *Event) GetProcessInterpreterFileName() string { 6236 if ev.BaseEvent.ProcessContext == nil { 6237 return "" 6238 } 6239 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6240 return "" 6241 } 6242 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent) 6243 } 6244 6245 // GetProcessInterpreterFileNameLength returns the value of the field, resolving if necessary 6246 func (ev *Event) GetProcessInterpreterFileNameLength() int { 6247 if ev.BaseEvent.ProcessContext == nil { 6248 return 0 6249 } 6250 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent)) 6251 } 6252 6253 // GetProcessInterpreterFilePackageName returns the value of the field, resolving if necessary 6254 func (ev *Event) GetProcessInterpreterFilePackageName() string { 6255 if ev.BaseEvent.ProcessContext == nil { 6256 return "" 6257 } 6258 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6259 return "" 6260 } 6261 return ev.FieldHandlers.ResolvePackageName(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent) 6262 } 6263 6264 // GetProcessInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 6265 func (ev *Event) GetProcessInterpreterFilePackageSourceVersion() string { 6266 if ev.BaseEvent.ProcessContext == nil { 6267 return "" 6268 } 6269 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6270 return "" 6271 } 6272 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent) 6273 } 6274 6275 // GetProcessInterpreterFilePackageVersion returns the value of the field, resolving if necessary 6276 func (ev *Event) GetProcessInterpreterFilePackageVersion() string { 6277 if ev.BaseEvent.ProcessContext == nil { 6278 return "" 6279 } 6280 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6281 return "" 6282 } 6283 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent) 6284 } 6285 6286 // GetProcessInterpreterFilePath returns the value of the field, resolving if necessary 6287 func (ev *Event) GetProcessInterpreterFilePath() string { 6288 if ev.BaseEvent.ProcessContext == nil { 6289 return "" 6290 } 6291 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6292 return "" 6293 } 6294 return ev.FieldHandlers.ResolveFilePath(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent) 6295 } 6296 6297 // GetProcessInterpreterFilePathLength returns the value of the field, resolving if necessary 6298 func (ev *Event) GetProcessInterpreterFilePathLength() int { 6299 if ev.BaseEvent.ProcessContext == nil { 6300 return 0 6301 } 6302 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent)) 6303 } 6304 6305 // GetProcessInterpreterFileRights returns the value of the field, resolving if necessary 6306 func (ev *Event) GetProcessInterpreterFileRights() int { 6307 if ev.BaseEvent.ProcessContext == nil { 6308 return 0 6309 } 6310 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6311 return 0 6312 } 6313 return ev.FieldHandlers.ResolveRights(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 6314 } 6315 6316 // GetProcessInterpreterFileUid returns the value of the field, resolving if necessary 6317 func (ev *Event) GetProcessInterpreterFileUid() uint32 { 6318 if ev.BaseEvent.ProcessContext == nil { 6319 return uint32(0) 6320 } 6321 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6322 return uint32(0) 6323 } 6324 return ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.UID 6325 } 6326 6327 // GetProcessInterpreterFileUser returns the value of the field, resolving if necessary 6328 func (ev *Event) GetProcessInterpreterFileUser() string { 6329 if ev.BaseEvent.ProcessContext == nil { 6330 return "" 6331 } 6332 if !ev.BaseEvent.ProcessContext.Process.HasInterpreter() { 6333 return "" 6334 } 6335 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.BaseEvent.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 6336 } 6337 6338 // GetProcessIsKworker returns the value of the field, resolving if necessary 6339 func (ev *Event) GetProcessIsKworker() bool { 6340 if ev.BaseEvent.ProcessContext == nil { 6341 return false 6342 } 6343 return ev.BaseEvent.ProcessContext.Process.PIDContext.IsKworker 6344 } 6345 6346 // GetProcessIsThread returns the value of the field, resolving if necessary 6347 func (ev *Event) GetProcessIsThread() bool { 6348 if ev.BaseEvent.ProcessContext == nil { 6349 return false 6350 } 6351 return ev.BaseEvent.ProcessContext.Process.IsThread 6352 } 6353 6354 // GetProcessParentArgs returns the value of the field, resolving if necessary 6355 func (ev *Event) GetProcessParentArgs() string { 6356 if ev.BaseEvent.ProcessContext == nil { 6357 return "" 6358 } 6359 if ev.BaseEvent.ProcessContext.Parent == nil { 6360 return "" 6361 } 6362 if !ev.BaseEvent.ProcessContext.HasParent() { 6363 return "" 6364 } 6365 return ev.FieldHandlers.ResolveProcessArgs(ev, ev.BaseEvent.ProcessContext.Parent) 6366 } 6367 6368 // GetProcessParentArgsFlags returns the value of the field, resolving if necessary 6369 func (ev *Event) GetProcessParentArgsFlags() []string { 6370 if ev.BaseEvent.ProcessContext == nil { 6371 return []string{} 6372 } 6373 if ev.BaseEvent.ProcessContext.Parent == nil { 6374 return []string{} 6375 } 6376 if !ev.BaseEvent.ProcessContext.HasParent() { 6377 return []string{} 6378 } 6379 return ev.FieldHandlers.ResolveProcessArgsFlags(ev, ev.BaseEvent.ProcessContext.Parent) 6380 } 6381 6382 // GetProcessParentArgsOptions returns the value of the field, resolving if necessary 6383 func (ev *Event) GetProcessParentArgsOptions() []string { 6384 if ev.BaseEvent.ProcessContext == nil { 6385 return []string{} 6386 } 6387 if ev.BaseEvent.ProcessContext.Parent == nil { 6388 return []string{} 6389 } 6390 if !ev.BaseEvent.ProcessContext.HasParent() { 6391 return []string{} 6392 } 6393 return ev.FieldHandlers.ResolveProcessArgsOptions(ev, ev.BaseEvent.ProcessContext.Parent) 6394 } 6395 6396 // GetProcessParentArgsScrubbed returns the value of the field, resolving if necessary 6397 func (ev *Event) GetProcessParentArgsScrubbed() string { 6398 if ev.BaseEvent.ProcessContext == nil { 6399 return "" 6400 } 6401 if ev.BaseEvent.ProcessContext.Parent == nil { 6402 return "" 6403 } 6404 if !ev.BaseEvent.ProcessContext.HasParent() { 6405 return "" 6406 } 6407 return ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, ev.BaseEvent.ProcessContext.Parent) 6408 } 6409 6410 // GetProcessParentArgsTruncated returns the value of the field, resolving if necessary 6411 func (ev *Event) GetProcessParentArgsTruncated() bool { 6412 if ev.BaseEvent.ProcessContext == nil { 6413 return false 6414 } 6415 if ev.BaseEvent.ProcessContext.Parent == nil { 6416 return false 6417 } 6418 if !ev.BaseEvent.ProcessContext.HasParent() { 6419 return false 6420 } 6421 return ev.FieldHandlers.ResolveProcessArgsTruncated(ev, ev.BaseEvent.ProcessContext.Parent) 6422 } 6423 6424 // GetProcessParentArgv returns the value of the field, resolving if necessary 6425 func (ev *Event) GetProcessParentArgv() []string { 6426 if ev.BaseEvent.ProcessContext == nil { 6427 return []string{} 6428 } 6429 if ev.BaseEvent.ProcessContext.Parent == nil { 6430 return []string{} 6431 } 6432 if !ev.BaseEvent.ProcessContext.HasParent() { 6433 return []string{} 6434 } 6435 return ev.FieldHandlers.ResolveProcessArgv(ev, ev.BaseEvent.ProcessContext.Parent) 6436 } 6437 6438 // GetProcessParentArgv0 returns the value of the field, resolving if necessary 6439 func (ev *Event) GetProcessParentArgv0() string { 6440 if ev.BaseEvent.ProcessContext == nil { 6441 return "" 6442 } 6443 if ev.BaseEvent.ProcessContext.Parent == nil { 6444 return "" 6445 } 6446 if !ev.BaseEvent.ProcessContext.HasParent() { 6447 return "" 6448 } 6449 return ev.FieldHandlers.ResolveProcessArgv0(ev, ev.BaseEvent.ProcessContext.Parent) 6450 } 6451 6452 // GetProcessParentArgvScrubbed returns the value of the field, resolving if necessary 6453 func (ev *Event) GetProcessParentArgvScrubbed() []string { 6454 if ev.BaseEvent.ProcessContext == nil { 6455 return []string{} 6456 } 6457 if ev.BaseEvent.ProcessContext.Parent == nil { 6458 return []string{} 6459 } 6460 if !ev.BaseEvent.ProcessContext.HasParent() { 6461 return []string{} 6462 } 6463 return ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, ev.BaseEvent.ProcessContext.Parent) 6464 } 6465 6466 // GetProcessParentCapEffective returns the value of the field, resolving if necessary 6467 func (ev *Event) GetProcessParentCapEffective() uint64 { 6468 if ev.BaseEvent.ProcessContext == nil { 6469 return uint64(0) 6470 } 6471 if ev.BaseEvent.ProcessContext.Parent == nil { 6472 return uint64(0) 6473 } 6474 if !ev.BaseEvent.ProcessContext.HasParent() { 6475 return uint64(0) 6476 } 6477 return ev.BaseEvent.ProcessContext.Parent.Credentials.CapEffective 6478 } 6479 6480 // GetProcessParentCapPermitted returns the value of the field, resolving if necessary 6481 func (ev *Event) GetProcessParentCapPermitted() uint64 { 6482 if ev.BaseEvent.ProcessContext == nil { 6483 return uint64(0) 6484 } 6485 if ev.BaseEvent.ProcessContext.Parent == nil { 6486 return uint64(0) 6487 } 6488 if !ev.BaseEvent.ProcessContext.HasParent() { 6489 return uint64(0) 6490 } 6491 return ev.BaseEvent.ProcessContext.Parent.Credentials.CapPermitted 6492 } 6493 6494 // GetProcessParentCmdargv returns the value of the field, resolving if necessary 6495 func (ev *Event) GetProcessParentCmdargv() []string { 6496 if ev.BaseEvent.ProcessContext == nil { 6497 return []string{} 6498 } 6499 if ev.BaseEvent.ProcessContext.Parent == nil { 6500 return []string{} 6501 } 6502 if !ev.BaseEvent.ProcessContext.HasParent() { 6503 return []string{} 6504 } 6505 return ev.FieldHandlers.ResolveProcessCmdArgv(ev, ev.BaseEvent.ProcessContext.Parent) 6506 } 6507 6508 // GetProcessParentComm returns the value of the field, resolving if necessary 6509 func (ev *Event) GetProcessParentComm() string { 6510 if ev.BaseEvent.ProcessContext == nil { 6511 return "" 6512 } 6513 if ev.BaseEvent.ProcessContext.Parent == nil { 6514 return "" 6515 } 6516 if !ev.BaseEvent.ProcessContext.HasParent() { 6517 return "" 6518 } 6519 return ev.BaseEvent.ProcessContext.Parent.Comm 6520 } 6521 6522 // GetProcessParentContainerId returns the value of the field, resolving if necessary 6523 func (ev *Event) GetProcessParentContainerId() string { 6524 if ev.BaseEvent.ProcessContext == nil { 6525 return "" 6526 } 6527 if ev.BaseEvent.ProcessContext.Parent == nil { 6528 return "" 6529 } 6530 if !ev.BaseEvent.ProcessContext.HasParent() { 6531 return "" 6532 } 6533 return ev.BaseEvent.ProcessContext.Parent.ContainerID 6534 } 6535 6536 // GetProcessParentCreatedAt returns the value of the field, resolving if necessary 6537 func (ev *Event) GetProcessParentCreatedAt() int { 6538 if ev.BaseEvent.ProcessContext == nil { 6539 return 0 6540 } 6541 if ev.BaseEvent.ProcessContext.Parent == nil { 6542 return 0 6543 } 6544 if !ev.BaseEvent.ProcessContext.HasParent() { 6545 return 0 6546 } 6547 return ev.FieldHandlers.ResolveProcessCreatedAt(ev, ev.BaseEvent.ProcessContext.Parent) 6548 } 6549 6550 // GetProcessParentEgid returns the value of the field, resolving if necessary 6551 func (ev *Event) GetProcessParentEgid() uint32 { 6552 if ev.BaseEvent.ProcessContext == nil { 6553 return uint32(0) 6554 } 6555 if ev.BaseEvent.ProcessContext.Parent == nil { 6556 return uint32(0) 6557 } 6558 if !ev.BaseEvent.ProcessContext.HasParent() { 6559 return uint32(0) 6560 } 6561 return ev.BaseEvent.ProcessContext.Parent.Credentials.EGID 6562 } 6563 6564 // GetProcessParentEgroup returns the value of the field, resolving if necessary 6565 func (ev *Event) GetProcessParentEgroup() string { 6566 if ev.BaseEvent.ProcessContext == nil { 6567 return "" 6568 } 6569 if ev.BaseEvent.ProcessContext.Parent == nil { 6570 return "" 6571 } 6572 if !ev.BaseEvent.ProcessContext.HasParent() { 6573 return "" 6574 } 6575 return ev.BaseEvent.ProcessContext.Parent.Credentials.EGroup 6576 } 6577 6578 // GetProcessParentEnvp returns the value of the field, resolving if necessary 6579 func (ev *Event) GetProcessParentEnvp() []string { 6580 if ev.BaseEvent.ProcessContext == nil { 6581 return []string{} 6582 } 6583 if ev.BaseEvent.ProcessContext.Parent == nil { 6584 return []string{} 6585 } 6586 if !ev.BaseEvent.ProcessContext.HasParent() { 6587 return []string{} 6588 } 6589 return ev.FieldHandlers.ResolveProcessEnvp(ev, ev.BaseEvent.ProcessContext.Parent) 6590 } 6591 6592 // GetProcessParentEnvs returns the value of the field, resolving if necessary 6593 func (ev *Event) GetProcessParentEnvs() []string { 6594 if ev.BaseEvent.ProcessContext == nil { 6595 return []string{} 6596 } 6597 if ev.BaseEvent.ProcessContext.Parent == nil { 6598 return []string{} 6599 } 6600 if !ev.BaseEvent.ProcessContext.HasParent() { 6601 return []string{} 6602 } 6603 return ev.FieldHandlers.ResolveProcessEnvs(ev, ev.BaseEvent.ProcessContext.Parent) 6604 } 6605 6606 // GetProcessParentEnvsTruncated returns the value of the field, resolving if necessary 6607 func (ev *Event) GetProcessParentEnvsTruncated() bool { 6608 if ev.BaseEvent.ProcessContext == nil { 6609 return false 6610 } 6611 if ev.BaseEvent.ProcessContext.Parent == nil { 6612 return false 6613 } 6614 if !ev.BaseEvent.ProcessContext.HasParent() { 6615 return false 6616 } 6617 return ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, ev.BaseEvent.ProcessContext.Parent) 6618 } 6619 6620 // GetProcessParentEuid returns the value of the field, resolving if necessary 6621 func (ev *Event) GetProcessParentEuid() uint32 { 6622 if ev.BaseEvent.ProcessContext == nil { 6623 return uint32(0) 6624 } 6625 if ev.BaseEvent.ProcessContext.Parent == nil { 6626 return uint32(0) 6627 } 6628 if !ev.BaseEvent.ProcessContext.HasParent() { 6629 return uint32(0) 6630 } 6631 return ev.BaseEvent.ProcessContext.Parent.Credentials.EUID 6632 } 6633 6634 // GetProcessParentEuser returns the value of the field, resolving if necessary 6635 func (ev *Event) GetProcessParentEuser() string { 6636 if ev.BaseEvent.ProcessContext == nil { 6637 return "" 6638 } 6639 if ev.BaseEvent.ProcessContext.Parent == nil { 6640 return "" 6641 } 6642 if !ev.BaseEvent.ProcessContext.HasParent() { 6643 return "" 6644 } 6645 return ev.BaseEvent.ProcessContext.Parent.Credentials.EUser 6646 } 6647 6648 // GetProcessParentFileChangeTime returns the value of the field, resolving if necessary 6649 func (ev *Event) GetProcessParentFileChangeTime() uint64 { 6650 if ev.BaseEvent.ProcessContext == nil { 6651 return uint64(0) 6652 } 6653 if ev.BaseEvent.ProcessContext.Parent == nil { 6654 return uint64(0) 6655 } 6656 if !ev.BaseEvent.ProcessContext.HasParent() { 6657 return uint64(0) 6658 } 6659 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6660 return uint64(0) 6661 } 6662 return ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields.CTime 6663 } 6664 6665 // GetProcessParentFileFilesystem returns the value of the field, resolving if necessary 6666 func (ev *Event) GetProcessParentFileFilesystem() string { 6667 if ev.BaseEvent.ProcessContext == nil { 6668 return "" 6669 } 6670 if ev.BaseEvent.ProcessContext.Parent == nil { 6671 return "" 6672 } 6673 if !ev.BaseEvent.ProcessContext.HasParent() { 6674 return "" 6675 } 6676 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6677 return "" 6678 } 6679 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent) 6680 } 6681 6682 // GetProcessParentFileGid returns the value of the field, resolving if necessary 6683 func (ev *Event) GetProcessParentFileGid() uint32 { 6684 if ev.BaseEvent.ProcessContext == nil { 6685 return uint32(0) 6686 } 6687 if ev.BaseEvent.ProcessContext.Parent == nil { 6688 return uint32(0) 6689 } 6690 if !ev.BaseEvent.ProcessContext.HasParent() { 6691 return uint32(0) 6692 } 6693 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6694 return uint32(0) 6695 } 6696 return ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields.GID 6697 } 6698 6699 // GetProcessParentFileGroup returns the value of the field, resolving if necessary 6700 func (ev *Event) GetProcessParentFileGroup() string { 6701 if ev.BaseEvent.ProcessContext == nil { 6702 return "" 6703 } 6704 if ev.BaseEvent.ProcessContext.Parent == nil { 6705 return "" 6706 } 6707 if !ev.BaseEvent.ProcessContext.HasParent() { 6708 return "" 6709 } 6710 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6711 return "" 6712 } 6713 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields) 6714 } 6715 6716 // GetProcessParentFileHashes returns the value of the field, resolving if necessary 6717 func (ev *Event) GetProcessParentFileHashes() []string { 6718 if ev.BaseEvent.ProcessContext == nil { 6719 return []string{} 6720 } 6721 if ev.BaseEvent.ProcessContext.Parent == nil { 6722 return []string{} 6723 } 6724 if !ev.BaseEvent.ProcessContext.HasParent() { 6725 return []string{} 6726 } 6727 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6728 return []string{} 6729 } 6730 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent) 6731 } 6732 6733 // GetProcessParentFileInUpperLayer returns the value of the field, resolving if necessary 6734 func (ev *Event) GetProcessParentFileInUpperLayer() bool { 6735 if ev.BaseEvent.ProcessContext == nil { 6736 return false 6737 } 6738 if ev.BaseEvent.ProcessContext.Parent == nil { 6739 return false 6740 } 6741 if !ev.BaseEvent.ProcessContext.HasParent() { 6742 return false 6743 } 6744 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6745 return false 6746 } 6747 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields) 6748 } 6749 6750 // GetProcessParentFileInode returns the value of the field, resolving if necessary 6751 func (ev *Event) GetProcessParentFileInode() uint64 { 6752 if ev.BaseEvent.ProcessContext == nil { 6753 return uint64(0) 6754 } 6755 if ev.BaseEvent.ProcessContext.Parent == nil { 6756 return uint64(0) 6757 } 6758 if !ev.BaseEvent.ProcessContext.HasParent() { 6759 return uint64(0) 6760 } 6761 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6762 return uint64(0) 6763 } 6764 return ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields.PathKey.Inode 6765 } 6766 6767 // GetProcessParentFileMode returns the value of the field, resolving if necessary 6768 func (ev *Event) GetProcessParentFileMode() uint16 { 6769 if ev.BaseEvent.ProcessContext == nil { 6770 return uint16(0) 6771 } 6772 if ev.BaseEvent.ProcessContext.Parent == nil { 6773 return uint16(0) 6774 } 6775 if !ev.BaseEvent.ProcessContext.HasParent() { 6776 return uint16(0) 6777 } 6778 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6779 return uint16(0) 6780 } 6781 return ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields.Mode 6782 } 6783 6784 // GetProcessParentFileModificationTime returns the value of the field, resolving if necessary 6785 func (ev *Event) GetProcessParentFileModificationTime() uint64 { 6786 if ev.BaseEvent.ProcessContext == nil { 6787 return uint64(0) 6788 } 6789 if ev.BaseEvent.ProcessContext.Parent == nil { 6790 return uint64(0) 6791 } 6792 if !ev.BaseEvent.ProcessContext.HasParent() { 6793 return uint64(0) 6794 } 6795 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6796 return uint64(0) 6797 } 6798 return ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields.MTime 6799 } 6800 6801 // GetProcessParentFileMountId returns the value of the field, resolving if necessary 6802 func (ev *Event) GetProcessParentFileMountId() uint32 { 6803 if ev.BaseEvent.ProcessContext == nil { 6804 return uint32(0) 6805 } 6806 if ev.BaseEvent.ProcessContext.Parent == nil { 6807 return uint32(0) 6808 } 6809 if !ev.BaseEvent.ProcessContext.HasParent() { 6810 return uint32(0) 6811 } 6812 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6813 return uint32(0) 6814 } 6815 return ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields.PathKey.MountID 6816 } 6817 6818 // GetProcessParentFileName returns the value of the field, resolving if necessary 6819 func (ev *Event) GetProcessParentFileName() string { 6820 if ev.BaseEvent.ProcessContext == nil { 6821 return "" 6822 } 6823 if ev.BaseEvent.ProcessContext.Parent == nil { 6824 return "" 6825 } 6826 if !ev.BaseEvent.ProcessContext.HasParent() { 6827 return "" 6828 } 6829 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6830 return "" 6831 } 6832 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent) 6833 } 6834 6835 // GetProcessParentFileNameLength returns the value of the field, resolving if necessary 6836 func (ev *Event) GetProcessParentFileNameLength() int { 6837 if ev.BaseEvent.ProcessContext == nil { 6838 return 0 6839 } 6840 if ev.BaseEvent.ProcessContext.Parent == nil { 6841 return 0 6842 } 6843 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent)) 6844 } 6845 6846 // GetProcessParentFilePackageName returns the value of the field, resolving if necessary 6847 func (ev *Event) GetProcessParentFilePackageName() string { 6848 if ev.BaseEvent.ProcessContext == nil { 6849 return "" 6850 } 6851 if ev.BaseEvent.ProcessContext.Parent == nil { 6852 return "" 6853 } 6854 if !ev.BaseEvent.ProcessContext.HasParent() { 6855 return "" 6856 } 6857 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6858 return "" 6859 } 6860 return ev.FieldHandlers.ResolvePackageName(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent) 6861 } 6862 6863 // GetProcessParentFilePackageSourceVersion returns the value of the field, resolving if necessary 6864 func (ev *Event) GetProcessParentFilePackageSourceVersion() string { 6865 if ev.BaseEvent.ProcessContext == nil { 6866 return "" 6867 } 6868 if ev.BaseEvent.ProcessContext.Parent == nil { 6869 return "" 6870 } 6871 if !ev.BaseEvent.ProcessContext.HasParent() { 6872 return "" 6873 } 6874 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6875 return "" 6876 } 6877 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent) 6878 } 6879 6880 // GetProcessParentFilePackageVersion returns the value of the field, resolving if necessary 6881 func (ev *Event) GetProcessParentFilePackageVersion() string { 6882 if ev.BaseEvent.ProcessContext == nil { 6883 return "" 6884 } 6885 if ev.BaseEvent.ProcessContext.Parent == nil { 6886 return "" 6887 } 6888 if !ev.BaseEvent.ProcessContext.HasParent() { 6889 return "" 6890 } 6891 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6892 return "" 6893 } 6894 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent) 6895 } 6896 6897 // GetProcessParentFilePath returns the value of the field, resolving if necessary 6898 func (ev *Event) GetProcessParentFilePath() string { 6899 if ev.BaseEvent.ProcessContext == nil { 6900 return "" 6901 } 6902 if ev.BaseEvent.ProcessContext.Parent == nil { 6903 return "" 6904 } 6905 if !ev.BaseEvent.ProcessContext.HasParent() { 6906 return "" 6907 } 6908 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6909 return "" 6910 } 6911 return ev.FieldHandlers.ResolveFilePath(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent) 6912 } 6913 6914 // GetProcessParentFilePathLength returns the value of the field, resolving if necessary 6915 func (ev *Event) GetProcessParentFilePathLength() int { 6916 if ev.BaseEvent.ProcessContext == nil { 6917 return 0 6918 } 6919 if ev.BaseEvent.ProcessContext.Parent == nil { 6920 return 0 6921 } 6922 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent)) 6923 } 6924 6925 // GetProcessParentFileRights returns the value of the field, resolving if necessary 6926 func (ev *Event) GetProcessParentFileRights() int { 6927 if ev.BaseEvent.ProcessContext == nil { 6928 return 0 6929 } 6930 if ev.BaseEvent.ProcessContext.Parent == nil { 6931 return 0 6932 } 6933 if !ev.BaseEvent.ProcessContext.HasParent() { 6934 return 0 6935 } 6936 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6937 return 0 6938 } 6939 return ev.FieldHandlers.ResolveRights(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields) 6940 } 6941 6942 // GetProcessParentFileUid returns the value of the field, resolving if necessary 6943 func (ev *Event) GetProcessParentFileUid() uint32 { 6944 if ev.BaseEvent.ProcessContext == nil { 6945 return uint32(0) 6946 } 6947 if ev.BaseEvent.ProcessContext.Parent == nil { 6948 return uint32(0) 6949 } 6950 if !ev.BaseEvent.ProcessContext.HasParent() { 6951 return uint32(0) 6952 } 6953 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6954 return uint32(0) 6955 } 6956 return ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields.UID 6957 } 6958 6959 // GetProcessParentFileUser returns the value of the field, resolving if necessary 6960 func (ev *Event) GetProcessParentFileUser() string { 6961 if ev.BaseEvent.ProcessContext == nil { 6962 return "" 6963 } 6964 if ev.BaseEvent.ProcessContext.Parent == nil { 6965 return "" 6966 } 6967 if !ev.BaseEvent.ProcessContext.HasParent() { 6968 return "" 6969 } 6970 if !ev.BaseEvent.ProcessContext.Parent.IsNotKworker() { 6971 return "" 6972 } 6973 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.BaseEvent.ProcessContext.Parent.FileEvent.FileFields) 6974 } 6975 6976 // GetProcessParentFsgid returns the value of the field, resolving if necessary 6977 func (ev *Event) GetProcessParentFsgid() uint32 { 6978 if ev.BaseEvent.ProcessContext == nil { 6979 return uint32(0) 6980 } 6981 if ev.BaseEvent.ProcessContext.Parent == nil { 6982 return uint32(0) 6983 } 6984 if !ev.BaseEvent.ProcessContext.HasParent() { 6985 return uint32(0) 6986 } 6987 return ev.BaseEvent.ProcessContext.Parent.Credentials.FSGID 6988 } 6989 6990 // GetProcessParentFsgroup returns the value of the field, resolving if necessary 6991 func (ev *Event) GetProcessParentFsgroup() string { 6992 if ev.BaseEvent.ProcessContext == nil { 6993 return "" 6994 } 6995 if ev.BaseEvent.ProcessContext.Parent == nil { 6996 return "" 6997 } 6998 if !ev.BaseEvent.ProcessContext.HasParent() { 6999 return "" 7000 } 7001 return ev.BaseEvent.ProcessContext.Parent.Credentials.FSGroup 7002 } 7003 7004 // GetProcessParentFsuid returns the value of the field, resolving if necessary 7005 func (ev *Event) GetProcessParentFsuid() uint32 { 7006 if ev.BaseEvent.ProcessContext == nil { 7007 return uint32(0) 7008 } 7009 if ev.BaseEvent.ProcessContext.Parent == nil { 7010 return uint32(0) 7011 } 7012 if !ev.BaseEvent.ProcessContext.HasParent() { 7013 return uint32(0) 7014 } 7015 return ev.BaseEvent.ProcessContext.Parent.Credentials.FSUID 7016 } 7017 7018 // GetProcessParentFsuser returns the value of the field, resolving if necessary 7019 func (ev *Event) GetProcessParentFsuser() string { 7020 if ev.BaseEvent.ProcessContext == nil { 7021 return "" 7022 } 7023 if ev.BaseEvent.ProcessContext.Parent == nil { 7024 return "" 7025 } 7026 if !ev.BaseEvent.ProcessContext.HasParent() { 7027 return "" 7028 } 7029 return ev.BaseEvent.ProcessContext.Parent.Credentials.FSUser 7030 } 7031 7032 // GetProcessParentGid returns the value of the field, resolving if necessary 7033 func (ev *Event) GetProcessParentGid() uint32 { 7034 if ev.BaseEvent.ProcessContext == nil { 7035 return uint32(0) 7036 } 7037 if ev.BaseEvent.ProcessContext.Parent == nil { 7038 return uint32(0) 7039 } 7040 if !ev.BaseEvent.ProcessContext.HasParent() { 7041 return uint32(0) 7042 } 7043 return ev.BaseEvent.ProcessContext.Parent.Credentials.GID 7044 } 7045 7046 // GetProcessParentGroup returns the value of the field, resolving if necessary 7047 func (ev *Event) GetProcessParentGroup() string { 7048 if ev.BaseEvent.ProcessContext == nil { 7049 return "" 7050 } 7051 if ev.BaseEvent.ProcessContext.Parent == nil { 7052 return "" 7053 } 7054 if !ev.BaseEvent.ProcessContext.HasParent() { 7055 return "" 7056 } 7057 return ev.BaseEvent.ProcessContext.Parent.Credentials.Group 7058 } 7059 7060 // GetProcessParentInterpreterFileChangeTime returns the value of the field, resolving if necessary 7061 func (ev *Event) GetProcessParentInterpreterFileChangeTime() uint64 { 7062 if ev.BaseEvent.ProcessContext == nil { 7063 return uint64(0) 7064 } 7065 if ev.BaseEvent.ProcessContext.Parent == nil { 7066 return uint64(0) 7067 } 7068 if !ev.BaseEvent.ProcessContext.HasParent() { 7069 return uint64(0) 7070 } 7071 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7072 return uint64(0) 7073 } 7074 return ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields.CTime 7075 } 7076 7077 // GetProcessParentInterpreterFileFilesystem returns the value of the field, resolving if necessary 7078 func (ev *Event) GetProcessParentInterpreterFileFilesystem() string { 7079 if ev.BaseEvent.ProcessContext == nil { 7080 return "" 7081 } 7082 if ev.BaseEvent.ProcessContext.Parent == nil { 7083 return "" 7084 } 7085 if !ev.BaseEvent.ProcessContext.HasParent() { 7086 return "" 7087 } 7088 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7089 return "" 7090 } 7091 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent) 7092 } 7093 7094 // GetProcessParentInterpreterFileGid returns the value of the field, resolving if necessary 7095 func (ev *Event) GetProcessParentInterpreterFileGid() uint32 { 7096 if ev.BaseEvent.ProcessContext == nil { 7097 return uint32(0) 7098 } 7099 if ev.BaseEvent.ProcessContext.Parent == nil { 7100 return uint32(0) 7101 } 7102 if !ev.BaseEvent.ProcessContext.HasParent() { 7103 return uint32(0) 7104 } 7105 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7106 return uint32(0) 7107 } 7108 return ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields.GID 7109 } 7110 7111 // GetProcessParentInterpreterFileGroup returns the value of the field, resolving if necessary 7112 func (ev *Event) GetProcessParentInterpreterFileGroup() string { 7113 if ev.BaseEvent.ProcessContext == nil { 7114 return "" 7115 } 7116 if ev.BaseEvent.ProcessContext.Parent == nil { 7117 return "" 7118 } 7119 if !ev.BaseEvent.ProcessContext.HasParent() { 7120 return "" 7121 } 7122 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7123 return "" 7124 } 7125 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields) 7126 } 7127 7128 // GetProcessParentInterpreterFileHashes returns the value of the field, resolving if necessary 7129 func (ev *Event) GetProcessParentInterpreterFileHashes() []string { 7130 if ev.BaseEvent.ProcessContext == nil { 7131 return []string{} 7132 } 7133 if ev.BaseEvent.ProcessContext.Parent == nil { 7134 return []string{} 7135 } 7136 if !ev.BaseEvent.ProcessContext.HasParent() { 7137 return []string{} 7138 } 7139 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7140 return []string{} 7141 } 7142 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent) 7143 } 7144 7145 // GetProcessParentInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 7146 func (ev *Event) GetProcessParentInterpreterFileInUpperLayer() bool { 7147 if ev.BaseEvent.ProcessContext == nil { 7148 return false 7149 } 7150 if ev.BaseEvent.ProcessContext.Parent == nil { 7151 return false 7152 } 7153 if !ev.BaseEvent.ProcessContext.HasParent() { 7154 return false 7155 } 7156 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7157 return false 7158 } 7159 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields) 7160 } 7161 7162 // GetProcessParentInterpreterFileInode returns the value of the field, resolving if necessary 7163 func (ev *Event) GetProcessParentInterpreterFileInode() uint64 { 7164 if ev.BaseEvent.ProcessContext == nil { 7165 return uint64(0) 7166 } 7167 if ev.BaseEvent.ProcessContext.Parent == nil { 7168 return uint64(0) 7169 } 7170 if !ev.BaseEvent.ProcessContext.HasParent() { 7171 return uint64(0) 7172 } 7173 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7174 return uint64(0) 7175 } 7176 return ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 7177 } 7178 7179 // GetProcessParentInterpreterFileMode returns the value of the field, resolving if necessary 7180 func (ev *Event) GetProcessParentInterpreterFileMode() uint16 { 7181 if ev.BaseEvent.ProcessContext == nil { 7182 return uint16(0) 7183 } 7184 if ev.BaseEvent.ProcessContext.Parent == nil { 7185 return uint16(0) 7186 } 7187 if !ev.BaseEvent.ProcessContext.HasParent() { 7188 return uint16(0) 7189 } 7190 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7191 return uint16(0) 7192 } 7193 return ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields.Mode 7194 } 7195 7196 // GetProcessParentInterpreterFileModificationTime returns the value of the field, resolving if necessary 7197 func (ev *Event) GetProcessParentInterpreterFileModificationTime() uint64 { 7198 if ev.BaseEvent.ProcessContext == nil { 7199 return uint64(0) 7200 } 7201 if ev.BaseEvent.ProcessContext.Parent == nil { 7202 return uint64(0) 7203 } 7204 if !ev.BaseEvent.ProcessContext.HasParent() { 7205 return uint64(0) 7206 } 7207 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7208 return uint64(0) 7209 } 7210 return ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields.MTime 7211 } 7212 7213 // GetProcessParentInterpreterFileMountId returns the value of the field, resolving if necessary 7214 func (ev *Event) GetProcessParentInterpreterFileMountId() uint32 { 7215 if ev.BaseEvent.ProcessContext == nil { 7216 return uint32(0) 7217 } 7218 if ev.BaseEvent.ProcessContext.Parent == nil { 7219 return uint32(0) 7220 } 7221 if !ev.BaseEvent.ProcessContext.HasParent() { 7222 return uint32(0) 7223 } 7224 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7225 return uint32(0) 7226 } 7227 return ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 7228 } 7229 7230 // GetProcessParentInterpreterFileName returns the value of the field, resolving if necessary 7231 func (ev *Event) GetProcessParentInterpreterFileName() string { 7232 if ev.BaseEvent.ProcessContext == nil { 7233 return "" 7234 } 7235 if ev.BaseEvent.ProcessContext.Parent == nil { 7236 return "" 7237 } 7238 if !ev.BaseEvent.ProcessContext.HasParent() { 7239 return "" 7240 } 7241 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7242 return "" 7243 } 7244 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent) 7245 } 7246 7247 // GetProcessParentInterpreterFileNameLength returns the value of the field, resolving if necessary 7248 func (ev *Event) GetProcessParentInterpreterFileNameLength() int { 7249 if ev.BaseEvent.ProcessContext == nil { 7250 return 0 7251 } 7252 if ev.BaseEvent.ProcessContext.Parent == nil { 7253 return 0 7254 } 7255 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent)) 7256 } 7257 7258 // GetProcessParentInterpreterFilePackageName returns the value of the field, resolving if necessary 7259 func (ev *Event) GetProcessParentInterpreterFilePackageName() string { 7260 if ev.BaseEvent.ProcessContext == nil { 7261 return "" 7262 } 7263 if ev.BaseEvent.ProcessContext.Parent == nil { 7264 return "" 7265 } 7266 if !ev.BaseEvent.ProcessContext.HasParent() { 7267 return "" 7268 } 7269 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7270 return "" 7271 } 7272 return ev.FieldHandlers.ResolvePackageName(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent) 7273 } 7274 7275 // GetProcessParentInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 7276 func (ev *Event) GetProcessParentInterpreterFilePackageSourceVersion() string { 7277 if ev.BaseEvent.ProcessContext == nil { 7278 return "" 7279 } 7280 if ev.BaseEvent.ProcessContext.Parent == nil { 7281 return "" 7282 } 7283 if !ev.BaseEvent.ProcessContext.HasParent() { 7284 return "" 7285 } 7286 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7287 return "" 7288 } 7289 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent) 7290 } 7291 7292 // GetProcessParentInterpreterFilePackageVersion returns the value of the field, resolving if necessary 7293 func (ev *Event) GetProcessParentInterpreterFilePackageVersion() string { 7294 if ev.BaseEvent.ProcessContext == nil { 7295 return "" 7296 } 7297 if ev.BaseEvent.ProcessContext.Parent == nil { 7298 return "" 7299 } 7300 if !ev.BaseEvent.ProcessContext.HasParent() { 7301 return "" 7302 } 7303 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7304 return "" 7305 } 7306 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent) 7307 } 7308 7309 // GetProcessParentInterpreterFilePath returns the value of the field, resolving if necessary 7310 func (ev *Event) GetProcessParentInterpreterFilePath() string { 7311 if ev.BaseEvent.ProcessContext == nil { 7312 return "" 7313 } 7314 if ev.BaseEvent.ProcessContext.Parent == nil { 7315 return "" 7316 } 7317 if !ev.BaseEvent.ProcessContext.HasParent() { 7318 return "" 7319 } 7320 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7321 return "" 7322 } 7323 return ev.FieldHandlers.ResolveFilePath(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent) 7324 } 7325 7326 // GetProcessParentInterpreterFilePathLength returns the value of the field, resolving if necessary 7327 func (ev *Event) GetProcessParentInterpreterFilePathLength() int { 7328 if ev.BaseEvent.ProcessContext == nil { 7329 return 0 7330 } 7331 if ev.BaseEvent.ProcessContext.Parent == nil { 7332 return 0 7333 } 7334 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent)) 7335 } 7336 7337 // GetProcessParentInterpreterFileRights returns the value of the field, resolving if necessary 7338 func (ev *Event) GetProcessParentInterpreterFileRights() int { 7339 if ev.BaseEvent.ProcessContext == nil { 7340 return 0 7341 } 7342 if ev.BaseEvent.ProcessContext.Parent == nil { 7343 return 0 7344 } 7345 if !ev.BaseEvent.ProcessContext.HasParent() { 7346 return 0 7347 } 7348 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7349 return 0 7350 } 7351 return ev.FieldHandlers.ResolveRights(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields) 7352 } 7353 7354 // GetProcessParentInterpreterFileUid returns the value of the field, resolving if necessary 7355 func (ev *Event) GetProcessParentInterpreterFileUid() uint32 { 7356 if ev.BaseEvent.ProcessContext == nil { 7357 return uint32(0) 7358 } 7359 if ev.BaseEvent.ProcessContext.Parent == nil { 7360 return uint32(0) 7361 } 7362 if !ev.BaseEvent.ProcessContext.HasParent() { 7363 return uint32(0) 7364 } 7365 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7366 return uint32(0) 7367 } 7368 return ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields.UID 7369 } 7370 7371 // GetProcessParentInterpreterFileUser returns the value of the field, resolving if necessary 7372 func (ev *Event) GetProcessParentInterpreterFileUser() string { 7373 if ev.BaseEvent.ProcessContext == nil { 7374 return "" 7375 } 7376 if ev.BaseEvent.ProcessContext.Parent == nil { 7377 return "" 7378 } 7379 if !ev.BaseEvent.ProcessContext.HasParent() { 7380 return "" 7381 } 7382 if !ev.BaseEvent.ProcessContext.Parent.HasInterpreter() { 7383 return "" 7384 } 7385 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.BaseEvent.ProcessContext.Parent.LinuxBinprm.FileEvent.FileFields) 7386 } 7387 7388 // GetProcessParentIsKworker returns the value of the field, resolving if necessary 7389 func (ev *Event) GetProcessParentIsKworker() bool { 7390 if ev.BaseEvent.ProcessContext == nil { 7391 return false 7392 } 7393 if ev.BaseEvent.ProcessContext.Parent == nil { 7394 return false 7395 } 7396 if !ev.BaseEvent.ProcessContext.HasParent() { 7397 return false 7398 } 7399 return ev.BaseEvent.ProcessContext.Parent.PIDContext.IsKworker 7400 } 7401 7402 // GetProcessParentIsThread returns the value of the field, resolving if necessary 7403 func (ev *Event) GetProcessParentIsThread() bool { 7404 if ev.BaseEvent.ProcessContext == nil { 7405 return false 7406 } 7407 if ev.BaseEvent.ProcessContext.Parent == nil { 7408 return false 7409 } 7410 if !ev.BaseEvent.ProcessContext.HasParent() { 7411 return false 7412 } 7413 return ev.BaseEvent.ProcessContext.Parent.IsThread 7414 } 7415 7416 // GetProcessParentPid returns the value of the field, resolving if necessary 7417 func (ev *Event) GetProcessParentPid() uint32 { 7418 if ev.BaseEvent.ProcessContext == nil { 7419 return uint32(0) 7420 } 7421 if ev.BaseEvent.ProcessContext.Parent == nil { 7422 return uint32(0) 7423 } 7424 if !ev.BaseEvent.ProcessContext.HasParent() { 7425 return uint32(0) 7426 } 7427 return ev.BaseEvent.ProcessContext.Parent.PIDContext.Pid 7428 } 7429 7430 // GetProcessParentPpid returns the value of the field, resolving if necessary 7431 func (ev *Event) GetProcessParentPpid() uint32 { 7432 if ev.BaseEvent.ProcessContext == nil { 7433 return uint32(0) 7434 } 7435 if ev.BaseEvent.ProcessContext.Parent == nil { 7436 return uint32(0) 7437 } 7438 if !ev.BaseEvent.ProcessContext.HasParent() { 7439 return uint32(0) 7440 } 7441 return ev.BaseEvent.ProcessContext.Parent.PPid 7442 } 7443 7444 // GetProcessParentTid returns the value of the field, resolving if necessary 7445 func (ev *Event) GetProcessParentTid() uint32 { 7446 if ev.BaseEvent.ProcessContext == nil { 7447 return uint32(0) 7448 } 7449 if ev.BaseEvent.ProcessContext.Parent == nil { 7450 return uint32(0) 7451 } 7452 if !ev.BaseEvent.ProcessContext.HasParent() { 7453 return uint32(0) 7454 } 7455 return ev.BaseEvent.ProcessContext.Parent.PIDContext.Tid 7456 } 7457 7458 // GetProcessParentTtyName returns the value of the field, resolving if necessary 7459 func (ev *Event) GetProcessParentTtyName() string { 7460 if ev.BaseEvent.ProcessContext == nil { 7461 return "" 7462 } 7463 if ev.BaseEvent.ProcessContext.Parent == nil { 7464 return "" 7465 } 7466 if !ev.BaseEvent.ProcessContext.HasParent() { 7467 return "" 7468 } 7469 return ev.BaseEvent.ProcessContext.Parent.TTYName 7470 } 7471 7472 // GetProcessParentUid returns the value of the field, resolving if necessary 7473 func (ev *Event) GetProcessParentUid() uint32 { 7474 if ev.BaseEvent.ProcessContext == nil { 7475 return uint32(0) 7476 } 7477 if ev.BaseEvent.ProcessContext.Parent == nil { 7478 return uint32(0) 7479 } 7480 if !ev.BaseEvent.ProcessContext.HasParent() { 7481 return uint32(0) 7482 } 7483 return ev.BaseEvent.ProcessContext.Parent.Credentials.UID 7484 } 7485 7486 // GetProcessParentUser returns the value of the field, resolving if necessary 7487 func (ev *Event) GetProcessParentUser() string { 7488 if ev.BaseEvent.ProcessContext == nil { 7489 return "" 7490 } 7491 if ev.BaseEvent.ProcessContext.Parent == nil { 7492 return "" 7493 } 7494 if !ev.BaseEvent.ProcessContext.HasParent() { 7495 return "" 7496 } 7497 return ev.BaseEvent.ProcessContext.Parent.Credentials.User 7498 } 7499 7500 // GetProcessParentUserSessionK8sGroups returns the value of the field, resolving if necessary 7501 func (ev *Event) GetProcessParentUserSessionK8sGroups() []string { 7502 if ev.BaseEvent.ProcessContext == nil { 7503 return []string{} 7504 } 7505 if ev.BaseEvent.ProcessContext.Parent == nil { 7506 return []string{} 7507 } 7508 if !ev.BaseEvent.ProcessContext.HasParent() { 7509 return []string{} 7510 } 7511 return ev.FieldHandlers.ResolveK8SGroups(ev, &ev.BaseEvent.ProcessContext.Parent.UserSession) 7512 } 7513 7514 // GetProcessParentUserSessionK8sUid returns the value of the field, resolving if necessary 7515 func (ev *Event) GetProcessParentUserSessionK8sUid() string { 7516 if ev.BaseEvent.ProcessContext == nil { 7517 return "" 7518 } 7519 if ev.BaseEvent.ProcessContext.Parent == nil { 7520 return "" 7521 } 7522 if !ev.BaseEvent.ProcessContext.HasParent() { 7523 return "" 7524 } 7525 return ev.FieldHandlers.ResolveK8SUID(ev, &ev.BaseEvent.ProcessContext.Parent.UserSession) 7526 } 7527 7528 // GetProcessParentUserSessionK8sUsername returns the value of the field, resolving if necessary 7529 func (ev *Event) GetProcessParentUserSessionK8sUsername() string { 7530 if ev.BaseEvent.ProcessContext == nil { 7531 return "" 7532 } 7533 if ev.BaseEvent.ProcessContext.Parent == nil { 7534 return "" 7535 } 7536 if !ev.BaseEvent.ProcessContext.HasParent() { 7537 return "" 7538 } 7539 return ev.FieldHandlers.ResolveK8SUsername(ev, &ev.BaseEvent.ProcessContext.Parent.UserSession) 7540 } 7541 7542 // GetProcessPid returns the value of the field, resolving if necessary 7543 func (ev *Event) GetProcessPid() uint32 { 7544 if ev.BaseEvent.ProcessContext == nil { 7545 return uint32(0) 7546 } 7547 return ev.BaseEvent.ProcessContext.Process.PIDContext.Pid 7548 } 7549 7550 // GetProcessPpid returns the value of the field, resolving if necessary 7551 func (ev *Event) GetProcessPpid() uint32 { 7552 if ev.BaseEvent.ProcessContext == nil { 7553 return uint32(0) 7554 } 7555 return ev.BaseEvent.ProcessContext.Process.PPid 7556 } 7557 7558 // GetProcessTid returns the value of the field, resolving if necessary 7559 func (ev *Event) GetProcessTid() uint32 { 7560 if ev.BaseEvent.ProcessContext == nil { 7561 return uint32(0) 7562 } 7563 return ev.BaseEvent.ProcessContext.Process.PIDContext.Tid 7564 } 7565 7566 // GetProcessTtyName returns the value of the field, resolving if necessary 7567 func (ev *Event) GetProcessTtyName() string { 7568 if ev.BaseEvent.ProcessContext == nil { 7569 return "" 7570 } 7571 return ev.BaseEvent.ProcessContext.Process.TTYName 7572 } 7573 7574 // GetProcessUid returns the value of the field, resolving if necessary 7575 func (ev *Event) GetProcessUid() uint32 { 7576 if ev.BaseEvent.ProcessContext == nil { 7577 return uint32(0) 7578 } 7579 return ev.BaseEvent.ProcessContext.Process.Credentials.UID 7580 } 7581 7582 // GetProcessUser returns the value of the field, resolving if necessary 7583 func (ev *Event) GetProcessUser() string { 7584 if ev.BaseEvent.ProcessContext == nil { 7585 return "" 7586 } 7587 return ev.BaseEvent.ProcessContext.Process.Credentials.User 7588 } 7589 7590 // GetProcessUserSessionK8sGroups returns the value of the field, resolving if necessary 7591 func (ev *Event) GetProcessUserSessionK8sGroups() []string { 7592 if ev.BaseEvent.ProcessContext == nil { 7593 return []string{} 7594 } 7595 return ev.FieldHandlers.ResolveK8SGroups(ev, &ev.BaseEvent.ProcessContext.Process.UserSession) 7596 } 7597 7598 // GetProcessUserSessionK8sUid returns the value of the field, resolving if necessary 7599 func (ev *Event) GetProcessUserSessionK8sUid() string { 7600 if ev.BaseEvent.ProcessContext == nil { 7601 return "" 7602 } 7603 return ev.FieldHandlers.ResolveK8SUID(ev, &ev.BaseEvent.ProcessContext.Process.UserSession) 7604 } 7605 7606 // GetProcessUserSessionK8sUsername returns the value of the field, resolving if necessary 7607 func (ev *Event) GetProcessUserSessionK8sUsername() string { 7608 if ev.BaseEvent.ProcessContext == nil { 7609 return "" 7610 } 7611 return ev.FieldHandlers.ResolveK8SUsername(ev, &ev.BaseEvent.ProcessContext.Process.UserSession) 7612 } 7613 7614 // GetPtraceRequest returns the value of the field, resolving if necessary 7615 func (ev *Event) GetPtraceRequest() uint32 { 7616 if ev.GetEventType().String() != "ptrace" { 7617 return uint32(0) 7618 } 7619 return ev.PTrace.Request 7620 } 7621 7622 // GetPtraceRetval returns the value of the field, resolving if necessary 7623 func (ev *Event) GetPtraceRetval() int64 { 7624 if ev.GetEventType().String() != "ptrace" { 7625 return int64(0) 7626 } 7627 return ev.PTrace.SyscallEvent.Retval 7628 } 7629 7630 // GetPtraceTraceeAncestorsArgs returns the value of the field, resolving if necessary 7631 func (ev *Event) GetPtraceTraceeAncestorsArgs() []string { 7632 if ev.GetEventType().String() != "ptrace" { 7633 return []string{} 7634 } 7635 if ev.PTrace.Tracee == nil { 7636 return []string{} 7637 } 7638 if ev.PTrace.Tracee.Ancestor == nil { 7639 return []string{} 7640 } 7641 var values []string 7642 ctx := eval.NewContext(ev) 7643 iterator := &ProcessAncestorsIterator{} 7644 ptr := iterator.Front(ctx) 7645 for ptr != nil { 7646 element := (*ProcessCacheEntry)(ptr) 7647 result := ev.FieldHandlers.ResolveProcessArgs(ev, &element.ProcessContext.Process) 7648 values = append(values, result) 7649 ptr = iterator.Next() 7650 } 7651 return values 7652 } 7653 7654 // GetPtraceTraceeAncestorsArgsFlags returns the value of the field, resolving if necessary 7655 func (ev *Event) GetPtraceTraceeAncestorsArgsFlags() []string { 7656 if ev.GetEventType().String() != "ptrace" { 7657 return []string{} 7658 } 7659 if ev.PTrace.Tracee == nil { 7660 return []string{} 7661 } 7662 if ev.PTrace.Tracee.Ancestor == nil { 7663 return []string{} 7664 } 7665 var values []string 7666 ctx := eval.NewContext(ev) 7667 iterator := &ProcessAncestorsIterator{} 7668 ptr := iterator.Front(ctx) 7669 for ptr != nil { 7670 element := (*ProcessCacheEntry)(ptr) 7671 result := ev.FieldHandlers.ResolveProcessArgsFlags(ev, &element.ProcessContext.Process) 7672 values = append(values, result...) 7673 ptr = iterator.Next() 7674 } 7675 return values 7676 } 7677 7678 // GetPtraceTraceeAncestorsArgsOptions returns the value of the field, resolving if necessary 7679 func (ev *Event) GetPtraceTraceeAncestorsArgsOptions() []string { 7680 if ev.GetEventType().String() != "ptrace" { 7681 return []string{} 7682 } 7683 if ev.PTrace.Tracee == nil { 7684 return []string{} 7685 } 7686 if ev.PTrace.Tracee.Ancestor == nil { 7687 return []string{} 7688 } 7689 var values []string 7690 ctx := eval.NewContext(ev) 7691 iterator := &ProcessAncestorsIterator{} 7692 ptr := iterator.Front(ctx) 7693 for ptr != nil { 7694 element := (*ProcessCacheEntry)(ptr) 7695 result := ev.FieldHandlers.ResolveProcessArgsOptions(ev, &element.ProcessContext.Process) 7696 values = append(values, result...) 7697 ptr = iterator.Next() 7698 } 7699 return values 7700 } 7701 7702 // GetPtraceTraceeAncestorsArgsScrubbed returns the value of the field, resolving if necessary 7703 func (ev *Event) GetPtraceTraceeAncestorsArgsScrubbed() []string { 7704 if ev.GetEventType().String() != "ptrace" { 7705 return []string{} 7706 } 7707 if ev.PTrace.Tracee == nil { 7708 return []string{} 7709 } 7710 if ev.PTrace.Tracee.Ancestor == nil { 7711 return []string{} 7712 } 7713 var values []string 7714 ctx := eval.NewContext(ev) 7715 iterator := &ProcessAncestorsIterator{} 7716 ptr := iterator.Front(ctx) 7717 for ptr != nil { 7718 element := (*ProcessCacheEntry)(ptr) 7719 result := ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, &element.ProcessContext.Process) 7720 values = append(values, result) 7721 ptr = iterator.Next() 7722 } 7723 return values 7724 } 7725 7726 // GetPtraceTraceeAncestorsArgsTruncated returns the value of the field, resolving if necessary 7727 func (ev *Event) GetPtraceTraceeAncestorsArgsTruncated() []bool { 7728 if ev.GetEventType().String() != "ptrace" { 7729 return []bool{} 7730 } 7731 if ev.PTrace.Tracee == nil { 7732 return []bool{} 7733 } 7734 if ev.PTrace.Tracee.Ancestor == nil { 7735 return []bool{} 7736 } 7737 var values []bool 7738 ctx := eval.NewContext(ev) 7739 iterator := &ProcessAncestorsIterator{} 7740 ptr := iterator.Front(ctx) 7741 for ptr != nil { 7742 element := (*ProcessCacheEntry)(ptr) 7743 result := ev.FieldHandlers.ResolveProcessArgsTruncated(ev, &element.ProcessContext.Process) 7744 values = append(values, result) 7745 ptr = iterator.Next() 7746 } 7747 return values 7748 } 7749 7750 // GetPtraceTraceeAncestorsArgv returns the value of the field, resolving if necessary 7751 func (ev *Event) GetPtraceTraceeAncestorsArgv() []string { 7752 if ev.GetEventType().String() != "ptrace" { 7753 return []string{} 7754 } 7755 if ev.PTrace.Tracee == nil { 7756 return []string{} 7757 } 7758 if ev.PTrace.Tracee.Ancestor == nil { 7759 return []string{} 7760 } 7761 var values []string 7762 ctx := eval.NewContext(ev) 7763 iterator := &ProcessAncestorsIterator{} 7764 ptr := iterator.Front(ctx) 7765 for ptr != nil { 7766 element := (*ProcessCacheEntry)(ptr) 7767 result := ev.FieldHandlers.ResolveProcessArgv(ev, &element.ProcessContext.Process) 7768 values = append(values, result...) 7769 ptr = iterator.Next() 7770 } 7771 return values 7772 } 7773 7774 // GetPtraceTraceeAncestorsArgv0 returns the value of the field, resolving if necessary 7775 func (ev *Event) GetPtraceTraceeAncestorsArgv0() []string { 7776 if ev.GetEventType().String() != "ptrace" { 7777 return []string{} 7778 } 7779 if ev.PTrace.Tracee == nil { 7780 return []string{} 7781 } 7782 if ev.PTrace.Tracee.Ancestor == nil { 7783 return []string{} 7784 } 7785 var values []string 7786 ctx := eval.NewContext(ev) 7787 iterator := &ProcessAncestorsIterator{} 7788 ptr := iterator.Front(ctx) 7789 for ptr != nil { 7790 element := (*ProcessCacheEntry)(ptr) 7791 result := ev.FieldHandlers.ResolveProcessArgv0(ev, &element.ProcessContext.Process) 7792 values = append(values, result) 7793 ptr = iterator.Next() 7794 } 7795 return values 7796 } 7797 7798 // GetPtraceTraceeAncestorsArgvScrubbed returns the value of the field, resolving if necessary 7799 func (ev *Event) GetPtraceTraceeAncestorsArgvScrubbed() []string { 7800 if ev.GetEventType().String() != "ptrace" { 7801 return []string{} 7802 } 7803 if ev.PTrace.Tracee == nil { 7804 return []string{} 7805 } 7806 if ev.PTrace.Tracee.Ancestor == nil { 7807 return []string{} 7808 } 7809 var values []string 7810 ctx := eval.NewContext(ev) 7811 iterator := &ProcessAncestorsIterator{} 7812 ptr := iterator.Front(ctx) 7813 for ptr != nil { 7814 element := (*ProcessCacheEntry)(ptr) 7815 result := ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, &element.ProcessContext.Process) 7816 values = append(values, result...) 7817 ptr = iterator.Next() 7818 } 7819 return values 7820 } 7821 7822 // GetPtraceTraceeAncestorsCapEffective returns the value of the field, resolving if necessary 7823 func (ev *Event) GetPtraceTraceeAncestorsCapEffective() []uint64 { 7824 if ev.GetEventType().String() != "ptrace" { 7825 return []uint64{} 7826 } 7827 if ev.PTrace.Tracee == nil { 7828 return []uint64{} 7829 } 7830 if ev.PTrace.Tracee.Ancestor == nil { 7831 return []uint64{} 7832 } 7833 var values []uint64 7834 ctx := eval.NewContext(ev) 7835 iterator := &ProcessAncestorsIterator{} 7836 ptr := iterator.Front(ctx) 7837 for ptr != nil { 7838 element := (*ProcessCacheEntry)(ptr) 7839 result := element.ProcessContext.Process.Credentials.CapEffective 7840 values = append(values, result) 7841 ptr = iterator.Next() 7842 } 7843 return values 7844 } 7845 7846 // GetPtraceTraceeAncestorsCapPermitted returns the value of the field, resolving if necessary 7847 func (ev *Event) GetPtraceTraceeAncestorsCapPermitted() []uint64 { 7848 if ev.GetEventType().String() != "ptrace" { 7849 return []uint64{} 7850 } 7851 if ev.PTrace.Tracee == nil { 7852 return []uint64{} 7853 } 7854 if ev.PTrace.Tracee.Ancestor == nil { 7855 return []uint64{} 7856 } 7857 var values []uint64 7858 ctx := eval.NewContext(ev) 7859 iterator := &ProcessAncestorsIterator{} 7860 ptr := iterator.Front(ctx) 7861 for ptr != nil { 7862 element := (*ProcessCacheEntry)(ptr) 7863 result := element.ProcessContext.Process.Credentials.CapPermitted 7864 values = append(values, result) 7865 ptr = iterator.Next() 7866 } 7867 return values 7868 } 7869 7870 // GetPtraceTraceeAncestorsCmdargv returns the value of the field, resolving if necessary 7871 func (ev *Event) GetPtraceTraceeAncestorsCmdargv() []string { 7872 if ev.GetEventType().String() != "ptrace" { 7873 return []string{} 7874 } 7875 if ev.PTrace.Tracee == nil { 7876 return []string{} 7877 } 7878 if ev.PTrace.Tracee.Ancestor == nil { 7879 return []string{} 7880 } 7881 var values []string 7882 ctx := eval.NewContext(ev) 7883 iterator := &ProcessAncestorsIterator{} 7884 ptr := iterator.Front(ctx) 7885 for ptr != nil { 7886 element := (*ProcessCacheEntry)(ptr) 7887 result := ev.FieldHandlers.ResolveProcessCmdArgv(ev, &element.ProcessContext.Process) 7888 values = append(values, result...) 7889 ptr = iterator.Next() 7890 } 7891 return values 7892 } 7893 7894 // GetPtraceTraceeAncestorsComm returns the value of the field, resolving if necessary 7895 func (ev *Event) GetPtraceTraceeAncestorsComm() []string { 7896 if ev.GetEventType().String() != "ptrace" { 7897 return []string{} 7898 } 7899 if ev.PTrace.Tracee == nil { 7900 return []string{} 7901 } 7902 if ev.PTrace.Tracee.Ancestor == nil { 7903 return []string{} 7904 } 7905 var values []string 7906 ctx := eval.NewContext(ev) 7907 iterator := &ProcessAncestorsIterator{} 7908 ptr := iterator.Front(ctx) 7909 for ptr != nil { 7910 element := (*ProcessCacheEntry)(ptr) 7911 result := element.ProcessContext.Process.Comm 7912 values = append(values, result) 7913 ptr = iterator.Next() 7914 } 7915 return values 7916 } 7917 7918 // GetPtraceTraceeAncestorsContainerId returns the value of the field, resolving if necessary 7919 func (ev *Event) GetPtraceTraceeAncestorsContainerId() []string { 7920 if ev.GetEventType().String() != "ptrace" { 7921 return []string{} 7922 } 7923 if ev.PTrace.Tracee == nil { 7924 return []string{} 7925 } 7926 if ev.PTrace.Tracee.Ancestor == nil { 7927 return []string{} 7928 } 7929 var values []string 7930 ctx := eval.NewContext(ev) 7931 iterator := &ProcessAncestorsIterator{} 7932 ptr := iterator.Front(ctx) 7933 for ptr != nil { 7934 element := (*ProcessCacheEntry)(ptr) 7935 result := element.ProcessContext.Process.ContainerID 7936 values = append(values, result) 7937 ptr = iterator.Next() 7938 } 7939 return values 7940 } 7941 7942 // GetPtraceTraceeAncestorsCreatedAt returns the value of the field, resolving if necessary 7943 func (ev *Event) GetPtraceTraceeAncestorsCreatedAt() []int { 7944 if ev.GetEventType().String() != "ptrace" { 7945 return []int{} 7946 } 7947 if ev.PTrace.Tracee == nil { 7948 return []int{} 7949 } 7950 if ev.PTrace.Tracee.Ancestor == nil { 7951 return []int{} 7952 } 7953 var values []int 7954 ctx := eval.NewContext(ev) 7955 iterator := &ProcessAncestorsIterator{} 7956 ptr := iterator.Front(ctx) 7957 for ptr != nil { 7958 element := (*ProcessCacheEntry)(ptr) 7959 result := int(ev.FieldHandlers.ResolveProcessCreatedAt(ev, &element.ProcessContext.Process)) 7960 values = append(values, result) 7961 ptr = iterator.Next() 7962 } 7963 return values 7964 } 7965 7966 // GetPtraceTraceeAncestorsEgid returns the value of the field, resolving if necessary 7967 func (ev *Event) GetPtraceTraceeAncestorsEgid() []uint32 { 7968 if ev.GetEventType().String() != "ptrace" { 7969 return []uint32{} 7970 } 7971 if ev.PTrace.Tracee == nil { 7972 return []uint32{} 7973 } 7974 if ev.PTrace.Tracee.Ancestor == nil { 7975 return []uint32{} 7976 } 7977 var values []uint32 7978 ctx := eval.NewContext(ev) 7979 iterator := &ProcessAncestorsIterator{} 7980 ptr := iterator.Front(ctx) 7981 for ptr != nil { 7982 element := (*ProcessCacheEntry)(ptr) 7983 result := element.ProcessContext.Process.Credentials.EGID 7984 values = append(values, result) 7985 ptr = iterator.Next() 7986 } 7987 return values 7988 } 7989 7990 // GetPtraceTraceeAncestorsEgroup returns the value of the field, resolving if necessary 7991 func (ev *Event) GetPtraceTraceeAncestorsEgroup() []string { 7992 if ev.GetEventType().String() != "ptrace" { 7993 return []string{} 7994 } 7995 if ev.PTrace.Tracee == nil { 7996 return []string{} 7997 } 7998 if ev.PTrace.Tracee.Ancestor == nil { 7999 return []string{} 8000 } 8001 var values []string 8002 ctx := eval.NewContext(ev) 8003 iterator := &ProcessAncestorsIterator{} 8004 ptr := iterator.Front(ctx) 8005 for ptr != nil { 8006 element := (*ProcessCacheEntry)(ptr) 8007 result := element.ProcessContext.Process.Credentials.EGroup 8008 values = append(values, result) 8009 ptr = iterator.Next() 8010 } 8011 return values 8012 } 8013 8014 // GetPtraceTraceeAncestorsEnvp returns the value of the field, resolving if necessary 8015 func (ev *Event) GetPtraceTraceeAncestorsEnvp() []string { 8016 if ev.GetEventType().String() != "ptrace" { 8017 return []string{} 8018 } 8019 if ev.PTrace.Tracee == nil { 8020 return []string{} 8021 } 8022 if ev.PTrace.Tracee.Ancestor == nil { 8023 return []string{} 8024 } 8025 var values []string 8026 ctx := eval.NewContext(ev) 8027 iterator := &ProcessAncestorsIterator{} 8028 ptr := iterator.Front(ctx) 8029 for ptr != nil { 8030 element := (*ProcessCacheEntry)(ptr) 8031 result := ev.FieldHandlers.ResolveProcessEnvp(ev, &element.ProcessContext.Process) 8032 values = append(values, result...) 8033 ptr = iterator.Next() 8034 } 8035 return values 8036 } 8037 8038 // GetPtraceTraceeAncestorsEnvs returns the value of the field, resolving if necessary 8039 func (ev *Event) GetPtraceTraceeAncestorsEnvs() []string { 8040 if ev.GetEventType().String() != "ptrace" { 8041 return []string{} 8042 } 8043 if ev.PTrace.Tracee == nil { 8044 return []string{} 8045 } 8046 if ev.PTrace.Tracee.Ancestor == nil { 8047 return []string{} 8048 } 8049 var values []string 8050 ctx := eval.NewContext(ev) 8051 iterator := &ProcessAncestorsIterator{} 8052 ptr := iterator.Front(ctx) 8053 for ptr != nil { 8054 element := (*ProcessCacheEntry)(ptr) 8055 result := ev.FieldHandlers.ResolveProcessEnvs(ev, &element.ProcessContext.Process) 8056 values = append(values, result...) 8057 ptr = iterator.Next() 8058 } 8059 return values 8060 } 8061 8062 // GetPtraceTraceeAncestorsEnvsTruncated returns the value of the field, resolving if necessary 8063 func (ev *Event) GetPtraceTraceeAncestorsEnvsTruncated() []bool { 8064 if ev.GetEventType().String() != "ptrace" { 8065 return []bool{} 8066 } 8067 if ev.PTrace.Tracee == nil { 8068 return []bool{} 8069 } 8070 if ev.PTrace.Tracee.Ancestor == nil { 8071 return []bool{} 8072 } 8073 var values []bool 8074 ctx := eval.NewContext(ev) 8075 iterator := &ProcessAncestorsIterator{} 8076 ptr := iterator.Front(ctx) 8077 for ptr != nil { 8078 element := (*ProcessCacheEntry)(ptr) 8079 result := ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, &element.ProcessContext.Process) 8080 values = append(values, result) 8081 ptr = iterator.Next() 8082 } 8083 return values 8084 } 8085 8086 // GetPtraceTraceeAncestorsEuid returns the value of the field, resolving if necessary 8087 func (ev *Event) GetPtraceTraceeAncestorsEuid() []uint32 { 8088 if ev.GetEventType().String() != "ptrace" { 8089 return []uint32{} 8090 } 8091 if ev.PTrace.Tracee == nil { 8092 return []uint32{} 8093 } 8094 if ev.PTrace.Tracee.Ancestor == nil { 8095 return []uint32{} 8096 } 8097 var values []uint32 8098 ctx := eval.NewContext(ev) 8099 iterator := &ProcessAncestorsIterator{} 8100 ptr := iterator.Front(ctx) 8101 for ptr != nil { 8102 element := (*ProcessCacheEntry)(ptr) 8103 result := element.ProcessContext.Process.Credentials.EUID 8104 values = append(values, result) 8105 ptr = iterator.Next() 8106 } 8107 return values 8108 } 8109 8110 // GetPtraceTraceeAncestorsEuser returns the value of the field, resolving if necessary 8111 func (ev *Event) GetPtraceTraceeAncestorsEuser() []string { 8112 if ev.GetEventType().String() != "ptrace" { 8113 return []string{} 8114 } 8115 if ev.PTrace.Tracee == nil { 8116 return []string{} 8117 } 8118 if ev.PTrace.Tracee.Ancestor == nil { 8119 return []string{} 8120 } 8121 var values []string 8122 ctx := eval.NewContext(ev) 8123 iterator := &ProcessAncestorsIterator{} 8124 ptr := iterator.Front(ctx) 8125 for ptr != nil { 8126 element := (*ProcessCacheEntry)(ptr) 8127 result := element.ProcessContext.Process.Credentials.EUser 8128 values = append(values, result) 8129 ptr = iterator.Next() 8130 } 8131 return values 8132 } 8133 8134 // GetPtraceTraceeAncestorsFileChangeTime returns the value of the field, resolving if necessary 8135 func (ev *Event) GetPtraceTraceeAncestorsFileChangeTime() []uint64 { 8136 if ev.GetEventType().String() != "ptrace" { 8137 return []uint64{} 8138 } 8139 if ev.PTrace.Tracee == nil { 8140 return []uint64{} 8141 } 8142 if ev.PTrace.Tracee.Ancestor == nil { 8143 return []uint64{} 8144 } 8145 var values []uint64 8146 ctx := eval.NewContext(ev) 8147 iterator := &ProcessAncestorsIterator{} 8148 ptr := iterator.Front(ctx) 8149 for ptr != nil { 8150 element := (*ProcessCacheEntry)(ptr) 8151 result := element.ProcessContext.Process.FileEvent.FileFields.CTime 8152 values = append(values, result) 8153 ptr = iterator.Next() 8154 } 8155 return values 8156 } 8157 8158 // GetPtraceTraceeAncestorsFileFilesystem returns the value of the field, resolving if necessary 8159 func (ev *Event) GetPtraceTraceeAncestorsFileFilesystem() []string { 8160 if ev.GetEventType().String() != "ptrace" { 8161 return []string{} 8162 } 8163 if ev.PTrace.Tracee == nil { 8164 return []string{} 8165 } 8166 if ev.PTrace.Tracee.Ancestor == nil { 8167 return []string{} 8168 } 8169 var values []string 8170 ctx := eval.NewContext(ev) 8171 iterator := &ProcessAncestorsIterator{} 8172 ptr := iterator.Front(ctx) 8173 for ptr != nil { 8174 element := (*ProcessCacheEntry)(ptr) 8175 result := ev.FieldHandlers.ResolveFileFilesystem(ev, &element.ProcessContext.Process.FileEvent) 8176 values = append(values, result) 8177 ptr = iterator.Next() 8178 } 8179 return values 8180 } 8181 8182 // GetPtraceTraceeAncestorsFileGid returns the value of the field, resolving if necessary 8183 func (ev *Event) GetPtraceTraceeAncestorsFileGid() []uint32 { 8184 if ev.GetEventType().String() != "ptrace" { 8185 return []uint32{} 8186 } 8187 if ev.PTrace.Tracee == nil { 8188 return []uint32{} 8189 } 8190 if ev.PTrace.Tracee.Ancestor == nil { 8191 return []uint32{} 8192 } 8193 var values []uint32 8194 ctx := eval.NewContext(ev) 8195 iterator := &ProcessAncestorsIterator{} 8196 ptr := iterator.Front(ctx) 8197 for ptr != nil { 8198 element := (*ProcessCacheEntry)(ptr) 8199 result := element.ProcessContext.Process.FileEvent.FileFields.GID 8200 values = append(values, result) 8201 ptr = iterator.Next() 8202 } 8203 return values 8204 } 8205 8206 // GetPtraceTraceeAncestorsFileGroup returns the value of the field, resolving if necessary 8207 func (ev *Event) GetPtraceTraceeAncestorsFileGroup() []string { 8208 if ev.GetEventType().String() != "ptrace" { 8209 return []string{} 8210 } 8211 if ev.PTrace.Tracee == nil { 8212 return []string{} 8213 } 8214 if ev.PTrace.Tracee.Ancestor == nil { 8215 return []string{} 8216 } 8217 var values []string 8218 ctx := eval.NewContext(ev) 8219 iterator := &ProcessAncestorsIterator{} 8220 ptr := iterator.Front(ctx) 8221 for ptr != nil { 8222 element := (*ProcessCacheEntry)(ptr) 8223 result := ev.FieldHandlers.ResolveFileFieldsGroup(ev, &element.ProcessContext.Process.FileEvent.FileFields) 8224 values = append(values, result) 8225 ptr = iterator.Next() 8226 } 8227 return values 8228 } 8229 8230 // GetPtraceTraceeAncestorsFileHashes returns the value of the field, resolving if necessary 8231 func (ev *Event) GetPtraceTraceeAncestorsFileHashes() []string { 8232 if ev.GetEventType().String() != "ptrace" { 8233 return []string{} 8234 } 8235 if ev.PTrace.Tracee == nil { 8236 return []string{} 8237 } 8238 if ev.PTrace.Tracee.Ancestor == nil { 8239 return []string{} 8240 } 8241 var values []string 8242 ctx := eval.NewContext(ev) 8243 iterator := &ProcessAncestorsIterator{} 8244 ptr := iterator.Front(ctx) 8245 for ptr != nil { 8246 element := (*ProcessCacheEntry)(ptr) 8247 result := ev.FieldHandlers.ResolveHashesFromEvent(ev, &element.ProcessContext.Process.FileEvent) 8248 values = append(values, result...) 8249 ptr = iterator.Next() 8250 } 8251 return values 8252 } 8253 8254 // GetPtraceTraceeAncestorsFileInUpperLayer returns the value of the field, resolving if necessary 8255 func (ev *Event) GetPtraceTraceeAncestorsFileInUpperLayer() []bool { 8256 if ev.GetEventType().String() != "ptrace" { 8257 return []bool{} 8258 } 8259 if ev.PTrace.Tracee == nil { 8260 return []bool{} 8261 } 8262 if ev.PTrace.Tracee.Ancestor == nil { 8263 return []bool{} 8264 } 8265 var values []bool 8266 ctx := eval.NewContext(ev) 8267 iterator := &ProcessAncestorsIterator{} 8268 ptr := iterator.Front(ctx) 8269 for ptr != nil { 8270 element := (*ProcessCacheEntry)(ptr) 8271 result := ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &element.ProcessContext.Process.FileEvent.FileFields) 8272 values = append(values, result) 8273 ptr = iterator.Next() 8274 } 8275 return values 8276 } 8277 8278 // GetPtraceTraceeAncestorsFileInode returns the value of the field, resolving if necessary 8279 func (ev *Event) GetPtraceTraceeAncestorsFileInode() []uint64 { 8280 if ev.GetEventType().String() != "ptrace" { 8281 return []uint64{} 8282 } 8283 if ev.PTrace.Tracee == nil { 8284 return []uint64{} 8285 } 8286 if ev.PTrace.Tracee.Ancestor == nil { 8287 return []uint64{} 8288 } 8289 var values []uint64 8290 ctx := eval.NewContext(ev) 8291 iterator := &ProcessAncestorsIterator{} 8292 ptr := iterator.Front(ctx) 8293 for ptr != nil { 8294 element := (*ProcessCacheEntry)(ptr) 8295 result := element.ProcessContext.Process.FileEvent.FileFields.PathKey.Inode 8296 values = append(values, result) 8297 ptr = iterator.Next() 8298 } 8299 return values 8300 } 8301 8302 // GetPtraceTraceeAncestorsFileMode returns the value of the field, resolving if necessary 8303 func (ev *Event) GetPtraceTraceeAncestorsFileMode() []uint16 { 8304 if ev.GetEventType().String() != "ptrace" { 8305 return []uint16{} 8306 } 8307 if ev.PTrace.Tracee == nil { 8308 return []uint16{} 8309 } 8310 if ev.PTrace.Tracee.Ancestor == nil { 8311 return []uint16{} 8312 } 8313 var values []uint16 8314 ctx := eval.NewContext(ev) 8315 iterator := &ProcessAncestorsIterator{} 8316 ptr := iterator.Front(ctx) 8317 for ptr != nil { 8318 element := (*ProcessCacheEntry)(ptr) 8319 result := element.ProcessContext.Process.FileEvent.FileFields.Mode 8320 values = append(values, result) 8321 ptr = iterator.Next() 8322 } 8323 return values 8324 } 8325 8326 // GetPtraceTraceeAncestorsFileModificationTime returns the value of the field, resolving if necessary 8327 func (ev *Event) GetPtraceTraceeAncestorsFileModificationTime() []uint64 { 8328 if ev.GetEventType().String() != "ptrace" { 8329 return []uint64{} 8330 } 8331 if ev.PTrace.Tracee == nil { 8332 return []uint64{} 8333 } 8334 if ev.PTrace.Tracee.Ancestor == nil { 8335 return []uint64{} 8336 } 8337 var values []uint64 8338 ctx := eval.NewContext(ev) 8339 iterator := &ProcessAncestorsIterator{} 8340 ptr := iterator.Front(ctx) 8341 for ptr != nil { 8342 element := (*ProcessCacheEntry)(ptr) 8343 result := element.ProcessContext.Process.FileEvent.FileFields.MTime 8344 values = append(values, result) 8345 ptr = iterator.Next() 8346 } 8347 return values 8348 } 8349 8350 // GetPtraceTraceeAncestorsFileMountId returns the value of the field, resolving if necessary 8351 func (ev *Event) GetPtraceTraceeAncestorsFileMountId() []uint32 { 8352 if ev.GetEventType().String() != "ptrace" { 8353 return []uint32{} 8354 } 8355 if ev.PTrace.Tracee == nil { 8356 return []uint32{} 8357 } 8358 if ev.PTrace.Tracee.Ancestor == nil { 8359 return []uint32{} 8360 } 8361 var values []uint32 8362 ctx := eval.NewContext(ev) 8363 iterator := &ProcessAncestorsIterator{} 8364 ptr := iterator.Front(ctx) 8365 for ptr != nil { 8366 element := (*ProcessCacheEntry)(ptr) 8367 result := element.ProcessContext.Process.FileEvent.FileFields.PathKey.MountID 8368 values = append(values, result) 8369 ptr = iterator.Next() 8370 } 8371 return values 8372 } 8373 8374 // GetPtraceTraceeAncestorsFileName returns the value of the field, resolving if necessary 8375 func (ev *Event) GetPtraceTraceeAncestorsFileName() []string { 8376 if ev.GetEventType().String() != "ptrace" { 8377 return []string{} 8378 } 8379 if ev.PTrace.Tracee == nil { 8380 return []string{} 8381 } 8382 if ev.PTrace.Tracee.Ancestor == nil { 8383 return []string{} 8384 } 8385 var values []string 8386 ctx := eval.NewContext(ev) 8387 iterator := &ProcessAncestorsIterator{} 8388 ptr := iterator.Front(ctx) 8389 for ptr != nil { 8390 element := (*ProcessCacheEntry)(ptr) 8391 result := ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.FileEvent) 8392 values = append(values, result) 8393 ptr = iterator.Next() 8394 } 8395 return values 8396 } 8397 8398 // GetPtraceTraceeAncestorsFileNameLength returns the value of the field, resolving if necessary 8399 func (ev *Event) GetPtraceTraceeAncestorsFileNameLength() []int { 8400 if ev.GetEventType().String() != "ptrace" { 8401 return []int{} 8402 } 8403 if ev.PTrace.Tracee == nil { 8404 return []int{} 8405 } 8406 if ev.PTrace.Tracee.Ancestor == nil { 8407 return []int{} 8408 } 8409 var values []int 8410 ctx := eval.NewContext(ev) 8411 iterator := &ProcessAncestorsIterator{} 8412 ptr := iterator.Front(ctx) 8413 for ptr != nil { 8414 element := (*ProcessCacheEntry)(ptr) 8415 result := len(ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.FileEvent)) 8416 values = append(values, result) 8417 ptr = iterator.Next() 8418 } 8419 return values 8420 } 8421 8422 // GetPtraceTraceeAncestorsFilePackageName returns the value of the field, resolving if necessary 8423 func (ev *Event) GetPtraceTraceeAncestorsFilePackageName() []string { 8424 if ev.GetEventType().String() != "ptrace" { 8425 return []string{} 8426 } 8427 if ev.PTrace.Tracee == nil { 8428 return []string{} 8429 } 8430 if ev.PTrace.Tracee.Ancestor == nil { 8431 return []string{} 8432 } 8433 var values []string 8434 ctx := eval.NewContext(ev) 8435 iterator := &ProcessAncestorsIterator{} 8436 ptr := iterator.Front(ctx) 8437 for ptr != nil { 8438 element := (*ProcessCacheEntry)(ptr) 8439 result := ev.FieldHandlers.ResolvePackageName(ev, &element.ProcessContext.Process.FileEvent) 8440 values = append(values, result) 8441 ptr = iterator.Next() 8442 } 8443 return values 8444 } 8445 8446 // GetPtraceTraceeAncestorsFilePackageSourceVersion returns the value of the field, resolving if necessary 8447 func (ev *Event) GetPtraceTraceeAncestorsFilePackageSourceVersion() []string { 8448 if ev.GetEventType().String() != "ptrace" { 8449 return []string{} 8450 } 8451 if ev.PTrace.Tracee == nil { 8452 return []string{} 8453 } 8454 if ev.PTrace.Tracee.Ancestor == nil { 8455 return []string{} 8456 } 8457 var values []string 8458 ctx := eval.NewContext(ev) 8459 iterator := &ProcessAncestorsIterator{} 8460 ptr := iterator.Front(ctx) 8461 for ptr != nil { 8462 element := (*ProcessCacheEntry)(ptr) 8463 result := ev.FieldHandlers.ResolvePackageSourceVersion(ev, &element.ProcessContext.Process.FileEvent) 8464 values = append(values, result) 8465 ptr = iterator.Next() 8466 } 8467 return values 8468 } 8469 8470 // GetPtraceTraceeAncestorsFilePackageVersion returns the value of the field, resolving if necessary 8471 func (ev *Event) GetPtraceTraceeAncestorsFilePackageVersion() []string { 8472 if ev.GetEventType().String() != "ptrace" { 8473 return []string{} 8474 } 8475 if ev.PTrace.Tracee == nil { 8476 return []string{} 8477 } 8478 if ev.PTrace.Tracee.Ancestor == nil { 8479 return []string{} 8480 } 8481 var values []string 8482 ctx := eval.NewContext(ev) 8483 iterator := &ProcessAncestorsIterator{} 8484 ptr := iterator.Front(ctx) 8485 for ptr != nil { 8486 element := (*ProcessCacheEntry)(ptr) 8487 result := ev.FieldHandlers.ResolvePackageVersion(ev, &element.ProcessContext.Process.FileEvent) 8488 values = append(values, result) 8489 ptr = iterator.Next() 8490 } 8491 return values 8492 } 8493 8494 // GetPtraceTraceeAncestorsFilePath returns the value of the field, resolving if necessary 8495 func (ev *Event) GetPtraceTraceeAncestorsFilePath() []string { 8496 if ev.GetEventType().String() != "ptrace" { 8497 return []string{} 8498 } 8499 if ev.PTrace.Tracee == nil { 8500 return []string{} 8501 } 8502 if ev.PTrace.Tracee.Ancestor == nil { 8503 return []string{} 8504 } 8505 var values []string 8506 ctx := eval.NewContext(ev) 8507 iterator := &ProcessAncestorsIterator{} 8508 ptr := iterator.Front(ctx) 8509 for ptr != nil { 8510 element := (*ProcessCacheEntry)(ptr) 8511 result := ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.FileEvent) 8512 values = append(values, result) 8513 ptr = iterator.Next() 8514 } 8515 return values 8516 } 8517 8518 // GetPtraceTraceeAncestorsFilePathLength returns the value of the field, resolving if necessary 8519 func (ev *Event) GetPtraceTraceeAncestorsFilePathLength() []int { 8520 if ev.GetEventType().String() != "ptrace" { 8521 return []int{} 8522 } 8523 if ev.PTrace.Tracee == nil { 8524 return []int{} 8525 } 8526 if ev.PTrace.Tracee.Ancestor == nil { 8527 return []int{} 8528 } 8529 var values []int 8530 ctx := eval.NewContext(ev) 8531 iterator := &ProcessAncestorsIterator{} 8532 ptr := iterator.Front(ctx) 8533 for ptr != nil { 8534 element := (*ProcessCacheEntry)(ptr) 8535 result := len(ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.FileEvent)) 8536 values = append(values, result) 8537 ptr = iterator.Next() 8538 } 8539 return values 8540 } 8541 8542 // GetPtraceTraceeAncestorsFileRights returns the value of the field, resolving if necessary 8543 func (ev *Event) GetPtraceTraceeAncestorsFileRights() []int { 8544 if ev.GetEventType().String() != "ptrace" { 8545 return []int{} 8546 } 8547 if ev.PTrace.Tracee == nil { 8548 return []int{} 8549 } 8550 if ev.PTrace.Tracee.Ancestor == nil { 8551 return []int{} 8552 } 8553 var values []int 8554 ctx := eval.NewContext(ev) 8555 iterator := &ProcessAncestorsIterator{} 8556 ptr := iterator.Front(ctx) 8557 for ptr != nil { 8558 element := (*ProcessCacheEntry)(ptr) 8559 result := int(ev.FieldHandlers.ResolveRights(ev, &element.ProcessContext.Process.FileEvent.FileFields)) 8560 values = append(values, result) 8561 ptr = iterator.Next() 8562 } 8563 return values 8564 } 8565 8566 // GetPtraceTraceeAncestorsFileUid returns the value of the field, resolving if necessary 8567 func (ev *Event) GetPtraceTraceeAncestorsFileUid() []uint32 { 8568 if ev.GetEventType().String() != "ptrace" { 8569 return []uint32{} 8570 } 8571 if ev.PTrace.Tracee == nil { 8572 return []uint32{} 8573 } 8574 if ev.PTrace.Tracee.Ancestor == nil { 8575 return []uint32{} 8576 } 8577 var values []uint32 8578 ctx := eval.NewContext(ev) 8579 iterator := &ProcessAncestorsIterator{} 8580 ptr := iterator.Front(ctx) 8581 for ptr != nil { 8582 element := (*ProcessCacheEntry)(ptr) 8583 result := element.ProcessContext.Process.FileEvent.FileFields.UID 8584 values = append(values, result) 8585 ptr = iterator.Next() 8586 } 8587 return values 8588 } 8589 8590 // GetPtraceTraceeAncestorsFileUser returns the value of the field, resolving if necessary 8591 func (ev *Event) GetPtraceTraceeAncestorsFileUser() []string { 8592 if ev.GetEventType().String() != "ptrace" { 8593 return []string{} 8594 } 8595 if ev.PTrace.Tracee == nil { 8596 return []string{} 8597 } 8598 if ev.PTrace.Tracee.Ancestor == nil { 8599 return []string{} 8600 } 8601 var values []string 8602 ctx := eval.NewContext(ev) 8603 iterator := &ProcessAncestorsIterator{} 8604 ptr := iterator.Front(ctx) 8605 for ptr != nil { 8606 element := (*ProcessCacheEntry)(ptr) 8607 result := ev.FieldHandlers.ResolveFileFieldsUser(ev, &element.ProcessContext.Process.FileEvent.FileFields) 8608 values = append(values, result) 8609 ptr = iterator.Next() 8610 } 8611 return values 8612 } 8613 8614 // GetPtraceTraceeAncestorsFsgid returns the value of the field, resolving if necessary 8615 func (ev *Event) GetPtraceTraceeAncestorsFsgid() []uint32 { 8616 if ev.GetEventType().String() != "ptrace" { 8617 return []uint32{} 8618 } 8619 if ev.PTrace.Tracee == nil { 8620 return []uint32{} 8621 } 8622 if ev.PTrace.Tracee.Ancestor == nil { 8623 return []uint32{} 8624 } 8625 var values []uint32 8626 ctx := eval.NewContext(ev) 8627 iterator := &ProcessAncestorsIterator{} 8628 ptr := iterator.Front(ctx) 8629 for ptr != nil { 8630 element := (*ProcessCacheEntry)(ptr) 8631 result := element.ProcessContext.Process.Credentials.FSGID 8632 values = append(values, result) 8633 ptr = iterator.Next() 8634 } 8635 return values 8636 } 8637 8638 // GetPtraceTraceeAncestorsFsgroup returns the value of the field, resolving if necessary 8639 func (ev *Event) GetPtraceTraceeAncestorsFsgroup() []string { 8640 if ev.GetEventType().String() != "ptrace" { 8641 return []string{} 8642 } 8643 if ev.PTrace.Tracee == nil { 8644 return []string{} 8645 } 8646 if ev.PTrace.Tracee.Ancestor == nil { 8647 return []string{} 8648 } 8649 var values []string 8650 ctx := eval.NewContext(ev) 8651 iterator := &ProcessAncestorsIterator{} 8652 ptr := iterator.Front(ctx) 8653 for ptr != nil { 8654 element := (*ProcessCacheEntry)(ptr) 8655 result := element.ProcessContext.Process.Credentials.FSGroup 8656 values = append(values, result) 8657 ptr = iterator.Next() 8658 } 8659 return values 8660 } 8661 8662 // GetPtraceTraceeAncestorsFsuid returns the value of the field, resolving if necessary 8663 func (ev *Event) GetPtraceTraceeAncestorsFsuid() []uint32 { 8664 if ev.GetEventType().String() != "ptrace" { 8665 return []uint32{} 8666 } 8667 if ev.PTrace.Tracee == nil { 8668 return []uint32{} 8669 } 8670 if ev.PTrace.Tracee.Ancestor == nil { 8671 return []uint32{} 8672 } 8673 var values []uint32 8674 ctx := eval.NewContext(ev) 8675 iterator := &ProcessAncestorsIterator{} 8676 ptr := iterator.Front(ctx) 8677 for ptr != nil { 8678 element := (*ProcessCacheEntry)(ptr) 8679 result := element.ProcessContext.Process.Credentials.FSUID 8680 values = append(values, result) 8681 ptr = iterator.Next() 8682 } 8683 return values 8684 } 8685 8686 // GetPtraceTraceeAncestorsFsuser returns the value of the field, resolving if necessary 8687 func (ev *Event) GetPtraceTraceeAncestorsFsuser() []string { 8688 if ev.GetEventType().String() != "ptrace" { 8689 return []string{} 8690 } 8691 if ev.PTrace.Tracee == nil { 8692 return []string{} 8693 } 8694 if ev.PTrace.Tracee.Ancestor == nil { 8695 return []string{} 8696 } 8697 var values []string 8698 ctx := eval.NewContext(ev) 8699 iterator := &ProcessAncestorsIterator{} 8700 ptr := iterator.Front(ctx) 8701 for ptr != nil { 8702 element := (*ProcessCacheEntry)(ptr) 8703 result := element.ProcessContext.Process.Credentials.FSUser 8704 values = append(values, result) 8705 ptr = iterator.Next() 8706 } 8707 return values 8708 } 8709 8710 // GetPtraceTraceeAncestorsGid returns the value of the field, resolving if necessary 8711 func (ev *Event) GetPtraceTraceeAncestorsGid() []uint32 { 8712 if ev.GetEventType().String() != "ptrace" { 8713 return []uint32{} 8714 } 8715 if ev.PTrace.Tracee == nil { 8716 return []uint32{} 8717 } 8718 if ev.PTrace.Tracee.Ancestor == nil { 8719 return []uint32{} 8720 } 8721 var values []uint32 8722 ctx := eval.NewContext(ev) 8723 iterator := &ProcessAncestorsIterator{} 8724 ptr := iterator.Front(ctx) 8725 for ptr != nil { 8726 element := (*ProcessCacheEntry)(ptr) 8727 result := element.ProcessContext.Process.Credentials.GID 8728 values = append(values, result) 8729 ptr = iterator.Next() 8730 } 8731 return values 8732 } 8733 8734 // GetPtraceTraceeAncestorsGroup returns the value of the field, resolving if necessary 8735 func (ev *Event) GetPtraceTraceeAncestorsGroup() []string { 8736 if ev.GetEventType().String() != "ptrace" { 8737 return []string{} 8738 } 8739 if ev.PTrace.Tracee == nil { 8740 return []string{} 8741 } 8742 if ev.PTrace.Tracee.Ancestor == nil { 8743 return []string{} 8744 } 8745 var values []string 8746 ctx := eval.NewContext(ev) 8747 iterator := &ProcessAncestorsIterator{} 8748 ptr := iterator.Front(ctx) 8749 for ptr != nil { 8750 element := (*ProcessCacheEntry)(ptr) 8751 result := element.ProcessContext.Process.Credentials.Group 8752 values = append(values, result) 8753 ptr = iterator.Next() 8754 } 8755 return values 8756 } 8757 8758 // GetPtraceTraceeAncestorsInterpreterFileChangeTime returns the value of the field, resolving if necessary 8759 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileChangeTime() []uint64 { 8760 if ev.GetEventType().String() != "ptrace" { 8761 return []uint64{} 8762 } 8763 if ev.PTrace.Tracee == nil { 8764 return []uint64{} 8765 } 8766 if ev.PTrace.Tracee.Ancestor == nil { 8767 return []uint64{} 8768 } 8769 var values []uint64 8770 ctx := eval.NewContext(ev) 8771 iterator := &ProcessAncestorsIterator{} 8772 ptr := iterator.Front(ctx) 8773 for ptr != nil { 8774 element := (*ProcessCacheEntry)(ptr) 8775 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.CTime 8776 values = append(values, result) 8777 ptr = iterator.Next() 8778 } 8779 return values 8780 } 8781 8782 // GetPtraceTraceeAncestorsInterpreterFileFilesystem returns the value of the field, resolving if necessary 8783 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileFilesystem() []string { 8784 if ev.GetEventType().String() != "ptrace" { 8785 return []string{} 8786 } 8787 if ev.PTrace.Tracee == nil { 8788 return []string{} 8789 } 8790 if ev.PTrace.Tracee.Ancestor == nil { 8791 return []string{} 8792 } 8793 var values []string 8794 ctx := eval.NewContext(ev) 8795 iterator := &ProcessAncestorsIterator{} 8796 ptr := iterator.Front(ctx) 8797 for ptr != nil { 8798 element := (*ProcessCacheEntry)(ptr) 8799 result := ev.FieldHandlers.ResolveFileFilesystem(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 8800 values = append(values, result) 8801 ptr = iterator.Next() 8802 } 8803 return values 8804 } 8805 8806 // GetPtraceTraceeAncestorsInterpreterFileGid returns the value of the field, resolving if necessary 8807 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileGid() []uint32 { 8808 if ev.GetEventType().String() != "ptrace" { 8809 return []uint32{} 8810 } 8811 if ev.PTrace.Tracee == nil { 8812 return []uint32{} 8813 } 8814 if ev.PTrace.Tracee.Ancestor == nil { 8815 return []uint32{} 8816 } 8817 var values []uint32 8818 ctx := eval.NewContext(ev) 8819 iterator := &ProcessAncestorsIterator{} 8820 ptr := iterator.Front(ctx) 8821 for ptr != nil { 8822 element := (*ProcessCacheEntry)(ptr) 8823 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.GID 8824 values = append(values, result) 8825 ptr = iterator.Next() 8826 } 8827 return values 8828 } 8829 8830 // GetPtraceTraceeAncestorsInterpreterFileGroup returns the value of the field, resolving if necessary 8831 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileGroup() []string { 8832 if ev.GetEventType().String() != "ptrace" { 8833 return []string{} 8834 } 8835 if ev.PTrace.Tracee == nil { 8836 return []string{} 8837 } 8838 if ev.PTrace.Tracee.Ancestor == nil { 8839 return []string{} 8840 } 8841 var values []string 8842 ctx := eval.NewContext(ev) 8843 iterator := &ProcessAncestorsIterator{} 8844 ptr := iterator.Front(ctx) 8845 for ptr != nil { 8846 element := (*ProcessCacheEntry)(ptr) 8847 result := ev.FieldHandlers.ResolveFileFieldsGroup(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 8848 values = append(values, result) 8849 ptr = iterator.Next() 8850 } 8851 return values 8852 } 8853 8854 // GetPtraceTraceeAncestorsInterpreterFileHashes returns the value of the field, resolving if necessary 8855 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileHashes() []string { 8856 if ev.GetEventType().String() != "ptrace" { 8857 return []string{} 8858 } 8859 if ev.PTrace.Tracee == nil { 8860 return []string{} 8861 } 8862 if ev.PTrace.Tracee.Ancestor == nil { 8863 return []string{} 8864 } 8865 var values []string 8866 ctx := eval.NewContext(ev) 8867 iterator := &ProcessAncestorsIterator{} 8868 ptr := iterator.Front(ctx) 8869 for ptr != nil { 8870 element := (*ProcessCacheEntry)(ptr) 8871 result := ev.FieldHandlers.ResolveHashesFromEvent(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 8872 values = append(values, result...) 8873 ptr = iterator.Next() 8874 } 8875 return values 8876 } 8877 8878 // GetPtraceTraceeAncestorsInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 8879 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileInUpperLayer() []bool { 8880 if ev.GetEventType().String() != "ptrace" { 8881 return []bool{} 8882 } 8883 if ev.PTrace.Tracee == nil { 8884 return []bool{} 8885 } 8886 if ev.PTrace.Tracee.Ancestor == nil { 8887 return []bool{} 8888 } 8889 var values []bool 8890 ctx := eval.NewContext(ev) 8891 iterator := &ProcessAncestorsIterator{} 8892 ptr := iterator.Front(ctx) 8893 for ptr != nil { 8894 element := (*ProcessCacheEntry)(ptr) 8895 result := ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 8896 values = append(values, result) 8897 ptr = iterator.Next() 8898 } 8899 return values 8900 } 8901 8902 // GetPtraceTraceeAncestorsInterpreterFileInode returns the value of the field, resolving if necessary 8903 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileInode() []uint64 { 8904 if ev.GetEventType().String() != "ptrace" { 8905 return []uint64{} 8906 } 8907 if ev.PTrace.Tracee == nil { 8908 return []uint64{} 8909 } 8910 if ev.PTrace.Tracee.Ancestor == nil { 8911 return []uint64{} 8912 } 8913 var values []uint64 8914 ctx := eval.NewContext(ev) 8915 iterator := &ProcessAncestorsIterator{} 8916 ptr := iterator.Front(ctx) 8917 for ptr != nil { 8918 element := (*ProcessCacheEntry)(ptr) 8919 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 8920 values = append(values, result) 8921 ptr = iterator.Next() 8922 } 8923 return values 8924 } 8925 8926 // GetPtraceTraceeAncestorsInterpreterFileMode returns the value of the field, resolving if necessary 8927 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileMode() []uint16 { 8928 if ev.GetEventType().String() != "ptrace" { 8929 return []uint16{} 8930 } 8931 if ev.PTrace.Tracee == nil { 8932 return []uint16{} 8933 } 8934 if ev.PTrace.Tracee.Ancestor == nil { 8935 return []uint16{} 8936 } 8937 var values []uint16 8938 ctx := eval.NewContext(ev) 8939 iterator := &ProcessAncestorsIterator{} 8940 ptr := iterator.Front(ctx) 8941 for ptr != nil { 8942 element := (*ProcessCacheEntry)(ptr) 8943 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.Mode 8944 values = append(values, result) 8945 ptr = iterator.Next() 8946 } 8947 return values 8948 } 8949 8950 // GetPtraceTraceeAncestorsInterpreterFileModificationTime returns the value of the field, resolving if necessary 8951 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileModificationTime() []uint64 { 8952 if ev.GetEventType().String() != "ptrace" { 8953 return []uint64{} 8954 } 8955 if ev.PTrace.Tracee == nil { 8956 return []uint64{} 8957 } 8958 if ev.PTrace.Tracee.Ancestor == nil { 8959 return []uint64{} 8960 } 8961 var values []uint64 8962 ctx := eval.NewContext(ev) 8963 iterator := &ProcessAncestorsIterator{} 8964 ptr := iterator.Front(ctx) 8965 for ptr != nil { 8966 element := (*ProcessCacheEntry)(ptr) 8967 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.MTime 8968 values = append(values, result) 8969 ptr = iterator.Next() 8970 } 8971 return values 8972 } 8973 8974 // GetPtraceTraceeAncestorsInterpreterFileMountId returns the value of the field, resolving if necessary 8975 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileMountId() []uint32 { 8976 if ev.GetEventType().String() != "ptrace" { 8977 return []uint32{} 8978 } 8979 if ev.PTrace.Tracee == nil { 8980 return []uint32{} 8981 } 8982 if ev.PTrace.Tracee.Ancestor == nil { 8983 return []uint32{} 8984 } 8985 var values []uint32 8986 ctx := eval.NewContext(ev) 8987 iterator := &ProcessAncestorsIterator{} 8988 ptr := iterator.Front(ctx) 8989 for ptr != nil { 8990 element := (*ProcessCacheEntry)(ptr) 8991 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 8992 values = append(values, result) 8993 ptr = iterator.Next() 8994 } 8995 return values 8996 } 8997 8998 // GetPtraceTraceeAncestorsInterpreterFileName returns the value of the field, resolving if necessary 8999 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileName() []string { 9000 if ev.GetEventType().String() != "ptrace" { 9001 return []string{} 9002 } 9003 if ev.PTrace.Tracee == nil { 9004 return []string{} 9005 } 9006 if ev.PTrace.Tracee.Ancestor == nil { 9007 return []string{} 9008 } 9009 var values []string 9010 ctx := eval.NewContext(ev) 9011 iterator := &ProcessAncestorsIterator{} 9012 ptr := iterator.Front(ctx) 9013 for ptr != nil { 9014 element := (*ProcessCacheEntry)(ptr) 9015 result := ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 9016 values = append(values, result) 9017 ptr = iterator.Next() 9018 } 9019 return values 9020 } 9021 9022 // GetPtraceTraceeAncestorsInterpreterFileNameLength returns the value of the field, resolving if necessary 9023 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileNameLength() []int { 9024 if ev.GetEventType().String() != "ptrace" { 9025 return []int{} 9026 } 9027 if ev.PTrace.Tracee == nil { 9028 return []int{} 9029 } 9030 if ev.PTrace.Tracee.Ancestor == nil { 9031 return []int{} 9032 } 9033 var values []int 9034 ctx := eval.NewContext(ev) 9035 iterator := &ProcessAncestorsIterator{} 9036 ptr := iterator.Front(ctx) 9037 for ptr != nil { 9038 element := (*ProcessCacheEntry)(ptr) 9039 result := len(ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent)) 9040 values = append(values, result) 9041 ptr = iterator.Next() 9042 } 9043 return values 9044 } 9045 9046 // GetPtraceTraceeAncestorsInterpreterFilePackageName returns the value of the field, resolving if necessary 9047 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFilePackageName() []string { 9048 if ev.GetEventType().String() != "ptrace" { 9049 return []string{} 9050 } 9051 if ev.PTrace.Tracee == nil { 9052 return []string{} 9053 } 9054 if ev.PTrace.Tracee.Ancestor == nil { 9055 return []string{} 9056 } 9057 var values []string 9058 ctx := eval.NewContext(ev) 9059 iterator := &ProcessAncestorsIterator{} 9060 ptr := iterator.Front(ctx) 9061 for ptr != nil { 9062 element := (*ProcessCacheEntry)(ptr) 9063 result := ev.FieldHandlers.ResolvePackageName(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 9064 values = append(values, result) 9065 ptr = iterator.Next() 9066 } 9067 return values 9068 } 9069 9070 // GetPtraceTraceeAncestorsInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 9071 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFilePackageSourceVersion() []string { 9072 if ev.GetEventType().String() != "ptrace" { 9073 return []string{} 9074 } 9075 if ev.PTrace.Tracee == nil { 9076 return []string{} 9077 } 9078 if ev.PTrace.Tracee.Ancestor == nil { 9079 return []string{} 9080 } 9081 var values []string 9082 ctx := eval.NewContext(ev) 9083 iterator := &ProcessAncestorsIterator{} 9084 ptr := iterator.Front(ctx) 9085 for ptr != nil { 9086 element := (*ProcessCacheEntry)(ptr) 9087 result := ev.FieldHandlers.ResolvePackageSourceVersion(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 9088 values = append(values, result) 9089 ptr = iterator.Next() 9090 } 9091 return values 9092 } 9093 9094 // GetPtraceTraceeAncestorsInterpreterFilePackageVersion returns the value of the field, resolving if necessary 9095 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFilePackageVersion() []string { 9096 if ev.GetEventType().String() != "ptrace" { 9097 return []string{} 9098 } 9099 if ev.PTrace.Tracee == nil { 9100 return []string{} 9101 } 9102 if ev.PTrace.Tracee.Ancestor == nil { 9103 return []string{} 9104 } 9105 var values []string 9106 ctx := eval.NewContext(ev) 9107 iterator := &ProcessAncestorsIterator{} 9108 ptr := iterator.Front(ctx) 9109 for ptr != nil { 9110 element := (*ProcessCacheEntry)(ptr) 9111 result := ev.FieldHandlers.ResolvePackageVersion(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 9112 values = append(values, result) 9113 ptr = iterator.Next() 9114 } 9115 return values 9116 } 9117 9118 // GetPtraceTraceeAncestorsInterpreterFilePath returns the value of the field, resolving if necessary 9119 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFilePath() []string { 9120 if ev.GetEventType().String() != "ptrace" { 9121 return []string{} 9122 } 9123 if ev.PTrace.Tracee == nil { 9124 return []string{} 9125 } 9126 if ev.PTrace.Tracee.Ancestor == nil { 9127 return []string{} 9128 } 9129 var values []string 9130 ctx := eval.NewContext(ev) 9131 iterator := &ProcessAncestorsIterator{} 9132 ptr := iterator.Front(ctx) 9133 for ptr != nil { 9134 element := (*ProcessCacheEntry)(ptr) 9135 result := ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 9136 values = append(values, result) 9137 ptr = iterator.Next() 9138 } 9139 return values 9140 } 9141 9142 // GetPtraceTraceeAncestorsInterpreterFilePathLength returns the value of the field, resolving if necessary 9143 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFilePathLength() []int { 9144 if ev.GetEventType().String() != "ptrace" { 9145 return []int{} 9146 } 9147 if ev.PTrace.Tracee == nil { 9148 return []int{} 9149 } 9150 if ev.PTrace.Tracee.Ancestor == nil { 9151 return []int{} 9152 } 9153 var values []int 9154 ctx := eval.NewContext(ev) 9155 iterator := &ProcessAncestorsIterator{} 9156 ptr := iterator.Front(ctx) 9157 for ptr != nil { 9158 element := (*ProcessCacheEntry)(ptr) 9159 result := len(ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent)) 9160 values = append(values, result) 9161 ptr = iterator.Next() 9162 } 9163 return values 9164 } 9165 9166 // GetPtraceTraceeAncestorsInterpreterFileRights returns the value of the field, resolving if necessary 9167 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileRights() []int { 9168 if ev.GetEventType().String() != "ptrace" { 9169 return []int{} 9170 } 9171 if ev.PTrace.Tracee == nil { 9172 return []int{} 9173 } 9174 if ev.PTrace.Tracee.Ancestor == nil { 9175 return []int{} 9176 } 9177 var values []int 9178 ctx := eval.NewContext(ev) 9179 iterator := &ProcessAncestorsIterator{} 9180 ptr := iterator.Front(ctx) 9181 for ptr != nil { 9182 element := (*ProcessCacheEntry)(ptr) 9183 result := int(ev.FieldHandlers.ResolveRights(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields)) 9184 values = append(values, result) 9185 ptr = iterator.Next() 9186 } 9187 return values 9188 } 9189 9190 // GetPtraceTraceeAncestorsInterpreterFileUid returns the value of the field, resolving if necessary 9191 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileUid() []uint32 { 9192 if ev.GetEventType().String() != "ptrace" { 9193 return []uint32{} 9194 } 9195 if ev.PTrace.Tracee == nil { 9196 return []uint32{} 9197 } 9198 if ev.PTrace.Tracee.Ancestor == nil { 9199 return []uint32{} 9200 } 9201 var values []uint32 9202 ctx := eval.NewContext(ev) 9203 iterator := &ProcessAncestorsIterator{} 9204 ptr := iterator.Front(ctx) 9205 for ptr != nil { 9206 element := (*ProcessCacheEntry)(ptr) 9207 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.UID 9208 values = append(values, result) 9209 ptr = iterator.Next() 9210 } 9211 return values 9212 } 9213 9214 // GetPtraceTraceeAncestorsInterpreterFileUser returns the value of the field, resolving if necessary 9215 func (ev *Event) GetPtraceTraceeAncestorsInterpreterFileUser() []string { 9216 if ev.GetEventType().String() != "ptrace" { 9217 return []string{} 9218 } 9219 if ev.PTrace.Tracee == nil { 9220 return []string{} 9221 } 9222 if ev.PTrace.Tracee.Ancestor == nil { 9223 return []string{} 9224 } 9225 var values []string 9226 ctx := eval.NewContext(ev) 9227 iterator := &ProcessAncestorsIterator{} 9228 ptr := iterator.Front(ctx) 9229 for ptr != nil { 9230 element := (*ProcessCacheEntry)(ptr) 9231 result := ev.FieldHandlers.ResolveFileFieldsUser(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 9232 values = append(values, result) 9233 ptr = iterator.Next() 9234 } 9235 return values 9236 } 9237 9238 // GetPtraceTraceeAncestorsIsKworker returns the value of the field, resolving if necessary 9239 func (ev *Event) GetPtraceTraceeAncestorsIsKworker() []bool { 9240 if ev.GetEventType().String() != "ptrace" { 9241 return []bool{} 9242 } 9243 if ev.PTrace.Tracee == nil { 9244 return []bool{} 9245 } 9246 if ev.PTrace.Tracee.Ancestor == nil { 9247 return []bool{} 9248 } 9249 var values []bool 9250 ctx := eval.NewContext(ev) 9251 iterator := &ProcessAncestorsIterator{} 9252 ptr := iterator.Front(ctx) 9253 for ptr != nil { 9254 element := (*ProcessCacheEntry)(ptr) 9255 result := element.ProcessContext.Process.PIDContext.IsKworker 9256 values = append(values, result) 9257 ptr = iterator.Next() 9258 } 9259 return values 9260 } 9261 9262 // GetPtraceTraceeAncestorsIsThread returns the value of the field, resolving if necessary 9263 func (ev *Event) GetPtraceTraceeAncestorsIsThread() []bool { 9264 if ev.GetEventType().String() != "ptrace" { 9265 return []bool{} 9266 } 9267 if ev.PTrace.Tracee == nil { 9268 return []bool{} 9269 } 9270 if ev.PTrace.Tracee.Ancestor == nil { 9271 return []bool{} 9272 } 9273 var values []bool 9274 ctx := eval.NewContext(ev) 9275 iterator := &ProcessAncestorsIterator{} 9276 ptr := iterator.Front(ctx) 9277 for ptr != nil { 9278 element := (*ProcessCacheEntry)(ptr) 9279 result := element.ProcessContext.Process.IsThread 9280 values = append(values, result) 9281 ptr = iterator.Next() 9282 } 9283 return values 9284 } 9285 9286 // GetPtraceTraceeAncestorsPid returns the value of the field, resolving if necessary 9287 func (ev *Event) GetPtraceTraceeAncestorsPid() []uint32 { 9288 if ev.GetEventType().String() != "ptrace" { 9289 return []uint32{} 9290 } 9291 if ev.PTrace.Tracee == nil { 9292 return []uint32{} 9293 } 9294 if ev.PTrace.Tracee.Ancestor == nil { 9295 return []uint32{} 9296 } 9297 var values []uint32 9298 ctx := eval.NewContext(ev) 9299 iterator := &ProcessAncestorsIterator{} 9300 ptr := iterator.Front(ctx) 9301 for ptr != nil { 9302 element := (*ProcessCacheEntry)(ptr) 9303 result := element.ProcessContext.Process.PIDContext.Pid 9304 values = append(values, result) 9305 ptr = iterator.Next() 9306 } 9307 return values 9308 } 9309 9310 // GetPtraceTraceeAncestorsPpid returns the value of the field, resolving if necessary 9311 func (ev *Event) GetPtraceTraceeAncestorsPpid() []uint32 { 9312 if ev.GetEventType().String() != "ptrace" { 9313 return []uint32{} 9314 } 9315 if ev.PTrace.Tracee == nil { 9316 return []uint32{} 9317 } 9318 if ev.PTrace.Tracee.Ancestor == nil { 9319 return []uint32{} 9320 } 9321 var values []uint32 9322 ctx := eval.NewContext(ev) 9323 iterator := &ProcessAncestorsIterator{} 9324 ptr := iterator.Front(ctx) 9325 for ptr != nil { 9326 element := (*ProcessCacheEntry)(ptr) 9327 result := element.ProcessContext.Process.PPid 9328 values = append(values, result) 9329 ptr = iterator.Next() 9330 } 9331 return values 9332 } 9333 9334 // GetPtraceTraceeAncestorsTid returns the value of the field, resolving if necessary 9335 func (ev *Event) GetPtraceTraceeAncestorsTid() []uint32 { 9336 if ev.GetEventType().String() != "ptrace" { 9337 return []uint32{} 9338 } 9339 if ev.PTrace.Tracee == nil { 9340 return []uint32{} 9341 } 9342 if ev.PTrace.Tracee.Ancestor == nil { 9343 return []uint32{} 9344 } 9345 var values []uint32 9346 ctx := eval.NewContext(ev) 9347 iterator := &ProcessAncestorsIterator{} 9348 ptr := iterator.Front(ctx) 9349 for ptr != nil { 9350 element := (*ProcessCacheEntry)(ptr) 9351 result := element.ProcessContext.Process.PIDContext.Tid 9352 values = append(values, result) 9353 ptr = iterator.Next() 9354 } 9355 return values 9356 } 9357 9358 // GetPtraceTraceeAncestorsTtyName returns the value of the field, resolving if necessary 9359 func (ev *Event) GetPtraceTraceeAncestorsTtyName() []string { 9360 if ev.GetEventType().String() != "ptrace" { 9361 return []string{} 9362 } 9363 if ev.PTrace.Tracee == nil { 9364 return []string{} 9365 } 9366 if ev.PTrace.Tracee.Ancestor == nil { 9367 return []string{} 9368 } 9369 var values []string 9370 ctx := eval.NewContext(ev) 9371 iterator := &ProcessAncestorsIterator{} 9372 ptr := iterator.Front(ctx) 9373 for ptr != nil { 9374 element := (*ProcessCacheEntry)(ptr) 9375 result := element.ProcessContext.Process.TTYName 9376 values = append(values, result) 9377 ptr = iterator.Next() 9378 } 9379 return values 9380 } 9381 9382 // GetPtraceTraceeAncestorsUid returns the value of the field, resolving if necessary 9383 func (ev *Event) GetPtraceTraceeAncestorsUid() []uint32 { 9384 if ev.GetEventType().String() != "ptrace" { 9385 return []uint32{} 9386 } 9387 if ev.PTrace.Tracee == nil { 9388 return []uint32{} 9389 } 9390 if ev.PTrace.Tracee.Ancestor == nil { 9391 return []uint32{} 9392 } 9393 var values []uint32 9394 ctx := eval.NewContext(ev) 9395 iterator := &ProcessAncestorsIterator{} 9396 ptr := iterator.Front(ctx) 9397 for ptr != nil { 9398 element := (*ProcessCacheEntry)(ptr) 9399 result := element.ProcessContext.Process.Credentials.UID 9400 values = append(values, result) 9401 ptr = iterator.Next() 9402 } 9403 return values 9404 } 9405 9406 // GetPtraceTraceeAncestorsUser returns the value of the field, resolving if necessary 9407 func (ev *Event) GetPtraceTraceeAncestorsUser() []string { 9408 if ev.GetEventType().String() != "ptrace" { 9409 return []string{} 9410 } 9411 if ev.PTrace.Tracee == nil { 9412 return []string{} 9413 } 9414 if ev.PTrace.Tracee.Ancestor == nil { 9415 return []string{} 9416 } 9417 var values []string 9418 ctx := eval.NewContext(ev) 9419 iterator := &ProcessAncestorsIterator{} 9420 ptr := iterator.Front(ctx) 9421 for ptr != nil { 9422 element := (*ProcessCacheEntry)(ptr) 9423 result := element.ProcessContext.Process.Credentials.User 9424 values = append(values, result) 9425 ptr = iterator.Next() 9426 } 9427 return values 9428 } 9429 9430 // GetPtraceTraceeAncestorsUserSessionK8sGroups returns the value of the field, resolving if necessary 9431 func (ev *Event) GetPtraceTraceeAncestorsUserSessionK8sGroups() []string { 9432 if ev.GetEventType().String() != "ptrace" { 9433 return []string{} 9434 } 9435 if ev.PTrace.Tracee == nil { 9436 return []string{} 9437 } 9438 if ev.PTrace.Tracee.Ancestor == nil { 9439 return []string{} 9440 } 9441 var values []string 9442 ctx := eval.NewContext(ev) 9443 iterator := &ProcessAncestorsIterator{} 9444 ptr := iterator.Front(ctx) 9445 for ptr != nil { 9446 element := (*ProcessCacheEntry)(ptr) 9447 result := ev.FieldHandlers.ResolveK8SGroups(ev, &element.ProcessContext.Process.UserSession) 9448 values = append(values, result...) 9449 ptr = iterator.Next() 9450 } 9451 return values 9452 } 9453 9454 // GetPtraceTraceeAncestorsUserSessionK8sUid returns the value of the field, resolving if necessary 9455 func (ev *Event) GetPtraceTraceeAncestorsUserSessionK8sUid() []string { 9456 if ev.GetEventType().String() != "ptrace" { 9457 return []string{} 9458 } 9459 if ev.PTrace.Tracee == nil { 9460 return []string{} 9461 } 9462 if ev.PTrace.Tracee.Ancestor == nil { 9463 return []string{} 9464 } 9465 var values []string 9466 ctx := eval.NewContext(ev) 9467 iterator := &ProcessAncestorsIterator{} 9468 ptr := iterator.Front(ctx) 9469 for ptr != nil { 9470 element := (*ProcessCacheEntry)(ptr) 9471 result := ev.FieldHandlers.ResolveK8SUID(ev, &element.ProcessContext.Process.UserSession) 9472 values = append(values, result) 9473 ptr = iterator.Next() 9474 } 9475 return values 9476 } 9477 9478 // GetPtraceTraceeAncestorsUserSessionK8sUsername returns the value of the field, resolving if necessary 9479 func (ev *Event) GetPtraceTraceeAncestorsUserSessionK8sUsername() []string { 9480 if ev.GetEventType().String() != "ptrace" { 9481 return []string{} 9482 } 9483 if ev.PTrace.Tracee == nil { 9484 return []string{} 9485 } 9486 if ev.PTrace.Tracee.Ancestor == nil { 9487 return []string{} 9488 } 9489 var values []string 9490 ctx := eval.NewContext(ev) 9491 iterator := &ProcessAncestorsIterator{} 9492 ptr := iterator.Front(ctx) 9493 for ptr != nil { 9494 element := (*ProcessCacheEntry)(ptr) 9495 result := ev.FieldHandlers.ResolveK8SUsername(ev, &element.ProcessContext.Process.UserSession) 9496 values = append(values, result) 9497 ptr = iterator.Next() 9498 } 9499 return values 9500 } 9501 9502 // GetPtraceTraceeArgs returns the value of the field, resolving if necessary 9503 func (ev *Event) GetPtraceTraceeArgs() string { 9504 if ev.GetEventType().String() != "ptrace" { 9505 return "" 9506 } 9507 if ev.PTrace.Tracee == nil { 9508 return "" 9509 } 9510 return ev.FieldHandlers.ResolveProcessArgs(ev, &ev.PTrace.Tracee.Process) 9511 } 9512 9513 // GetPtraceTraceeArgsFlags returns the value of the field, resolving if necessary 9514 func (ev *Event) GetPtraceTraceeArgsFlags() []string { 9515 if ev.GetEventType().String() != "ptrace" { 9516 return []string{} 9517 } 9518 if ev.PTrace.Tracee == nil { 9519 return []string{} 9520 } 9521 return ev.FieldHandlers.ResolveProcessArgsFlags(ev, &ev.PTrace.Tracee.Process) 9522 } 9523 9524 // GetPtraceTraceeArgsOptions returns the value of the field, resolving if necessary 9525 func (ev *Event) GetPtraceTraceeArgsOptions() []string { 9526 if ev.GetEventType().String() != "ptrace" { 9527 return []string{} 9528 } 9529 if ev.PTrace.Tracee == nil { 9530 return []string{} 9531 } 9532 return ev.FieldHandlers.ResolveProcessArgsOptions(ev, &ev.PTrace.Tracee.Process) 9533 } 9534 9535 // GetPtraceTraceeArgsScrubbed returns the value of the field, resolving if necessary 9536 func (ev *Event) GetPtraceTraceeArgsScrubbed() string { 9537 if ev.GetEventType().String() != "ptrace" { 9538 return "" 9539 } 9540 if ev.PTrace.Tracee == nil { 9541 return "" 9542 } 9543 return ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, &ev.PTrace.Tracee.Process) 9544 } 9545 9546 // GetPtraceTraceeArgsTruncated returns the value of the field, resolving if necessary 9547 func (ev *Event) GetPtraceTraceeArgsTruncated() bool { 9548 if ev.GetEventType().String() != "ptrace" { 9549 return false 9550 } 9551 if ev.PTrace.Tracee == nil { 9552 return false 9553 } 9554 return ev.FieldHandlers.ResolveProcessArgsTruncated(ev, &ev.PTrace.Tracee.Process) 9555 } 9556 9557 // GetPtraceTraceeArgv returns the value of the field, resolving if necessary 9558 func (ev *Event) GetPtraceTraceeArgv() []string { 9559 if ev.GetEventType().String() != "ptrace" { 9560 return []string{} 9561 } 9562 if ev.PTrace.Tracee == nil { 9563 return []string{} 9564 } 9565 return ev.FieldHandlers.ResolveProcessArgv(ev, &ev.PTrace.Tracee.Process) 9566 } 9567 9568 // GetPtraceTraceeArgv0 returns the value of the field, resolving if necessary 9569 func (ev *Event) GetPtraceTraceeArgv0() string { 9570 if ev.GetEventType().String() != "ptrace" { 9571 return "" 9572 } 9573 if ev.PTrace.Tracee == nil { 9574 return "" 9575 } 9576 return ev.FieldHandlers.ResolveProcessArgv0(ev, &ev.PTrace.Tracee.Process) 9577 } 9578 9579 // GetPtraceTraceeArgvScrubbed returns the value of the field, resolving if necessary 9580 func (ev *Event) GetPtraceTraceeArgvScrubbed() []string { 9581 if ev.GetEventType().String() != "ptrace" { 9582 return []string{} 9583 } 9584 if ev.PTrace.Tracee == nil { 9585 return []string{} 9586 } 9587 return ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, &ev.PTrace.Tracee.Process) 9588 } 9589 9590 // GetPtraceTraceeCapEffective returns the value of the field, resolving if necessary 9591 func (ev *Event) GetPtraceTraceeCapEffective() uint64 { 9592 if ev.GetEventType().String() != "ptrace" { 9593 return uint64(0) 9594 } 9595 if ev.PTrace.Tracee == nil { 9596 return uint64(0) 9597 } 9598 return ev.PTrace.Tracee.Process.Credentials.CapEffective 9599 } 9600 9601 // GetPtraceTraceeCapPermitted returns the value of the field, resolving if necessary 9602 func (ev *Event) GetPtraceTraceeCapPermitted() uint64 { 9603 if ev.GetEventType().String() != "ptrace" { 9604 return uint64(0) 9605 } 9606 if ev.PTrace.Tracee == nil { 9607 return uint64(0) 9608 } 9609 return ev.PTrace.Tracee.Process.Credentials.CapPermitted 9610 } 9611 9612 // GetPtraceTraceeCmdargv returns the value of the field, resolving if necessary 9613 func (ev *Event) GetPtraceTraceeCmdargv() []string { 9614 if ev.GetEventType().String() != "ptrace" { 9615 return []string{} 9616 } 9617 if ev.PTrace.Tracee == nil { 9618 return []string{} 9619 } 9620 return ev.FieldHandlers.ResolveProcessCmdArgv(ev, &ev.PTrace.Tracee.Process) 9621 } 9622 9623 // GetPtraceTraceeComm returns the value of the field, resolving if necessary 9624 func (ev *Event) GetPtraceTraceeComm() string { 9625 if ev.GetEventType().String() != "ptrace" { 9626 return "" 9627 } 9628 if ev.PTrace.Tracee == nil { 9629 return "" 9630 } 9631 return ev.PTrace.Tracee.Process.Comm 9632 } 9633 9634 // GetPtraceTraceeContainerId returns the value of the field, resolving if necessary 9635 func (ev *Event) GetPtraceTraceeContainerId() string { 9636 if ev.GetEventType().String() != "ptrace" { 9637 return "" 9638 } 9639 if ev.PTrace.Tracee == nil { 9640 return "" 9641 } 9642 return ev.PTrace.Tracee.Process.ContainerID 9643 } 9644 9645 // GetPtraceTraceeCreatedAt returns the value of the field, resolving if necessary 9646 func (ev *Event) GetPtraceTraceeCreatedAt() int { 9647 if ev.GetEventType().String() != "ptrace" { 9648 return 0 9649 } 9650 if ev.PTrace.Tracee == nil { 9651 return 0 9652 } 9653 return ev.FieldHandlers.ResolveProcessCreatedAt(ev, &ev.PTrace.Tracee.Process) 9654 } 9655 9656 // GetPtraceTraceeEgid returns the value of the field, resolving if necessary 9657 func (ev *Event) GetPtraceTraceeEgid() uint32 { 9658 if ev.GetEventType().String() != "ptrace" { 9659 return uint32(0) 9660 } 9661 if ev.PTrace.Tracee == nil { 9662 return uint32(0) 9663 } 9664 return ev.PTrace.Tracee.Process.Credentials.EGID 9665 } 9666 9667 // GetPtraceTraceeEgroup returns the value of the field, resolving if necessary 9668 func (ev *Event) GetPtraceTraceeEgroup() string { 9669 if ev.GetEventType().String() != "ptrace" { 9670 return "" 9671 } 9672 if ev.PTrace.Tracee == nil { 9673 return "" 9674 } 9675 return ev.PTrace.Tracee.Process.Credentials.EGroup 9676 } 9677 9678 // GetPtraceTraceeEnvp returns the value of the field, resolving if necessary 9679 func (ev *Event) GetPtraceTraceeEnvp() []string { 9680 if ev.GetEventType().String() != "ptrace" { 9681 return []string{} 9682 } 9683 if ev.PTrace.Tracee == nil { 9684 return []string{} 9685 } 9686 return ev.FieldHandlers.ResolveProcessEnvp(ev, &ev.PTrace.Tracee.Process) 9687 } 9688 9689 // GetPtraceTraceeEnvs returns the value of the field, resolving if necessary 9690 func (ev *Event) GetPtraceTraceeEnvs() []string { 9691 if ev.GetEventType().String() != "ptrace" { 9692 return []string{} 9693 } 9694 if ev.PTrace.Tracee == nil { 9695 return []string{} 9696 } 9697 return ev.FieldHandlers.ResolveProcessEnvs(ev, &ev.PTrace.Tracee.Process) 9698 } 9699 9700 // GetPtraceTraceeEnvsTruncated returns the value of the field, resolving if necessary 9701 func (ev *Event) GetPtraceTraceeEnvsTruncated() bool { 9702 if ev.GetEventType().String() != "ptrace" { 9703 return false 9704 } 9705 if ev.PTrace.Tracee == nil { 9706 return false 9707 } 9708 return ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, &ev.PTrace.Tracee.Process) 9709 } 9710 9711 // GetPtraceTraceeEuid returns the value of the field, resolving if necessary 9712 func (ev *Event) GetPtraceTraceeEuid() uint32 { 9713 if ev.GetEventType().String() != "ptrace" { 9714 return uint32(0) 9715 } 9716 if ev.PTrace.Tracee == nil { 9717 return uint32(0) 9718 } 9719 return ev.PTrace.Tracee.Process.Credentials.EUID 9720 } 9721 9722 // GetPtraceTraceeEuser returns the value of the field, resolving if necessary 9723 func (ev *Event) GetPtraceTraceeEuser() string { 9724 if ev.GetEventType().String() != "ptrace" { 9725 return "" 9726 } 9727 if ev.PTrace.Tracee == nil { 9728 return "" 9729 } 9730 return ev.PTrace.Tracee.Process.Credentials.EUser 9731 } 9732 9733 // GetPtraceTraceeExecTime returns the value of the field, resolving if necessary 9734 func (ev *Event) GetPtraceTraceeExecTime() time.Time { 9735 if ev.GetEventType().String() != "ptrace" { 9736 return time.Time{} 9737 } 9738 if ev.PTrace.Tracee == nil { 9739 return time.Time{} 9740 } 9741 return ev.PTrace.Tracee.Process.ExecTime 9742 } 9743 9744 // GetPtraceTraceeExitTime returns the value of the field, resolving if necessary 9745 func (ev *Event) GetPtraceTraceeExitTime() time.Time { 9746 if ev.GetEventType().String() != "ptrace" { 9747 return time.Time{} 9748 } 9749 if ev.PTrace.Tracee == nil { 9750 return time.Time{} 9751 } 9752 return ev.PTrace.Tracee.Process.ExitTime 9753 } 9754 9755 // GetPtraceTraceeFileChangeTime returns the value of the field, resolving if necessary 9756 func (ev *Event) GetPtraceTraceeFileChangeTime() uint64 { 9757 if ev.GetEventType().String() != "ptrace" { 9758 return uint64(0) 9759 } 9760 if ev.PTrace.Tracee == nil { 9761 return uint64(0) 9762 } 9763 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9764 return uint64(0) 9765 } 9766 return ev.PTrace.Tracee.Process.FileEvent.FileFields.CTime 9767 } 9768 9769 // GetPtraceTraceeFileFilesystem returns the value of the field, resolving if necessary 9770 func (ev *Event) GetPtraceTraceeFileFilesystem() string { 9771 if ev.GetEventType().String() != "ptrace" { 9772 return "" 9773 } 9774 if ev.PTrace.Tracee == nil { 9775 return "" 9776 } 9777 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9778 return "" 9779 } 9780 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.PTrace.Tracee.Process.FileEvent) 9781 } 9782 9783 // GetPtraceTraceeFileGid returns the value of the field, resolving if necessary 9784 func (ev *Event) GetPtraceTraceeFileGid() uint32 { 9785 if ev.GetEventType().String() != "ptrace" { 9786 return uint32(0) 9787 } 9788 if ev.PTrace.Tracee == nil { 9789 return uint32(0) 9790 } 9791 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9792 return uint32(0) 9793 } 9794 return ev.PTrace.Tracee.Process.FileEvent.FileFields.GID 9795 } 9796 9797 // GetPtraceTraceeFileGroup returns the value of the field, resolving if necessary 9798 func (ev *Event) GetPtraceTraceeFileGroup() string { 9799 if ev.GetEventType().String() != "ptrace" { 9800 return "" 9801 } 9802 if ev.PTrace.Tracee == nil { 9803 return "" 9804 } 9805 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9806 return "" 9807 } 9808 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.PTrace.Tracee.Process.FileEvent.FileFields) 9809 } 9810 9811 // GetPtraceTraceeFileHashes returns the value of the field, resolving if necessary 9812 func (ev *Event) GetPtraceTraceeFileHashes() []string { 9813 if ev.GetEventType().String() != "ptrace" { 9814 return []string{} 9815 } 9816 if ev.PTrace.Tracee == nil { 9817 return []string{} 9818 } 9819 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9820 return []string{} 9821 } 9822 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.PTrace.Tracee.Process.FileEvent) 9823 } 9824 9825 // GetPtraceTraceeFileInUpperLayer returns the value of the field, resolving if necessary 9826 func (ev *Event) GetPtraceTraceeFileInUpperLayer() bool { 9827 if ev.GetEventType().String() != "ptrace" { 9828 return false 9829 } 9830 if ev.PTrace.Tracee == nil { 9831 return false 9832 } 9833 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9834 return false 9835 } 9836 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.PTrace.Tracee.Process.FileEvent.FileFields) 9837 } 9838 9839 // GetPtraceTraceeFileInode returns the value of the field, resolving if necessary 9840 func (ev *Event) GetPtraceTraceeFileInode() uint64 { 9841 if ev.GetEventType().String() != "ptrace" { 9842 return uint64(0) 9843 } 9844 if ev.PTrace.Tracee == nil { 9845 return uint64(0) 9846 } 9847 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9848 return uint64(0) 9849 } 9850 return ev.PTrace.Tracee.Process.FileEvent.FileFields.PathKey.Inode 9851 } 9852 9853 // GetPtraceTraceeFileMode returns the value of the field, resolving if necessary 9854 func (ev *Event) GetPtraceTraceeFileMode() uint16 { 9855 if ev.GetEventType().String() != "ptrace" { 9856 return uint16(0) 9857 } 9858 if ev.PTrace.Tracee == nil { 9859 return uint16(0) 9860 } 9861 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9862 return uint16(0) 9863 } 9864 return ev.PTrace.Tracee.Process.FileEvent.FileFields.Mode 9865 } 9866 9867 // GetPtraceTraceeFileModificationTime returns the value of the field, resolving if necessary 9868 func (ev *Event) GetPtraceTraceeFileModificationTime() uint64 { 9869 if ev.GetEventType().String() != "ptrace" { 9870 return uint64(0) 9871 } 9872 if ev.PTrace.Tracee == nil { 9873 return uint64(0) 9874 } 9875 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9876 return uint64(0) 9877 } 9878 return ev.PTrace.Tracee.Process.FileEvent.FileFields.MTime 9879 } 9880 9881 // GetPtraceTraceeFileMountId returns the value of the field, resolving if necessary 9882 func (ev *Event) GetPtraceTraceeFileMountId() uint32 { 9883 if ev.GetEventType().String() != "ptrace" { 9884 return uint32(0) 9885 } 9886 if ev.PTrace.Tracee == nil { 9887 return uint32(0) 9888 } 9889 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9890 return uint32(0) 9891 } 9892 return ev.PTrace.Tracee.Process.FileEvent.FileFields.PathKey.MountID 9893 } 9894 9895 // GetPtraceTraceeFileName returns the value of the field, resolving if necessary 9896 func (ev *Event) GetPtraceTraceeFileName() string { 9897 if ev.GetEventType().String() != "ptrace" { 9898 return "" 9899 } 9900 if ev.PTrace.Tracee == nil { 9901 return "" 9902 } 9903 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9904 return "" 9905 } 9906 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.PTrace.Tracee.Process.FileEvent) 9907 } 9908 9909 // GetPtraceTraceeFileNameLength returns the value of the field, resolving if necessary 9910 func (ev *Event) GetPtraceTraceeFileNameLength() int { 9911 if ev.GetEventType().String() != "ptrace" { 9912 return 0 9913 } 9914 if ev.PTrace.Tracee == nil { 9915 return 0 9916 } 9917 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.PTrace.Tracee.Process.FileEvent)) 9918 } 9919 9920 // GetPtraceTraceeFilePackageName returns the value of the field, resolving if necessary 9921 func (ev *Event) GetPtraceTraceeFilePackageName() string { 9922 if ev.GetEventType().String() != "ptrace" { 9923 return "" 9924 } 9925 if ev.PTrace.Tracee == nil { 9926 return "" 9927 } 9928 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9929 return "" 9930 } 9931 return ev.FieldHandlers.ResolvePackageName(ev, &ev.PTrace.Tracee.Process.FileEvent) 9932 } 9933 9934 // GetPtraceTraceeFilePackageSourceVersion returns the value of the field, resolving if necessary 9935 func (ev *Event) GetPtraceTraceeFilePackageSourceVersion() string { 9936 if ev.GetEventType().String() != "ptrace" { 9937 return "" 9938 } 9939 if ev.PTrace.Tracee == nil { 9940 return "" 9941 } 9942 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9943 return "" 9944 } 9945 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.PTrace.Tracee.Process.FileEvent) 9946 } 9947 9948 // GetPtraceTraceeFilePackageVersion returns the value of the field, resolving if necessary 9949 func (ev *Event) GetPtraceTraceeFilePackageVersion() string { 9950 if ev.GetEventType().String() != "ptrace" { 9951 return "" 9952 } 9953 if ev.PTrace.Tracee == nil { 9954 return "" 9955 } 9956 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9957 return "" 9958 } 9959 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.PTrace.Tracee.Process.FileEvent) 9960 } 9961 9962 // GetPtraceTraceeFilePath returns the value of the field, resolving if necessary 9963 func (ev *Event) GetPtraceTraceeFilePath() string { 9964 if ev.GetEventType().String() != "ptrace" { 9965 return "" 9966 } 9967 if ev.PTrace.Tracee == nil { 9968 return "" 9969 } 9970 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9971 return "" 9972 } 9973 return ev.FieldHandlers.ResolveFilePath(ev, &ev.PTrace.Tracee.Process.FileEvent) 9974 } 9975 9976 // GetPtraceTraceeFilePathLength returns the value of the field, resolving if necessary 9977 func (ev *Event) GetPtraceTraceeFilePathLength() int { 9978 if ev.GetEventType().String() != "ptrace" { 9979 return 0 9980 } 9981 if ev.PTrace.Tracee == nil { 9982 return 0 9983 } 9984 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.PTrace.Tracee.Process.FileEvent)) 9985 } 9986 9987 // GetPtraceTraceeFileRights returns the value of the field, resolving if necessary 9988 func (ev *Event) GetPtraceTraceeFileRights() int { 9989 if ev.GetEventType().String() != "ptrace" { 9990 return 0 9991 } 9992 if ev.PTrace.Tracee == nil { 9993 return 0 9994 } 9995 if !ev.PTrace.Tracee.Process.IsNotKworker() { 9996 return 0 9997 } 9998 return ev.FieldHandlers.ResolveRights(ev, &ev.PTrace.Tracee.Process.FileEvent.FileFields) 9999 } 10000 10001 // GetPtraceTraceeFileUid returns the value of the field, resolving if necessary 10002 func (ev *Event) GetPtraceTraceeFileUid() uint32 { 10003 if ev.GetEventType().String() != "ptrace" { 10004 return uint32(0) 10005 } 10006 if ev.PTrace.Tracee == nil { 10007 return uint32(0) 10008 } 10009 if !ev.PTrace.Tracee.Process.IsNotKworker() { 10010 return uint32(0) 10011 } 10012 return ev.PTrace.Tracee.Process.FileEvent.FileFields.UID 10013 } 10014 10015 // GetPtraceTraceeFileUser returns the value of the field, resolving if necessary 10016 func (ev *Event) GetPtraceTraceeFileUser() string { 10017 if ev.GetEventType().String() != "ptrace" { 10018 return "" 10019 } 10020 if ev.PTrace.Tracee == nil { 10021 return "" 10022 } 10023 if !ev.PTrace.Tracee.Process.IsNotKworker() { 10024 return "" 10025 } 10026 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.PTrace.Tracee.Process.FileEvent.FileFields) 10027 } 10028 10029 // GetPtraceTraceeForkTime returns the value of the field, resolving if necessary 10030 func (ev *Event) GetPtraceTraceeForkTime() time.Time { 10031 if ev.GetEventType().String() != "ptrace" { 10032 return time.Time{} 10033 } 10034 if ev.PTrace.Tracee == nil { 10035 return time.Time{} 10036 } 10037 return ev.PTrace.Tracee.Process.ForkTime 10038 } 10039 10040 // GetPtraceTraceeFsgid returns the value of the field, resolving if necessary 10041 func (ev *Event) GetPtraceTraceeFsgid() uint32 { 10042 if ev.GetEventType().String() != "ptrace" { 10043 return uint32(0) 10044 } 10045 if ev.PTrace.Tracee == nil { 10046 return uint32(0) 10047 } 10048 return ev.PTrace.Tracee.Process.Credentials.FSGID 10049 } 10050 10051 // GetPtraceTraceeFsgroup returns the value of the field, resolving if necessary 10052 func (ev *Event) GetPtraceTraceeFsgroup() string { 10053 if ev.GetEventType().String() != "ptrace" { 10054 return "" 10055 } 10056 if ev.PTrace.Tracee == nil { 10057 return "" 10058 } 10059 return ev.PTrace.Tracee.Process.Credentials.FSGroup 10060 } 10061 10062 // GetPtraceTraceeFsuid returns the value of the field, resolving if necessary 10063 func (ev *Event) GetPtraceTraceeFsuid() uint32 { 10064 if ev.GetEventType().String() != "ptrace" { 10065 return uint32(0) 10066 } 10067 if ev.PTrace.Tracee == nil { 10068 return uint32(0) 10069 } 10070 return ev.PTrace.Tracee.Process.Credentials.FSUID 10071 } 10072 10073 // GetPtraceTraceeFsuser returns the value of the field, resolving if necessary 10074 func (ev *Event) GetPtraceTraceeFsuser() string { 10075 if ev.GetEventType().String() != "ptrace" { 10076 return "" 10077 } 10078 if ev.PTrace.Tracee == nil { 10079 return "" 10080 } 10081 return ev.PTrace.Tracee.Process.Credentials.FSUser 10082 } 10083 10084 // GetPtraceTraceeGid returns the value of the field, resolving if necessary 10085 func (ev *Event) GetPtraceTraceeGid() uint32 { 10086 if ev.GetEventType().String() != "ptrace" { 10087 return uint32(0) 10088 } 10089 if ev.PTrace.Tracee == nil { 10090 return uint32(0) 10091 } 10092 return ev.PTrace.Tracee.Process.Credentials.GID 10093 } 10094 10095 // GetPtraceTraceeGroup returns the value of the field, resolving if necessary 10096 func (ev *Event) GetPtraceTraceeGroup() string { 10097 if ev.GetEventType().String() != "ptrace" { 10098 return "" 10099 } 10100 if ev.PTrace.Tracee == nil { 10101 return "" 10102 } 10103 return ev.PTrace.Tracee.Process.Credentials.Group 10104 } 10105 10106 // GetPtraceTraceeInterpreterFileChangeTime returns the value of the field, resolving if necessary 10107 func (ev *Event) GetPtraceTraceeInterpreterFileChangeTime() uint64 { 10108 if ev.GetEventType().String() != "ptrace" { 10109 return uint64(0) 10110 } 10111 if ev.PTrace.Tracee == nil { 10112 return uint64(0) 10113 } 10114 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10115 return uint64(0) 10116 } 10117 return ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields.CTime 10118 } 10119 10120 // GetPtraceTraceeInterpreterFileFilesystem returns the value of the field, resolving if necessary 10121 func (ev *Event) GetPtraceTraceeInterpreterFileFilesystem() string { 10122 if ev.GetEventType().String() != "ptrace" { 10123 return "" 10124 } 10125 if ev.PTrace.Tracee == nil { 10126 return "" 10127 } 10128 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10129 return "" 10130 } 10131 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent) 10132 } 10133 10134 // GetPtraceTraceeInterpreterFileGid returns the value of the field, resolving if necessary 10135 func (ev *Event) GetPtraceTraceeInterpreterFileGid() uint32 { 10136 if ev.GetEventType().String() != "ptrace" { 10137 return uint32(0) 10138 } 10139 if ev.PTrace.Tracee == nil { 10140 return uint32(0) 10141 } 10142 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10143 return uint32(0) 10144 } 10145 return ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields.GID 10146 } 10147 10148 // GetPtraceTraceeInterpreterFileGroup returns the value of the field, resolving if necessary 10149 func (ev *Event) GetPtraceTraceeInterpreterFileGroup() string { 10150 if ev.GetEventType().String() != "ptrace" { 10151 return "" 10152 } 10153 if ev.PTrace.Tracee == nil { 10154 return "" 10155 } 10156 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10157 return "" 10158 } 10159 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields) 10160 } 10161 10162 // GetPtraceTraceeInterpreterFileHashes returns the value of the field, resolving if necessary 10163 func (ev *Event) GetPtraceTraceeInterpreterFileHashes() []string { 10164 if ev.GetEventType().String() != "ptrace" { 10165 return []string{} 10166 } 10167 if ev.PTrace.Tracee == nil { 10168 return []string{} 10169 } 10170 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10171 return []string{} 10172 } 10173 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent) 10174 } 10175 10176 // GetPtraceTraceeInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 10177 func (ev *Event) GetPtraceTraceeInterpreterFileInUpperLayer() bool { 10178 if ev.GetEventType().String() != "ptrace" { 10179 return false 10180 } 10181 if ev.PTrace.Tracee == nil { 10182 return false 10183 } 10184 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10185 return false 10186 } 10187 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields) 10188 } 10189 10190 // GetPtraceTraceeInterpreterFileInode returns the value of the field, resolving if necessary 10191 func (ev *Event) GetPtraceTraceeInterpreterFileInode() uint64 { 10192 if ev.GetEventType().String() != "ptrace" { 10193 return uint64(0) 10194 } 10195 if ev.PTrace.Tracee == nil { 10196 return uint64(0) 10197 } 10198 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10199 return uint64(0) 10200 } 10201 return ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 10202 } 10203 10204 // GetPtraceTraceeInterpreterFileMode returns the value of the field, resolving if necessary 10205 func (ev *Event) GetPtraceTraceeInterpreterFileMode() uint16 { 10206 if ev.GetEventType().String() != "ptrace" { 10207 return uint16(0) 10208 } 10209 if ev.PTrace.Tracee == nil { 10210 return uint16(0) 10211 } 10212 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10213 return uint16(0) 10214 } 10215 return ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields.Mode 10216 } 10217 10218 // GetPtraceTraceeInterpreterFileModificationTime returns the value of the field, resolving if necessary 10219 func (ev *Event) GetPtraceTraceeInterpreterFileModificationTime() uint64 { 10220 if ev.GetEventType().String() != "ptrace" { 10221 return uint64(0) 10222 } 10223 if ev.PTrace.Tracee == nil { 10224 return uint64(0) 10225 } 10226 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10227 return uint64(0) 10228 } 10229 return ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields.MTime 10230 } 10231 10232 // GetPtraceTraceeInterpreterFileMountId returns the value of the field, resolving if necessary 10233 func (ev *Event) GetPtraceTraceeInterpreterFileMountId() uint32 { 10234 if ev.GetEventType().String() != "ptrace" { 10235 return uint32(0) 10236 } 10237 if ev.PTrace.Tracee == nil { 10238 return uint32(0) 10239 } 10240 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10241 return uint32(0) 10242 } 10243 return ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 10244 } 10245 10246 // GetPtraceTraceeInterpreterFileName returns the value of the field, resolving if necessary 10247 func (ev *Event) GetPtraceTraceeInterpreterFileName() string { 10248 if ev.GetEventType().String() != "ptrace" { 10249 return "" 10250 } 10251 if ev.PTrace.Tracee == nil { 10252 return "" 10253 } 10254 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10255 return "" 10256 } 10257 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent) 10258 } 10259 10260 // GetPtraceTraceeInterpreterFileNameLength returns the value of the field, resolving if necessary 10261 func (ev *Event) GetPtraceTraceeInterpreterFileNameLength() int { 10262 if ev.GetEventType().String() != "ptrace" { 10263 return 0 10264 } 10265 if ev.PTrace.Tracee == nil { 10266 return 0 10267 } 10268 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent)) 10269 } 10270 10271 // GetPtraceTraceeInterpreterFilePackageName returns the value of the field, resolving if necessary 10272 func (ev *Event) GetPtraceTraceeInterpreterFilePackageName() string { 10273 if ev.GetEventType().String() != "ptrace" { 10274 return "" 10275 } 10276 if ev.PTrace.Tracee == nil { 10277 return "" 10278 } 10279 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10280 return "" 10281 } 10282 return ev.FieldHandlers.ResolvePackageName(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent) 10283 } 10284 10285 // GetPtraceTraceeInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 10286 func (ev *Event) GetPtraceTraceeInterpreterFilePackageSourceVersion() string { 10287 if ev.GetEventType().String() != "ptrace" { 10288 return "" 10289 } 10290 if ev.PTrace.Tracee == nil { 10291 return "" 10292 } 10293 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10294 return "" 10295 } 10296 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent) 10297 } 10298 10299 // GetPtraceTraceeInterpreterFilePackageVersion returns the value of the field, resolving if necessary 10300 func (ev *Event) GetPtraceTraceeInterpreterFilePackageVersion() string { 10301 if ev.GetEventType().String() != "ptrace" { 10302 return "" 10303 } 10304 if ev.PTrace.Tracee == nil { 10305 return "" 10306 } 10307 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10308 return "" 10309 } 10310 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent) 10311 } 10312 10313 // GetPtraceTraceeInterpreterFilePath returns the value of the field, resolving if necessary 10314 func (ev *Event) GetPtraceTraceeInterpreterFilePath() string { 10315 if ev.GetEventType().String() != "ptrace" { 10316 return "" 10317 } 10318 if ev.PTrace.Tracee == nil { 10319 return "" 10320 } 10321 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10322 return "" 10323 } 10324 return ev.FieldHandlers.ResolveFilePath(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent) 10325 } 10326 10327 // GetPtraceTraceeInterpreterFilePathLength returns the value of the field, resolving if necessary 10328 func (ev *Event) GetPtraceTraceeInterpreterFilePathLength() int { 10329 if ev.GetEventType().String() != "ptrace" { 10330 return 0 10331 } 10332 if ev.PTrace.Tracee == nil { 10333 return 0 10334 } 10335 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent)) 10336 } 10337 10338 // GetPtraceTraceeInterpreterFileRights returns the value of the field, resolving if necessary 10339 func (ev *Event) GetPtraceTraceeInterpreterFileRights() int { 10340 if ev.GetEventType().String() != "ptrace" { 10341 return 0 10342 } 10343 if ev.PTrace.Tracee == nil { 10344 return 0 10345 } 10346 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10347 return 0 10348 } 10349 return ev.FieldHandlers.ResolveRights(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields) 10350 } 10351 10352 // GetPtraceTraceeInterpreterFileUid returns the value of the field, resolving if necessary 10353 func (ev *Event) GetPtraceTraceeInterpreterFileUid() uint32 { 10354 if ev.GetEventType().String() != "ptrace" { 10355 return uint32(0) 10356 } 10357 if ev.PTrace.Tracee == nil { 10358 return uint32(0) 10359 } 10360 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10361 return uint32(0) 10362 } 10363 return ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields.UID 10364 } 10365 10366 // GetPtraceTraceeInterpreterFileUser returns the value of the field, resolving if necessary 10367 func (ev *Event) GetPtraceTraceeInterpreterFileUser() string { 10368 if ev.GetEventType().String() != "ptrace" { 10369 return "" 10370 } 10371 if ev.PTrace.Tracee == nil { 10372 return "" 10373 } 10374 if !ev.PTrace.Tracee.Process.HasInterpreter() { 10375 return "" 10376 } 10377 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.PTrace.Tracee.Process.LinuxBinprm.FileEvent.FileFields) 10378 } 10379 10380 // GetPtraceTraceeIsKworker returns the value of the field, resolving if necessary 10381 func (ev *Event) GetPtraceTraceeIsKworker() bool { 10382 if ev.GetEventType().String() != "ptrace" { 10383 return false 10384 } 10385 if ev.PTrace.Tracee == nil { 10386 return false 10387 } 10388 return ev.PTrace.Tracee.Process.PIDContext.IsKworker 10389 } 10390 10391 // GetPtraceTraceeIsThread returns the value of the field, resolving if necessary 10392 func (ev *Event) GetPtraceTraceeIsThread() bool { 10393 if ev.GetEventType().String() != "ptrace" { 10394 return false 10395 } 10396 if ev.PTrace.Tracee == nil { 10397 return false 10398 } 10399 return ev.PTrace.Tracee.Process.IsThread 10400 } 10401 10402 // GetPtraceTraceeParentArgs returns the value of the field, resolving if necessary 10403 func (ev *Event) GetPtraceTraceeParentArgs() string { 10404 if ev.GetEventType().String() != "ptrace" { 10405 return "" 10406 } 10407 if ev.PTrace.Tracee == nil { 10408 return "" 10409 } 10410 if ev.PTrace.Tracee.Parent == nil { 10411 return "" 10412 } 10413 if !ev.PTrace.Tracee.HasParent() { 10414 return "" 10415 } 10416 return ev.FieldHandlers.ResolveProcessArgs(ev, ev.PTrace.Tracee.Parent) 10417 } 10418 10419 // GetPtraceTraceeParentArgsFlags returns the value of the field, resolving if necessary 10420 func (ev *Event) GetPtraceTraceeParentArgsFlags() []string { 10421 if ev.GetEventType().String() != "ptrace" { 10422 return []string{} 10423 } 10424 if ev.PTrace.Tracee == nil { 10425 return []string{} 10426 } 10427 if ev.PTrace.Tracee.Parent == nil { 10428 return []string{} 10429 } 10430 if !ev.PTrace.Tracee.HasParent() { 10431 return []string{} 10432 } 10433 return ev.FieldHandlers.ResolveProcessArgsFlags(ev, ev.PTrace.Tracee.Parent) 10434 } 10435 10436 // GetPtraceTraceeParentArgsOptions returns the value of the field, resolving if necessary 10437 func (ev *Event) GetPtraceTraceeParentArgsOptions() []string { 10438 if ev.GetEventType().String() != "ptrace" { 10439 return []string{} 10440 } 10441 if ev.PTrace.Tracee == nil { 10442 return []string{} 10443 } 10444 if ev.PTrace.Tracee.Parent == nil { 10445 return []string{} 10446 } 10447 if !ev.PTrace.Tracee.HasParent() { 10448 return []string{} 10449 } 10450 return ev.FieldHandlers.ResolveProcessArgsOptions(ev, ev.PTrace.Tracee.Parent) 10451 } 10452 10453 // GetPtraceTraceeParentArgsScrubbed returns the value of the field, resolving if necessary 10454 func (ev *Event) GetPtraceTraceeParentArgsScrubbed() string { 10455 if ev.GetEventType().String() != "ptrace" { 10456 return "" 10457 } 10458 if ev.PTrace.Tracee == nil { 10459 return "" 10460 } 10461 if ev.PTrace.Tracee.Parent == nil { 10462 return "" 10463 } 10464 if !ev.PTrace.Tracee.HasParent() { 10465 return "" 10466 } 10467 return ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, ev.PTrace.Tracee.Parent) 10468 } 10469 10470 // GetPtraceTraceeParentArgsTruncated returns the value of the field, resolving if necessary 10471 func (ev *Event) GetPtraceTraceeParentArgsTruncated() bool { 10472 if ev.GetEventType().String() != "ptrace" { 10473 return false 10474 } 10475 if ev.PTrace.Tracee == nil { 10476 return false 10477 } 10478 if ev.PTrace.Tracee.Parent == nil { 10479 return false 10480 } 10481 if !ev.PTrace.Tracee.HasParent() { 10482 return false 10483 } 10484 return ev.FieldHandlers.ResolveProcessArgsTruncated(ev, ev.PTrace.Tracee.Parent) 10485 } 10486 10487 // GetPtraceTraceeParentArgv returns the value of the field, resolving if necessary 10488 func (ev *Event) GetPtraceTraceeParentArgv() []string { 10489 if ev.GetEventType().String() != "ptrace" { 10490 return []string{} 10491 } 10492 if ev.PTrace.Tracee == nil { 10493 return []string{} 10494 } 10495 if ev.PTrace.Tracee.Parent == nil { 10496 return []string{} 10497 } 10498 if !ev.PTrace.Tracee.HasParent() { 10499 return []string{} 10500 } 10501 return ev.FieldHandlers.ResolveProcessArgv(ev, ev.PTrace.Tracee.Parent) 10502 } 10503 10504 // GetPtraceTraceeParentArgv0 returns the value of the field, resolving if necessary 10505 func (ev *Event) GetPtraceTraceeParentArgv0() string { 10506 if ev.GetEventType().String() != "ptrace" { 10507 return "" 10508 } 10509 if ev.PTrace.Tracee == nil { 10510 return "" 10511 } 10512 if ev.PTrace.Tracee.Parent == nil { 10513 return "" 10514 } 10515 if !ev.PTrace.Tracee.HasParent() { 10516 return "" 10517 } 10518 return ev.FieldHandlers.ResolveProcessArgv0(ev, ev.PTrace.Tracee.Parent) 10519 } 10520 10521 // GetPtraceTraceeParentArgvScrubbed returns the value of the field, resolving if necessary 10522 func (ev *Event) GetPtraceTraceeParentArgvScrubbed() []string { 10523 if ev.GetEventType().String() != "ptrace" { 10524 return []string{} 10525 } 10526 if ev.PTrace.Tracee == nil { 10527 return []string{} 10528 } 10529 if ev.PTrace.Tracee.Parent == nil { 10530 return []string{} 10531 } 10532 if !ev.PTrace.Tracee.HasParent() { 10533 return []string{} 10534 } 10535 return ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, ev.PTrace.Tracee.Parent) 10536 } 10537 10538 // GetPtraceTraceeParentCapEffective returns the value of the field, resolving if necessary 10539 func (ev *Event) GetPtraceTraceeParentCapEffective() uint64 { 10540 if ev.GetEventType().String() != "ptrace" { 10541 return uint64(0) 10542 } 10543 if ev.PTrace.Tracee == nil { 10544 return uint64(0) 10545 } 10546 if ev.PTrace.Tracee.Parent == nil { 10547 return uint64(0) 10548 } 10549 if !ev.PTrace.Tracee.HasParent() { 10550 return uint64(0) 10551 } 10552 return ev.PTrace.Tracee.Parent.Credentials.CapEffective 10553 } 10554 10555 // GetPtraceTraceeParentCapPermitted returns the value of the field, resolving if necessary 10556 func (ev *Event) GetPtraceTraceeParentCapPermitted() uint64 { 10557 if ev.GetEventType().String() != "ptrace" { 10558 return uint64(0) 10559 } 10560 if ev.PTrace.Tracee == nil { 10561 return uint64(0) 10562 } 10563 if ev.PTrace.Tracee.Parent == nil { 10564 return uint64(0) 10565 } 10566 if !ev.PTrace.Tracee.HasParent() { 10567 return uint64(0) 10568 } 10569 return ev.PTrace.Tracee.Parent.Credentials.CapPermitted 10570 } 10571 10572 // GetPtraceTraceeParentCmdargv returns the value of the field, resolving if necessary 10573 func (ev *Event) GetPtraceTraceeParentCmdargv() []string { 10574 if ev.GetEventType().String() != "ptrace" { 10575 return []string{} 10576 } 10577 if ev.PTrace.Tracee == nil { 10578 return []string{} 10579 } 10580 if ev.PTrace.Tracee.Parent == nil { 10581 return []string{} 10582 } 10583 if !ev.PTrace.Tracee.HasParent() { 10584 return []string{} 10585 } 10586 return ev.FieldHandlers.ResolveProcessCmdArgv(ev, ev.PTrace.Tracee.Parent) 10587 } 10588 10589 // GetPtraceTraceeParentComm returns the value of the field, resolving if necessary 10590 func (ev *Event) GetPtraceTraceeParentComm() string { 10591 if ev.GetEventType().String() != "ptrace" { 10592 return "" 10593 } 10594 if ev.PTrace.Tracee == nil { 10595 return "" 10596 } 10597 if ev.PTrace.Tracee.Parent == nil { 10598 return "" 10599 } 10600 if !ev.PTrace.Tracee.HasParent() { 10601 return "" 10602 } 10603 return ev.PTrace.Tracee.Parent.Comm 10604 } 10605 10606 // GetPtraceTraceeParentContainerId returns the value of the field, resolving if necessary 10607 func (ev *Event) GetPtraceTraceeParentContainerId() string { 10608 if ev.GetEventType().String() != "ptrace" { 10609 return "" 10610 } 10611 if ev.PTrace.Tracee == nil { 10612 return "" 10613 } 10614 if ev.PTrace.Tracee.Parent == nil { 10615 return "" 10616 } 10617 if !ev.PTrace.Tracee.HasParent() { 10618 return "" 10619 } 10620 return ev.PTrace.Tracee.Parent.ContainerID 10621 } 10622 10623 // GetPtraceTraceeParentCreatedAt returns the value of the field, resolving if necessary 10624 func (ev *Event) GetPtraceTraceeParentCreatedAt() int { 10625 if ev.GetEventType().String() != "ptrace" { 10626 return 0 10627 } 10628 if ev.PTrace.Tracee == nil { 10629 return 0 10630 } 10631 if ev.PTrace.Tracee.Parent == nil { 10632 return 0 10633 } 10634 if !ev.PTrace.Tracee.HasParent() { 10635 return 0 10636 } 10637 return ev.FieldHandlers.ResolveProcessCreatedAt(ev, ev.PTrace.Tracee.Parent) 10638 } 10639 10640 // GetPtraceTraceeParentEgid returns the value of the field, resolving if necessary 10641 func (ev *Event) GetPtraceTraceeParentEgid() uint32 { 10642 if ev.GetEventType().String() != "ptrace" { 10643 return uint32(0) 10644 } 10645 if ev.PTrace.Tracee == nil { 10646 return uint32(0) 10647 } 10648 if ev.PTrace.Tracee.Parent == nil { 10649 return uint32(0) 10650 } 10651 if !ev.PTrace.Tracee.HasParent() { 10652 return uint32(0) 10653 } 10654 return ev.PTrace.Tracee.Parent.Credentials.EGID 10655 } 10656 10657 // GetPtraceTraceeParentEgroup returns the value of the field, resolving if necessary 10658 func (ev *Event) GetPtraceTraceeParentEgroup() string { 10659 if ev.GetEventType().String() != "ptrace" { 10660 return "" 10661 } 10662 if ev.PTrace.Tracee == nil { 10663 return "" 10664 } 10665 if ev.PTrace.Tracee.Parent == nil { 10666 return "" 10667 } 10668 if !ev.PTrace.Tracee.HasParent() { 10669 return "" 10670 } 10671 return ev.PTrace.Tracee.Parent.Credentials.EGroup 10672 } 10673 10674 // GetPtraceTraceeParentEnvp returns the value of the field, resolving if necessary 10675 func (ev *Event) GetPtraceTraceeParentEnvp() []string { 10676 if ev.GetEventType().String() != "ptrace" { 10677 return []string{} 10678 } 10679 if ev.PTrace.Tracee == nil { 10680 return []string{} 10681 } 10682 if ev.PTrace.Tracee.Parent == nil { 10683 return []string{} 10684 } 10685 if !ev.PTrace.Tracee.HasParent() { 10686 return []string{} 10687 } 10688 return ev.FieldHandlers.ResolveProcessEnvp(ev, ev.PTrace.Tracee.Parent) 10689 } 10690 10691 // GetPtraceTraceeParentEnvs returns the value of the field, resolving if necessary 10692 func (ev *Event) GetPtraceTraceeParentEnvs() []string { 10693 if ev.GetEventType().String() != "ptrace" { 10694 return []string{} 10695 } 10696 if ev.PTrace.Tracee == nil { 10697 return []string{} 10698 } 10699 if ev.PTrace.Tracee.Parent == nil { 10700 return []string{} 10701 } 10702 if !ev.PTrace.Tracee.HasParent() { 10703 return []string{} 10704 } 10705 return ev.FieldHandlers.ResolveProcessEnvs(ev, ev.PTrace.Tracee.Parent) 10706 } 10707 10708 // GetPtraceTraceeParentEnvsTruncated returns the value of the field, resolving if necessary 10709 func (ev *Event) GetPtraceTraceeParentEnvsTruncated() bool { 10710 if ev.GetEventType().String() != "ptrace" { 10711 return false 10712 } 10713 if ev.PTrace.Tracee == nil { 10714 return false 10715 } 10716 if ev.PTrace.Tracee.Parent == nil { 10717 return false 10718 } 10719 if !ev.PTrace.Tracee.HasParent() { 10720 return false 10721 } 10722 return ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, ev.PTrace.Tracee.Parent) 10723 } 10724 10725 // GetPtraceTraceeParentEuid returns the value of the field, resolving if necessary 10726 func (ev *Event) GetPtraceTraceeParentEuid() uint32 { 10727 if ev.GetEventType().String() != "ptrace" { 10728 return uint32(0) 10729 } 10730 if ev.PTrace.Tracee == nil { 10731 return uint32(0) 10732 } 10733 if ev.PTrace.Tracee.Parent == nil { 10734 return uint32(0) 10735 } 10736 if !ev.PTrace.Tracee.HasParent() { 10737 return uint32(0) 10738 } 10739 return ev.PTrace.Tracee.Parent.Credentials.EUID 10740 } 10741 10742 // GetPtraceTraceeParentEuser returns the value of the field, resolving if necessary 10743 func (ev *Event) GetPtraceTraceeParentEuser() string { 10744 if ev.GetEventType().String() != "ptrace" { 10745 return "" 10746 } 10747 if ev.PTrace.Tracee == nil { 10748 return "" 10749 } 10750 if ev.PTrace.Tracee.Parent == nil { 10751 return "" 10752 } 10753 if !ev.PTrace.Tracee.HasParent() { 10754 return "" 10755 } 10756 return ev.PTrace.Tracee.Parent.Credentials.EUser 10757 } 10758 10759 // GetPtraceTraceeParentFileChangeTime returns the value of the field, resolving if necessary 10760 func (ev *Event) GetPtraceTraceeParentFileChangeTime() uint64 { 10761 if ev.GetEventType().String() != "ptrace" { 10762 return uint64(0) 10763 } 10764 if ev.PTrace.Tracee == nil { 10765 return uint64(0) 10766 } 10767 if ev.PTrace.Tracee.Parent == nil { 10768 return uint64(0) 10769 } 10770 if !ev.PTrace.Tracee.HasParent() { 10771 return uint64(0) 10772 } 10773 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10774 return uint64(0) 10775 } 10776 return ev.PTrace.Tracee.Parent.FileEvent.FileFields.CTime 10777 } 10778 10779 // GetPtraceTraceeParentFileFilesystem returns the value of the field, resolving if necessary 10780 func (ev *Event) GetPtraceTraceeParentFileFilesystem() string { 10781 if ev.GetEventType().String() != "ptrace" { 10782 return "" 10783 } 10784 if ev.PTrace.Tracee == nil { 10785 return "" 10786 } 10787 if ev.PTrace.Tracee.Parent == nil { 10788 return "" 10789 } 10790 if !ev.PTrace.Tracee.HasParent() { 10791 return "" 10792 } 10793 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10794 return "" 10795 } 10796 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.PTrace.Tracee.Parent.FileEvent) 10797 } 10798 10799 // GetPtraceTraceeParentFileGid returns the value of the field, resolving if necessary 10800 func (ev *Event) GetPtraceTraceeParentFileGid() uint32 { 10801 if ev.GetEventType().String() != "ptrace" { 10802 return uint32(0) 10803 } 10804 if ev.PTrace.Tracee == nil { 10805 return uint32(0) 10806 } 10807 if ev.PTrace.Tracee.Parent == nil { 10808 return uint32(0) 10809 } 10810 if !ev.PTrace.Tracee.HasParent() { 10811 return uint32(0) 10812 } 10813 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10814 return uint32(0) 10815 } 10816 return ev.PTrace.Tracee.Parent.FileEvent.FileFields.GID 10817 } 10818 10819 // GetPtraceTraceeParentFileGroup returns the value of the field, resolving if necessary 10820 func (ev *Event) GetPtraceTraceeParentFileGroup() string { 10821 if ev.GetEventType().String() != "ptrace" { 10822 return "" 10823 } 10824 if ev.PTrace.Tracee == nil { 10825 return "" 10826 } 10827 if ev.PTrace.Tracee.Parent == nil { 10828 return "" 10829 } 10830 if !ev.PTrace.Tracee.HasParent() { 10831 return "" 10832 } 10833 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10834 return "" 10835 } 10836 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.PTrace.Tracee.Parent.FileEvent.FileFields) 10837 } 10838 10839 // GetPtraceTraceeParentFileHashes returns the value of the field, resolving if necessary 10840 func (ev *Event) GetPtraceTraceeParentFileHashes() []string { 10841 if ev.GetEventType().String() != "ptrace" { 10842 return []string{} 10843 } 10844 if ev.PTrace.Tracee == nil { 10845 return []string{} 10846 } 10847 if ev.PTrace.Tracee.Parent == nil { 10848 return []string{} 10849 } 10850 if !ev.PTrace.Tracee.HasParent() { 10851 return []string{} 10852 } 10853 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10854 return []string{} 10855 } 10856 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.PTrace.Tracee.Parent.FileEvent) 10857 } 10858 10859 // GetPtraceTraceeParentFileInUpperLayer returns the value of the field, resolving if necessary 10860 func (ev *Event) GetPtraceTraceeParentFileInUpperLayer() bool { 10861 if ev.GetEventType().String() != "ptrace" { 10862 return false 10863 } 10864 if ev.PTrace.Tracee == nil { 10865 return false 10866 } 10867 if ev.PTrace.Tracee.Parent == nil { 10868 return false 10869 } 10870 if !ev.PTrace.Tracee.HasParent() { 10871 return false 10872 } 10873 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10874 return false 10875 } 10876 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.PTrace.Tracee.Parent.FileEvent.FileFields) 10877 } 10878 10879 // GetPtraceTraceeParentFileInode returns the value of the field, resolving if necessary 10880 func (ev *Event) GetPtraceTraceeParentFileInode() uint64 { 10881 if ev.GetEventType().String() != "ptrace" { 10882 return uint64(0) 10883 } 10884 if ev.PTrace.Tracee == nil { 10885 return uint64(0) 10886 } 10887 if ev.PTrace.Tracee.Parent == nil { 10888 return uint64(0) 10889 } 10890 if !ev.PTrace.Tracee.HasParent() { 10891 return uint64(0) 10892 } 10893 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10894 return uint64(0) 10895 } 10896 return ev.PTrace.Tracee.Parent.FileEvent.FileFields.PathKey.Inode 10897 } 10898 10899 // GetPtraceTraceeParentFileMode returns the value of the field, resolving if necessary 10900 func (ev *Event) GetPtraceTraceeParentFileMode() uint16 { 10901 if ev.GetEventType().String() != "ptrace" { 10902 return uint16(0) 10903 } 10904 if ev.PTrace.Tracee == nil { 10905 return uint16(0) 10906 } 10907 if ev.PTrace.Tracee.Parent == nil { 10908 return uint16(0) 10909 } 10910 if !ev.PTrace.Tracee.HasParent() { 10911 return uint16(0) 10912 } 10913 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10914 return uint16(0) 10915 } 10916 return ev.PTrace.Tracee.Parent.FileEvent.FileFields.Mode 10917 } 10918 10919 // GetPtraceTraceeParentFileModificationTime returns the value of the field, resolving if necessary 10920 func (ev *Event) GetPtraceTraceeParentFileModificationTime() uint64 { 10921 if ev.GetEventType().String() != "ptrace" { 10922 return uint64(0) 10923 } 10924 if ev.PTrace.Tracee == nil { 10925 return uint64(0) 10926 } 10927 if ev.PTrace.Tracee.Parent == nil { 10928 return uint64(0) 10929 } 10930 if !ev.PTrace.Tracee.HasParent() { 10931 return uint64(0) 10932 } 10933 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10934 return uint64(0) 10935 } 10936 return ev.PTrace.Tracee.Parent.FileEvent.FileFields.MTime 10937 } 10938 10939 // GetPtraceTraceeParentFileMountId returns the value of the field, resolving if necessary 10940 func (ev *Event) GetPtraceTraceeParentFileMountId() uint32 { 10941 if ev.GetEventType().String() != "ptrace" { 10942 return uint32(0) 10943 } 10944 if ev.PTrace.Tracee == nil { 10945 return uint32(0) 10946 } 10947 if ev.PTrace.Tracee.Parent == nil { 10948 return uint32(0) 10949 } 10950 if !ev.PTrace.Tracee.HasParent() { 10951 return uint32(0) 10952 } 10953 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10954 return uint32(0) 10955 } 10956 return ev.PTrace.Tracee.Parent.FileEvent.FileFields.PathKey.MountID 10957 } 10958 10959 // GetPtraceTraceeParentFileName returns the value of the field, resolving if necessary 10960 func (ev *Event) GetPtraceTraceeParentFileName() string { 10961 if ev.GetEventType().String() != "ptrace" { 10962 return "" 10963 } 10964 if ev.PTrace.Tracee == nil { 10965 return "" 10966 } 10967 if ev.PTrace.Tracee.Parent == nil { 10968 return "" 10969 } 10970 if !ev.PTrace.Tracee.HasParent() { 10971 return "" 10972 } 10973 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 10974 return "" 10975 } 10976 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.PTrace.Tracee.Parent.FileEvent) 10977 } 10978 10979 // GetPtraceTraceeParentFileNameLength returns the value of the field, resolving if necessary 10980 func (ev *Event) GetPtraceTraceeParentFileNameLength() int { 10981 if ev.GetEventType().String() != "ptrace" { 10982 return 0 10983 } 10984 if ev.PTrace.Tracee == nil { 10985 return 0 10986 } 10987 if ev.PTrace.Tracee.Parent == nil { 10988 return 0 10989 } 10990 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.PTrace.Tracee.Parent.FileEvent)) 10991 } 10992 10993 // GetPtraceTraceeParentFilePackageName returns the value of the field, resolving if necessary 10994 func (ev *Event) GetPtraceTraceeParentFilePackageName() string { 10995 if ev.GetEventType().String() != "ptrace" { 10996 return "" 10997 } 10998 if ev.PTrace.Tracee == nil { 10999 return "" 11000 } 11001 if ev.PTrace.Tracee.Parent == nil { 11002 return "" 11003 } 11004 if !ev.PTrace.Tracee.HasParent() { 11005 return "" 11006 } 11007 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 11008 return "" 11009 } 11010 return ev.FieldHandlers.ResolvePackageName(ev, &ev.PTrace.Tracee.Parent.FileEvent) 11011 } 11012 11013 // GetPtraceTraceeParentFilePackageSourceVersion returns the value of the field, resolving if necessary 11014 func (ev *Event) GetPtraceTraceeParentFilePackageSourceVersion() string { 11015 if ev.GetEventType().String() != "ptrace" { 11016 return "" 11017 } 11018 if ev.PTrace.Tracee == nil { 11019 return "" 11020 } 11021 if ev.PTrace.Tracee.Parent == nil { 11022 return "" 11023 } 11024 if !ev.PTrace.Tracee.HasParent() { 11025 return "" 11026 } 11027 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 11028 return "" 11029 } 11030 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.PTrace.Tracee.Parent.FileEvent) 11031 } 11032 11033 // GetPtraceTraceeParentFilePackageVersion returns the value of the field, resolving if necessary 11034 func (ev *Event) GetPtraceTraceeParentFilePackageVersion() string { 11035 if ev.GetEventType().String() != "ptrace" { 11036 return "" 11037 } 11038 if ev.PTrace.Tracee == nil { 11039 return "" 11040 } 11041 if ev.PTrace.Tracee.Parent == nil { 11042 return "" 11043 } 11044 if !ev.PTrace.Tracee.HasParent() { 11045 return "" 11046 } 11047 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 11048 return "" 11049 } 11050 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.PTrace.Tracee.Parent.FileEvent) 11051 } 11052 11053 // GetPtraceTraceeParentFilePath returns the value of the field, resolving if necessary 11054 func (ev *Event) GetPtraceTraceeParentFilePath() string { 11055 if ev.GetEventType().String() != "ptrace" { 11056 return "" 11057 } 11058 if ev.PTrace.Tracee == nil { 11059 return "" 11060 } 11061 if ev.PTrace.Tracee.Parent == nil { 11062 return "" 11063 } 11064 if !ev.PTrace.Tracee.HasParent() { 11065 return "" 11066 } 11067 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 11068 return "" 11069 } 11070 return ev.FieldHandlers.ResolveFilePath(ev, &ev.PTrace.Tracee.Parent.FileEvent) 11071 } 11072 11073 // GetPtraceTraceeParentFilePathLength returns the value of the field, resolving if necessary 11074 func (ev *Event) GetPtraceTraceeParentFilePathLength() int { 11075 if ev.GetEventType().String() != "ptrace" { 11076 return 0 11077 } 11078 if ev.PTrace.Tracee == nil { 11079 return 0 11080 } 11081 if ev.PTrace.Tracee.Parent == nil { 11082 return 0 11083 } 11084 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.PTrace.Tracee.Parent.FileEvent)) 11085 } 11086 11087 // GetPtraceTraceeParentFileRights returns the value of the field, resolving if necessary 11088 func (ev *Event) GetPtraceTraceeParentFileRights() int { 11089 if ev.GetEventType().String() != "ptrace" { 11090 return 0 11091 } 11092 if ev.PTrace.Tracee == nil { 11093 return 0 11094 } 11095 if ev.PTrace.Tracee.Parent == nil { 11096 return 0 11097 } 11098 if !ev.PTrace.Tracee.HasParent() { 11099 return 0 11100 } 11101 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 11102 return 0 11103 } 11104 return ev.FieldHandlers.ResolveRights(ev, &ev.PTrace.Tracee.Parent.FileEvent.FileFields) 11105 } 11106 11107 // GetPtraceTraceeParentFileUid returns the value of the field, resolving if necessary 11108 func (ev *Event) GetPtraceTraceeParentFileUid() uint32 { 11109 if ev.GetEventType().String() != "ptrace" { 11110 return uint32(0) 11111 } 11112 if ev.PTrace.Tracee == nil { 11113 return uint32(0) 11114 } 11115 if ev.PTrace.Tracee.Parent == nil { 11116 return uint32(0) 11117 } 11118 if !ev.PTrace.Tracee.HasParent() { 11119 return uint32(0) 11120 } 11121 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 11122 return uint32(0) 11123 } 11124 return ev.PTrace.Tracee.Parent.FileEvent.FileFields.UID 11125 } 11126 11127 // GetPtraceTraceeParentFileUser returns the value of the field, resolving if necessary 11128 func (ev *Event) GetPtraceTraceeParentFileUser() string { 11129 if ev.GetEventType().String() != "ptrace" { 11130 return "" 11131 } 11132 if ev.PTrace.Tracee == nil { 11133 return "" 11134 } 11135 if ev.PTrace.Tracee.Parent == nil { 11136 return "" 11137 } 11138 if !ev.PTrace.Tracee.HasParent() { 11139 return "" 11140 } 11141 if !ev.PTrace.Tracee.Parent.IsNotKworker() { 11142 return "" 11143 } 11144 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.PTrace.Tracee.Parent.FileEvent.FileFields) 11145 } 11146 11147 // GetPtraceTraceeParentFsgid returns the value of the field, resolving if necessary 11148 func (ev *Event) GetPtraceTraceeParentFsgid() uint32 { 11149 if ev.GetEventType().String() != "ptrace" { 11150 return uint32(0) 11151 } 11152 if ev.PTrace.Tracee == nil { 11153 return uint32(0) 11154 } 11155 if ev.PTrace.Tracee.Parent == nil { 11156 return uint32(0) 11157 } 11158 if !ev.PTrace.Tracee.HasParent() { 11159 return uint32(0) 11160 } 11161 return ev.PTrace.Tracee.Parent.Credentials.FSGID 11162 } 11163 11164 // GetPtraceTraceeParentFsgroup returns the value of the field, resolving if necessary 11165 func (ev *Event) GetPtraceTraceeParentFsgroup() string { 11166 if ev.GetEventType().String() != "ptrace" { 11167 return "" 11168 } 11169 if ev.PTrace.Tracee == nil { 11170 return "" 11171 } 11172 if ev.PTrace.Tracee.Parent == nil { 11173 return "" 11174 } 11175 if !ev.PTrace.Tracee.HasParent() { 11176 return "" 11177 } 11178 return ev.PTrace.Tracee.Parent.Credentials.FSGroup 11179 } 11180 11181 // GetPtraceTraceeParentFsuid returns the value of the field, resolving if necessary 11182 func (ev *Event) GetPtraceTraceeParentFsuid() uint32 { 11183 if ev.GetEventType().String() != "ptrace" { 11184 return uint32(0) 11185 } 11186 if ev.PTrace.Tracee == nil { 11187 return uint32(0) 11188 } 11189 if ev.PTrace.Tracee.Parent == nil { 11190 return uint32(0) 11191 } 11192 if !ev.PTrace.Tracee.HasParent() { 11193 return uint32(0) 11194 } 11195 return ev.PTrace.Tracee.Parent.Credentials.FSUID 11196 } 11197 11198 // GetPtraceTraceeParentFsuser returns the value of the field, resolving if necessary 11199 func (ev *Event) GetPtraceTraceeParentFsuser() string { 11200 if ev.GetEventType().String() != "ptrace" { 11201 return "" 11202 } 11203 if ev.PTrace.Tracee == nil { 11204 return "" 11205 } 11206 if ev.PTrace.Tracee.Parent == nil { 11207 return "" 11208 } 11209 if !ev.PTrace.Tracee.HasParent() { 11210 return "" 11211 } 11212 return ev.PTrace.Tracee.Parent.Credentials.FSUser 11213 } 11214 11215 // GetPtraceTraceeParentGid returns the value of the field, resolving if necessary 11216 func (ev *Event) GetPtraceTraceeParentGid() uint32 { 11217 if ev.GetEventType().String() != "ptrace" { 11218 return uint32(0) 11219 } 11220 if ev.PTrace.Tracee == nil { 11221 return uint32(0) 11222 } 11223 if ev.PTrace.Tracee.Parent == nil { 11224 return uint32(0) 11225 } 11226 if !ev.PTrace.Tracee.HasParent() { 11227 return uint32(0) 11228 } 11229 return ev.PTrace.Tracee.Parent.Credentials.GID 11230 } 11231 11232 // GetPtraceTraceeParentGroup returns the value of the field, resolving if necessary 11233 func (ev *Event) GetPtraceTraceeParentGroup() string { 11234 if ev.GetEventType().String() != "ptrace" { 11235 return "" 11236 } 11237 if ev.PTrace.Tracee == nil { 11238 return "" 11239 } 11240 if ev.PTrace.Tracee.Parent == nil { 11241 return "" 11242 } 11243 if !ev.PTrace.Tracee.HasParent() { 11244 return "" 11245 } 11246 return ev.PTrace.Tracee.Parent.Credentials.Group 11247 } 11248 11249 // GetPtraceTraceeParentInterpreterFileChangeTime returns the value of the field, resolving if necessary 11250 func (ev *Event) GetPtraceTraceeParentInterpreterFileChangeTime() uint64 { 11251 if ev.GetEventType().String() != "ptrace" { 11252 return uint64(0) 11253 } 11254 if ev.PTrace.Tracee == nil { 11255 return uint64(0) 11256 } 11257 if ev.PTrace.Tracee.Parent == nil { 11258 return uint64(0) 11259 } 11260 if !ev.PTrace.Tracee.HasParent() { 11261 return uint64(0) 11262 } 11263 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11264 return uint64(0) 11265 } 11266 return ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields.CTime 11267 } 11268 11269 // GetPtraceTraceeParentInterpreterFileFilesystem returns the value of the field, resolving if necessary 11270 func (ev *Event) GetPtraceTraceeParentInterpreterFileFilesystem() string { 11271 if ev.GetEventType().String() != "ptrace" { 11272 return "" 11273 } 11274 if ev.PTrace.Tracee == nil { 11275 return "" 11276 } 11277 if ev.PTrace.Tracee.Parent == nil { 11278 return "" 11279 } 11280 if !ev.PTrace.Tracee.HasParent() { 11281 return "" 11282 } 11283 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11284 return "" 11285 } 11286 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent) 11287 } 11288 11289 // GetPtraceTraceeParentInterpreterFileGid returns the value of the field, resolving if necessary 11290 func (ev *Event) GetPtraceTraceeParentInterpreterFileGid() uint32 { 11291 if ev.GetEventType().String() != "ptrace" { 11292 return uint32(0) 11293 } 11294 if ev.PTrace.Tracee == nil { 11295 return uint32(0) 11296 } 11297 if ev.PTrace.Tracee.Parent == nil { 11298 return uint32(0) 11299 } 11300 if !ev.PTrace.Tracee.HasParent() { 11301 return uint32(0) 11302 } 11303 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11304 return uint32(0) 11305 } 11306 return ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields.GID 11307 } 11308 11309 // GetPtraceTraceeParentInterpreterFileGroup returns the value of the field, resolving if necessary 11310 func (ev *Event) GetPtraceTraceeParentInterpreterFileGroup() string { 11311 if ev.GetEventType().String() != "ptrace" { 11312 return "" 11313 } 11314 if ev.PTrace.Tracee == nil { 11315 return "" 11316 } 11317 if ev.PTrace.Tracee.Parent == nil { 11318 return "" 11319 } 11320 if !ev.PTrace.Tracee.HasParent() { 11321 return "" 11322 } 11323 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11324 return "" 11325 } 11326 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields) 11327 } 11328 11329 // GetPtraceTraceeParentInterpreterFileHashes returns the value of the field, resolving if necessary 11330 func (ev *Event) GetPtraceTraceeParentInterpreterFileHashes() []string { 11331 if ev.GetEventType().String() != "ptrace" { 11332 return []string{} 11333 } 11334 if ev.PTrace.Tracee == nil { 11335 return []string{} 11336 } 11337 if ev.PTrace.Tracee.Parent == nil { 11338 return []string{} 11339 } 11340 if !ev.PTrace.Tracee.HasParent() { 11341 return []string{} 11342 } 11343 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11344 return []string{} 11345 } 11346 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent) 11347 } 11348 11349 // GetPtraceTraceeParentInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 11350 func (ev *Event) GetPtraceTraceeParentInterpreterFileInUpperLayer() bool { 11351 if ev.GetEventType().String() != "ptrace" { 11352 return false 11353 } 11354 if ev.PTrace.Tracee == nil { 11355 return false 11356 } 11357 if ev.PTrace.Tracee.Parent == nil { 11358 return false 11359 } 11360 if !ev.PTrace.Tracee.HasParent() { 11361 return false 11362 } 11363 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11364 return false 11365 } 11366 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields) 11367 } 11368 11369 // GetPtraceTraceeParentInterpreterFileInode returns the value of the field, resolving if necessary 11370 func (ev *Event) GetPtraceTraceeParentInterpreterFileInode() uint64 { 11371 if ev.GetEventType().String() != "ptrace" { 11372 return uint64(0) 11373 } 11374 if ev.PTrace.Tracee == nil { 11375 return uint64(0) 11376 } 11377 if ev.PTrace.Tracee.Parent == nil { 11378 return uint64(0) 11379 } 11380 if !ev.PTrace.Tracee.HasParent() { 11381 return uint64(0) 11382 } 11383 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11384 return uint64(0) 11385 } 11386 return ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 11387 } 11388 11389 // GetPtraceTraceeParentInterpreterFileMode returns the value of the field, resolving if necessary 11390 func (ev *Event) GetPtraceTraceeParentInterpreterFileMode() uint16 { 11391 if ev.GetEventType().String() != "ptrace" { 11392 return uint16(0) 11393 } 11394 if ev.PTrace.Tracee == nil { 11395 return uint16(0) 11396 } 11397 if ev.PTrace.Tracee.Parent == nil { 11398 return uint16(0) 11399 } 11400 if !ev.PTrace.Tracee.HasParent() { 11401 return uint16(0) 11402 } 11403 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11404 return uint16(0) 11405 } 11406 return ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields.Mode 11407 } 11408 11409 // GetPtraceTraceeParentInterpreterFileModificationTime returns the value of the field, resolving if necessary 11410 func (ev *Event) GetPtraceTraceeParentInterpreterFileModificationTime() uint64 { 11411 if ev.GetEventType().String() != "ptrace" { 11412 return uint64(0) 11413 } 11414 if ev.PTrace.Tracee == nil { 11415 return uint64(0) 11416 } 11417 if ev.PTrace.Tracee.Parent == nil { 11418 return uint64(0) 11419 } 11420 if !ev.PTrace.Tracee.HasParent() { 11421 return uint64(0) 11422 } 11423 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11424 return uint64(0) 11425 } 11426 return ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields.MTime 11427 } 11428 11429 // GetPtraceTraceeParentInterpreterFileMountId returns the value of the field, resolving if necessary 11430 func (ev *Event) GetPtraceTraceeParentInterpreterFileMountId() uint32 { 11431 if ev.GetEventType().String() != "ptrace" { 11432 return uint32(0) 11433 } 11434 if ev.PTrace.Tracee == nil { 11435 return uint32(0) 11436 } 11437 if ev.PTrace.Tracee.Parent == nil { 11438 return uint32(0) 11439 } 11440 if !ev.PTrace.Tracee.HasParent() { 11441 return uint32(0) 11442 } 11443 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11444 return uint32(0) 11445 } 11446 return ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 11447 } 11448 11449 // GetPtraceTraceeParentInterpreterFileName returns the value of the field, resolving if necessary 11450 func (ev *Event) GetPtraceTraceeParentInterpreterFileName() string { 11451 if ev.GetEventType().String() != "ptrace" { 11452 return "" 11453 } 11454 if ev.PTrace.Tracee == nil { 11455 return "" 11456 } 11457 if ev.PTrace.Tracee.Parent == nil { 11458 return "" 11459 } 11460 if !ev.PTrace.Tracee.HasParent() { 11461 return "" 11462 } 11463 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11464 return "" 11465 } 11466 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent) 11467 } 11468 11469 // GetPtraceTraceeParentInterpreterFileNameLength returns the value of the field, resolving if necessary 11470 func (ev *Event) GetPtraceTraceeParentInterpreterFileNameLength() int { 11471 if ev.GetEventType().String() != "ptrace" { 11472 return 0 11473 } 11474 if ev.PTrace.Tracee == nil { 11475 return 0 11476 } 11477 if ev.PTrace.Tracee.Parent == nil { 11478 return 0 11479 } 11480 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent)) 11481 } 11482 11483 // GetPtraceTraceeParentInterpreterFilePackageName returns the value of the field, resolving if necessary 11484 func (ev *Event) GetPtraceTraceeParentInterpreterFilePackageName() string { 11485 if ev.GetEventType().String() != "ptrace" { 11486 return "" 11487 } 11488 if ev.PTrace.Tracee == nil { 11489 return "" 11490 } 11491 if ev.PTrace.Tracee.Parent == nil { 11492 return "" 11493 } 11494 if !ev.PTrace.Tracee.HasParent() { 11495 return "" 11496 } 11497 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11498 return "" 11499 } 11500 return ev.FieldHandlers.ResolvePackageName(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent) 11501 } 11502 11503 // GetPtraceTraceeParentInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 11504 func (ev *Event) GetPtraceTraceeParentInterpreterFilePackageSourceVersion() string { 11505 if ev.GetEventType().String() != "ptrace" { 11506 return "" 11507 } 11508 if ev.PTrace.Tracee == nil { 11509 return "" 11510 } 11511 if ev.PTrace.Tracee.Parent == nil { 11512 return "" 11513 } 11514 if !ev.PTrace.Tracee.HasParent() { 11515 return "" 11516 } 11517 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11518 return "" 11519 } 11520 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent) 11521 } 11522 11523 // GetPtraceTraceeParentInterpreterFilePackageVersion returns the value of the field, resolving if necessary 11524 func (ev *Event) GetPtraceTraceeParentInterpreterFilePackageVersion() string { 11525 if ev.GetEventType().String() != "ptrace" { 11526 return "" 11527 } 11528 if ev.PTrace.Tracee == nil { 11529 return "" 11530 } 11531 if ev.PTrace.Tracee.Parent == nil { 11532 return "" 11533 } 11534 if !ev.PTrace.Tracee.HasParent() { 11535 return "" 11536 } 11537 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11538 return "" 11539 } 11540 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent) 11541 } 11542 11543 // GetPtraceTraceeParentInterpreterFilePath returns the value of the field, resolving if necessary 11544 func (ev *Event) GetPtraceTraceeParentInterpreterFilePath() string { 11545 if ev.GetEventType().String() != "ptrace" { 11546 return "" 11547 } 11548 if ev.PTrace.Tracee == nil { 11549 return "" 11550 } 11551 if ev.PTrace.Tracee.Parent == nil { 11552 return "" 11553 } 11554 if !ev.PTrace.Tracee.HasParent() { 11555 return "" 11556 } 11557 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11558 return "" 11559 } 11560 return ev.FieldHandlers.ResolveFilePath(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent) 11561 } 11562 11563 // GetPtraceTraceeParentInterpreterFilePathLength returns the value of the field, resolving if necessary 11564 func (ev *Event) GetPtraceTraceeParentInterpreterFilePathLength() int { 11565 if ev.GetEventType().String() != "ptrace" { 11566 return 0 11567 } 11568 if ev.PTrace.Tracee == nil { 11569 return 0 11570 } 11571 if ev.PTrace.Tracee.Parent == nil { 11572 return 0 11573 } 11574 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent)) 11575 } 11576 11577 // GetPtraceTraceeParentInterpreterFileRights returns the value of the field, resolving if necessary 11578 func (ev *Event) GetPtraceTraceeParentInterpreterFileRights() int { 11579 if ev.GetEventType().String() != "ptrace" { 11580 return 0 11581 } 11582 if ev.PTrace.Tracee == nil { 11583 return 0 11584 } 11585 if ev.PTrace.Tracee.Parent == nil { 11586 return 0 11587 } 11588 if !ev.PTrace.Tracee.HasParent() { 11589 return 0 11590 } 11591 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11592 return 0 11593 } 11594 return ev.FieldHandlers.ResolveRights(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields) 11595 } 11596 11597 // GetPtraceTraceeParentInterpreterFileUid returns the value of the field, resolving if necessary 11598 func (ev *Event) GetPtraceTraceeParentInterpreterFileUid() uint32 { 11599 if ev.GetEventType().String() != "ptrace" { 11600 return uint32(0) 11601 } 11602 if ev.PTrace.Tracee == nil { 11603 return uint32(0) 11604 } 11605 if ev.PTrace.Tracee.Parent == nil { 11606 return uint32(0) 11607 } 11608 if !ev.PTrace.Tracee.HasParent() { 11609 return uint32(0) 11610 } 11611 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11612 return uint32(0) 11613 } 11614 return ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields.UID 11615 } 11616 11617 // GetPtraceTraceeParentInterpreterFileUser returns the value of the field, resolving if necessary 11618 func (ev *Event) GetPtraceTraceeParentInterpreterFileUser() string { 11619 if ev.GetEventType().String() != "ptrace" { 11620 return "" 11621 } 11622 if ev.PTrace.Tracee == nil { 11623 return "" 11624 } 11625 if ev.PTrace.Tracee.Parent == nil { 11626 return "" 11627 } 11628 if !ev.PTrace.Tracee.HasParent() { 11629 return "" 11630 } 11631 if !ev.PTrace.Tracee.Parent.HasInterpreter() { 11632 return "" 11633 } 11634 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.PTrace.Tracee.Parent.LinuxBinprm.FileEvent.FileFields) 11635 } 11636 11637 // GetPtraceTraceeParentIsKworker returns the value of the field, resolving if necessary 11638 func (ev *Event) GetPtraceTraceeParentIsKworker() bool { 11639 if ev.GetEventType().String() != "ptrace" { 11640 return false 11641 } 11642 if ev.PTrace.Tracee == nil { 11643 return false 11644 } 11645 if ev.PTrace.Tracee.Parent == nil { 11646 return false 11647 } 11648 if !ev.PTrace.Tracee.HasParent() { 11649 return false 11650 } 11651 return ev.PTrace.Tracee.Parent.PIDContext.IsKworker 11652 } 11653 11654 // GetPtraceTraceeParentIsThread returns the value of the field, resolving if necessary 11655 func (ev *Event) GetPtraceTraceeParentIsThread() bool { 11656 if ev.GetEventType().String() != "ptrace" { 11657 return false 11658 } 11659 if ev.PTrace.Tracee == nil { 11660 return false 11661 } 11662 if ev.PTrace.Tracee.Parent == nil { 11663 return false 11664 } 11665 if !ev.PTrace.Tracee.HasParent() { 11666 return false 11667 } 11668 return ev.PTrace.Tracee.Parent.IsThread 11669 } 11670 11671 // GetPtraceTraceeParentPid returns the value of the field, resolving if necessary 11672 func (ev *Event) GetPtraceTraceeParentPid() uint32 { 11673 if ev.GetEventType().String() != "ptrace" { 11674 return uint32(0) 11675 } 11676 if ev.PTrace.Tracee == nil { 11677 return uint32(0) 11678 } 11679 if ev.PTrace.Tracee.Parent == nil { 11680 return uint32(0) 11681 } 11682 if !ev.PTrace.Tracee.HasParent() { 11683 return uint32(0) 11684 } 11685 return ev.PTrace.Tracee.Parent.PIDContext.Pid 11686 } 11687 11688 // GetPtraceTraceeParentPpid returns the value of the field, resolving if necessary 11689 func (ev *Event) GetPtraceTraceeParentPpid() uint32 { 11690 if ev.GetEventType().String() != "ptrace" { 11691 return uint32(0) 11692 } 11693 if ev.PTrace.Tracee == nil { 11694 return uint32(0) 11695 } 11696 if ev.PTrace.Tracee.Parent == nil { 11697 return uint32(0) 11698 } 11699 if !ev.PTrace.Tracee.HasParent() { 11700 return uint32(0) 11701 } 11702 return ev.PTrace.Tracee.Parent.PPid 11703 } 11704 11705 // GetPtraceTraceeParentTid returns the value of the field, resolving if necessary 11706 func (ev *Event) GetPtraceTraceeParentTid() uint32 { 11707 if ev.GetEventType().String() != "ptrace" { 11708 return uint32(0) 11709 } 11710 if ev.PTrace.Tracee == nil { 11711 return uint32(0) 11712 } 11713 if ev.PTrace.Tracee.Parent == nil { 11714 return uint32(0) 11715 } 11716 if !ev.PTrace.Tracee.HasParent() { 11717 return uint32(0) 11718 } 11719 return ev.PTrace.Tracee.Parent.PIDContext.Tid 11720 } 11721 11722 // GetPtraceTraceeParentTtyName returns the value of the field, resolving if necessary 11723 func (ev *Event) GetPtraceTraceeParentTtyName() string { 11724 if ev.GetEventType().String() != "ptrace" { 11725 return "" 11726 } 11727 if ev.PTrace.Tracee == nil { 11728 return "" 11729 } 11730 if ev.PTrace.Tracee.Parent == nil { 11731 return "" 11732 } 11733 if !ev.PTrace.Tracee.HasParent() { 11734 return "" 11735 } 11736 return ev.PTrace.Tracee.Parent.TTYName 11737 } 11738 11739 // GetPtraceTraceeParentUid returns the value of the field, resolving if necessary 11740 func (ev *Event) GetPtraceTraceeParentUid() uint32 { 11741 if ev.GetEventType().String() != "ptrace" { 11742 return uint32(0) 11743 } 11744 if ev.PTrace.Tracee == nil { 11745 return uint32(0) 11746 } 11747 if ev.PTrace.Tracee.Parent == nil { 11748 return uint32(0) 11749 } 11750 if !ev.PTrace.Tracee.HasParent() { 11751 return uint32(0) 11752 } 11753 return ev.PTrace.Tracee.Parent.Credentials.UID 11754 } 11755 11756 // GetPtraceTraceeParentUser returns the value of the field, resolving if necessary 11757 func (ev *Event) GetPtraceTraceeParentUser() string { 11758 if ev.GetEventType().String() != "ptrace" { 11759 return "" 11760 } 11761 if ev.PTrace.Tracee == nil { 11762 return "" 11763 } 11764 if ev.PTrace.Tracee.Parent == nil { 11765 return "" 11766 } 11767 if !ev.PTrace.Tracee.HasParent() { 11768 return "" 11769 } 11770 return ev.PTrace.Tracee.Parent.Credentials.User 11771 } 11772 11773 // GetPtraceTraceeParentUserSessionK8sGroups returns the value of the field, resolving if necessary 11774 func (ev *Event) GetPtraceTraceeParentUserSessionK8sGroups() []string { 11775 if ev.GetEventType().String() != "ptrace" { 11776 return []string{} 11777 } 11778 if ev.PTrace.Tracee == nil { 11779 return []string{} 11780 } 11781 if ev.PTrace.Tracee.Parent == nil { 11782 return []string{} 11783 } 11784 if !ev.PTrace.Tracee.HasParent() { 11785 return []string{} 11786 } 11787 return ev.FieldHandlers.ResolveK8SGroups(ev, &ev.PTrace.Tracee.Parent.UserSession) 11788 } 11789 11790 // GetPtraceTraceeParentUserSessionK8sUid returns the value of the field, resolving if necessary 11791 func (ev *Event) GetPtraceTraceeParentUserSessionK8sUid() string { 11792 if ev.GetEventType().String() != "ptrace" { 11793 return "" 11794 } 11795 if ev.PTrace.Tracee == nil { 11796 return "" 11797 } 11798 if ev.PTrace.Tracee.Parent == nil { 11799 return "" 11800 } 11801 if !ev.PTrace.Tracee.HasParent() { 11802 return "" 11803 } 11804 return ev.FieldHandlers.ResolveK8SUID(ev, &ev.PTrace.Tracee.Parent.UserSession) 11805 } 11806 11807 // GetPtraceTraceeParentUserSessionK8sUsername returns the value of the field, resolving if necessary 11808 func (ev *Event) GetPtraceTraceeParentUserSessionK8sUsername() string { 11809 if ev.GetEventType().String() != "ptrace" { 11810 return "" 11811 } 11812 if ev.PTrace.Tracee == nil { 11813 return "" 11814 } 11815 if ev.PTrace.Tracee.Parent == nil { 11816 return "" 11817 } 11818 if !ev.PTrace.Tracee.HasParent() { 11819 return "" 11820 } 11821 return ev.FieldHandlers.ResolveK8SUsername(ev, &ev.PTrace.Tracee.Parent.UserSession) 11822 } 11823 11824 // GetPtraceTraceePid returns the value of the field, resolving if necessary 11825 func (ev *Event) GetPtraceTraceePid() uint32 { 11826 if ev.GetEventType().String() != "ptrace" { 11827 return uint32(0) 11828 } 11829 if ev.PTrace.Tracee == nil { 11830 return uint32(0) 11831 } 11832 return ev.PTrace.Tracee.Process.PIDContext.Pid 11833 } 11834 11835 // GetPtraceTraceePpid returns the value of the field, resolving if necessary 11836 func (ev *Event) GetPtraceTraceePpid() uint32 { 11837 if ev.GetEventType().String() != "ptrace" { 11838 return uint32(0) 11839 } 11840 if ev.PTrace.Tracee == nil { 11841 return uint32(0) 11842 } 11843 return ev.PTrace.Tracee.Process.PPid 11844 } 11845 11846 // GetPtraceTraceeTid returns the value of the field, resolving if necessary 11847 func (ev *Event) GetPtraceTraceeTid() uint32 { 11848 if ev.GetEventType().String() != "ptrace" { 11849 return uint32(0) 11850 } 11851 if ev.PTrace.Tracee == nil { 11852 return uint32(0) 11853 } 11854 return ev.PTrace.Tracee.Process.PIDContext.Tid 11855 } 11856 11857 // GetPtraceTraceeTtyName returns the value of the field, resolving if necessary 11858 func (ev *Event) GetPtraceTraceeTtyName() string { 11859 if ev.GetEventType().String() != "ptrace" { 11860 return "" 11861 } 11862 if ev.PTrace.Tracee == nil { 11863 return "" 11864 } 11865 return ev.PTrace.Tracee.Process.TTYName 11866 } 11867 11868 // GetPtraceTraceeUid returns the value of the field, resolving if necessary 11869 func (ev *Event) GetPtraceTraceeUid() uint32 { 11870 if ev.GetEventType().String() != "ptrace" { 11871 return uint32(0) 11872 } 11873 if ev.PTrace.Tracee == nil { 11874 return uint32(0) 11875 } 11876 return ev.PTrace.Tracee.Process.Credentials.UID 11877 } 11878 11879 // GetPtraceTraceeUser returns the value of the field, resolving if necessary 11880 func (ev *Event) GetPtraceTraceeUser() string { 11881 if ev.GetEventType().String() != "ptrace" { 11882 return "" 11883 } 11884 if ev.PTrace.Tracee == nil { 11885 return "" 11886 } 11887 return ev.PTrace.Tracee.Process.Credentials.User 11888 } 11889 11890 // GetPtraceTraceeUserSessionK8sGroups returns the value of the field, resolving if necessary 11891 func (ev *Event) GetPtraceTraceeUserSessionK8sGroups() []string { 11892 if ev.GetEventType().String() != "ptrace" { 11893 return []string{} 11894 } 11895 if ev.PTrace.Tracee == nil { 11896 return []string{} 11897 } 11898 return ev.FieldHandlers.ResolveK8SGroups(ev, &ev.PTrace.Tracee.Process.UserSession) 11899 } 11900 11901 // GetPtraceTraceeUserSessionK8sUid returns the value of the field, resolving if necessary 11902 func (ev *Event) GetPtraceTraceeUserSessionK8sUid() string { 11903 if ev.GetEventType().String() != "ptrace" { 11904 return "" 11905 } 11906 if ev.PTrace.Tracee == nil { 11907 return "" 11908 } 11909 return ev.FieldHandlers.ResolveK8SUID(ev, &ev.PTrace.Tracee.Process.UserSession) 11910 } 11911 11912 // GetPtraceTraceeUserSessionK8sUsername returns the value of the field, resolving if necessary 11913 func (ev *Event) GetPtraceTraceeUserSessionK8sUsername() string { 11914 if ev.GetEventType().String() != "ptrace" { 11915 return "" 11916 } 11917 if ev.PTrace.Tracee == nil { 11918 return "" 11919 } 11920 return ev.FieldHandlers.ResolveK8SUsername(ev, &ev.PTrace.Tracee.Process.UserSession) 11921 } 11922 11923 // GetRemovexattrFileChangeTime returns the value of the field, resolving if necessary 11924 func (ev *Event) GetRemovexattrFileChangeTime() uint64 { 11925 if ev.GetEventType().String() != "removexattr" { 11926 return uint64(0) 11927 } 11928 return ev.RemoveXAttr.File.FileFields.CTime 11929 } 11930 11931 // GetRemovexattrFileDestinationName returns the value of the field, resolving if necessary 11932 func (ev *Event) GetRemovexattrFileDestinationName() string { 11933 if ev.GetEventType().String() != "removexattr" { 11934 return "" 11935 } 11936 return ev.FieldHandlers.ResolveXAttrName(ev, &ev.RemoveXAttr) 11937 } 11938 11939 // GetRemovexattrFileDestinationNamespace returns the value of the field, resolving if necessary 11940 func (ev *Event) GetRemovexattrFileDestinationNamespace() string { 11941 if ev.GetEventType().String() != "removexattr" { 11942 return "" 11943 } 11944 return ev.FieldHandlers.ResolveXAttrNamespace(ev, &ev.RemoveXAttr) 11945 } 11946 11947 // GetRemovexattrFileFilesystem returns the value of the field, resolving if necessary 11948 func (ev *Event) GetRemovexattrFileFilesystem() string { 11949 if ev.GetEventType().String() != "removexattr" { 11950 return "" 11951 } 11952 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.RemoveXAttr.File) 11953 } 11954 11955 // GetRemovexattrFileGid returns the value of the field, resolving if necessary 11956 func (ev *Event) GetRemovexattrFileGid() uint32 { 11957 if ev.GetEventType().String() != "removexattr" { 11958 return uint32(0) 11959 } 11960 return ev.RemoveXAttr.File.FileFields.GID 11961 } 11962 11963 // GetRemovexattrFileGroup returns the value of the field, resolving if necessary 11964 func (ev *Event) GetRemovexattrFileGroup() string { 11965 if ev.GetEventType().String() != "removexattr" { 11966 return "" 11967 } 11968 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.RemoveXAttr.File.FileFields) 11969 } 11970 11971 // GetRemovexattrFileHashes returns the value of the field, resolving if necessary 11972 func (ev *Event) GetRemovexattrFileHashes() []string { 11973 if ev.GetEventType().String() != "removexattr" { 11974 return []string{} 11975 } 11976 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.RemoveXAttr.File) 11977 } 11978 11979 // GetRemovexattrFileInUpperLayer returns the value of the field, resolving if necessary 11980 func (ev *Event) GetRemovexattrFileInUpperLayer() bool { 11981 if ev.GetEventType().String() != "removexattr" { 11982 return false 11983 } 11984 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.RemoveXAttr.File.FileFields) 11985 } 11986 11987 // GetRemovexattrFileInode returns the value of the field, resolving if necessary 11988 func (ev *Event) GetRemovexattrFileInode() uint64 { 11989 if ev.GetEventType().String() != "removexattr" { 11990 return uint64(0) 11991 } 11992 return ev.RemoveXAttr.File.FileFields.PathKey.Inode 11993 } 11994 11995 // GetRemovexattrFileMode returns the value of the field, resolving if necessary 11996 func (ev *Event) GetRemovexattrFileMode() uint16 { 11997 if ev.GetEventType().String() != "removexattr" { 11998 return uint16(0) 11999 } 12000 return ev.RemoveXAttr.File.FileFields.Mode 12001 } 12002 12003 // GetRemovexattrFileModificationTime returns the value of the field, resolving if necessary 12004 func (ev *Event) GetRemovexattrFileModificationTime() uint64 { 12005 if ev.GetEventType().String() != "removexattr" { 12006 return uint64(0) 12007 } 12008 return ev.RemoveXAttr.File.FileFields.MTime 12009 } 12010 12011 // GetRemovexattrFileMountId returns the value of the field, resolving if necessary 12012 func (ev *Event) GetRemovexattrFileMountId() uint32 { 12013 if ev.GetEventType().String() != "removexattr" { 12014 return uint32(0) 12015 } 12016 return ev.RemoveXAttr.File.FileFields.PathKey.MountID 12017 } 12018 12019 // GetRemovexattrFileName returns the value of the field, resolving if necessary 12020 func (ev *Event) GetRemovexattrFileName() string { 12021 if ev.GetEventType().String() != "removexattr" { 12022 return "" 12023 } 12024 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.RemoveXAttr.File) 12025 } 12026 12027 // GetRemovexattrFileNameLength returns the value of the field, resolving if necessary 12028 func (ev *Event) GetRemovexattrFileNameLength() int { 12029 if ev.GetEventType().String() != "removexattr" { 12030 return 0 12031 } 12032 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.RemoveXAttr.File)) 12033 } 12034 12035 // GetRemovexattrFilePackageName returns the value of the field, resolving if necessary 12036 func (ev *Event) GetRemovexattrFilePackageName() string { 12037 if ev.GetEventType().String() != "removexattr" { 12038 return "" 12039 } 12040 return ev.FieldHandlers.ResolvePackageName(ev, &ev.RemoveXAttr.File) 12041 } 12042 12043 // GetRemovexattrFilePackageSourceVersion returns the value of the field, resolving if necessary 12044 func (ev *Event) GetRemovexattrFilePackageSourceVersion() string { 12045 if ev.GetEventType().String() != "removexattr" { 12046 return "" 12047 } 12048 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.RemoveXAttr.File) 12049 } 12050 12051 // GetRemovexattrFilePackageVersion returns the value of the field, resolving if necessary 12052 func (ev *Event) GetRemovexattrFilePackageVersion() string { 12053 if ev.GetEventType().String() != "removexattr" { 12054 return "" 12055 } 12056 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.RemoveXAttr.File) 12057 } 12058 12059 // GetRemovexattrFilePath returns the value of the field, resolving if necessary 12060 func (ev *Event) GetRemovexattrFilePath() string { 12061 if ev.GetEventType().String() != "removexattr" { 12062 return "" 12063 } 12064 return ev.FieldHandlers.ResolveFilePath(ev, &ev.RemoveXAttr.File) 12065 } 12066 12067 // GetRemovexattrFilePathLength returns the value of the field, resolving if necessary 12068 func (ev *Event) GetRemovexattrFilePathLength() int { 12069 if ev.GetEventType().String() != "removexattr" { 12070 return 0 12071 } 12072 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.RemoveXAttr.File)) 12073 } 12074 12075 // GetRemovexattrFileRights returns the value of the field, resolving if necessary 12076 func (ev *Event) GetRemovexattrFileRights() int { 12077 if ev.GetEventType().String() != "removexattr" { 12078 return 0 12079 } 12080 return ev.FieldHandlers.ResolveRights(ev, &ev.RemoveXAttr.File.FileFields) 12081 } 12082 12083 // GetRemovexattrFileUid returns the value of the field, resolving if necessary 12084 func (ev *Event) GetRemovexattrFileUid() uint32 { 12085 if ev.GetEventType().String() != "removexattr" { 12086 return uint32(0) 12087 } 12088 return ev.RemoveXAttr.File.FileFields.UID 12089 } 12090 12091 // GetRemovexattrFileUser returns the value of the field, resolving if necessary 12092 func (ev *Event) GetRemovexattrFileUser() string { 12093 if ev.GetEventType().String() != "removexattr" { 12094 return "" 12095 } 12096 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.RemoveXAttr.File.FileFields) 12097 } 12098 12099 // GetRemovexattrRetval returns the value of the field, resolving if necessary 12100 func (ev *Event) GetRemovexattrRetval() int64 { 12101 if ev.GetEventType().String() != "removexattr" { 12102 return int64(0) 12103 } 12104 return ev.RemoveXAttr.SyscallEvent.Retval 12105 } 12106 12107 // GetRenameFileChangeTime returns the value of the field, resolving if necessary 12108 func (ev *Event) GetRenameFileChangeTime() uint64 { 12109 if ev.GetEventType().String() != "rename" { 12110 return uint64(0) 12111 } 12112 return ev.Rename.Old.FileFields.CTime 12113 } 12114 12115 // GetRenameFileDestinationChangeTime returns the value of the field, resolving if necessary 12116 func (ev *Event) GetRenameFileDestinationChangeTime() uint64 { 12117 if ev.GetEventType().String() != "rename" { 12118 return uint64(0) 12119 } 12120 return ev.Rename.New.FileFields.CTime 12121 } 12122 12123 // GetRenameFileDestinationFilesystem returns the value of the field, resolving if necessary 12124 func (ev *Event) GetRenameFileDestinationFilesystem() string { 12125 if ev.GetEventType().String() != "rename" { 12126 return "" 12127 } 12128 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Rename.New) 12129 } 12130 12131 // GetRenameFileDestinationGid returns the value of the field, resolving if necessary 12132 func (ev *Event) GetRenameFileDestinationGid() uint32 { 12133 if ev.GetEventType().String() != "rename" { 12134 return uint32(0) 12135 } 12136 return ev.Rename.New.FileFields.GID 12137 } 12138 12139 // GetRenameFileDestinationGroup returns the value of the field, resolving if necessary 12140 func (ev *Event) GetRenameFileDestinationGroup() string { 12141 if ev.GetEventType().String() != "rename" { 12142 return "" 12143 } 12144 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Rename.New.FileFields) 12145 } 12146 12147 // GetRenameFileDestinationHashes returns the value of the field, resolving if necessary 12148 func (ev *Event) GetRenameFileDestinationHashes() []string { 12149 if ev.GetEventType().String() != "rename" { 12150 return []string{} 12151 } 12152 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Rename.New) 12153 } 12154 12155 // GetRenameFileDestinationInUpperLayer returns the value of the field, resolving if necessary 12156 func (ev *Event) GetRenameFileDestinationInUpperLayer() bool { 12157 if ev.GetEventType().String() != "rename" { 12158 return false 12159 } 12160 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Rename.New.FileFields) 12161 } 12162 12163 // GetRenameFileDestinationInode returns the value of the field, resolving if necessary 12164 func (ev *Event) GetRenameFileDestinationInode() uint64 { 12165 if ev.GetEventType().String() != "rename" { 12166 return uint64(0) 12167 } 12168 return ev.Rename.New.FileFields.PathKey.Inode 12169 } 12170 12171 // GetRenameFileDestinationMode returns the value of the field, resolving if necessary 12172 func (ev *Event) GetRenameFileDestinationMode() uint16 { 12173 if ev.GetEventType().String() != "rename" { 12174 return uint16(0) 12175 } 12176 return ev.Rename.New.FileFields.Mode 12177 } 12178 12179 // GetRenameFileDestinationModificationTime returns the value of the field, resolving if necessary 12180 func (ev *Event) GetRenameFileDestinationModificationTime() uint64 { 12181 if ev.GetEventType().String() != "rename" { 12182 return uint64(0) 12183 } 12184 return ev.Rename.New.FileFields.MTime 12185 } 12186 12187 // GetRenameFileDestinationMountId returns the value of the field, resolving if necessary 12188 func (ev *Event) GetRenameFileDestinationMountId() uint32 { 12189 if ev.GetEventType().String() != "rename" { 12190 return uint32(0) 12191 } 12192 return ev.Rename.New.FileFields.PathKey.MountID 12193 } 12194 12195 // GetRenameFileDestinationName returns the value of the field, resolving if necessary 12196 func (ev *Event) GetRenameFileDestinationName() string { 12197 if ev.GetEventType().String() != "rename" { 12198 return "" 12199 } 12200 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Rename.New) 12201 } 12202 12203 // GetRenameFileDestinationNameLength returns the value of the field, resolving if necessary 12204 func (ev *Event) GetRenameFileDestinationNameLength() int { 12205 if ev.GetEventType().String() != "rename" { 12206 return 0 12207 } 12208 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Rename.New)) 12209 } 12210 12211 // GetRenameFileDestinationPackageName returns the value of the field, resolving if necessary 12212 func (ev *Event) GetRenameFileDestinationPackageName() string { 12213 if ev.GetEventType().String() != "rename" { 12214 return "" 12215 } 12216 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Rename.New) 12217 } 12218 12219 // GetRenameFileDestinationPackageSourceVersion returns the value of the field, resolving if necessary 12220 func (ev *Event) GetRenameFileDestinationPackageSourceVersion() string { 12221 if ev.GetEventType().String() != "rename" { 12222 return "" 12223 } 12224 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Rename.New) 12225 } 12226 12227 // GetRenameFileDestinationPackageVersion returns the value of the field, resolving if necessary 12228 func (ev *Event) GetRenameFileDestinationPackageVersion() string { 12229 if ev.GetEventType().String() != "rename" { 12230 return "" 12231 } 12232 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Rename.New) 12233 } 12234 12235 // GetRenameFileDestinationPath returns the value of the field, resolving if necessary 12236 func (ev *Event) GetRenameFileDestinationPath() string { 12237 if ev.GetEventType().String() != "rename" { 12238 return "" 12239 } 12240 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Rename.New) 12241 } 12242 12243 // GetRenameFileDestinationPathLength returns the value of the field, resolving if necessary 12244 func (ev *Event) GetRenameFileDestinationPathLength() int { 12245 if ev.GetEventType().String() != "rename" { 12246 return 0 12247 } 12248 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Rename.New)) 12249 } 12250 12251 // GetRenameFileDestinationRights returns the value of the field, resolving if necessary 12252 func (ev *Event) GetRenameFileDestinationRights() int { 12253 if ev.GetEventType().String() != "rename" { 12254 return 0 12255 } 12256 return ev.FieldHandlers.ResolveRights(ev, &ev.Rename.New.FileFields) 12257 } 12258 12259 // GetRenameFileDestinationUid returns the value of the field, resolving if necessary 12260 func (ev *Event) GetRenameFileDestinationUid() uint32 { 12261 if ev.GetEventType().String() != "rename" { 12262 return uint32(0) 12263 } 12264 return ev.Rename.New.FileFields.UID 12265 } 12266 12267 // GetRenameFileDestinationUser returns the value of the field, resolving if necessary 12268 func (ev *Event) GetRenameFileDestinationUser() string { 12269 if ev.GetEventType().String() != "rename" { 12270 return "" 12271 } 12272 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Rename.New.FileFields) 12273 } 12274 12275 // GetRenameFileFilesystem returns the value of the field, resolving if necessary 12276 func (ev *Event) GetRenameFileFilesystem() string { 12277 if ev.GetEventType().String() != "rename" { 12278 return "" 12279 } 12280 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Rename.Old) 12281 } 12282 12283 // GetRenameFileGid returns the value of the field, resolving if necessary 12284 func (ev *Event) GetRenameFileGid() uint32 { 12285 if ev.GetEventType().String() != "rename" { 12286 return uint32(0) 12287 } 12288 return ev.Rename.Old.FileFields.GID 12289 } 12290 12291 // GetRenameFileGroup returns the value of the field, resolving if necessary 12292 func (ev *Event) GetRenameFileGroup() string { 12293 if ev.GetEventType().String() != "rename" { 12294 return "" 12295 } 12296 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Rename.Old.FileFields) 12297 } 12298 12299 // GetRenameFileHashes returns the value of the field, resolving if necessary 12300 func (ev *Event) GetRenameFileHashes() []string { 12301 if ev.GetEventType().String() != "rename" { 12302 return []string{} 12303 } 12304 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Rename.Old) 12305 } 12306 12307 // GetRenameFileInUpperLayer returns the value of the field, resolving if necessary 12308 func (ev *Event) GetRenameFileInUpperLayer() bool { 12309 if ev.GetEventType().String() != "rename" { 12310 return false 12311 } 12312 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Rename.Old.FileFields) 12313 } 12314 12315 // GetRenameFileInode returns the value of the field, resolving if necessary 12316 func (ev *Event) GetRenameFileInode() uint64 { 12317 if ev.GetEventType().String() != "rename" { 12318 return uint64(0) 12319 } 12320 return ev.Rename.Old.FileFields.PathKey.Inode 12321 } 12322 12323 // GetRenameFileMode returns the value of the field, resolving if necessary 12324 func (ev *Event) GetRenameFileMode() uint16 { 12325 if ev.GetEventType().String() != "rename" { 12326 return uint16(0) 12327 } 12328 return ev.Rename.Old.FileFields.Mode 12329 } 12330 12331 // GetRenameFileModificationTime returns the value of the field, resolving if necessary 12332 func (ev *Event) GetRenameFileModificationTime() uint64 { 12333 if ev.GetEventType().String() != "rename" { 12334 return uint64(0) 12335 } 12336 return ev.Rename.Old.FileFields.MTime 12337 } 12338 12339 // GetRenameFileMountId returns the value of the field, resolving if necessary 12340 func (ev *Event) GetRenameFileMountId() uint32 { 12341 if ev.GetEventType().String() != "rename" { 12342 return uint32(0) 12343 } 12344 return ev.Rename.Old.FileFields.PathKey.MountID 12345 } 12346 12347 // GetRenameFileName returns the value of the field, resolving if necessary 12348 func (ev *Event) GetRenameFileName() string { 12349 if ev.GetEventType().String() != "rename" { 12350 return "" 12351 } 12352 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Rename.Old) 12353 } 12354 12355 // GetRenameFileNameLength returns the value of the field, resolving if necessary 12356 func (ev *Event) GetRenameFileNameLength() int { 12357 if ev.GetEventType().String() != "rename" { 12358 return 0 12359 } 12360 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Rename.Old)) 12361 } 12362 12363 // GetRenameFilePackageName returns the value of the field, resolving if necessary 12364 func (ev *Event) GetRenameFilePackageName() string { 12365 if ev.GetEventType().String() != "rename" { 12366 return "" 12367 } 12368 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Rename.Old) 12369 } 12370 12371 // GetRenameFilePackageSourceVersion returns the value of the field, resolving if necessary 12372 func (ev *Event) GetRenameFilePackageSourceVersion() string { 12373 if ev.GetEventType().String() != "rename" { 12374 return "" 12375 } 12376 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Rename.Old) 12377 } 12378 12379 // GetRenameFilePackageVersion returns the value of the field, resolving if necessary 12380 func (ev *Event) GetRenameFilePackageVersion() string { 12381 if ev.GetEventType().String() != "rename" { 12382 return "" 12383 } 12384 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Rename.Old) 12385 } 12386 12387 // GetRenameFilePath returns the value of the field, resolving if necessary 12388 func (ev *Event) GetRenameFilePath() string { 12389 if ev.GetEventType().String() != "rename" { 12390 return "" 12391 } 12392 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Rename.Old) 12393 } 12394 12395 // GetRenameFilePathLength returns the value of the field, resolving if necessary 12396 func (ev *Event) GetRenameFilePathLength() int { 12397 if ev.GetEventType().String() != "rename" { 12398 return 0 12399 } 12400 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Rename.Old)) 12401 } 12402 12403 // GetRenameFileRights returns the value of the field, resolving if necessary 12404 func (ev *Event) GetRenameFileRights() int { 12405 if ev.GetEventType().String() != "rename" { 12406 return 0 12407 } 12408 return ev.FieldHandlers.ResolveRights(ev, &ev.Rename.Old.FileFields) 12409 } 12410 12411 // GetRenameFileUid returns the value of the field, resolving if necessary 12412 func (ev *Event) GetRenameFileUid() uint32 { 12413 if ev.GetEventType().String() != "rename" { 12414 return uint32(0) 12415 } 12416 return ev.Rename.Old.FileFields.UID 12417 } 12418 12419 // GetRenameFileUser returns the value of the field, resolving if necessary 12420 func (ev *Event) GetRenameFileUser() string { 12421 if ev.GetEventType().String() != "rename" { 12422 return "" 12423 } 12424 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Rename.Old.FileFields) 12425 } 12426 12427 // GetRenameRetval returns the value of the field, resolving if necessary 12428 func (ev *Event) GetRenameRetval() int64 { 12429 if ev.GetEventType().String() != "rename" { 12430 return int64(0) 12431 } 12432 return ev.Rename.SyscallEvent.Retval 12433 } 12434 12435 // GetRmdirFileChangeTime returns the value of the field, resolving if necessary 12436 func (ev *Event) GetRmdirFileChangeTime() uint64 { 12437 if ev.GetEventType().String() != "rmdir" { 12438 return uint64(0) 12439 } 12440 return ev.Rmdir.File.FileFields.CTime 12441 } 12442 12443 // GetRmdirFileFilesystem returns the value of the field, resolving if necessary 12444 func (ev *Event) GetRmdirFileFilesystem() string { 12445 if ev.GetEventType().String() != "rmdir" { 12446 return "" 12447 } 12448 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Rmdir.File) 12449 } 12450 12451 // GetRmdirFileGid returns the value of the field, resolving if necessary 12452 func (ev *Event) GetRmdirFileGid() uint32 { 12453 if ev.GetEventType().String() != "rmdir" { 12454 return uint32(0) 12455 } 12456 return ev.Rmdir.File.FileFields.GID 12457 } 12458 12459 // GetRmdirFileGroup returns the value of the field, resolving if necessary 12460 func (ev *Event) GetRmdirFileGroup() string { 12461 if ev.GetEventType().String() != "rmdir" { 12462 return "" 12463 } 12464 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Rmdir.File.FileFields) 12465 } 12466 12467 // GetRmdirFileHashes returns the value of the field, resolving if necessary 12468 func (ev *Event) GetRmdirFileHashes() []string { 12469 if ev.GetEventType().String() != "rmdir" { 12470 return []string{} 12471 } 12472 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Rmdir.File) 12473 } 12474 12475 // GetRmdirFileInUpperLayer returns the value of the field, resolving if necessary 12476 func (ev *Event) GetRmdirFileInUpperLayer() bool { 12477 if ev.GetEventType().String() != "rmdir" { 12478 return false 12479 } 12480 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Rmdir.File.FileFields) 12481 } 12482 12483 // GetRmdirFileInode returns the value of the field, resolving if necessary 12484 func (ev *Event) GetRmdirFileInode() uint64 { 12485 if ev.GetEventType().String() != "rmdir" { 12486 return uint64(0) 12487 } 12488 return ev.Rmdir.File.FileFields.PathKey.Inode 12489 } 12490 12491 // GetRmdirFileMode returns the value of the field, resolving if necessary 12492 func (ev *Event) GetRmdirFileMode() uint16 { 12493 if ev.GetEventType().String() != "rmdir" { 12494 return uint16(0) 12495 } 12496 return ev.Rmdir.File.FileFields.Mode 12497 } 12498 12499 // GetRmdirFileModificationTime returns the value of the field, resolving if necessary 12500 func (ev *Event) GetRmdirFileModificationTime() uint64 { 12501 if ev.GetEventType().String() != "rmdir" { 12502 return uint64(0) 12503 } 12504 return ev.Rmdir.File.FileFields.MTime 12505 } 12506 12507 // GetRmdirFileMountId returns the value of the field, resolving if necessary 12508 func (ev *Event) GetRmdirFileMountId() uint32 { 12509 if ev.GetEventType().String() != "rmdir" { 12510 return uint32(0) 12511 } 12512 return ev.Rmdir.File.FileFields.PathKey.MountID 12513 } 12514 12515 // GetRmdirFileName returns the value of the field, resolving if necessary 12516 func (ev *Event) GetRmdirFileName() string { 12517 if ev.GetEventType().String() != "rmdir" { 12518 return "" 12519 } 12520 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Rmdir.File) 12521 } 12522 12523 // GetRmdirFileNameLength returns the value of the field, resolving if necessary 12524 func (ev *Event) GetRmdirFileNameLength() int { 12525 if ev.GetEventType().String() != "rmdir" { 12526 return 0 12527 } 12528 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Rmdir.File)) 12529 } 12530 12531 // GetRmdirFilePackageName returns the value of the field, resolving if necessary 12532 func (ev *Event) GetRmdirFilePackageName() string { 12533 if ev.GetEventType().String() != "rmdir" { 12534 return "" 12535 } 12536 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Rmdir.File) 12537 } 12538 12539 // GetRmdirFilePackageSourceVersion returns the value of the field, resolving if necessary 12540 func (ev *Event) GetRmdirFilePackageSourceVersion() string { 12541 if ev.GetEventType().String() != "rmdir" { 12542 return "" 12543 } 12544 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Rmdir.File) 12545 } 12546 12547 // GetRmdirFilePackageVersion returns the value of the field, resolving if necessary 12548 func (ev *Event) GetRmdirFilePackageVersion() string { 12549 if ev.GetEventType().String() != "rmdir" { 12550 return "" 12551 } 12552 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Rmdir.File) 12553 } 12554 12555 // GetRmdirFilePath returns the value of the field, resolving if necessary 12556 func (ev *Event) GetRmdirFilePath() string { 12557 if ev.GetEventType().String() != "rmdir" { 12558 return "" 12559 } 12560 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Rmdir.File) 12561 } 12562 12563 // GetRmdirFilePathLength returns the value of the field, resolving if necessary 12564 func (ev *Event) GetRmdirFilePathLength() int { 12565 if ev.GetEventType().String() != "rmdir" { 12566 return 0 12567 } 12568 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Rmdir.File)) 12569 } 12570 12571 // GetRmdirFileRights returns the value of the field, resolving if necessary 12572 func (ev *Event) GetRmdirFileRights() int { 12573 if ev.GetEventType().String() != "rmdir" { 12574 return 0 12575 } 12576 return ev.FieldHandlers.ResolveRights(ev, &ev.Rmdir.File.FileFields) 12577 } 12578 12579 // GetRmdirFileUid returns the value of the field, resolving if necessary 12580 func (ev *Event) GetRmdirFileUid() uint32 { 12581 if ev.GetEventType().String() != "rmdir" { 12582 return uint32(0) 12583 } 12584 return ev.Rmdir.File.FileFields.UID 12585 } 12586 12587 // GetRmdirFileUser returns the value of the field, resolving if necessary 12588 func (ev *Event) GetRmdirFileUser() string { 12589 if ev.GetEventType().String() != "rmdir" { 12590 return "" 12591 } 12592 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Rmdir.File.FileFields) 12593 } 12594 12595 // GetRmdirRetval returns the value of the field, resolving if necessary 12596 func (ev *Event) GetRmdirRetval() int64 { 12597 if ev.GetEventType().String() != "rmdir" { 12598 return int64(0) 12599 } 12600 return ev.Rmdir.SyscallEvent.Retval 12601 } 12602 12603 // GetSelinuxBoolName returns the value of the field, resolving if necessary 12604 func (ev *Event) GetSelinuxBoolName() string { 12605 if ev.GetEventType().String() != "selinux" { 12606 return "" 12607 } 12608 return ev.FieldHandlers.ResolveSELinuxBoolName(ev, &ev.SELinux) 12609 } 12610 12611 // GetSelinuxBoolState returns the value of the field, resolving if necessary 12612 func (ev *Event) GetSelinuxBoolState() string { 12613 if ev.GetEventType().String() != "selinux" { 12614 return "" 12615 } 12616 return ev.SELinux.BoolChangeValue 12617 } 12618 12619 // GetSelinuxBoolCommitState returns the value of the field, resolving if necessary 12620 func (ev *Event) GetSelinuxBoolCommitState() bool { 12621 if ev.GetEventType().String() != "selinux" { 12622 return false 12623 } 12624 return ev.SELinux.BoolCommitValue 12625 } 12626 12627 // GetSelinuxEnforceStatus returns the value of the field, resolving if necessary 12628 func (ev *Event) GetSelinuxEnforceStatus() string { 12629 if ev.GetEventType().String() != "selinux" { 12630 return "" 12631 } 12632 return ev.SELinux.EnforceStatus 12633 } 12634 12635 // GetSetgidEgid returns the value of the field, resolving if necessary 12636 func (ev *Event) GetSetgidEgid() uint32 { 12637 if ev.GetEventType().String() != "setgid" { 12638 return uint32(0) 12639 } 12640 return ev.SetGID.EGID 12641 } 12642 12643 // GetSetgidEgroup returns the value of the field, resolving if necessary 12644 func (ev *Event) GetSetgidEgroup() string { 12645 if ev.GetEventType().String() != "setgid" { 12646 return "" 12647 } 12648 return ev.FieldHandlers.ResolveSetgidEGroup(ev, &ev.SetGID) 12649 } 12650 12651 // GetSetgidFsgid returns the value of the field, resolving if necessary 12652 func (ev *Event) GetSetgidFsgid() uint32 { 12653 if ev.GetEventType().String() != "setgid" { 12654 return uint32(0) 12655 } 12656 return ev.SetGID.FSGID 12657 } 12658 12659 // GetSetgidFsgroup returns the value of the field, resolving if necessary 12660 func (ev *Event) GetSetgidFsgroup() string { 12661 if ev.GetEventType().String() != "setgid" { 12662 return "" 12663 } 12664 return ev.FieldHandlers.ResolveSetgidFSGroup(ev, &ev.SetGID) 12665 } 12666 12667 // GetSetgidGid returns the value of the field, resolving if necessary 12668 func (ev *Event) GetSetgidGid() uint32 { 12669 if ev.GetEventType().String() != "setgid" { 12670 return uint32(0) 12671 } 12672 return ev.SetGID.GID 12673 } 12674 12675 // GetSetgidGroup returns the value of the field, resolving if necessary 12676 func (ev *Event) GetSetgidGroup() string { 12677 if ev.GetEventType().String() != "setgid" { 12678 return "" 12679 } 12680 return ev.FieldHandlers.ResolveSetgidGroup(ev, &ev.SetGID) 12681 } 12682 12683 // GetSetuidEuid returns the value of the field, resolving if necessary 12684 func (ev *Event) GetSetuidEuid() uint32 { 12685 if ev.GetEventType().String() != "setuid" { 12686 return uint32(0) 12687 } 12688 return ev.SetUID.EUID 12689 } 12690 12691 // GetSetuidEuser returns the value of the field, resolving if necessary 12692 func (ev *Event) GetSetuidEuser() string { 12693 if ev.GetEventType().String() != "setuid" { 12694 return "" 12695 } 12696 return ev.FieldHandlers.ResolveSetuidEUser(ev, &ev.SetUID) 12697 } 12698 12699 // GetSetuidFsuid returns the value of the field, resolving if necessary 12700 func (ev *Event) GetSetuidFsuid() uint32 { 12701 if ev.GetEventType().String() != "setuid" { 12702 return uint32(0) 12703 } 12704 return ev.SetUID.FSUID 12705 } 12706 12707 // GetSetuidFsuser returns the value of the field, resolving if necessary 12708 func (ev *Event) GetSetuidFsuser() string { 12709 if ev.GetEventType().String() != "setuid" { 12710 return "" 12711 } 12712 return ev.FieldHandlers.ResolveSetuidFSUser(ev, &ev.SetUID) 12713 } 12714 12715 // GetSetuidUid returns the value of the field, resolving if necessary 12716 func (ev *Event) GetSetuidUid() uint32 { 12717 if ev.GetEventType().String() != "setuid" { 12718 return uint32(0) 12719 } 12720 return ev.SetUID.UID 12721 } 12722 12723 // GetSetuidUser returns the value of the field, resolving if necessary 12724 func (ev *Event) GetSetuidUser() string { 12725 if ev.GetEventType().String() != "setuid" { 12726 return "" 12727 } 12728 return ev.FieldHandlers.ResolveSetuidUser(ev, &ev.SetUID) 12729 } 12730 12731 // GetSetxattrFileChangeTime returns the value of the field, resolving if necessary 12732 func (ev *Event) GetSetxattrFileChangeTime() uint64 { 12733 if ev.GetEventType().String() != "setxattr" { 12734 return uint64(0) 12735 } 12736 return ev.SetXAttr.File.FileFields.CTime 12737 } 12738 12739 // GetSetxattrFileDestinationName returns the value of the field, resolving if necessary 12740 func (ev *Event) GetSetxattrFileDestinationName() string { 12741 if ev.GetEventType().String() != "setxattr" { 12742 return "" 12743 } 12744 return ev.FieldHandlers.ResolveXAttrName(ev, &ev.SetXAttr) 12745 } 12746 12747 // GetSetxattrFileDestinationNamespace returns the value of the field, resolving if necessary 12748 func (ev *Event) GetSetxattrFileDestinationNamespace() string { 12749 if ev.GetEventType().String() != "setxattr" { 12750 return "" 12751 } 12752 return ev.FieldHandlers.ResolveXAttrNamespace(ev, &ev.SetXAttr) 12753 } 12754 12755 // GetSetxattrFileFilesystem returns the value of the field, resolving if necessary 12756 func (ev *Event) GetSetxattrFileFilesystem() string { 12757 if ev.GetEventType().String() != "setxattr" { 12758 return "" 12759 } 12760 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.SetXAttr.File) 12761 } 12762 12763 // GetSetxattrFileGid returns the value of the field, resolving if necessary 12764 func (ev *Event) GetSetxattrFileGid() uint32 { 12765 if ev.GetEventType().String() != "setxattr" { 12766 return uint32(0) 12767 } 12768 return ev.SetXAttr.File.FileFields.GID 12769 } 12770 12771 // GetSetxattrFileGroup returns the value of the field, resolving if necessary 12772 func (ev *Event) GetSetxattrFileGroup() string { 12773 if ev.GetEventType().String() != "setxattr" { 12774 return "" 12775 } 12776 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.SetXAttr.File.FileFields) 12777 } 12778 12779 // GetSetxattrFileHashes returns the value of the field, resolving if necessary 12780 func (ev *Event) GetSetxattrFileHashes() []string { 12781 if ev.GetEventType().String() != "setxattr" { 12782 return []string{} 12783 } 12784 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.SetXAttr.File) 12785 } 12786 12787 // GetSetxattrFileInUpperLayer returns the value of the field, resolving if necessary 12788 func (ev *Event) GetSetxattrFileInUpperLayer() bool { 12789 if ev.GetEventType().String() != "setxattr" { 12790 return false 12791 } 12792 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.SetXAttr.File.FileFields) 12793 } 12794 12795 // GetSetxattrFileInode returns the value of the field, resolving if necessary 12796 func (ev *Event) GetSetxattrFileInode() uint64 { 12797 if ev.GetEventType().String() != "setxattr" { 12798 return uint64(0) 12799 } 12800 return ev.SetXAttr.File.FileFields.PathKey.Inode 12801 } 12802 12803 // GetSetxattrFileMode returns the value of the field, resolving if necessary 12804 func (ev *Event) GetSetxattrFileMode() uint16 { 12805 if ev.GetEventType().String() != "setxattr" { 12806 return uint16(0) 12807 } 12808 return ev.SetXAttr.File.FileFields.Mode 12809 } 12810 12811 // GetSetxattrFileModificationTime returns the value of the field, resolving if necessary 12812 func (ev *Event) GetSetxattrFileModificationTime() uint64 { 12813 if ev.GetEventType().String() != "setxattr" { 12814 return uint64(0) 12815 } 12816 return ev.SetXAttr.File.FileFields.MTime 12817 } 12818 12819 // GetSetxattrFileMountId returns the value of the field, resolving if necessary 12820 func (ev *Event) GetSetxattrFileMountId() uint32 { 12821 if ev.GetEventType().String() != "setxattr" { 12822 return uint32(0) 12823 } 12824 return ev.SetXAttr.File.FileFields.PathKey.MountID 12825 } 12826 12827 // GetSetxattrFileName returns the value of the field, resolving if necessary 12828 func (ev *Event) GetSetxattrFileName() string { 12829 if ev.GetEventType().String() != "setxattr" { 12830 return "" 12831 } 12832 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.SetXAttr.File) 12833 } 12834 12835 // GetSetxattrFileNameLength returns the value of the field, resolving if necessary 12836 func (ev *Event) GetSetxattrFileNameLength() int { 12837 if ev.GetEventType().String() != "setxattr" { 12838 return 0 12839 } 12840 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.SetXAttr.File)) 12841 } 12842 12843 // GetSetxattrFilePackageName returns the value of the field, resolving if necessary 12844 func (ev *Event) GetSetxattrFilePackageName() string { 12845 if ev.GetEventType().String() != "setxattr" { 12846 return "" 12847 } 12848 return ev.FieldHandlers.ResolvePackageName(ev, &ev.SetXAttr.File) 12849 } 12850 12851 // GetSetxattrFilePackageSourceVersion returns the value of the field, resolving if necessary 12852 func (ev *Event) GetSetxattrFilePackageSourceVersion() string { 12853 if ev.GetEventType().String() != "setxattr" { 12854 return "" 12855 } 12856 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.SetXAttr.File) 12857 } 12858 12859 // GetSetxattrFilePackageVersion returns the value of the field, resolving if necessary 12860 func (ev *Event) GetSetxattrFilePackageVersion() string { 12861 if ev.GetEventType().String() != "setxattr" { 12862 return "" 12863 } 12864 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.SetXAttr.File) 12865 } 12866 12867 // GetSetxattrFilePath returns the value of the field, resolving if necessary 12868 func (ev *Event) GetSetxattrFilePath() string { 12869 if ev.GetEventType().String() != "setxattr" { 12870 return "" 12871 } 12872 return ev.FieldHandlers.ResolveFilePath(ev, &ev.SetXAttr.File) 12873 } 12874 12875 // GetSetxattrFilePathLength returns the value of the field, resolving if necessary 12876 func (ev *Event) GetSetxattrFilePathLength() int { 12877 if ev.GetEventType().String() != "setxattr" { 12878 return 0 12879 } 12880 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.SetXAttr.File)) 12881 } 12882 12883 // GetSetxattrFileRights returns the value of the field, resolving if necessary 12884 func (ev *Event) GetSetxattrFileRights() int { 12885 if ev.GetEventType().String() != "setxattr" { 12886 return 0 12887 } 12888 return ev.FieldHandlers.ResolveRights(ev, &ev.SetXAttr.File.FileFields) 12889 } 12890 12891 // GetSetxattrFileUid returns the value of the field, resolving if necessary 12892 func (ev *Event) GetSetxattrFileUid() uint32 { 12893 if ev.GetEventType().String() != "setxattr" { 12894 return uint32(0) 12895 } 12896 return ev.SetXAttr.File.FileFields.UID 12897 } 12898 12899 // GetSetxattrFileUser returns the value of the field, resolving if necessary 12900 func (ev *Event) GetSetxattrFileUser() string { 12901 if ev.GetEventType().String() != "setxattr" { 12902 return "" 12903 } 12904 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.SetXAttr.File.FileFields) 12905 } 12906 12907 // GetSetxattrRetval returns the value of the field, resolving if necessary 12908 func (ev *Event) GetSetxattrRetval() int64 { 12909 if ev.GetEventType().String() != "setxattr" { 12910 return int64(0) 12911 } 12912 return ev.SetXAttr.SyscallEvent.Retval 12913 } 12914 12915 // GetSignalPid returns the value of the field, resolving if necessary 12916 func (ev *Event) GetSignalPid() uint32 { 12917 if ev.GetEventType().String() != "signal" { 12918 return uint32(0) 12919 } 12920 return ev.Signal.PID 12921 } 12922 12923 // GetSignalRetval returns the value of the field, resolving if necessary 12924 func (ev *Event) GetSignalRetval() int64 { 12925 if ev.GetEventType().String() != "signal" { 12926 return int64(0) 12927 } 12928 return ev.Signal.SyscallEvent.Retval 12929 } 12930 12931 // GetSignalTargetAncestorsArgs returns the value of the field, resolving if necessary 12932 func (ev *Event) GetSignalTargetAncestorsArgs() []string { 12933 if ev.GetEventType().String() != "signal" { 12934 return []string{} 12935 } 12936 if ev.Signal.Target == nil { 12937 return []string{} 12938 } 12939 if ev.Signal.Target.Ancestor == nil { 12940 return []string{} 12941 } 12942 var values []string 12943 ctx := eval.NewContext(ev) 12944 iterator := &ProcessAncestorsIterator{} 12945 ptr := iterator.Front(ctx) 12946 for ptr != nil { 12947 element := (*ProcessCacheEntry)(ptr) 12948 result := ev.FieldHandlers.ResolveProcessArgs(ev, &element.ProcessContext.Process) 12949 values = append(values, result) 12950 ptr = iterator.Next() 12951 } 12952 return values 12953 } 12954 12955 // GetSignalTargetAncestorsArgsFlags returns the value of the field, resolving if necessary 12956 func (ev *Event) GetSignalTargetAncestorsArgsFlags() []string { 12957 if ev.GetEventType().String() != "signal" { 12958 return []string{} 12959 } 12960 if ev.Signal.Target == nil { 12961 return []string{} 12962 } 12963 if ev.Signal.Target.Ancestor == nil { 12964 return []string{} 12965 } 12966 var values []string 12967 ctx := eval.NewContext(ev) 12968 iterator := &ProcessAncestorsIterator{} 12969 ptr := iterator.Front(ctx) 12970 for ptr != nil { 12971 element := (*ProcessCacheEntry)(ptr) 12972 result := ev.FieldHandlers.ResolveProcessArgsFlags(ev, &element.ProcessContext.Process) 12973 values = append(values, result...) 12974 ptr = iterator.Next() 12975 } 12976 return values 12977 } 12978 12979 // GetSignalTargetAncestorsArgsOptions returns the value of the field, resolving if necessary 12980 func (ev *Event) GetSignalTargetAncestorsArgsOptions() []string { 12981 if ev.GetEventType().String() != "signal" { 12982 return []string{} 12983 } 12984 if ev.Signal.Target == nil { 12985 return []string{} 12986 } 12987 if ev.Signal.Target.Ancestor == nil { 12988 return []string{} 12989 } 12990 var values []string 12991 ctx := eval.NewContext(ev) 12992 iterator := &ProcessAncestorsIterator{} 12993 ptr := iterator.Front(ctx) 12994 for ptr != nil { 12995 element := (*ProcessCacheEntry)(ptr) 12996 result := ev.FieldHandlers.ResolveProcessArgsOptions(ev, &element.ProcessContext.Process) 12997 values = append(values, result...) 12998 ptr = iterator.Next() 12999 } 13000 return values 13001 } 13002 13003 // GetSignalTargetAncestorsArgsScrubbed returns the value of the field, resolving if necessary 13004 func (ev *Event) GetSignalTargetAncestorsArgsScrubbed() []string { 13005 if ev.GetEventType().String() != "signal" { 13006 return []string{} 13007 } 13008 if ev.Signal.Target == nil { 13009 return []string{} 13010 } 13011 if ev.Signal.Target.Ancestor == nil { 13012 return []string{} 13013 } 13014 var values []string 13015 ctx := eval.NewContext(ev) 13016 iterator := &ProcessAncestorsIterator{} 13017 ptr := iterator.Front(ctx) 13018 for ptr != nil { 13019 element := (*ProcessCacheEntry)(ptr) 13020 result := ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, &element.ProcessContext.Process) 13021 values = append(values, result) 13022 ptr = iterator.Next() 13023 } 13024 return values 13025 } 13026 13027 // GetSignalTargetAncestorsArgsTruncated returns the value of the field, resolving if necessary 13028 func (ev *Event) GetSignalTargetAncestorsArgsTruncated() []bool { 13029 if ev.GetEventType().String() != "signal" { 13030 return []bool{} 13031 } 13032 if ev.Signal.Target == nil { 13033 return []bool{} 13034 } 13035 if ev.Signal.Target.Ancestor == nil { 13036 return []bool{} 13037 } 13038 var values []bool 13039 ctx := eval.NewContext(ev) 13040 iterator := &ProcessAncestorsIterator{} 13041 ptr := iterator.Front(ctx) 13042 for ptr != nil { 13043 element := (*ProcessCacheEntry)(ptr) 13044 result := ev.FieldHandlers.ResolveProcessArgsTruncated(ev, &element.ProcessContext.Process) 13045 values = append(values, result) 13046 ptr = iterator.Next() 13047 } 13048 return values 13049 } 13050 13051 // GetSignalTargetAncestorsArgv returns the value of the field, resolving if necessary 13052 func (ev *Event) GetSignalTargetAncestorsArgv() []string { 13053 if ev.GetEventType().String() != "signal" { 13054 return []string{} 13055 } 13056 if ev.Signal.Target == nil { 13057 return []string{} 13058 } 13059 if ev.Signal.Target.Ancestor == nil { 13060 return []string{} 13061 } 13062 var values []string 13063 ctx := eval.NewContext(ev) 13064 iterator := &ProcessAncestorsIterator{} 13065 ptr := iterator.Front(ctx) 13066 for ptr != nil { 13067 element := (*ProcessCacheEntry)(ptr) 13068 result := ev.FieldHandlers.ResolveProcessArgv(ev, &element.ProcessContext.Process) 13069 values = append(values, result...) 13070 ptr = iterator.Next() 13071 } 13072 return values 13073 } 13074 13075 // GetSignalTargetAncestorsArgv0 returns the value of the field, resolving if necessary 13076 func (ev *Event) GetSignalTargetAncestorsArgv0() []string { 13077 if ev.GetEventType().String() != "signal" { 13078 return []string{} 13079 } 13080 if ev.Signal.Target == nil { 13081 return []string{} 13082 } 13083 if ev.Signal.Target.Ancestor == nil { 13084 return []string{} 13085 } 13086 var values []string 13087 ctx := eval.NewContext(ev) 13088 iterator := &ProcessAncestorsIterator{} 13089 ptr := iterator.Front(ctx) 13090 for ptr != nil { 13091 element := (*ProcessCacheEntry)(ptr) 13092 result := ev.FieldHandlers.ResolveProcessArgv0(ev, &element.ProcessContext.Process) 13093 values = append(values, result) 13094 ptr = iterator.Next() 13095 } 13096 return values 13097 } 13098 13099 // GetSignalTargetAncestorsArgvScrubbed returns the value of the field, resolving if necessary 13100 func (ev *Event) GetSignalTargetAncestorsArgvScrubbed() []string { 13101 if ev.GetEventType().String() != "signal" { 13102 return []string{} 13103 } 13104 if ev.Signal.Target == nil { 13105 return []string{} 13106 } 13107 if ev.Signal.Target.Ancestor == nil { 13108 return []string{} 13109 } 13110 var values []string 13111 ctx := eval.NewContext(ev) 13112 iterator := &ProcessAncestorsIterator{} 13113 ptr := iterator.Front(ctx) 13114 for ptr != nil { 13115 element := (*ProcessCacheEntry)(ptr) 13116 result := ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, &element.ProcessContext.Process) 13117 values = append(values, result...) 13118 ptr = iterator.Next() 13119 } 13120 return values 13121 } 13122 13123 // GetSignalTargetAncestorsCapEffective returns the value of the field, resolving if necessary 13124 func (ev *Event) GetSignalTargetAncestorsCapEffective() []uint64 { 13125 if ev.GetEventType().String() != "signal" { 13126 return []uint64{} 13127 } 13128 if ev.Signal.Target == nil { 13129 return []uint64{} 13130 } 13131 if ev.Signal.Target.Ancestor == nil { 13132 return []uint64{} 13133 } 13134 var values []uint64 13135 ctx := eval.NewContext(ev) 13136 iterator := &ProcessAncestorsIterator{} 13137 ptr := iterator.Front(ctx) 13138 for ptr != nil { 13139 element := (*ProcessCacheEntry)(ptr) 13140 result := element.ProcessContext.Process.Credentials.CapEffective 13141 values = append(values, result) 13142 ptr = iterator.Next() 13143 } 13144 return values 13145 } 13146 13147 // GetSignalTargetAncestorsCapPermitted returns the value of the field, resolving if necessary 13148 func (ev *Event) GetSignalTargetAncestorsCapPermitted() []uint64 { 13149 if ev.GetEventType().String() != "signal" { 13150 return []uint64{} 13151 } 13152 if ev.Signal.Target == nil { 13153 return []uint64{} 13154 } 13155 if ev.Signal.Target.Ancestor == nil { 13156 return []uint64{} 13157 } 13158 var values []uint64 13159 ctx := eval.NewContext(ev) 13160 iterator := &ProcessAncestorsIterator{} 13161 ptr := iterator.Front(ctx) 13162 for ptr != nil { 13163 element := (*ProcessCacheEntry)(ptr) 13164 result := element.ProcessContext.Process.Credentials.CapPermitted 13165 values = append(values, result) 13166 ptr = iterator.Next() 13167 } 13168 return values 13169 } 13170 13171 // GetSignalTargetAncestorsCmdargv returns the value of the field, resolving if necessary 13172 func (ev *Event) GetSignalTargetAncestorsCmdargv() []string { 13173 if ev.GetEventType().String() != "signal" { 13174 return []string{} 13175 } 13176 if ev.Signal.Target == nil { 13177 return []string{} 13178 } 13179 if ev.Signal.Target.Ancestor == nil { 13180 return []string{} 13181 } 13182 var values []string 13183 ctx := eval.NewContext(ev) 13184 iterator := &ProcessAncestorsIterator{} 13185 ptr := iterator.Front(ctx) 13186 for ptr != nil { 13187 element := (*ProcessCacheEntry)(ptr) 13188 result := ev.FieldHandlers.ResolveProcessCmdArgv(ev, &element.ProcessContext.Process) 13189 values = append(values, result...) 13190 ptr = iterator.Next() 13191 } 13192 return values 13193 } 13194 13195 // GetSignalTargetAncestorsComm returns the value of the field, resolving if necessary 13196 func (ev *Event) GetSignalTargetAncestorsComm() []string { 13197 if ev.GetEventType().String() != "signal" { 13198 return []string{} 13199 } 13200 if ev.Signal.Target == nil { 13201 return []string{} 13202 } 13203 if ev.Signal.Target.Ancestor == nil { 13204 return []string{} 13205 } 13206 var values []string 13207 ctx := eval.NewContext(ev) 13208 iterator := &ProcessAncestorsIterator{} 13209 ptr := iterator.Front(ctx) 13210 for ptr != nil { 13211 element := (*ProcessCacheEntry)(ptr) 13212 result := element.ProcessContext.Process.Comm 13213 values = append(values, result) 13214 ptr = iterator.Next() 13215 } 13216 return values 13217 } 13218 13219 // GetSignalTargetAncestorsContainerId returns the value of the field, resolving if necessary 13220 func (ev *Event) GetSignalTargetAncestorsContainerId() []string { 13221 if ev.GetEventType().String() != "signal" { 13222 return []string{} 13223 } 13224 if ev.Signal.Target == nil { 13225 return []string{} 13226 } 13227 if ev.Signal.Target.Ancestor == nil { 13228 return []string{} 13229 } 13230 var values []string 13231 ctx := eval.NewContext(ev) 13232 iterator := &ProcessAncestorsIterator{} 13233 ptr := iterator.Front(ctx) 13234 for ptr != nil { 13235 element := (*ProcessCacheEntry)(ptr) 13236 result := element.ProcessContext.Process.ContainerID 13237 values = append(values, result) 13238 ptr = iterator.Next() 13239 } 13240 return values 13241 } 13242 13243 // GetSignalTargetAncestorsCreatedAt returns the value of the field, resolving if necessary 13244 func (ev *Event) GetSignalTargetAncestorsCreatedAt() []int { 13245 if ev.GetEventType().String() != "signal" { 13246 return []int{} 13247 } 13248 if ev.Signal.Target == nil { 13249 return []int{} 13250 } 13251 if ev.Signal.Target.Ancestor == nil { 13252 return []int{} 13253 } 13254 var values []int 13255 ctx := eval.NewContext(ev) 13256 iterator := &ProcessAncestorsIterator{} 13257 ptr := iterator.Front(ctx) 13258 for ptr != nil { 13259 element := (*ProcessCacheEntry)(ptr) 13260 result := int(ev.FieldHandlers.ResolveProcessCreatedAt(ev, &element.ProcessContext.Process)) 13261 values = append(values, result) 13262 ptr = iterator.Next() 13263 } 13264 return values 13265 } 13266 13267 // GetSignalTargetAncestorsEgid returns the value of the field, resolving if necessary 13268 func (ev *Event) GetSignalTargetAncestorsEgid() []uint32 { 13269 if ev.GetEventType().String() != "signal" { 13270 return []uint32{} 13271 } 13272 if ev.Signal.Target == nil { 13273 return []uint32{} 13274 } 13275 if ev.Signal.Target.Ancestor == nil { 13276 return []uint32{} 13277 } 13278 var values []uint32 13279 ctx := eval.NewContext(ev) 13280 iterator := &ProcessAncestorsIterator{} 13281 ptr := iterator.Front(ctx) 13282 for ptr != nil { 13283 element := (*ProcessCacheEntry)(ptr) 13284 result := element.ProcessContext.Process.Credentials.EGID 13285 values = append(values, result) 13286 ptr = iterator.Next() 13287 } 13288 return values 13289 } 13290 13291 // GetSignalTargetAncestorsEgroup returns the value of the field, resolving if necessary 13292 func (ev *Event) GetSignalTargetAncestorsEgroup() []string { 13293 if ev.GetEventType().String() != "signal" { 13294 return []string{} 13295 } 13296 if ev.Signal.Target == nil { 13297 return []string{} 13298 } 13299 if ev.Signal.Target.Ancestor == nil { 13300 return []string{} 13301 } 13302 var values []string 13303 ctx := eval.NewContext(ev) 13304 iterator := &ProcessAncestorsIterator{} 13305 ptr := iterator.Front(ctx) 13306 for ptr != nil { 13307 element := (*ProcessCacheEntry)(ptr) 13308 result := element.ProcessContext.Process.Credentials.EGroup 13309 values = append(values, result) 13310 ptr = iterator.Next() 13311 } 13312 return values 13313 } 13314 13315 // GetSignalTargetAncestorsEnvp returns the value of the field, resolving if necessary 13316 func (ev *Event) GetSignalTargetAncestorsEnvp() []string { 13317 if ev.GetEventType().String() != "signal" { 13318 return []string{} 13319 } 13320 if ev.Signal.Target == nil { 13321 return []string{} 13322 } 13323 if ev.Signal.Target.Ancestor == nil { 13324 return []string{} 13325 } 13326 var values []string 13327 ctx := eval.NewContext(ev) 13328 iterator := &ProcessAncestorsIterator{} 13329 ptr := iterator.Front(ctx) 13330 for ptr != nil { 13331 element := (*ProcessCacheEntry)(ptr) 13332 result := ev.FieldHandlers.ResolveProcessEnvp(ev, &element.ProcessContext.Process) 13333 values = append(values, result...) 13334 ptr = iterator.Next() 13335 } 13336 return values 13337 } 13338 13339 // GetSignalTargetAncestorsEnvs returns the value of the field, resolving if necessary 13340 func (ev *Event) GetSignalTargetAncestorsEnvs() []string { 13341 if ev.GetEventType().String() != "signal" { 13342 return []string{} 13343 } 13344 if ev.Signal.Target == nil { 13345 return []string{} 13346 } 13347 if ev.Signal.Target.Ancestor == nil { 13348 return []string{} 13349 } 13350 var values []string 13351 ctx := eval.NewContext(ev) 13352 iterator := &ProcessAncestorsIterator{} 13353 ptr := iterator.Front(ctx) 13354 for ptr != nil { 13355 element := (*ProcessCacheEntry)(ptr) 13356 result := ev.FieldHandlers.ResolveProcessEnvs(ev, &element.ProcessContext.Process) 13357 values = append(values, result...) 13358 ptr = iterator.Next() 13359 } 13360 return values 13361 } 13362 13363 // GetSignalTargetAncestorsEnvsTruncated returns the value of the field, resolving if necessary 13364 func (ev *Event) GetSignalTargetAncestorsEnvsTruncated() []bool { 13365 if ev.GetEventType().String() != "signal" { 13366 return []bool{} 13367 } 13368 if ev.Signal.Target == nil { 13369 return []bool{} 13370 } 13371 if ev.Signal.Target.Ancestor == nil { 13372 return []bool{} 13373 } 13374 var values []bool 13375 ctx := eval.NewContext(ev) 13376 iterator := &ProcessAncestorsIterator{} 13377 ptr := iterator.Front(ctx) 13378 for ptr != nil { 13379 element := (*ProcessCacheEntry)(ptr) 13380 result := ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, &element.ProcessContext.Process) 13381 values = append(values, result) 13382 ptr = iterator.Next() 13383 } 13384 return values 13385 } 13386 13387 // GetSignalTargetAncestorsEuid returns the value of the field, resolving if necessary 13388 func (ev *Event) GetSignalTargetAncestorsEuid() []uint32 { 13389 if ev.GetEventType().String() != "signal" { 13390 return []uint32{} 13391 } 13392 if ev.Signal.Target == nil { 13393 return []uint32{} 13394 } 13395 if ev.Signal.Target.Ancestor == nil { 13396 return []uint32{} 13397 } 13398 var values []uint32 13399 ctx := eval.NewContext(ev) 13400 iterator := &ProcessAncestorsIterator{} 13401 ptr := iterator.Front(ctx) 13402 for ptr != nil { 13403 element := (*ProcessCacheEntry)(ptr) 13404 result := element.ProcessContext.Process.Credentials.EUID 13405 values = append(values, result) 13406 ptr = iterator.Next() 13407 } 13408 return values 13409 } 13410 13411 // GetSignalTargetAncestorsEuser returns the value of the field, resolving if necessary 13412 func (ev *Event) GetSignalTargetAncestorsEuser() []string { 13413 if ev.GetEventType().String() != "signal" { 13414 return []string{} 13415 } 13416 if ev.Signal.Target == nil { 13417 return []string{} 13418 } 13419 if ev.Signal.Target.Ancestor == nil { 13420 return []string{} 13421 } 13422 var values []string 13423 ctx := eval.NewContext(ev) 13424 iterator := &ProcessAncestorsIterator{} 13425 ptr := iterator.Front(ctx) 13426 for ptr != nil { 13427 element := (*ProcessCacheEntry)(ptr) 13428 result := element.ProcessContext.Process.Credentials.EUser 13429 values = append(values, result) 13430 ptr = iterator.Next() 13431 } 13432 return values 13433 } 13434 13435 // GetSignalTargetAncestorsFileChangeTime returns the value of the field, resolving if necessary 13436 func (ev *Event) GetSignalTargetAncestorsFileChangeTime() []uint64 { 13437 if ev.GetEventType().String() != "signal" { 13438 return []uint64{} 13439 } 13440 if ev.Signal.Target == nil { 13441 return []uint64{} 13442 } 13443 if ev.Signal.Target.Ancestor == nil { 13444 return []uint64{} 13445 } 13446 var values []uint64 13447 ctx := eval.NewContext(ev) 13448 iterator := &ProcessAncestorsIterator{} 13449 ptr := iterator.Front(ctx) 13450 for ptr != nil { 13451 element := (*ProcessCacheEntry)(ptr) 13452 result := element.ProcessContext.Process.FileEvent.FileFields.CTime 13453 values = append(values, result) 13454 ptr = iterator.Next() 13455 } 13456 return values 13457 } 13458 13459 // GetSignalTargetAncestorsFileFilesystem returns the value of the field, resolving if necessary 13460 func (ev *Event) GetSignalTargetAncestorsFileFilesystem() []string { 13461 if ev.GetEventType().String() != "signal" { 13462 return []string{} 13463 } 13464 if ev.Signal.Target == nil { 13465 return []string{} 13466 } 13467 if ev.Signal.Target.Ancestor == nil { 13468 return []string{} 13469 } 13470 var values []string 13471 ctx := eval.NewContext(ev) 13472 iterator := &ProcessAncestorsIterator{} 13473 ptr := iterator.Front(ctx) 13474 for ptr != nil { 13475 element := (*ProcessCacheEntry)(ptr) 13476 result := ev.FieldHandlers.ResolveFileFilesystem(ev, &element.ProcessContext.Process.FileEvent) 13477 values = append(values, result) 13478 ptr = iterator.Next() 13479 } 13480 return values 13481 } 13482 13483 // GetSignalTargetAncestorsFileGid returns the value of the field, resolving if necessary 13484 func (ev *Event) GetSignalTargetAncestorsFileGid() []uint32 { 13485 if ev.GetEventType().String() != "signal" { 13486 return []uint32{} 13487 } 13488 if ev.Signal.Target == nil { 13489 return []uint32{} 13490 } 13491 if ev.Signal.Target.Ancestor == nil { 13492 return []uint32{} 13493 } 13494 var values []uint32 13495 ctx := eval.NewContext(ev) 13496 iterator := &ProcessAncestorsIterator{} 13497 ptr := iterator.Front(ctx) 13498 for ptr != nil { 13499 element := (*ProcessCacheEntry)(ptr) 13500 result := element.ProcessContext.Process.FileEvent.FileFields.GID 13501 values = append(values, result) 13502 ptr = iterator.Next() 13503 } 13504 return values 13505 } 13506 13507 // GetSignalTargetAncestorsFileGroup returns the value of the field, resolving if necessary 13508 func (ev *Event) GetSignalTargetAncestorsFileGroup() []string { 13509 if ev.GetEventType().String() != "signal" { 13510 return []string{} 13511 } 13512 if ev.Signal.Target == nil { 13513 return []string{} 13514 } 13515 if ev.Signal.Target.Ancestor == nil { 13516 return []string{} 13517 } 13518 var values []string 13519 ctx := eval.NewContext(ev) 13520 iterator := &ProcessAncestorsIterator{} 13521 ptr := iterator.Front(ctx) 13522 for ptr != nil { 13523 element := (*ProcessCacheEntry)(ptr) 13524 result := ev.FieldHandlers.ResolveFileFieldsGroup(ev, &element.ProcessContext.Process.FileEvent.FileFields) 13525 values = append(values, result) 13526 ptr = iterator.Next() 13527 } 13528 return values 13529 } 13530 13531 // GetSignalTargetAncestorsFileHashes returns the value of the field, resolving if necessary 13532 func (ev *Event) GetSignalTargetAncestorsFileHashes() []string { 13533 if ev.GetEventType().String() != "signal" { 13534 return []string{} 13535 } 13536 if ev.Signal.Target == nil { 13537 return []string{} 13538 } 13539 if ev.Signal.Target.Ancestor == nil { 13540 return []string{} 13541 } 13542 var values []string 13543 ctx := eval.NewContext(ev) 13544 iterator := &ProcessAncestorsIterator{} 13545 ptr := iterator.Front(ctx) 13546 for ptr != nil { 13547 element := (*ProcessCacheEntry)(ptr) 13548 result := ev.FieldHandlers.ResolveHashesFromEvent(ev, &element.ProcessContext.Process.FileEvent) 13549 values = append(values, result...) 13550 ptr = iterator.Next() 13551 } 13552 return values 13553 } 13554 13555 // GetSignalTargetAncestorsFileInUpperLayer returns the value of the field, resolving if necessary 13556 func (ev *Event) GetSignalTargetAncestorsFileInUpperLayer() []bool { 13557 if ev.GetEventType().String() != "signal" { 13558 return []bool{} 13559 } 13560 if ev.Signal.Target == nil { 13561 return []bool{} 13562 } 13563 if ev.Signal.Target.Ancestor == nil { 13564 return []bool{} 13565 } 13566 var values []bool 13567 ctx := eval.NewContext(ev) 13568 iterator := &ProcessAncestorsIterator{} 13569 ptr := iterator.Front(ctx) 13570 for ptr != nil { 13571 element := (*ProcessCacheEntry)(ptr) 13572 result := ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &element.ProcessContext.Process.FileEvent.FileFields) 13573 values = append(values, result) 13574 ptr = iterator.Next() 13575 } 13576 return values 13577 } 13578 13579 // GetSignalTargetAncestorsFileInode returns the value of the field, resolving if necessary 13580 func (ev *Event) GetSignalTargetAncestorsFileInode() []uint64 { 13581 if ev.GetEventType().String() != "signal" { 13582 return []uint64{} 13583 } 13584 if ev.Signal.Target == nil { 13585 return []uint64{} 13586 } 13587 if ev.Signal.Target.Ancestor == nil { 13588 return []uint64{} 13589 } 13590 var values []uint64 13591 ctx := eval.NewContext(ev) 13592 iterator := &ProcessAncestorsIterator{} 13593 ptr := iterator.Front(ctx) 13594 for ptr != nil { 13595 element := (*ProcessCacheEntry)(ptr) 13596 result := element.ProcessContext.Process.FileEvent.FileFields.PathKey.Inode 13597 values = append(values, result) 13598 ptr = iterator.Next() 13599 } 13600 return values 13601 } 13602 13603 // GetSignalTargetAncestorsFileMode returns the value of the field, resolving if necessary 13604 func (ev *Event) GetSignalTargetAncestorsFileMode() []uint16 { 13605 if ev.GetEventType().String() != "signal" { 13606 return []uint16{} 13607 } 13608 if ev.Signal.Target == nil { 13609 return []uint16{} 13610 } 13611 if ev.Signal.Target.Ancestor == nil { 13612 return []uint16{} 13613 } 13614 var values []uint16 13615 ctx := eval.NewContext(ev) 13616 iterator := &ProcessAncestorsIterator{} 13617 ptr := iterator.Front(ctx) 13618 for ptr != nil { 13619 element := (*ProcessCacheEntry)(ptr) 13620 result := element.ProcessContext.Process.FileEvent.FileFields.Mode 13621 values = append(values, result) 13622 ptr = iterator.Next() 13623 } 13624 return values 13625 } 13626 13627 // GetSignalTargetAncestorsFileModificationTime returns the value of the field, resolving if necessary 13628 func (ev *Event) GetSignalTargetAncestorsFileModificationTime() []uint64 { 13629 if ev.GetEventType().String() != "signal" { 13630 return []uint64{} 13631 } 13632 if ev.Signal.Target == nil { 13633 return []uint64{} 13634 } 13635 if ev.Signal.Target.Ancestor == nil { 13636 return []uint64{} 13637 } 13638 var values []uint64 13639 ctx := eval.NewContext(ev) 13640 iterator := &ProcessAncestorsIterator{} 13641 ptr := iterator.Front(ctx) 13642 for ptr != nil { 13643 element := (*ProcessCacheEntry)(ptr) 13644 result := element.ProcessContext.Process.FileEvent.FileFields.MTime 13645 values = append(values, result) 13646 ptr = iterator.Next() 13647 } 13648 return values 13649 } 13650 13651 // GetSignalTargetAncestorsFileMountId returns the value of the field, resolving if necessary 13652 func (ev *Event) GetSignalTargetAncestorsFileMountId() []uint32 { 13653 if ev.GetEventType().String() != "signal" { 13654 return []uint32{} 13655 } 13656 if ev.Signal.Target == nil { 13657 return []uint32{} 13658 } 13659 if ev.Signal.Target.Ancestor == nil { 13660 return []uint32{} 13661 } 13662 var values []uint32 13663 ctx := eval.NewContext(ev) 13664 iterator := &ProcessAncestorsIterator{} 13665 ptr := iterator.Front(ctx) 13666 for ptr != nil { 13667 element := (*ProcessCacheEntry)(ptr) 13668 result := element.ProcessContext.Process.FileEvent.FileFields.PathKey.MountID 13669 values = append(values, result) 13670 ptr = iterator.Next() 13671 } 13672 return values 13673 } 13674 13675 // GetSignalTargetAncestorsFileName returns the value of the field, resolving if necessary 13676 func (ev *Event) GetSignalTargetAncestorsFileName() []string { 13677 if ev.GetEventType().String() != "signal" { 13678 return []string{} 13679 } 13680 if ev.Signal.Target == nil { 13681 return []string{} 13682 } 13683 if ev.Signal.Target.Ancestor == nil { 13684 return []string{} 13685 } 13686 var values []string 13687 ctx := eval.NewContext(ev) 13688 iterator := &ProcessAncestorsIterator{} 13689 ptr := iterator.Front(ctx) 13690 for ptr != nil { 13691 element := (*ProcessCacheEntry)(ptr) 13692 result := ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.FileEvent) 13693 values = append(values, result) 13694 ptr = iterator.Next() 13695 } 13696 return values 13697 } 13698 13699 // GetSignalTargetAncestorsFileNameLength returns the value of the field, resolving if necessary 13700 func (ev *Event) GetSignalTargetAncestorsFileNameLength() []int { 13701 if ev.GetEventType().String() != "signal" { 13702 return []int{} 13703 } 13704 if ev.Signal.Target == nil { 13705 return []int{} 13706 } 13707 if ev.Signal.Target.Ancestor == nil { 13708 return []int{} 13709 } 13710 var values []int 13711 ctx := eval.NewContext(ev) 13712 iterator := &ProcessAncestorsIterator{} 13713 ptr := iterator.Front(ctx) 13714 for ptr != nil { 13715 element := (*ProcessCacheEntry)(ptr) 13716 result := len(ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.FileEvent)) 13717 values = append(values, result) 13718 ptr = iterator.Next() 13719 } 13720 return values 13721 } 13722 13723 // GetSignalTargetAncestorsFilePackageName returns the value of the field, resolving if necessary 13724 func (ev *Event) GetSignalTargetAncestorsFilePackageName() []string { 13725 if ev.GetEventType().String() != "signal" { 13726 return []string{} 13727 } 13728 if ev.Signal.Target == nil { 13729 return []string{} 13730 } 13731 if ev.Signal.Target.Ancestor == nil { 13732 return []string{} 13733 } 13734 var values []string 13735 ctx := eval.NewContext(ev) 13736 iterator := &ProcessAncestorsIterator{} 13737 ptr := iterator.Front(ctx) 13738 for ptr != nil { 13739 element := (*ProcessCacheEntry)(ptr) 13740 result := ev.FieldHandlers.ResolvePackageName(ev, &element.ProcessContext.Process.FileEvent) 13741 values = append(values, result) 13742 ptr = iterator.Next() 13743 } 13744 return values 13745 } 13746 13747 // GetSignalTargetAncestorsFilePackageSourceVersion returns the value of the field, resolving if necessary 13748 func (ev *Event) GetSignalTargetAncestorsFilePackageSourceVersion() []string { 13749 if ev.GetEventType().String() != "signal" { 13750 return []string{} 13751 } 13752 if ev.Signal.Target == nil { 13753 return []string{} 13754 } 13755 if ev.Signal.Target.Ancestor == nil { 13756 return []string{} 13757 } 13758 var values []string 13759 ctx := eval.NewContext(ev) 13760 iterator := &ProcessAncestorsIterator{} 13761 ptr := iterator.Front(ctx) 13762 for ptr != nil { 13763 element := (*ProcessCacheEntry)(ptr) 13764 result := ev.FieldHandlers.ResolvePackageSourceVersion(ev, &element.ProcessContext.Process.FileEvent) 13765 values = append(values, result) 13766 ptr = iterator.Next() 13767 } 13768 return values 13769 } 13770 13771 // GetSignalTargetAncestorsFilePackageVersion returns the value of the field, resolving if necessary 13772 func (ev *Event) GetSignalTargetAncestorsFilePackageVersion() []string { 13773 if ev.GetEventType().String() != "signal" { 13774 return []string{} 13775 } 13776 if ev.Signal.Target == nil { 13777 return []string{} 13778 } 13779 if ev.Signal.Target.Ancestor == nil { 13780 return []string{} 13781 } 13782 var values []string 13783 ctx := eval.NewContext(ev) 13784 iterator := &ProcessAncestorsIterator{} 13785 ptr := iterator.Front(ctx) 13786 for ptr != nil { 13787 element := (*ProcessCacheEntry)(ptr) 13788 result := ev.FieldHandlers.ResolvePackageVersion(ev, &element.ProcessContext.Process.FileEvent) 13789 values = append(values, result) 13790 ptr = iterator.Next() 13791 } 13792 return values 13793 } 13794 13795 // GetSignalTargetAncestorsFilePath returns the value of the field, resolving if necessary 13796 func (ev *Event) GetSignalTargetAncestorsFilePath() []string { 13797 if ev.GetEventType().String() != "signal" { 13798 return []string{} 13799 } 13800 if ev.Signal.Target == nil { 13801 return []string{} 13802 } 13803 if ev.Signal.Target.Ancestor == nil { 13804 return []string{} 13805 } 13806 var values []string 13807 ctx := eval.NewContext(ev) 13808 iterator := &ProcessAncestorsIterator{} 13809 ptr := iterator.Front(ctx) 13810 for ptr != nil { 13811 element := (*ProcessCacheEntry)(ptr) 13812 result := ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.FileEvent) 13813 values = append(values, result) 13814 ptr = iterator.Next() 13815 } 13816 return values 13817 } 13818 13819 // GetSignalTargetAncestorsFilePathLength returns the value of the field, resolving if necessary 13820 func (ev *Event) GetSignalTargetAncestorsFilePathLength() []int { 13821 if ev.GetEventType().String() != "signal" { 13822 return []int{} 13823 } 13824 if ev.Signal.Target == nil { 13825 return []int{} 13826 } 13827 if ev.Signal.Target.Ancestor == nil { 13828 return []int{} 13829 } 13830 var values []int 13831 ctx := eval.NewContext(ev) 13832 iterator := &ProcessAncestorsIterator{} 13833 ptr := iterator.Front(ctx) 13834 for ptr != nil { 13835 element := (*ProcessCacheEntry)(ptr) 13836 result := len(ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.FileEvent)) 13837 values = append(values, result) 13838 ptr = iterator.Next() 13839 } 13840 return values 13841 } 13842 13843 // GetSignalTargetAncestorsFileRights returns the value of the field, resolving if necessary 13844 func (ev *Event) GetSignalTargetAncestorsFileRights() []int { 13845 if ev.GetEventType().String() != "signal" { 13846 return []int{} 13847 } 13848 if ev.Signal.Target == nil { 13849 return []int{} 13850 } 13851 if ev.Signal.Target.Ancestor == nil { 13852 return []int{} 13853 } 13854 var values []int 13855 ctx := eval.NewContext(ev) 13856 iterator := &ProcessAncestorsIterator{} 13857 ptr := iterator.Front(ctx) 13858 for ptr != nil { 13859 element := (*ProcessCacheEntry)(ptr) 13860 result := int(ev.FieldHandlers.ResolveRights(ev, &element.ProcessContext.Process.FileEvent.FileFields)) 13861 values = append(values, result) 13862 ptr = iterator.Next() 13863 } 13864 return values 13865 } 13866 13867 // GetSignalTargetAncestorsFileUid returns the value of the field, resolving if necessary 13868 func (ev *Event) GetSignalTargetAncestorsFileUid() []uint32 { 13869 if ev.GetEventType().String() != "signal" { 13870 return []uint32{} 13871 } 13872 if ev.Signal.Target == nil { 13873 return []uint32{} 13874 } 13875 if ev.Signal.Target.Ancestor == nil { 13876 return []uint32{} 13877 } 13878 var values []uint32 13879 ctx := eval.NewContext(ev) 13880 iterator := &ProcessAncestorsIterator{} 13881 ptr := iterator.Front(ctx) 13882 for ptr != nil { 13883 element := (*ProcessCacheEntry)(ptr) 13884 result := element.ProcessContext.Process.FileEvent.FileFields.UID 13885 values = append(values, result) 13886 ptr = iterator.Next() 13887 } 13888 return values 13889 } 13890 13891 // GetSignalTargetAncestorsFileUser returns the value of the field, resolving if necessary 13892 func (ev *Event) GetSignalTargetAncestorsFileUser() []string { 13893 if ev.GetEventType().String() != "signal" { 13894 return []string{} 13895 } 13896 if ev.Signal.Target == nil { 13897 return []string{} 13898 } 13899 if ev.Signal.Target.Ancestor == nil { 13900 return []string{} 13901 } 13902 var values []string 13903 ctx := eval.NewContext(ev) 13904 iterator := &ProcessAncestorsIterator{} 13905 ptr := iterator.Front(ctx) 13906 for ptr != nil { 13907 element := (*ProcessCacheEntry)(ptr) 13908 result := ev.FieldHandlers.ResolveFileFieldsUser(ev, &element.ProcessContext.Process.FileEvent.FileFields) 13909 values = append(values, result) 13910 ptr = iterator.Next() 13911 } 13912 return values 13913 } 13914 13915 // GetSignalTargetAncestorsFsgid returns the value of the field, resolving if necessary 13916 func (ev *Event) GetSignalTargetAncestorsFsgid() []uint32 { 13917 if ev.GetEventType().String() != "signal" { 13918 return []uint32{} 13919 } 13920 if ev.Signal.Target == nil { 13921 return []uint32{} 13922 } 13923 if ev.Signal.Target.Ancestor == nil { 13924 return []uint32{} 13925 } 13926 var values []uint32 13927 ctx := eval.NewContext(ev) 13928 iterator := &ProcessAncestorsIterator{} 13929 ptr := iterator.Front(ctx) 13930 for ptr != nil { 13931 element := (*ProcessCacheEntry)(ptr) 13932 result := element.ProcessContext.Process.Credentials.FSGID 13933 values = append(values, result) 13934 ptr = iterator.Next() 13935 } 13936 return values 13937 } 13938 13939 // GetSignalTargetAncestorsFsgroup returns the value of the field, resolving if necessary 13940 func (ev *Event) GetSignalTargetAncestorsFsgroup() []string { 13941 if ev.GetEventType().String() != "signal" { 13942 return []string{} 13943 } 13944 if ev.Signal.Target == nil { 13945 return []string{} 13946 } 13947 if ev.Signal.Target.Ancestor == nil { 13948 return []string{} 13949 } 13950 var values []string 13951 ctx := eval.NewContext(ev) 13952 iterator := &ProcessAncestorsIterator{} 13953 ptr := iterator.Front(ctx) 13954 for ptr != nil { 13955 element := (*ProcessCacheEntry)(ptr) 13956 result := element.ProcessContext.Process.Credentials.FSGroup 13957 values = append(values, result) 13958 ptr = iterator.Next() 13959 } 13960 return values 13961 } 13962 13963 // GetSignalTargetAncestorsFsuid returns the value of the field, resolving if necessary 13964 func (ev *Event) GetSignalTargetAncestorsFsuid() []uint32 { 13965 if ev.GetEventType().String() != "signal" { 13966 return []uint32{} 13967 } 13968 if ev.Signal.Target == nil { 13969 return []uint32{} 13970 } 13971 if ev.Signal.Target.Ancestor == nil { 13972 return []uint32{} 13973 } 13974 var values []uint32 13975 ctx := eval.NewContext(ev) 13976 iterator := &ProcessAncestorsIterator{} 13977 ptr := iterator.Front(ctx) 13978 for ptr != nil { 13979 element := (*ProcessCacheEntry)(ptr) 13980 result := element.ProcessContext.Process.Credentials.FSUID 13981 values = append(values, result) 13982 ptr = iterator.Next() 13983 } 13984 return values 13985 } 13986 13987 // GetSignalTargetAncestorsFsuser returns the value of the field, resolving if necessary 13988 func (ev *Event) GetSignalTargetAncestorsFsuser() []string { 13989 if ev.GetEventType().String() != "signal" { 13990 return []string{} 13991 } 13992 if ev.Signal.Target == nil { 13993 return []string{} 13994 } 13995 if ev.Signal.Target.Ancestor == nil { 13996 return []string{} 13997 } 13998 var values []string 13999 ctx := eval.NewContext(ev) 14000 iterator := &ProcessAncestorsIterator{} 14001 ptr := iterator.Front(ctx) 14002 for ptr != nil { 14003 element := (*ProcessCacheEntry)(ptr) 14004 result := element.ProcessContext.Process.Credentials.FSUser 14005 values = append(values, result) 14006 ptr = iterator.Next() 14007 } 14008 return values 14009 } 14010 14011 // GetSignalTargetAncestorsGid returns the value of the field, resolving if necessary 14012 func (ev *Event) GetSignalTargetAncestorsGid() []uint32 { 14013 if ev.GetEventType().String() != "signal" { 14014 return []uint32{} 14015 } 14016 if ev.Signal.Target == nil { 14017 return []uint32{} 14018 } 14019 if ev.Signal.Target.Ancestor == nil { 14020 return []uint32{} 14021 } 14022 var values []uint32 14023 ctx := eval.NewContext(ev) 14024 iterator := &ProcessAncestorsIterator{} 14025 ptr := iterator.Front(ctx) 14026 for ptr != nil { 14027 element := (*ProcessCacheEntry)(ptr) 14028 result := element.ProcessContext.Process.Credentials.GID 14029 values = append(values, result) 14030 ptr = iterator.Next() 14031 } 14032 return values 14033 } 14034 14035 // GetSignalTargetAncestorsGroup returns the value of the field, resolving if necessary 14036 func (ev *Event) GetSignalTargetAncestorsGroup() []string { 14037 if ev.GetEventType().String() != "signal" { 14038 return []string{} 14039 } 14040 if ev.Signal.Target == nil { 14041 return []string{} 14042 } 14043 if ev.Signal.Target.Ancestor == nil { 14044 return []string{} 14045 } 14046 var values []string 14047 ctx := eval.NewContext(ev) 14048 iterator := &ProcessAncestorsIterator{} 14049 ptr := iterator.Front(ctx) 14050 for ptr != nil { 14051 element := (*ProcessCacheEntry)(ptr) 14052 result := element.ProcessContext.Process.Credentials.Group 14053 values = append(values, result) 14054 ptr = iterator.Next() 14055 } 14056 return values 14057 } 14058 14059 // GetSignalTargetAncestorsInterpreterFileChangeTime returns the value of the field, resolving if necessary 14060 func (ev *Event) GetSignalTargetAncestorsInterpreterFileChangeTime() []uint64 { 14061 if ev.GetEventType().String() != "signal" { 14062 return []uint64{} 14063 } 14064 if ev.Signal.Target == nil { 14065 return []uint64{} 14066 } 14067 if ev.Signal.Target.Ancestor == nil { 14068 return []uint64{} 14069 } 14070 var values []uint64 14071 ctx := eval.NewContext(ev) 14072 iterator := &ProcessAncestorsIterator{} 14073 ptr := iterator.Front(ctx) 14074 for ptr != nil { 14075 element := (*ProcessCacheEntry)(ptr) 14076 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.CTime 14077 values = append(values, result) 14078 ptr = iterator.Next() 14079 } 14080 return values 14081 } 14082 14083 // GetSignalTargetAncestorsInterpreterFileFilesystem returns the value of the field, resolving if necessary 14084 func (ev *Event) GetSignalTargetAncestorsInterpreterFileFilesystem() []string { 14085 if ev.GetEventType().String() != "signal" { 14086 return []string{} 14087 } 14088 if ev.Signal.Target == nil { 14089 return []string{} 14090 } 14091 if ev.Signal.Target.Ancestor == nil { 14092 return []string{} 14093 } 14094 var values []string 14095 ctx := eval.NewContext(ev) 14096 iterator := &ProcessAncestorsIterator{} 14097 ptr := iterator.Front(ctx) 14098 for ptr != nil { 14099 element := (*ProcessCacheEntry)(ptr) 14100 result := ev.FieldHandlers.ResolveFileFilesystem(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 14101 values = append(values, result) 14102 ptr = iterator.Next() 14103 } 14104 return values 14105 } 14106 14107 // GetSignalTargetAncestorsInterpreterFileGid returns the value of the field, resolving if necessary 14108 func (ev *Event) GetSignalTargetAncestorsInterpreterFileGid() []uint32 { 14109 if ev.GetEventType().String() != "signal" { 14110 return []uint32{} 14111 } 14112 if ev.Signal.Target == nil { 14113 return []uint32{} 14114 } 14115 if ev.Signal.Target.Ancestor == nil { 14116 return []uint32{} 14117 } 14118 var values []uint32 14119 ctx := eval.NewContext(ev) 14120 iterator := &ProcessAncestorsIterator{} 14121 ptr := iterator.Front(ctx) 14122 for ptr != nil { 14123 element := (*ProcessCacheEntry)(ptr) 14124 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.GID 14125 values = append(values, result) 14126 ptr = iterator.Next() 14127 } 14128 return values 14129 } 14130 14131 // GetSignalTargetAncestorsInterpreterFileGroup returns the value of the field, resolving if necessary 14132 func (ev *Event) GetSignalTargetAncestorsInterpreterFileGroup() []string { 14133 if ev.GetEventType().String() != "signal" { 14134 return []string{} 14135 } 14136 if ev.Signal.Target == nil { 14137 return []string{} 14138 } 14139 if ev.Signal.Target.Ancestor == nil { 14140 return []string{} 14141 } 14142 var values []string 14143 ctx := eval.NewContext(ev) 14144 iterator := &ProcessAncestorsIterator{} 14145 ptr := iterator.Front(ctx) 14146 for ptr != nil { 14147 element := (*ProcessCacheEntry)(ptr) 14148 result := ev.FieldHandlers.ResolveFileFieldsGroup(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 14149 values = append(values, result) 14150 ptr = iterator.Next() 14151 } 14152 return values 14153 } 14154 14155 // GetSignalTargetAncestorsInterpreterFileHashes returns the value of the field, resolving if necessary 14156 func (ev *Event) GetSignalTargetAncestorsInterpreterFileHashes() []string { 14157 if ev.GetEventType().String() != "signal" { 14158 return []string{} 14159 } 14160 if ev.Signal.Target == nil { 14161 return []string{} 14162 } 14163 if ev.Signal.Target.Ancestor == nil { 14164 return []string{} 14165 } 14166 var values []string 14167 ctx := eval.NewContext(ev) 14168 iterator := &ProcessAncestorsIterator{} 14169 ptr := iterator.Front(ctx) 14170 for ptr != nil { 14171 element := (*ProcessCacheEntry)(ptr) 14172 result := ev.FieldHandlers.ResolveHashesFromEvent(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 14173 values = append(values, result...) 14174 ptr = iterator.Next() 14175 } 14176 return values 14177 } 14178 14179 // GetSignalTargetAncestorsInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 14180 func (ev *Event) GetSignalTargetAncestorsInterpreterFileInUpperLayer() []bool { 14181 if ev.GetEventType().String() != "signal" { 14182 return []bool{} 14183 } 14184 if ev.Signal.Target == nil { 14185 return []bool{} 14186 } 14187 if ev.Signal.Target.Ancestor == nil { 14188 return []bool{} 14189 } 14190 var values []bool 14191 ctx := eval.NewContext(ev) 14192 iterator := &ProcessAncestorsIterator{} 14193 ptr := iterator.Front(ctx) 14194 for ptr != nil { 14195 element := (*ProcessCacheEntry)(ptr) 14196 result := ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 14197 values = append(values, result) 14198 ptr = iterator.Next() 14199 } 14200 return values 14201 } 14202 14203 // GetSignalTargetAncestorsInterpreterFileInode returns the value of the field, resolving if necessary 14204 func (ev *Event) GetSignalTargetAncestorsInterpreterFileInode() []uint64 { 14205 if ev.GetEventType().String() != "signal" { 14206 return []uint64{} 14207 } 14208 if ev.Signal.Target == nil { 14209 return []uint64{} 14210 } 14211 if ev.Signal.Target.Ancestor == nil { 14212 return []uint64{} 14213 } 14214 var values []uint64 14215 ctx := eval.NewContext(ev) 14216 iterator := &ProcessAncestorsIterator{} 14217 ptr := iterator.Front(ctx) 14218 for ptr != nil { 14219 element := (*ProcessCacheEntry)(ptr) 14220 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 14221 values = append(values, result) 14222 ptr = iterator.Next() 14223 } 14224 return values 14225 } 14226 14227 // GetSignalTargetAncestorsInterpreterFileMode returns the value of the field, resolving if necessary 14228 func (ev *Event) GetSignalTargetAncestorsInterpreterFileMode() []uint16 { 14229 if ev.GetEventType().String() != "signal" { 14230 return []uint16{} 14231 } 14232 if ev.Signal.Target == nil { 14233 return []uint16{} 14234 } 14235 if ev.Signal.Target.Ancestor == nil { 14236 return []uint16{} 14237 } 14238 var values []uint16 14239 ctx := eval.NewContext(ev) 14240 iterator := &ProcessAncestorsIterator{} 14241 ptr := iterator.Front(ctx) 14242 for ptr != nil { 14243 element := (*ProcessCacheEntry)(ptr) 14244 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.Mode 14245 values = append(values, result) 14246 ptr = iterator.Next() 14247 } 14248 return values 14249 } 14250 14251 // GetSignalTargetAncestorsInterpreterFileModificationTime returns the value of the field, resolving if necessary 14252 func (ev *Event) GetSignalTargetAncestorsInterpreterFileModificationTime() []uint64 { 14253 if ev.GetEventType().String() != "signal" { 14254 return []uint64{} 14255 } 14256 if ev.Signal.Target == nil { 14257 return []uint64{} 14258 } 14259 if ev.Signal.Target.Ancestor == nil { 14260 return []uint64{} 14261 } 14262 var values []uint64 14263 ctx := eval.NewContext(ev) 14264 iterator := &ProcessAncestorsIterator{} 14265 ptr := iterator.Front(ctx) 14266 for ptr != nil { 14267 element := (*ProcessCacheEntry)(ptr) 14268 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.MTime 14269 values = append(values, result) 14270 ptr = iterator.Next() 14271 } 14272 return values 14273 } 14274 14275 // GetSignalTargetAncestorsInterpreterFileMountId returns the value of the field, resolving if necessary 14276 func (ev *Event) GetSignalTargetAncestorsInterpreterFileMountId() []uint32 { 14277 if ev.GetEventType().String() != "signal" { 14278 return []uint32{} 14279 } 14280 if ev.Signal.Target == nil { 14281 return []uint32{} 14282 } 14283 if ev.Signal.Target.Ancestor == nil { 14284 return []uint32{} 14285 } 14286 var values []uint32 14287 ctx := eval.NewContext(ev) 14288 iterator := &ProcessAncestorsIterator{} 14289 ptr := iterator.Front(ctx) 14290 for ptr != nil { 14291 element := (*ProcessCacheEntry)(ptr) 14292 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 14293 values = append(values, result) 14294 ptr = iterator.Next() 14295 } 14296 return values 14297 } 14298 14299 // GetSignalTargetAncestorsInterpreterFileName returns the value of the field, resolving if necessary 14300 func (ev *Event) GetSignalTargetAncestorsInterpreterFileName() []string { 14301 if ev.GetEventType().String() != "signal" { 14302 return []string{} 14303 } 14304 if ev.Signal.Target == nil { 14305 return []string{} 14306 } 14307 if ev.Signal.Target.Ancestor == nil { 14308 return []string{} 14309 } 14310 var values []string 14311 ctx := eval.NewContext(ev) 14312 iterator := &ProcessAncestorsIterator{} 14313 ptr := iterator.Front(ctx) 14314 for ptr != nil { 14315 element := (*ProcessCacheEntry)(ptr) 14316 result := ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 14317 values = append(values, result) 14318 ptr = iterator.Next() 14319 } 14320 return values 14321 } 14322 14323 // GetSignalTargetAncestorsInterpreterFileNameLength returns the value of the field, resolving if necessary 14324 func (ev *Event) GetSignalTargetAncestorsInterpreterFileNameLength() []int { 14325 if ev.GetEventType().String() != "signal" { 14326 return []int{} 14327 } 14328 if ev.Signal.Target == nil { 14329 return []int{} 14330 } 14331 if ev.Signal.Target.Ancestor == nil { 14332 return []int{} 14333 } 14334 var values []int 14335 ctx := eval.NewContext(ev) 14336 iterator := &ProcessAncestorsIterator{} 14337 ptr := iterator.Front(ctx) 14338 for ptr != nil { 14339 element := (*ProcessCacheEntry)(ptr) 14340 result := len(ev.FieldHandlers.ResolveFileBasename(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent)) 14341 values = append(values, result) 14342 ptr = iterator.Next() 14343 } 14344 return values 14345 } 14346 14347 // GetSignalTargetAncestorsInterpreterFilePackageName returns the value of the field, resolving if necessary 14348 func (ev *Event) GetSignalTargetAncestorsInterpreterFilePackageName() []string { 14349 if ev.GetEventType().String() != "signal" { 14350 return []string{} 14351 } 14352 if ev.Signal.Target == nil { 14353 return []string{} 14354 } 14355 if ev.Signal.Target.Ancestor == nil { 14356 return []string{} 14357 } 14358 var values []string 14359 ctx := eval.NewContext(ev) 14360 iterator := &ProcessAncestorsIterator{} 14361 ptr := iterator.Front(ctx) 14362 for ptr != nil { 14363 element := (*ProcessCacheEntry)(ptr) 14364 result := ev.FieldHandlers.ResolvePackageName(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 14365 values = append(values, result) 14366 ptr = iterator.Next() 14367 } 14368 return values 14369 } 14370 14371 // GetSignalTargetAncestorsInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 14372 func (ev *Event) GetSignalTargetAncestorsInterpreterFilePackageSourceVersion() []string { 14373 if ev.GetEventType().String() != "signal" { 14374 return []string{} 14375 } 14376 if ev.Signal.Target == nil { 14377 return []string{} 14378 } 14379 if ev.Signal.Target.Ancestor == nil { 14380 return []string{} 14381 } 14382 var values []string 14383 ctx := eval.NewContext(ev) 14384 iterator := &ProcessAncestorsIterator{} 14385 ptr := iterator.Front(ctx) 14386 for ptr != nil { 14387 element := (*ProcessCacheEntry)(ptr) 14388 result := ev.FieldHandlers.ResolvePackageSourceVersion(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 14389 values = append(values, result) 14390 ptr = iterator.Next() 14391 } 14392 return values 14393 } 14394 14395 // GetSignalTargetAncestorsInterpreterFilePackageVersion returns the value of the field, resolving if necessary 14396 func (ev *Event) GetSignalTargetAncestorsInterpreterFilePackageVersion() []string { 14397 if ev.GetEventType().String() != "signal" { 14398 return []string{} 14399 } 14400 if ev.Signal.Target == nil { 14401 return []string{} 14402 } 14403 if ev.Signal.Target.Ancestor == nil { 14404 return []string{} 14405 } 14406 var values []string 14407 ctx := eval.NewContext(ev) 14408 iterator := &ProcessAncestorsIterator{} 14409 ptr := iterator.Front(ctx) 14410 for ptr != nil { 14411 element := (*ProcessCacheEntry)(ptr) 14412 result := ev.FieldHandlers.ResolvePackageVersion(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 14413 values = append(values, result) 14414 ptr = iterator.Next() 14415 } 14416 return values 14417 } 14418 14419 // GetSignalTargetAncestorsInterpreterFilePath returns the value of the field, resolving if necessary 14420 func (ev *Event) GetSignalTargetAncestorsInterpreterFilePath() []string { 14421 if ev.GetEventType().String() != "signal" { 14422 return []string{} 14423 } 14424 if ev.Signal.Target == nil { 14425 return []string{} 14426 } 14427 if ev.Signal.Target.Ancestor == nil { 14428 return []string{} 14429 } 14430 var values []string 14431 ctx := eval.NewContext(ev) 14432 iterator := &ProcessAncestorsIterator{} 14433 ptr := iterator.Front(ctx) 14434 for ptr != nil { 14435 element := (*ProcessCacheEntry)(ptr) 14436 result := ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent) 14437 values = append(values, result) 14438 ptr = iterator.Next() 14439 } 14440 return values 14441 } 14442 14443 // GetSignalTargetAncestorsInterpreterFilePathLength returns the value of the field, resolving if necessary 14444 func (ev *Event) GetSignalTargetAncestorsInterpreterFilePathLength() []int { 14445 if ev.GetEventType().String() != "signal" { 14446 return []int{} 14447 } 14448 if ev.Signal.Target == nil { 14449 return []int{} 14450 } 14451 if ev.Signal.Target.Ancestor == nil { 14452 return []int{} 14453 } 14454 var values []int 14455 ctx := eval.NewContext(ev) 14456 iterator := &ProcessAncestorsIterator{} 14457 ptr := iterator.Front(ctx) 14458 for ptr != nil { 14459 element := (*ProcessCacheEntry)(ptr) 14460 result := len(ev.FieldHandlers.ResolveFilePath(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent)) 14461 values = append(values, result) 14462 ptr = iterator.Next() 14463 } 14464 return values 14465 } 14466 14467 // GetSignalTargetAncestorsInterpreterFileRights returns the value of the field, resolving if necessary 14468 func (ev *Event) GetSignalTargetAncestorsInterpreterFileRights() []int { 14469 if ev.GetEventType().String() != "signal" { 14470 return []int{} 14471 } 14472 if ev.Signal.Target == nil { 14473 return []int{} 14474 } 14475 if ev.Signal.Target.Ancestor == nil { 14476 return []int{} 14477 } 14478 var values []int 14479 ctx := eval.NewContext(ev) 14480 iterator := &ProcessAncestorsIterator{} 14481 ptr := iterator.Front(ctx) 14482 for ptr != nil { 14483 element := (*ProcessCacheEntry)(ptr) 14484 result := int(ev.FieldHandlers.ResolveRights(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields)) 14485 values = append(values, result) 14486 ptr = iterator.Next() 14487 } 14488 return values 14489 } 14490 14491 // GetSignalTargetAncestorsInterpreterFileUid returns the value of the field, resolving if necessary 14492 func (ev *Event) GetSignalTargetAncestorsInterpreterFileUid() []uint32 { 14493 if ev.GetEventType().String() != "signal" { 14494 return []uint32{} 14495 } 14496 if ev.Signal.Target == nil { 14497 return []uint32{} 14498 } 14499 if ev.Signal.Target.Ancestor == nil { 14500 return []uint32{} 14501 } 14502 var values []uint32 14503 ctx := eval.NewContext(ev) 14504 iterator := &ProcessAncestorsIterator{} 14505 ptr := iterator.Front(ctx) 14506 for ptr != nil { 14507 element := (*ProcessCacheEntry)(ptr) 14508 result := element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields.UID 14509 values = append(values, result) 14510 ptr = iterator.Next() 14511 } 14512 return values 14513 } 14514 14515 // GetSignalTargetAncestorsInterpreterFileUser returns the value of the field, resolving if necessary 14516 func (ev *Event) GetSignalTargetAncestorsInterpreterFileUser() []string { 14517 if ev.GetEventType().String() != "signal" { 14518 return []string{} 14519 } 14520 if ev.Signal.Target == nil { 14521 return []string{} 14522 } 14523 if ev.Signal.Target.Ancestor == nil { 14524 return []string{} 14525 } 14526 var values []string 14527 ctx := eval.NewContext(ev) 14528 iterator := &ProcessAncestorsIterator{} 14529 ptr := iterator.Front(ctx) 14530 for ptr != nil { 14531 element := (*ProcessCacheEntry)(ptr) 14532 result := ev.FieldHandlers.ResolveFileFieldsUser(ev, &element.ProcessContext.Process.LinuxBinprm.FileEvent.FileFields) 14533 values = append(values, result) 14534 ptr = iterator.Next() 14535 } 14536 return values 14537 } 14538 14539 // GetSignalTargetAncestorsIsKworker returns the value of the field, resolving if necessary 14540 func (ev *Event) GetSignalTargetAncestorsIsKworker() []bool { 14541 if ev.GetEventType().String() != "signal" { 14542 return []bool{} 14543 } 14544 if ev.Signal.Target == nil { 14545 return []bool{} 14546 } 14547 if ev.Signal.Target.Ancestor == nil { 14548 return []bool{} 14549 } 14550 var values []bool 14551 ctx := eval.NewContext(ev) 14552 iterator := &ProcessAncestorsIterator{} 14553 ptr := iterator.Front(ctx) 14554 for ptr != nil { 14555 element := (*ProcessCacheEntry)(ptr) 14556 result := element.ProcessContext.Process.PIDContext.IsKworker 14557 values = append(values, result) 14558 ptr = iterator.Next() 14559 } 14560 return values 14561 } 14562 14563 // GetSignalTargetAncestorsIsThread returns the value of the field, resolving if necessary 14564 func (ev *Event) GetSignalTargetAncestorsIsThread() []bool { 14565 if ev.GetEventType().String() != "signal" { 14566 return []bool{} 14567 } 14568 if ev.Signal.Target == nil { 14569 return []bool{} 14570 } 14571 if ev.Signal.Target.Ancestor == nil { 14572 return []bool{} 14573 } 14574 var values []bool 14575 ctx := eval.NewContext(ev) 14576 iterator := &ProcessAncestorsIterator{} 14577 ptr := iterator.Front(ctx) 14578 for ptr != nil { 14579 element := (*ProcessCacheEntry)(ptr) 14580 result := element.ProcessContext.Process.IsThread 14581 values = append(values, result) 14582 ptr = iterator.Next() 14583 } 14584 return values 14585 } 14586 14587 // GetSignalTargetAncestorsPid returns the value of the field, resolving if necessary 14588 func (ev *Event) GetSignalTargetAncestorsPid() []uint32 { 14589 if ev.GetEventType().String() != "signal" { 14590 return []uint32{} 14591 } 14592 if ev.Signal.Target == nil { 14593 return []uint32{} 14594 } 14595 if ev.Signal.Target.Ancestor == nil { 14596 return []uint32{} 14597 } 14598 var values []uint32 14599 ctx := eval.NewContext(ev) 14600 iterator := &ProcessAncestorsIterator{} 14601 ptr := iterator.Front(ctx) 14602 for ptr != nil { 14603 element := (*ProcessCacheEntry)(ptr) 14604 result := element.ProcessContext.Process.PIDContext.Pid 14605 values = append(values, result) 14606 ptr = iterator.Next() 14607 } 14608 return values 14609 } 14610 14611 // GetSignalTargetAncestorsPpid returns the value of the field, resolving if necessary 14612 func (ev *Event) GetSignalTargetAncestorsPpid() []uint32 { 14613 if ev.GetEventType().String() != "signal" { 14614 return []uint32{} 14615 } 14616 if ev.Signal.Target == nil { 14617 return []uint32{} 14618 } 14619 if ev.Signal.Target.Ancestor == nil { 14620 return []uint32{} 14621 } 14622 var values []uint32 14623 ctx := eval.NewContext(ev) 14624 iterator := &ProcessAncestorsIterator{} 14625 ptr := iterator.Front(ctx) 14626 for ptr != nil { 14627 element := (*ProcessCacheEntry)(ptr) 14628 result := element.ProcessContext.Process.PPid 14629 values = append(values, result) 14630 ptr = iterator.Next() 14631 } 14632 return values 14633 } 14634 14635 // GetSignalTargetAncestorsTid returns the value of the field, resolving if necessary 14636 func (ev *Event) GetSignalTargetAncestorsTid() []uint32 { 14637 if ev.GetEventType().String() != "signal" { 14638 return []uint32{} 14639 } 14640 if ev.Signal.Target == nil { 14641 return []uint32{} 14642 } 14643 if ev.Signal.Target.Ancestor == nil { 14644 return []uint32{} 14645 } 14646 var values []uint32 14647 ctx := eval.NewContext(ev) 14648 iterator := &ProcessAncestorsIterator{} 14649 ptr := iterator.Front(ctx) 14650 for ptr != nil { 14651 element := (*ProcessCacheEntry)(ptr) 14652 result := element.ProcessContext.Process.PIDContext.Tid 14653 values = append(values, result) 14654 ptr = iterator.Next() 14655 } 14656 return values 14657 } 14658 14659 // GetSignalTargetAncestorsTtyName returns the value of the field, resolving if necessary 14660 func (ev *Event) GetSignalTargetAncestorsTtyName() []string { 14661 if ev.GetEventType().String() != "signal" { 14662 return []string{} 14663 } 14664 if ev.Signal.Target == nil { 14665 return []string{} 14666 } 14667 if ev.Signal.Target.Ancestor == nil { 14668 return []string{} 14669 } 14670 var values []string 14671 ctx := eval.NewContext(ev) 14672 iterator := &ProcessAncestorsIterator{} 14673 ptr := iterator.Front(ctx) 14674 for ptr != nil { 14675 element := (*ProcessCacheEntry)(ptr) 14676 result := element.ProcessContext.Process.TTYName 14677 values = append(values, result) 14678 ptr = iterator.Next() 14679 } 14680 return values 14681 } 14682 14683 // GetSignalTargetAncestorsUid returns the value of the field, resolving if necessary 14684 func (ev *Event) GetSignalTargetAncestorsUid() []uint32 { 14685 if ev.GetEventType().String() != "signal" { 14686 return []uint32{} 14687 } 14688 if ev.Signal.Target == nil { 14689 return []uint32{} 14690 } 14691 if ev.Signal.Target.Ancestor == nil { 14692 return []uint32{} 14693 } 14694 var values []uint32 14695 ctx := eval.NewContext(ev) 14696 iterator := &ProcessAncestorsIterator{} 14697 ptr := iterator.Front(ctx) 14698 for ptr != nil { 14699 element := (*ProcessCacheEntry)(ptr) 14700 result := element.ProcessContext.Process.Credentials.UID 14701 values = append(values, result) 14702 ptr = iterator.Next() 14703 } 14704 return values 14705 } 14706 14707 // GetSignalTargetAncestorsUser returns the value of the field, resolving if necessary 14708 func (ev *Event) GetSignalTargetAncestorsUser() []string { 14709 if ev.GetEventType().String() != "signal" { 14710 return []string{} 14711 } 14712 if ev.Signal.Target == nil { 14713 return []string{} 14714 } 14715 if ev.Signal.Target.Ancestor == nil { 14716 return []string{} 14717 } 14718 var values []string 14719 ctx := eval.NewContext(ev) 14720 iterator := &ProcessAncestorsIterator{} 14721 ptr := iterator.Front(ctx) 14722 for ptr != nil { 14723 element := (*ProcessCacheEntry)(ptr) 14724 result := element.ProcessContext.Process.Credentials.User 14725 values = append(values, result) 14726 ptr = iterator.Next() 14727 } 14728 return values 14729 } 14730 14731 // GetSignalTargetAncestorsUserSessionK8sGroups returns the value of the field, resolving if necessary 14732 func (ev *Event) GetSignalTargetAncestorsUserSessionK8sGroups() []string { 14733 if ev.GetEventType().String() != "signal" { 14734 return []string{} 14735 } 14736 if ev.Signal.Target == nil { 14737 return []string{} 14738 } 14739 if ev.Signal.Target.Ancestor == nil { 14740 return []string{} 14741 } 14742 var values []string 14743 ctx := eval.NewContext(ev) 14744 iterator := &ProcessAncestorsIterator{} 14745 ptr := iterator.Front(ctx) 14746 for ptr != nil { 14747 element := (*ProcessCacheEntry)(ptr) 14748 result := ev.FieldHandlers.ResolveK8SGroups(ev, &element.ProcessContext.Process.UserSession) 14749 values = append(values, result...) 14750 ptr = iterator.Next() 14751 } 14752 return values 14753 } 14754 14755 // GetSignalTargetAncestorsUserSessionK8sUid returns the value of the field, resolving if necessary 14756 func (ev *Event) GetSignalTargetAncestorsUserSessionK8sUid() []string { 14757 if ev.GetEventType().String() != "signal" { 14758 return []string{} 14759 } 14760 if ev.Signal.Target == nil { 14761 return []string{} 14762 } 14763 if ev.Signal.Target.Ancestor == nil { 14764 return []string{} 14765 } 14766 var values []string 14767 ctx := eval.NewContext(ev) 14768 iterator := &ProcessAncestorsIterator{} 14769 ptr := iterator.Front(ctx) 14770 for ptr != nil { 14771 element := (*ProcessCacheEntry)(ptr) 14772 result := ev.FieldHandlers.ResolveK8SUID(ev, &element.ProcessContext.Process.UserSession) 14773 values = append(values, result) 14774 ptr = iterator.Next() 14775 } 14776 return values 14777 } 14778 14779 // GetSignalTargetAncestorsUserSessionK8sUsername returns the value of the field, resolving if necessary 14780 func (ev *Event) GetSignalTargetAncestorsUserSessionK8sUsername() []string { 14781 if ev.GetEventType().String() != "signal" { 14782 return []string{} 14783 } 14784 if ev.Signal.Target == nil { 14785 return []string{} 14786 } 14787 if ev.Signal.Target.Ancestor == nil { 14788 return []string{} 14789 } 14790 var values []string 14791 ctx := eval.NewContext(ev) 14792 iterator := &ProcessAncestorsIterator{} 14793 ptr := iterator.Front(ctx) 14794 for ptr != nil { 14795 element := (*ProcessCacheEntry)(ptr) 14796 result := ev.FieldHandlers.ResolveK8SUsername(ev, &element.ProcessContext.Process.UserSession) 14797 values = append(values, result) 14798 ptr = iterator.Next() 14799 } 14800 return values 14801 } 14802 14803 // GetSignalTargetArgs returns the value of the field, resolving if necessary 14804 func (ev *Event) GetSignalTargetArgs() string { 14805 if ev.GetEventType().String() != "signal" { 14806 return "" 14807 } 14808 if ev.Signal.Target == nil { 14809 return "" 14810 } 14811 return ev.FieldHandlers.ResolveProcessArgs(ev, &ev.Signal.Target.Process) 14812 } 14813 14814 // GetSignalTargetArgsFlags returns the value of the field, resolving if necessary 14815 func (ev *Event) GetSignalTargetArgsFlags() []string { 14816 if ev.GetEventType().String() != "signal" { 14817 return []string{} 14818 } 14819 if ev.Signal.Target == nil { 14820 return []string{} 14821 } 14822 return ev.FieldHandlers.ResolveProcessArgsFlags(ev, &ev.Signal.Target.Process) 14823 } 14824 14825 // GetSignalTargetArgsOptions returns the value of the field, resolving if necessary 14826 func (ev *Event) GetSignalTargetArgsOptions() []string { 14827 if ev.GetEventType().String() != "signal" { 14828 return []string{} 14829 } 14830 if ev.Signal.Target == nil { 14831 return []string{} 14832 } 14833 return ev.FieldHandlers.ResolveProcessArgsOptions(ev, &ev.Signal.Target.Process) 14834 } 14835 14836 // GetSignalTargetArgsScrubbed returns the value of the field, resolving if necessary 14837 func (ev *Event) GetSignalTargetArgsScrubbed() string { 14838 if ev.GetEventType().String() != "signal" { 14839 return "" 14840 } 14841 if ev.Signal.Target == nil { 14842 return "" 14843 } 14844 return ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, &ev.Signal.Target.Process) 14845 } 14846 14847 // GetSignalTargetArgsTruncated returns the value of the field, resolving if necessary 14848 func (ev *Event) GetSignalTargetArgsTruncated() bool { 14849 if ev.GetEventType().String() != "signal" { 14850 return false 14851 } 14852 if ev.Signal.Target == nil { 14853 return false 14854 } 14855 return ev.FieldHandlers.ResolveProcessArgsTruncated(ev, &ev.Signal.Target.Process) 14856 } 14857 14858 // GetSignalTargetArgv returns the value of the field, resolving if necessary 14859 func (ev *Event) GetSignalTargetArgv() []string { 14860 if ev.GetEventType().String() != "signal" { 14861 return []string{} 14862 } 14863 if ev.Signal.Target == nil { 14864 return []string{} 14865 } 14866 return ev.FieldHandlers.ResolveProcessArgv(ev, &ev.Signal.Target.Process) 14867 } 14868 14869 // GetSignalTargetArgv0 returns the value of the field, resolving if necessary 14870 func (ev *Event) GetSignalTargetArgv0() string { 14871 if ev.GetEventType().String() != "signal" { 14872 return "" 14873 } 14874 if ev.Signal.Target == nil { 14875 return "" 14876 } 14877 return ev.FieldHandlers.ResolveProcessArgv0(ev, &ev.Signal.Target.Process) 14878 } 14879 14880 // GetSignalTargetArgvScrubbed returns the value of the field, resolving if necessary 14881 func (ev *Event) GetSignalTargetArgvScrubbed() []string { 14882 if ev.GetEventType().String() != "signal" { 14883 return []string{} 14884 } 14885 if ev.Signal.Target == nil { 14886 return []string{} 14887 } 14888 return ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, &ev.Signal.Target.Process) 14889 } 14890 14891 // GetSignalTargetCapEffective returns the value of the field, resolving if necessary 14892 func (ev *Event) GetSignalTargetCapEffective() uint64 { 14893 if ev.GetEventType().String() != "signal" { 14894 return uint64(0) 14895 } 14896 if ev.Signal.Target == nil { 14897 return uint64(0) 14898 } 14899 return ev.Signal.Target.Process.Credentials.CapEffective 14900 } 14901 14902 // GetSignalTargetCapPermitted returns the value of the field, resolving if necessary 14903 func (ev *Event) GetSignalTargetCapPermitted() uint64 { 14904 if ev.GetEventType().String() != "signal" { 14905 return uint64(0) 14906 } 14907 if ev.Signal.Target == nil { 14908 return uint64(0) 14909 } 14910 return ev.Signal.Target.Process.Credentials.CapPermitted 14911 } 14912 14913 // GetSignalTargetCmdargv returns the value of the field, resolving if necessary 14914 func (ev *Event) GetSignalTargetCmdargv() []string { 14915 if ev.GetEventType().String() != "signal" { 14916 return []string{} 14917 } 14918 if ev.Signal.Target == nil { 14919 return []string{} 14920 } 14921 return ev.FieldHandlers.ResolveProcessCmdArgv(ev, &ev.Signal.Target.Process) 14922 } 14923 14924 // GetSignalTargetComm returns the value of the field, resolving if necessary 14925 func (ev *Event) GetSignalTargetComm() string { 14926 if ev.GetEventType().String() != "signal" { 14927 return "" 14928 } 14929 if ev.Signal.Target == nil { 14930 return "" 14931 } 14932 return ev.Signal.Target.Process.Comm 14933 } 14934 14935 // GetSignalTargetContainerId returns the value of the field, resolving if necessary 14936 func (ev *Event) GetSignalTargetContainerId() string { 14937 if ev.GetEventType().String() != "signal" { 14938 return "" 14939 } 14940 if ev.Signal.Target == nil { 14941 return "" 14942 } 14943 return ev.Signal.Target.Process.ContainerID 14944 } 14945 14946 // GetSignalTargetCreatedAt returns the value of the field, resolving if necessary 14947 func (ev *Event) GetSignalTargetCreatedAt() int { 14948 if ev.GetEventType().String() != "signal" { 14949 return 0 14950 } 14951 if ev.Signal.Target == nil { 14952 return 0 14953 } 14954 return ev.FieldHandlers.ResolveProcessCreatedAt(ev, &ev.Signal.Target.Process) 14955 } 14956 14957 // GetSignalTargetEgid returns the value of the field, resolving if necessary 14958 func (ev *Event) GetSignalTargetEgid() uint32 { 14959 if ev.GetEventType().String() != "signal" { 14960 return uint32(0) 14961 } 14962 if ev.Signal.Target == nil { 14963 return uint32(0) 14964 } 14965 return ev.Signal.Target.Process.Credentials.EGID 14966 } 14967 14968 // GetSignalTargetEgroup returns the value of the field, resolving if necessary 14969 func (ev *Event) GetSignalTargetEgroup() string { 14970 if ev.GetEventType().String() != "signal" { 14971 return "" 14972 } 14973 if ev.Signal.Target == nil { 14974 return "" 14975 } 14976 return ev.Signal.Target.Process.Credentials.EGroup 14977 } 14978 14979 // GetSignalTargetEnvp returns the value of the field, resolving if necessary 14980 func (ev *Event) GetSignalTargetEnvp() []string { 14981 if ev.GetEventType().String() != "signal" { 14982 return []string{} 14983 } 14984 if ev.Signal.Target == nil { 14985 return []string{} 14986 } 14987 return ev.FieldHandlers.ResolveProcessEnvp(ev, &ev.Signal.Target.Process) 14988 } 14989 14990 // GetSignalTargetEnvs returns the value of the field, resolving if necessary 14991 func (ev *Event) GetSignalTargetEnvs() []string { 14992 if ev.GetEventType().String() != "signal" { 14993 return []string{} 14994 } 14995 if ev.Signal.Target == nil { 14996 return []string{} 14997 } 14998 return ev.FieldHandlers.ResolveProcessEnvs(ev, &ev.Signal.Target.Process) 14999 } 15000 15001 // GetSignalTargetEnvsTruncated returns the value of the field, resolving if necessary 15002 func (ev *Event) GetSignalTargetEnvsTruncated() bool { 15003 if ev.GetEventType().String() != "signal" { 15004 return false 15005 } 15006 if ev.Signal.Target == nil { 15007 return false 15008 } 15009 return ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, &ev.Signal.Target.Process) 15010 } 15011 15012 // GetSignalTargetEuid returns the value of the field, resolving if necessary 15013 func (ev *Event) GetSignalTargetEuid() uint32 { 15014 if ev.GetEventType().String() != "signal" { 15015 return uint32(0) 15016 } 15017 if ev.Signal.Target == nil { 15018 return uint32(0) 15019 } 15020 return ev.Signal.Target.Process.Credentials.EUID 15021 } 15022 15023 // GetSignalTargetEuser returns the value of the field, resolving if necessary 15024 func (ev *Event) GetSignalTargetEuser() string { 15025 if ev.GetEventType().String() != "signal" { 15026 return "" 15027 } 15028 if ev.Signal.Target == nil { 15029 return "" 15030 } 15031 return ev.Signal.Target.Process.Credentials.EUser 15032 } 15033 15034 // GetSignalTargetExecTime returns the value of the field, resolving if necessary 15035 func (ev *Event) GetSignalTargetExecTime() time.Time { 15036 if ev.GetEventType().String() != "signal" { 15037 return time.Time{} 15038 } 15039 if ev.Signal.Target == nil { 15040 return time.Time{} 15041 } 15042 return ev.Signal.Target.Process.ExecTime 15043 } 15044 15045 // GetSignalTargetExitTime returns the value of the field, resolving if necessary 15046 func (ev *Event) GetSignalTargetExitTime() time.Time { 15047 if ev.GetEventType().String() != "signal" { 15048 return time.Time{} 15049 } 15050 if ev.Signal.Target == nil { 15051 return time.Time{} 15052 } 15053 return ev.Signal.Target.Process.ExitTime 15054 } 15055 15056 // GetSignalTargetFileChangeTime returns the value of the field, resolving if necessary 15057 func (ev *Event) GetSignalTargetFileChangeTime() uint64 { 15058 if ev.GetEventType().String() != "signal" { 15059 return uint64(0) 15060 } 15061 if ev.Signal.Target == nil { 15062 return uint64(0) 15063 } 15064 if !ev.Signal.Target.Process.IsNotKworker() { 15065 return uint64(0) 15066 } 15067 return ev.Signal.Target.Process.FileEvent.FileFields.CTime 15068 } 15069 15070 // GetSignalTargetFileFilesystem returns the value of the field, resolving if necessary 15071 func (ev *Event) GetSignalTargetFileFilesystem() string { 15072 if ev.GetEventType().String() != "signal" { 15073 return "" 15074 } 15075 if ev.Signal.Target == nil { 15076 return "" 15077 } 15078 if !ev.Signal.Target.Process.IsNotKworker() { 15079 return "" 15080 } 15081 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Signal.Target.Process.FileEvent) 15082 } 15083 15084 // GetSignalTargetFileGid returns the value of the field, resolving if necessary 15085 func (ev *Event) GetSignalTargetFileGid() uint32 { 15086 if ev.GetEventType().String() != "signal" { 15087 return uint32(0) 15088 } 15089 if ev.Signal.Target == nil { 15090 return uint32(0) 15091 } 15092 if !ev.Signal.Target.Process.IsNotKworker() { 15093 return uint32(0) 15094 } 15095 return ev.Signal.Target.Process.FileEvent.FileFields.GID 15096 } 15097 15098 // GetSignalTargetFileGroup returns the value of the field, resolving if necessary 15099 func (ev *Event) GetSignalTargetFileGroup() string { 15100 if ev.GetEventType().String() != "signal" { 15101 return "" 15102 } 15103 if ev.Signal.Target == nil { 15104 return "" 15105 } 15106 if !ev.Signal.Target.Process.IsNotKworker() { 15107 return "" 15108 } 15109 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Signal.Target.Process.FileEvent.FileFields) 15110 } 15111 15112 // GetSignalTargetFileHashes returns the value of the field, resolving if necessary 15113 func (ev *Event) GetSignalTargetFileHashes() []string { 15114 if ev.GetEventType().String() != "signal" { 15115 return []string{} 15116 } 15117 if ev.Signal.Target == nil { 15118 return []string{} 15119 } 15120 if !ev.Signal.Target.Process.IsNotKworker() { 15121 return []string{} 15122 } 15123 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Signal.Target.Process.FileEvent) 15124 } 15125 15126 // GetSignalTargetFileInUpperLayer returns the value of the field, resolving if necessary 15127 func (ev *Event) GetSignalTargetFileInUpperLayer() bool { 15128 if ev.GetEventType().String() != "signal" { 15129 return false 15130 } 15131 if ev.Signal.Target == nil { 15132 return false 15133 } 15134 if !ev.Signal.Target.Process.IsNotKworker() { 15135 return false 15136 } 15137 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Signal.Target.Process.FileEvent.FileFields) 15138 } 15139 15140 // GetSignalTargetFileInode returns the value of the field, resolving if necessary 15141 func (ev *Event) GetSignalTargetFileInode() uint64 { 15142 if ev.GetEventType().String() != "signal" { 15143 return uint64(0) 15144 } 15145 if ev.Signal.Target == nil { 15146 return uint64(0) 15147 } 15148 if !ev.Signal.Target.Process.IsNotKworker() { 15149 return uint64(0) 15150 } 15151 return ev.Signal.Target.Process.FileEvent.FileFields.PathKey.Inode 15152 } 15153 15154 // GetSignalTargetFileMode returns the value of the field, resolving if necessary 15155 func (ev *Event) GetSignalTargetFileMode() uint16 { 15156 if ev.GetEventType().String() != "signal" { 15157 return uint16(0) 15158 } 15159 if ev.Signal.Target == nil { 15160 return uint16(0) 15161 } 15162 if !ev.Signal.Target.Process.IsNotKworker() { 15163 return uint16(0) 15164 } 15165 return ev.Signal.Target.Process.FileEvent.FileFields.Mode 15166 } 15167 15168 // GetSignalTargetFileModificationTime returns the value of the field, resolving if necessary 15169 func (ev *Event) GetSignalTargetFileModificationTime() uint64 { 15170 if ev.GetEventType().String() != "signal" { 15171 return uint64(0) 15172 } 15173 if ev.Signal.Target == nil { 15174 return uint64(0) 15175 } 15176 if !ev.Signal.Target.Process.IsNotKworker() { 15177 return uint64(0) 15178 } 15179 return ev.Signal.Target.Process.FileEvent.FileFields.MTime 15180 } 15181 15182 // GetSignalTargetFileMountId returns the value of the field, resolving if necessary 15183 func (ev *Event) GetSignalTargetFileMountId() uint32 { 15184 if ev.GetEventType().String() != "signal" { 15185 return uint32(0) 15186 } 15187 if ev.Signal.Target == nil { 15188 return uint32(0) 15189 } 15190 if !ev.Signal.Target.Process.IsNotKworker() { 15191 return uint32(0) 15192 } 15193 return ev.Signal.Target.Process.FileEvent.FileFields.PathKey.MountID 15194 } 15195 15196 // GetSignalTargetFileName returns the value of the field, resolving if necessary 15197 func (ev *Event) GetSignalTargetFileName() string { 15198 if ev.GetEventType().String() != "signal" { 15199 return "" 15200 } 15201 if ev.Signal.Target == nil { 15202 return "" 15203 } 15204 if !ev.Signal.Target.Process.IsNotKworker() { 15205 return "" 15206 } 15207 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Signal.Target.Process.FileEvent) 15208 } 15209 15210 // GetSignalTargetFileNameLength returns the value of the field, resolving if necessary 15211 func (ev *Event) GetSignalTargetFileNameLength() int { 15212 if ev.GetEventType().String() != "signal" { 15213 return 0 15214 } 15215 if ev.Signal.Target == nil { 15216 return 0 15217 } 15218 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Signal.Target.Process.FileEvent)) 15219 } 15220 15221 // GetSignalTargetFilePackageName returns the value of the field, resolving if necessary 15222 func (ev *Event) GetSignalTargetFilePackageName() string { 15223 if ev.GetEventType().String() != "signal" { 15224 return "" 15225 } 15226 if ev.Signal.Target == nil { 15227 return "" 15228 } 15229 if !ev.Signal.Target.Process.IsNotKworker() { 15230 return "" 15231 } 15232 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Signal.Target.Process.FileEvent) 15233 } 15234 15235 // GetSignalTargetFilePackageSourceVersion returns the value of the field, resolving if necessary 15236 func (ev *Event) GetSignalTargetFilePackageSourceVersion() string { 15237 if ev.GetEventType().String() != "signal" { 15238 return "" 15239 } 15240 if ev.Signal.Target == nil { 15241 return "" 15242 } 15243 if !ev.Signal.Target.Process.IsNotKworker() { 15244 return "" 15245 } 15246 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Signal.Target.Process.FileEvent) 15247 } 15248 15249 // GetSignalTargetFilePackageVersion returns the value of the field, resolving if necessary 15250 func (ev *Event) GetSignalTargetFilePackageVersion() string { 15251 if ev.GetEventType().String() != "signal" { 15252 return "" 15253 } 15254 if ev.Signal.Target == nil { 15255 return "" 15256 } 15257 if !ev.Signal.Target.Process.IsNotKworker() { 15258 return "" 15259 } 15260 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Signal.Target.Process.FileEvent) 15261 } 15262 15263 // GetSignalTargetFilePath returns the value of the field, resolving if necessary 15264 func (ev *Event) GetSignalTargetFilePath() string { 15265 if ev.GetEventType().String() != "signal" { 15266 return "" 15267 } 15268 if ev.Signal.Target == nil { 15269 return "" 15270 } 15271 if !ev.Signal.Target.Process.IsNotKworker() { 15272 return "" 15273 } 15274 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Signal.Target.Process.FileEvent) 15275 } 15276 15277 // GetSignalTargetFilePathLength returns the value of the field, resolving if necessary 15278 func (ev *Event) GetSignalTargetFilePathLength() int { 15279 if ev.GetEventType().String() != "signal" { 15280 return 0 15281 } 15282 if ev.Signal.Target == nil { 15283 return 0 15284 } 15285 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Signal.Target.Process.FileEvent)) 15286 } 15287 15288 // GetSignalTargetFileRights returns the value of the field, resolving if necessary 15289 func (ev *Event) GetSignalTargetFileRights() int { 15290 if ev.GetEventType().String() != "signal" { 15291 return 0 15292 } 15293 if ev.Signal.Target == nil { 15294 return 0 15295 } 15296 if !ev.Signal.Target.Process.IsNotKworker() { 15297 return 0 15298 } 15299 return ev.FieldHandlers.ResolveRights(ev, &ev.Signal.Target.Process.FileEvent.FileFields) 15300 } 15301 15302 // GetSignalTargetFileUid returns the value of the field, resolving if necessary 15303 func (ev *Event) GetSignalTargetFileUid() uint32 { 15304 if ev.GetEventType().String() != "signal" { 15305 return uint32(0) 15306 } 15307 if ev.Signal.Target == nil { 15308 return uint32(0) 15309 } 15310 if !ev.Signal.Target.Process.IsNotKworker() { 15311 return uint32(0) 15312 } 15313 return ev.Signal.Target.Process.FileEvent.FileFields.UID 15314 } 15315 15316 // GetSignalTargetFileUser returns the value of the field, resolving if necessary 15317 func (ev *Event) GetSignalTargetFileUser() string { 15318 if ev.GetEventType().String() != "signal" { 15319 return "" 15320 } 15321 if ev.Signal.Target == nil { 15322 return "" 15323 } 15324 if !ev.Signal.Target.Process.IsNotKworker() { 15325 return "" 15326 } 15327 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Signal.Target.Process.FileEvent.FileFields) 15328 } 15329 15330 // GetSignalTargetForkTime returns the value of the field, resolving if necessary 15331 func (ev *Event) GetSignalTargetForkTime() time.Time { 15332 if ev.GetEventType().String() != "signal" { 15333 return time.Time{} 15334 } 15335 if ev.Signal.Target == nil { 15336 return time.Time{} 15337 } 15338 return ev.Signal.Target.Process.ForkTime 15339 } 15340 15341 // GetSignalTargetFsgid returns the value of the field, resolving if necessary 15342 func (ev *Event) GetSignalTargetFsgid() uint32 { 15343 if ev.GetEventType().String() != "signal" { 15344 return uint32(0) 15345 } 15346 if ev.Signal.Target == nil { 15347 return uint32(0) 15348 } 15349 return ev.Signal.Target.Process.Credentials.FSGID 15350 } 15351 15352 // GetSignalTargetFsgroup returns the value of the field, resolving if necessary 15353 func (ev *Event) GetSignalTargetFsgroup() string { 15354 if ev.GetEventType().String() != "signal" { 15355 return "" 15356 } 15357 if ev.Signal.Target == nil { 15358 return "" 15359 } 15360 return ev.Signal.Target.Process.Credentials.FSGroup 15361 } 15362 15363 // GetSignalTargetFsuid returns the value of the field, resolving if necessary 15364 func (ev *Event) GetSignalTargetFsuid() uint32 { 15365 if ev.GetEventType().String() != "signal" { 15366 return uint32(0) 15367 } 15368 if ev.Signal.Target == nil { 15369 return uint32(0) 15370 } 15371 return ev.Signal.Target.Process.Credentials.FSUID 15372 } 15373 15374 // GetSignalTargetFsuser returns the value of the field, resolving if necessary 15375 func (ev *Event) GetSignalTargetFsuser() string { 15376 if ev.GetEventType().String() != "signal" { 15377 return "" 15378 } 15379 if ev.Signal.Target == nil { 15380 return "" 15381 } 15382 return ev.Signal.Target.Process.Credentials.FSUser 15383 } 15384 15385 // GetSignalTargetGid returns the value of the field, resolving if necessary 15386 func (ev *Event) GetSignalTargetGid() uint32 { 15387 if ev.GetEventType().String() != "signal" { 15388 return uint32(0) 15389 } 15390 if ev.Signal.Target == nil { 15391 return uint32(0) 15392 } 15393 return ev.Signal.Target.Process.Credentials.GID 15394 } 15395 15396 // GetSignalTargetGroup returns the value of the field, resolving if necessary 15397 func (ev *Event) GetSignalTargetGroup() string { 15398 if ev.GetEventType().String() != "signal" { 15399 return "" 15400 } 15401 if ev.Signal.Target == nil { 15402 return "" 15403 } 15404 return ev.Signal.Target.Process.Credentials.Group 15405 } 15406 15407 // GetSignalTargetInterpreterFileChangeTime returns the value of the field, resolving if necessary 15408 func (ev *Event) GetSignalTargetInterpreterFileChangeTime() uint64 { 15409 if ev.GetEventType().String() != "signal" { 15410 return uint64(0) 15411 } 15412 if ev.Signal.Target == nil { 15413 return uint64(0) 15414 } 15415 if !ev.Signal.Target.Process.HasInterpreter() { 15416 return uint64(0) 15417 } 15418 return ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields.CTime 15419 } 15420 15421 // GetSignalTargetInterpreterFileFilesystem returns the value of the field, resolving if necessary 15422 func (ev *Event) GetSignalTargetInterpreterFileFilesystem() string { 15423 if ev.GetEventType().String() != "signal" { 15424 return "" 15425 } 15426 if ev.Signal.Target == nil { 15427 return "" 15428 } 15429 if !ev.Signal.Target.Process.HasInterpreter() { 15430 return "" 15431 } 15432 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent) 15433 } 15434 15435 // GetSignalTargetInterpreterFileGid returns the value of the field, resolving if necessary 15436 func (ev *Event) GetSignalTargetInterpreterFileGid() uint32 { 15437 if ev.GetEventType().String() != "signal" { 15438 return uint32(0) 15439 } 15440 if ev.Signal.Target == nil { 15441 return uint32(0) 15442 } 15443 if !ev.Signal.Target.Process.HasInterpreter() { 15444 return uint32(0) 15445 } 15446 return ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields.GID 15447 } 15448 15449 // GetSignalTargetInterpreterFileGroup returns the value of the field, resolving if necessary 15450 func (ev *Event) GetSignalTargetInterpreterFileGroup() string { 15451 if ev.GetEventType().String() != "signal" { 15452 return "" 15453 } 15454 if ev.Signal.Target == nil { 15455 return "" 15456 } 15457 if !ev.Signal.Target.Process.HasInterpreter() { 15458 return "" 15459 } 15460 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields) 15461 } 15462 15463 // GetSignalTargetInterpreterFileHashes returns the value of the field, resolving if necessary 15464 func (ev *Event) GetSignalTargetInterpreterFileHashes() []string { 15465 if ev.GetEventType().String() != "signal" { 15466 return []string{} 15467 } 15468 if ev.Signal.Target == nil { 15469 return []string{} 15470 } 15471 if !ev.Signal.Target.Process.HasInterpreter() { 15472 return []string{} 15473 } 15474 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent) 15475 } 15476 15477 // GetSignalTargetInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 15478 func (ev *Event) GetSignalTargetInterpreterFileInUpperLayer() bool { 15479 if ev.GetEventType().String() != "signal" { 15480 return false 15481 } 15482 if ev.Signal.Target == nil { 15483 return false 15484 } 15485 if !ev.Signal.Target.Process.HasInterpreter() { 15486 return false 15487 } 15488 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields) 15489 } 15490 15491 // GetSignalTargetInterpreterFileInode returns the value of the field, resolving if necessary 15492 func (ev *Event) GetSignalTargetInterpreterFileInode() uint64 { 15493 if ev.GetEventType().String() != "signal" { 15494 return uint64(0) 15495 } 15496 if ev.Signal.Target == nil { 15497 return uint64(0) 15498 } 15499 if !ev.Signal.Target.Process.HasInterpreter() { 15500 return uint64(0) 15501 } 15502 return ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 15503 } 15504 15505 // GetSignalTargetInterpreterFileMode returns the value of the field, resolving if necessary 15506 func (ev *Event) GetSignalTargetInterpreterFileMode() uint16 { 15507 if ev.GetEventType().String() != "signal" { 15508 return uint16(0) 15509 } 15510 if ev.Signal.Target == nil { 15511 return uint16(0) 15512 } 15513 if !ev.Signal.Target.Process.HasInterpreter() { 15514 return uint16(0) 15515 } 15516 return ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields.Mode 15517 } 15518 15519 // GetSignalTargetInterpreterFileModificationTime returns the value of the field, resolving if necessary 15520 func (ev *Event) GetSignalTargetInterpreterFileModificationTime() uint64 { 15521 if ev.GetEventType().String() != "signal" { 15522 return uint64(0) 15523 } 15524 if ev.Signal.Target == nil { 15525 return uint64(0) 15526 } 15527 if !ev.Signal.Target.Process.HasInterpreter() { 15528 return uint64(0) 15529 } 15530 return ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields.MTime 15531 } 15532 15533 // GetSignalTargetInterpreterFileMountId returns the value of the field, resolving if necessary 15534 func (ev *Event) GetSignalTargetInterpreterFileMountId() uint32 { 15535 if ev.GetEventType().String() != "signal" { 15536 return uint32(0) 15537 } 15538 if ev.Signal.Target == nil { 15539 return uint32(0) 15540 } 15541 if !ev.Signal.Target.Process.HasInterpreter() { 15542 return uint32(0) 15543 } 15544 return ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 15545 } 15546 15547 // GetSignalTargetInterpreterFileName returns the value of the field, resolving if necessary 15548 func (ev *Event) GetSignalTargetInterpreterFileName() string { 15549 if ev.GetEventType().String() != "signal" { 15550 return "" 15551 } 15552 if ev.Signal.Target == nil { 15553 return "" 15554 } 15555 if !ev.Signal.Target.Process.HasInterpreter() { 15556 return "" 15557 } 15558 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent) 15559 } 15560 15561 // GetSignalTargetInterpreterFileNameLength returns the value of the field, resolving if necessary 15562 func (ev *Event) GetSignalTargetInterpreterFileNameLength() int { 15563 if ev.GetEventType().String() != "signal" { 15564 return 0 15565 } 15566 if ev.Signal.Target == nil { 15567 return 0 15568 } 15569 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent)) 15570 } 15571 15572 // GetSignalTargetInterpreterFilePackageName returns the value of the field, resolving if necessary 15573 func (ev *Event) GetSignalTargetInterpreterFilePackageName() string { 15574 if ev.GetEventType().String() != "signal" { 15575 return "" 15576 } 15577 if ev.Signal.Target == nil { 15578 return "" 15579 } 15580 if !ev.Signal.Target.Process.HasInterpreter() { 15581 return "" 15582 } 15583 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent) 15584 } 15585 15586 // GetSignalTargetInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 15587 func (ev *Event) GetSignalTargetInterpreterFilePackageSourceVersion() string { 15588 if ev.GetEventType().String() != "signal" { 15589 return "" 15590 } 15591 if ev.Signal.Target == nil { 15592 return "" 15593 } 15594 if !ev.Signal.Target.Process.HasInterpreter() { 15595 return "" 15596 } 15597 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent) 15598 } 15599 15600 // GetSignalTargetInterpreterFilePackageVersion returns the value of the field, resolving if necessary 15601 func (ev *Event) GetSignalTargetInterpreterFilePackageVersion() string { 15602 if ev.GetEventType().String() != "signal" { 15603 return "" 15604 } 15605 if ev.Signal.Target == nil { 15606 return "" 15607 } 15608 if !ev.Signal.Target.Process.HasInterpreter() { 15609 return "" 15610 } 15611 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent) 15612 } 15613 15614 // GetSignalTargetInterpreterFilePath returns the value of the field, resolving if necessary 15615 func (ev *Event) GetSignalTargetInterpreterFilePath() string { 15616 if ev.GetEventType().String() != "signal" { 15617 return "" 15618 } 15619 if ev.Signal.Target == nil { 15620 return "" 15621 } 15622 if !ev.Signal.Target.Process.HasInterpreter() { 15623 return "" 15624 } 15625 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent) 15626 } 15627 15628 // GetSignalTargetInterpreterFilePathLength returns the value of the field, resolving if necessary 15629 func (ev *Event) GetSignalTargetInterpreterFilePathLength() int { 15630 if ev.GetEventType().String() != "signal" { 15631 return 0 15632 } 15633 if ev.Signal.Target == nil { 15634 return 0 15635 } 15636 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent)) 15637 } 15638 15639 // GetSignalTargetInterpreterFileRights returns the value of the field, resolving if necessary 15640 func (ev *Event) GetSignalTargetInterpreterFileRights() int { 15641 if ev.GetEventType().String() != "signal" { 15642 return 0 15643 } 15644 if ev.Signal.Target == nil { 15645 return 0 15646 } 15647 if !ev.Signal.Target.Process.HasInterpreter() { 15648 return 0 15649 } 15650 return ev.FieldHandlers.ResolveRights(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields) 15651 } 15652 15653 // GetSignalTargetInterpreterFileUid returns the value of the field, resolving if necessary 15654 func (ev *Event) GetSignalTargetInterpreterFileUid() uint32 { 15655 if ev.GetEventType().String() != "signal" { 15656 return uint32(0) 15657 } 15658 if ev.Signal.Target == nil { 15659 return uint32(0) 15660 } 15661 if !ev.Signal.Target.Process.HasInterpreter() { 15662 return uint32(0) 15663 } 15664 return ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields.UID 15665 } 15666 15667 // GetSignalTargetInterpreterFileUser returns the value of the field, resolving if necessary 15668 func (ev *Event) GetSignalTargetInterpreterFileUser() string { 15669 if ev.GetEventType().String() != "signal" { 15670 return "" 15671 } 15672 if ev.Signal.Target == nil { 15673 return "" 15674 } 15675 if !ev.Signal.Target.Process.HasInterpreter() { 15676 return "" 15677 } 15678 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Signal.Target.Process.LinuxBinprm.FileEvent.FileFields) 15679 } 15680 15681 // GetSignalTargetIsKworker returns the value of the field, resolving if necessary 15682 func (ev *Event) GetSignalTargetIsKworker() bool { 15683 if ev.GetEventType().String() != "signal" { 15684 return false 15685 } 15686 if ev.Signal.Target == nil { 15687 return false 15688 } 15689 return ev.Signal.Target.Process.PIDContext.IsKworker 15690 } 15691 15692 // GetSignalTargetIsThread returns the value of the field, resolving if necessary 15693 func (ev *Event) GetSignalTargetIsThread() bool { 15694 if ev.GetEventType().String() != "signal" { 15695 return false 15696 } 15697 if ev.Signal.Target == nil { 15698 return false 15699 } 15700 return ev.Signal.Target.Process.IsThread 15701 } 15702 15703 // GetSignalTargetParentArgs returns the value of the field, resolving if necessary 15704 func (ev *Event) GetSignalTargetParentArgs() string { 15705 if ev.GetEventType().String() != "signal" { 15706 return "" 15707 } 15708 if ev.Signal.Target == nil { 15709 return "" 15710 } 15711 if ev.Signal.Target.Parent == nil { 15712 return "" 15713 } 15714 if !ev.Signal.Target.HasParent() { 15715 return "" 15716 } 15717 return ev.FieldHandlers.ResolveProcessArgs(ev, ev.Signal.Target.Parent) 15718 } 15719 15720 // GetSignalTargetParentArgsFlags returns the value of the field, resolving if necessary 15721 func (ev *Event) GetSignalTargetParentArgsFlags() []string { 15722 if ev.GetEventType().String() != "signal" { 15723 return []string{} 15724 } 15725 if ev.Signal.Target == nil { 15726 return []string{} 15727 } 15728 if ev.Signal.Target.Parent == nil { 15729 return []string{} 15730 } 15731 if !ev.Signal.Target.HasParent() { 15732 return []string{} 15733 } 15734 return ev.FieldHandlers.ResolveProcessArgsFlags(ev, ev.Signal.Target.Parent) 15735 } 15736 15737 // GetSignalTargetParentArgsOptions returns the value of the field, resolving if necessary 15738 func (ev *Event) GetSignalTargetParentArgsOptions() []string { 15739 if ev.GetEventType().String() != "signal" { 15740 return []string{} 15741 } 15742 if ev.Signal.Target == nil { 15743 return []string{} 15744 } 15745 if ev.Signal.Target.Parent == nil { 15746 return []string{} 15747 } 15748 if !ev.Signal.Target.HasParent() { 15749 return []string{} 15750 } 15751 return ev.FieldHandlers.ResolveProcessArgsOptions(ev, ev.Signal.Target.Parent) 15752 } 15753 15754 // GetSignalTargetParentArgsScrubbed returns the value of the field, resolving if necessary 15755 func (ev *Event) GetSignalTargetParentArgsScrubbed() string { 15756 if ev.GetEventType().String() != "signal" { 15757 return "" 15758 } 15759 if ev.Signal.Target == nil { 15760 return "" 15761 } 15762 if ev.Signal.Target.Parent == nil { 15763 return "" 15764 } 15765 if !ev.Signal.Target.HasParent() { 15766 return "" 15767 } 15768 return ev.FieldHandlers.ResolveProcessArgsScrubbed(ev, ev.Signal.Target.Parent) 15769 } 15770 15771 // GetSignalTargetParentArgsTruncated returns the value of the field, resolving if necessary 15772 func (ev *Event) GetSignalTargetParentArgsTruncated() bool { 15773 if ev.GetEventType().String() != "signal" { 15774 return false 15775 } 15776 if ev.Signal.Target == nil { 15777 return false 15778 } 15779 if ev.Signal.Target.Parent == nil { 15780 return false 15781 } 15782 if !ev.Signal.Target.HasParent() { 15783 return false 15784 } 15785 return ev.FieldHandlers.ResolveProcessArgsTruncated(ev, ev.Signal.Target.Parent) 15786 } 15787 15788 // GetSignalTargetParentArgv returns the value of the field, resolving if necessary 15789 func (ev *Event) GetSignalTargetParentArgv() []string { 15790 if ev.GetEventType().String() != "signal" { 15791 return []string{} 15792 } 15793 if ev.Signal.Target == nil { 15794 return []string{} 15795 } 15796 if ev.Signal.Target.Parent == nil { 15797 return []string{} 15798 } 15799 if !ev.Signal.Target.HasParent() { 15800 return []string{} 15801 } 15802 return ev.FieldHandlers.ResolveProcessArgv(ev, ev.Signal.Target.Parent) 15803 } 15804 15805 // GetSignalTargetParentArgv0 returns the value of the field, resolving if necessary 15806 func (ev *Event) GetSignalTargetParentArgv0() string { 15807 if ev.GetEventType().String() != "signal" { 15808 return "" 15809 } 15810 if ev.Signal.Target == nil { 15811 return "" 15812 } 15813 if ev.Signal.Target.Parent == nil { 15814 return "" 15815 } 15816 if !ev.Signal.Target.HasParent() { 15817 return "" 15818 } 15819 return ev.FieldHandlers.ResolveProcessArgv0(ev, ev.Signal.Target.Parent) 15820 } 15821 15822 // GetSignalTargetParentArgvScrubbed returns the value of the field, resolving if necessary 15823 func (ev *Event) GetSignalTargetParentArgvScrubbed() []string { 15824 if ev.GetEventType().String() != "signal" { 15825 return []string{} 15826 } 15827 if ev.Signal.Target == nil { 15828 return []string{} 15829 } 15830 if ev.Signal.Target.Parent == nil { 15831 return []string{} 15832 } 15833 if !ev.Signal.Target.HasParent() { 15834 return []string{} 15835 } 15836 return ev.FieldHandlers.ResolveProcessArgvScrubbed(ev, ev.Signal.Target.Parent) 15837 } 15838 15839 // GetSignalTargetParentCapEffective returns the value of the field, resolving if necessary 15840 func (ev *Event) GetSignalTargetParentCapEffective() uint64 { 15841 if ev.GetEventType().String() != "signal" { 15842 return uint64(0) 15843 } 15844 if ev.Signal.Target == nil { 15845 return uint64(0) 15846 } 15847 if ev.Signal.Target.Parent == nil { 15848 return uint64(0) 15849 } 15850 if !ev.Signal.Target.HasParent() { 15851 return uint64(0) 15852 } 15853 return ev.Signal.Target.Parent.Credentials.CapEffective 15854 } 15855 15856 // GetSignalTargetParentCapPermitted returns the value of the field, resolving if necessary 15857 func (ev *Event) GetSignalTargetParentCapPermitted() uint64 { 15858 if ev.GetEventType().String() != "signal" { 15859 return uint64(0) 15860 } 15861 if ev.Signal.Target == nil { 15862 return uint64(0) 15863 } 15864 if ev.Signal.Target.Parent == nil { 15865 return uint64(0) 15866 } 15867 if !ev.Signal.Target.HasParent() { 15868 return uint64(0) 15869 } 15870 return ev.Signal.Target.Parent.Credentials.CapPermitted 15871 } 15872 15873 // GetSignalTargetParentCmdargv returns the value of the field, resolving if necessary 15874 func (ev *Event) GetSignalTargetParentCmdargv() []string { 15875 if ev.GetEventType().String() != "signal" { 15876 return []string{} 15877 } 15878 if ev.Signal.Target == nil { 15879 return []string{} 15880 } 15881 if ev.Signal.Target.Parent == nil { 15882 return []string{} 15883 } 15884 if !ev.Signal.Target.HasParent() { 15885 return []string{} 15886 } 15887 return ev.FieldHandlers.ResolveProcessCmdArgv(ev, ev.Signal.Target.Parent) 15888 } 15889 15890 // GetSignalTargetParentComm returns the value of the field, resolving if necessary 15891 func (ev *Event) GetSignalTargetParentComm() string { 15892 if ev.GetEventType().String() != "signal" { 15893 return "" 15894 } 15895 if ev.Signal.Target == nil { 15896 return "" 15897 } 15898 if ev.Signal.Target.Parent == nil { 15899 return "" 15900 } 15901 if !ev.Signal.Target.HasParent() { 15902 return "" 15903 } 15904 return ev.Signal.Target.Parent.Comm 15905 } 15906 15907 // GetSignalTargetParentContainerId returns the value of the field, resolving if necessary 15908 func (ev *Event) GetSignalTargetParentContainerId() string { 15909 if ev.GetEventType().String() != "signal" { 15910 return "" 15911 } 15912 if ev.Signal.Target == nil { 15913 return "" 15914 } 15915 if ev.Signal.Target.Parent == nil { 15916 return "" 15917 } 15918 if !ev.Signal.Target.HasParent() { 15919 return "" 15920 } 15921 return ev.Signal.Target.Parent.ContainerID 15922 } 15923 15924 // GetSignalTargetParentCreatedAt returns the value of the field, resolving if necessary 15925 func (ev *Event) GetSignalTargetParentCreatedAt() int { 15926 if ev.GetEventType().String() != "signal" { 15927 return 0 15928 } 15929 if ev.Signal.Target == nil { 15930 return 0 15931 } 15932 if ev.Signal.Target.Parent == nil { 15933 return 0 15934 } 15935 if !ev.Signal.Target.HasParent() { 15936 return 0 15937 } 15938 return ev.FieldHandlers.ResolveProcessCreatedAt(ev, ev.Signal.Target.Parent) 15939 } 15940 15941 // GetSignalTargetParentEgid returns the value of the field, resolving if necessary 15942 func (ev *Event) GetSignalTargetParentEgid() uint32 { 15943 if ev.GetEventType().String() != "signal" { 15944 return uint32(0) 15945 } 15946 if ev.Signal.Target == nil { 15947 return uint32(0) 15948 } 15949 if ev.Signal.Target.Parent == nil { 15950 return uint32(0) 15951 } 15952 if !ev.Signal.Target.HasParent() { 15953 return uint32(0) 15954 } 15955 return ev.Signal.Target.Parent.Credentials.EGID 15956 } 15957 15958 // GetSignalTargetParentEgroup returns the value of the field, resolving if necessary 15959 func (ev *Event) GetSignalTargetParentEgroup() string { 15960 if ev.GetEventType().String() != "signal" { 15961 return "" 15962 } 15963 if ev.Signal.Target == nil { 15964 return "" 15965 } 15966 if ev.Signal.Target.Parent == nil { 15967 return "" 15968 } 15969 if !ev.Signal.Target.HasParent() { 15970 return "" 15971 } 15972 return ev.Signal.Target.Parent.Credentials.EGroup 15973 } 15974 15975 // GetSignalTargetParentEnvp returns the value of the field, resolving if necessary 15976 func (ev *Event) GetSignalTargetParentEnvp() []string { 15977 if ev.GetEventType().String() != "signal" { 15978 return []string{} 15979 } 15980 if ev.Signal.Target == nil { 15981 return []string{} 15982 } 15983 if ev.Signal.Target.Parent == nil { 15984 return []string{} 15985 } 15986 if !ev.Signal.Target.HasParent() { 15987 return []string{} 15988 } 15989 return ev.FieldHandlers.ResolveProcessEnvp(ev, ev.Signal.Target.Parent) 15990 } 15991 15992 // GetSignalTargetParentEnvs returns the value of the field, resolving if necessary 15993 func (ev *Event) GetSignalTargetParentEnvs() []string { 15994 if ev.GetEventType().String() != "signal" { 15995 return []string{} 15996 } 15997 if ev.Signal.Target == nil { 15998 return []string{} 15999 } 16000 if ev.Signal.Target.Parent == nil { 16001 return []string{} 16002 } 16003 if !ev.Signal.Target.HasParent() { 16004 return []string{} 16005 } 16006 return ev.FieldHandlers.ResolveProcessEnvs(ev, ev.Signal.Target.Parent) 16007 } 16008 16009 // GetSignalTargetParentEnvsTruncated returns the value of the field, resolving if necessary 16010 func (ev *Event) GetSignalTargetParentEnvsTruncated() bool { 16011 if ev.GetEventType().String() != "signal" { 16012 return false 16013 } 16014 if ev.Signal.Target == nil { 16015 return false 16016 } 16017 if ev.Signal.Target.Parent == nil { 16018 return false 16019 } 16020 if !ev.Signal.Target.HasParent() { 16021 return false 16022 } 16023 return ev.FieldHandlers.ResolveProcessEnvsTruncated(ev, ev.Signal.Target.Parent) 16024 } 16025 16026 // GetSignalTargetParentEuid returns the value of the field, resolving if necessary 16027 func (ev *Event) GetSignalTargetParentEuid() uint32 { 16028 if ev.GetEventType().String() != "signal" { 16029 return uint32(0) 16030 } 16031 if ev.Signal.Target == nil { 16032 return uint32(0) 16033 } 16034 if ev.Signal.Target.Parent == nil { 16035 return uint32(0) 16036 } 16037 if !ev.Signal.Target.HasParent() { 16038 return uint32(0) 16039 } 16040 return ev.Signal.Target.Parent.Credentials.EUID 16041 } 16042 16043 // GetSignalTargetParentEuser returns the value of the field, resolving if necessary 16044 func (ev *Event) GetSignalTargetParentEuser() string { 16045 if ev.GetEventType().String() != "signal" { 16046 return "" 16047 } 16048 if ev.Signal.Target == nil { 16049 return "" 16050 } 16051 if ev.Signal.Target.Parent == nil { 16052 return "" 16053 } 16054 if !ev.Signal.Target.HasParent() { 16055 return "" 16056 } 16057 return ev.Signal.Target.Parent.Credentials.EUser 16058 } 16059 16060 // GetSignalTargetParentFileChangeTime returns the value of the field, resolving if necessary 16061 func (ev *Event) GetSignalTargetParentFileChangeTime() uint64 { 16062 if ev.GetEventType().String() != "signal" { 16063 return uint64(0) 16064 } 16065 if ev.Signal.Target == nil { 16066 return uint64(0) 16067 } 16068 if ev.Signal.Target.Parent == nil { 16069 return uint64(0) 16070 } 16071 if !ev.Signal.Target.HasParent() { 16072 return uint64(0) 16073 } 16074 if !ev.Signal.Target.Parent.IsNotKworker() { 16075 return uint64(0) 16076 } 16077 return ev.Signal.Target.Parent.FileEvent.FileFields.CTime 16078 } 16079 16080 // GetSignalTargetParentFileFilesystem returns the value of the field, resolving if necessary 16081 func (ev *Event) GetSignalTargetParentFileFilesystem() string { 16082 if ev.GetEventType().String() != "signal" { 16083 return "" 16084 } 16085 if ev.Signal.Target == nil { 16086 return "" 16087 } 16088 if ev.Signal.Target.Parent == nil { 16089 return "" 16090 } 16091 if !ev.Signal.Target.HasParent() { 16092 return "" 16093 } 16094 if !ev.Signal.Target.Parent.IsNotKworker() { 16095 return "" 16096 } 16097 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Signal.Target.Parent.FileEvent) 16098 } 16099 16100 // GetSignalTargetParentFileGid returns the value of the field, resolving if necessary 16101 func (ev *Event) GetSignalTargetParentFileGid() uint32 { 16102 if ev.GetEventType().String() != "signal" { 16103 return uint32(0) 16104 } 16105 if ev.Signal.Target == nil { 16106 return uint32(0) 16107 } 16108 if ev.Signal.Target.Parent == nil { 16109 return uint32(0) 16110 } 16111 if !ev.Signal.Target.HasParent() { 16112 return uint32(0) 16113 } 16114 if !ev.Signal.Target.Parent.IsNotKworker() { 16115 return uint32(0) 16116 } 16117 return ev.Signal.Target.Parent.FileEvent.FileFields.GID 16118 } 16119 16120 // GetSignalTargetParentFileGroup returns the value of the field, resolving if necessary 16121 func (ev *Event) GetSignalTargetParentFileGroup() string { 16122 if ev.GetEventType().String() != "signal" { 16123 return "" 16124 } 16125 if ev.Signal.Target == nil { 16126 return "" 16127 } 16128 if ev.Signal.Target.Parent == nil { 16129 return "" 16130 } 16131 if !ev.Signal.Target.HasParent() { 16132 return "" 16133 } 16134 if !ev.Signal.Target.Parent.IsNotKworker() { 16135 return "" 16136 } 16137 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Signal.Target.Parent.FileEvent.FileFields) 16138 } 16139 16140 // GetSignalTargetParentFileHashes returns the value of the field, resolving if necessary 16141 func (ev *Event) GetSignalTargetParentFileHashes() []string { 16142 if ev.GetEventType().String() != "signal" { 16143 return []string{} 16144 } 16145 if ev.Signal.Target == nil { 16146 return []string{} 16147 } 16148 if ev.Signal.Target.Parent == nil { 16149 return []string{} 16150 } 16151 if !ev.Signal.Target.HasParent() { 16152 return []string{} 16153 } 16154 if !ev.Signal.Target.Parent.IsNotKworker() { 16155 return []string{} 16156 } 16157 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Signal.Target.Parent.FileEvent) 16158 } 16159 16160 // GetSignalTargetParentFileInUpperLayer returns the value of the field, resolving if necessary 16161 func (ev *Event) GetSignalTargetParentFileInUpperLayer() bool { 16162 if ev.GetEventType().String() != "signal" { 16163 return false 16164 } 16165 if ev.Signal.Target == nil { 16166 return false 16167 } 16168 if ev.Signal.Target.Parent == nil { 16169 return false 16170 } 16171 if !ev.Signal.Target.HasParent() { 16172 return false 16173 } 16174 if !ev.Signal.Target.Parent.IsNotKworker() { 16175 return false 16176 } 16177 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Signal.Target.Parent.FileEvent.FileFields) 16178 } 16179 16180 // GetSignalTargetParentFileInode returns the value of the field, resolving if necessary 16181 func (ev *Event) GetSignalTargetParentFileInode() uint64 { 16182 if ev.GetEventType().String() != "signal" { 16183 return uint64(0) 16184 } 16185 if ev.Signal.Target == nil { 16186 return uint64(0) 16187 } 16188 if ev.Signal.Target.Parent == nil { 16189 return uint64(0) 16190 } 16191 if !ev.Signal.Target.HasParent() { 16192 return uint64(0) 16193 } 16194 if !ev.Signal.Target.Parent.IsNotKworker() { 16195 return uint64(0) 16196 } 16197 return ev.Signal.Target.Parent.FileEvent.FileFields.PathKey.Inode 16198 } 16199 16200 // GetSignalTargetParentFileMode returns the value of the field, resolving if necessary 16201 func (ev *Event) GetSignalTargetParentFileMode() uint16 { 16202 if ev.GetEventType().String() != "signal" { 16203 return uint16(0) 16204 } 16205 if ev.Signal.Target == nil { 16206 return uint16(0) 16207 } 16208 if ev.Signal.Target.Parent == nil { 16209 return uint16(0) 16210 } 16211 if !ev.Signal.Target.HasParent() { 16212 return uint16(0) 16213 } 16214 if !ev.Signal.Target.Parent.IsNotKworker() { 16215 return uint16(0) 16216 } 16217 return ev.Signal.Target.Parent.FileEvent.FileFields.Mode 16218 } 16219 16220 // GetSignalTargetParentFileModificationTime returns the value of the field, resolving if necessary 16221 func (ev *Event) GetSignalTargetParentFileModificationTime() uint64 { 16222 if ev.GetEventType().String() != "signal" { 16223 return uint64(0) 16224 } 16225 if ev.Signal.Target == nil { 16226 return uint64(0) 16227 } 16228 if ev.Signal.Target.Parent == nil { 16229 return uint64(0) 16230 } 16231 if !ev.Signal.Target.HasParent() { 16232 return uint64(0) 16233 } 16234 if !ev.Signal.Target.Parent.IsNotKworker() { 16235 return uint64(0) 16236 } 16237 return ev.Signal.Target.Parent.FileEvent.FileFields.MTime 16238 } 16239 16240 // GetSignalTargetParentFileMountId returns the value of the field, resolving if necessary 16241 func (ev *Event) GetSignalTargetParentFileMountId() uint32 { 16242 if ev.GetEventType().String() != "signal" { 16243 return uint32(0) 16244 } 16245 if ev.Signal.Target == nil { 16246 return uint32(0) 16247 } 16248 if ev.Signal.Target.Parent == nil { 16249 return uint32(0) 16250 } 16251 if !ev.Signal.Target.HasParent() { 16252 return uint32(0) 16253 } 16254 if !ev.Signal.Target.Parent.IsNotKworker() { 16255 return uint32(0) 16256 } 16257 return ev.Signal.Target.Parent.FileEvent.FileFields.PathKey.MountID 16258 } 16259 16260 // GetSignalTargetParentFileName returns the value of the field, resolving if necessary 16261 func (ev *Event) GetSignalTargetParentFileName() string { 16262 if ev.GetEventType().String() != "signal" { 16263 return "" 16264 } 16265 if ev.Signal.Target == nil { 16266 return "" 16267 } 16268 if ev.Signal.Target.Parent == nil { 16269 return "" 16270 } 16271 if !ev.Signal.Target.HasParent() { 16272 return "" 16273 } 16274 if !ev.Signal.Target.Parent.IsNotKworker() { 16275 return "" 16276 } 16277 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Signal.Target.Parent.FileEvent) 16278 } 16279 16280 // GetSignalTargetParentFileNameLength returns the value of the field, resolving if necessary 16281 func (ev *Event) GetSignalTargetParentFileNameLength() int { 16282 if ev.GetEventType().String() != "signal" { 16283 return 0 16284 } 16285 if ev.Signal.Target == nil { 16286 return 0 16287 } 16288 if ev.Signal.Target.Parent == nil { 16289 return 0 16290 } 16291 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Signal.Target.Parent.FileEvent)) 16292 } 16293 16294 // GetSignalTargetParentFilePackageName returns the value of the field, resolving if necessary 16295 func (ev *Event) GetSignalTargetParentFilePackageName() string { 16296 if ev.GetEventType().String() != "signal" { 16297 return "" 16298 } 16299 if ev.Signal.Target == nil { 16300 return "" 16301 } 16302 if ev.Signal.Target.Parent == nil { 16303 return "" 16304 } 16305 if !ev.Signal.Target.HasParent() { 16306 return "" 16307 } 16308 if !ev.Signal.Target.Parent.IsNotKworker() { 16309 return "" 16310 } 16311 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Signal.Target.Parent.FileEvent) 16312 } 16313 16314 // GetSignalTargetParentFilePackageSourceVersion returns the value of the field, resolving if necessary 16315 func (ev *Event) GetSignalTargetParentFilePackageSourceVersion() string { 16316 if ev.GetEventType().String() != "signal" { 16317 return "" 16318 } 16319 if ev.Signal.Target == nil { 16320 return "" 16321 } 16322 if ev.Signal.Target.Parent == nil { 16323 return "" 16324 } 16325 if !ev.Signal.Target.HasParent() { 16326 return "" 16327 } 16328 if !ev.Signal.Target.Parent.IsNotKworker() { 16329 return "" 16330 } 16331 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Signal.Target.Parent.FileEvent) 16332 } 16333 16334 // GetSignalTargetParentFilePackageVersion returns the value of the field, resolving if necessary 16335 func (ev *Event) GetSignalTargetParentFilePackageVersion() string { 16336 if ev.GetEventType().String() != "signal" { 16337 return "" 16338 } 16339 if ev.Signal.Target == nil { 16340 return "" 16341 } 16342 if ev.Signal.Target.Parent == nil { 16343 return "" 16344 } 16345 if !ev.Signal.Target.HasParent() { 16346 return "" 16347 } 16348 if !ev.Signal.Target.Parent.IsNotKworker() { 16349 return "" 16350 } 16351 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Signal.Target.Parent.FileEvent) 16352 } 16353 16354 // GetSignalTargetParentFilePath returns the value of the field, resolving if necessary 16355 func (ev *Event) GetSignalTargetParentFilePath() string { 16356 if ev.GetEventType().String() != "signal" { 16357 return "" 16358 } 16359 if ev.Signal.Target == nil { 16360 return "" 16361 } 16362 if ev.Signal.Target.Parent == nil { 16363 return "" 16364 } 16365 if !ev.Signal.Target.HasParent() { 16366 return "" 16367 } 16368 if !ev.Signal.Target.Parent.IsNotKworker() { 16369 return "" 16370 } 16371 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Signal.Target.Parent.FileEvent) 16372 } 16373 16374 // GetSignalTargetParentFilePathLength returns the value of the field, resolving if necessary 16375 func (ev *Event) GetSignalTargetParentFilePathLength() int { 16376 if ev.GetEventType().String() != "signal" { 16377 return 0 16378 } 16379 if ev.Signal.Target == nil { 16380 return 0 16381 } 16382 if ev.Signal.Target.Parent == nil { 16383 return 0 16384 } 16385 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Signal.Target.Parent.FileEvent)) 16386 } 16387 16388 // GetSignalTargetParentFileRights returns the value of the field, resolving if necessary 16389 func (ev *Event) GetSignalTargetParentFileRights() int { 16390 if ev.GetEventType().String() != "signal" { 16391 return 0 16392 } 16393 if ev.Signal.Target == nil { 16394 return 0 16395 } 16396 if ev.Signal.Target.Parent == nil { 16397 return 0 16398 } 16399 if !ev.Signal.Target.HasParent() { 16400 return 0 16401 } 16402 if !ev.Signal.Target.Parent.IsNotKworker() { 16403 return 0 16404 } 16405 return ev.FieldHandlers.ResolveRights(ev, &ev.Signal.Target.Parent.FileEvent.FileFields) 16406 } 16407 16408 // GetSignalTargetParentFileUid returns the value of the field, resolving if necessary 16409 func (ev *Event) GetSignalTargetParentFileUid() uint32 { 16410 if ev.GetEventType().String() != "signal" { 16411 return uint32(0) 16412 } 16413 if ev.Signal.Target == nil { 16414 return uint32(0) 16415 } 16416 if ev.Signal.Target.Parent == nil { 16417 return uint32(0) 16418 } 16419 if !ev.Signal.Target.HasParent() { 16420 return uint32(0) 16421 } 16422 if !ev.Signal.Target.Parent.IsNotKworker() { 16423 return uint32(0) 16424 } 16425 return ev.Signal.Target.Parent.FileEvent.FileFields.UID 16426 } 16427 16428 // GetSignalTargetParentFileUser returns the value of the field, resolving if necessary 16429 func (ev *Event) GetSignalTargetParentFileUser() string { 16430 if ev.GetEventType().String() != "signal" { 16431 return "" 16432 } 16433 if ev.Signal.Target == nil { 16434 return "" 16435 } 16436 if ev.Signal.Target.Parent == nil { 16437 return "" 16438 } 16439 if !ev.Signal.Target.HasParent() { 16440 return "" 16441 } 16442 if !ev.Signal.Target.Parent.IsNotKworker() { 16443 return "" 16444 } 16445 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Signal.Target.Parent.FileEvent.FileFields) 16446 } 16447 16448 // GetSignalTargetParentFsgid returns the value of the field, resolving if necessary 16449 func (ev *Event) GetSignalTargetParentFsgid() uint32 { 16450 if ev.GetEventType().String() != "signal" { 16451 return uint32(0) 16452 } 16453 if ev.Signal.Target == nil { 16454 return uint32(0) 16455 } 16456 if ev.Signal.Target.Parent == nil { 16457 return uint32(0) 16458 } 16459 if !ev.Signal.Target.HasParent() { 16460 return uint32(0) 16461 } 16462 return ev.Signal.Target.Parent.Credentials.FSGID 16463 } 16464 16465 // GetSignalTargetParentFsgroup returns the value of the field, resolving if necessary 16466 func (ev *Event) GetSignalTargetParentFsgroup() string { 16467 if ev.GetEventType().String() != "signal" { 16468 return "" 16469 } 16470 if ev.Signal.Target == nil { 16471 return "" 16472 } 16473 if ev.Signal.Target.Parent == nil { 16474 return "" 16475 } 16476 if !ev.Signal.Target.HasParent() { 16477 return "" 16478 } 16479 return ev.Signal.Target.Parent.Credentials.FSGroup 16480 } 16481 16482 // GetSignalTargetParentFsuid returns the value of the field, resolving if necessary 16483 func (ev *Event) GetSignalTargetParentFsuid() uint32 { 16484 if ev.GetEventType().String() != "signal" { 16485 return uint32(0) 16486 } 16487 if ev.Signal.Target == nil { 16488 return uint32(0) 16489 } 16490 if ev.Signal.Target.Parent == nil { 16491 return uint32(0) 16492 } 16493 if !ev.Signal.Target.HasParent() { 16494 return uint32(0) 16495 } 16496 return ev.Signal.Target.Parent.Credentials.FSUID 16497 } 16498 16499 // GetSignalTargetParentFsuser returns the value of the field, resolving if necessary 16500 func (ev *Event) GetSignalTargetParentFsuser() string { 16501 if ev.GetEventType().String() != "signal" { 16502 return "" 16503 } 16504 if ev.Signal.Target == nil { 16505 return "" 16506 } 16507 if ev.Signal.Target.Parent == nil { 16508 return "" 16509 } 16510 if !ev.Signal.Target.HasParent() { 16511 return "" 16512 } 16513 return ev.Signal.Target.Parent.Credentials.FSUser 16514 } 16515 16516 // GetSignalTargetParentGid returns the value of the field, resolving if necessary 16517 func (ev *Event) GetSignalTargetParentGid() uint32 { 16518 if ev.GetEventType().String() != "signal" { 16519 return uint32(0) 16520 } 16521 if ev.Signal.Target == nil { 16522 return uint32(0) 16523 } 16524 if ev.Signal.Target.Parent == nil { 16525 return uint32(0) 16526 } 16527 if !ev.Signal.Target.HasParent() { 16528 return uint32(0) 16529 } 16530 return ev.Signal.Target.Parent.Credentials.GID 16531 } 16532 16533 // GetSignalTargetParentGroup returns the value of the field, resolving if necessary 16534 func (ev *Event) GetSignalTargetParentGroup() string { 16535 if ev.GetEventType().String() != "signal" { 16536 return "" 16537 } 16538 if ev.Signal.Target == nil { 16539 return "" 16540 } 16541 if ev.Signal.Target.Parent == nil { 16542 return "" 16543 } 16544 if !ev.Signal.Target.HasParent() { 16545 return "" 16546 } 16547 return ev.Signal.Target.Parent.Credentials.Group 16548 } 16549 16550 // GetSignalTargetParentInterpreterFileChangeTime returns the value of the field, resolving if necessary 16551 func (ev *Event) GetSignalTargetParentInterpreterFileChangeTime() uint64 { 16552 if ev.GetEventType().String() != "signal" { 16553 return uint64(0) 16554 } 16555 if ev.Signal.Target == nil { 16556 return uint64(0) 16557 } 16558 if ev.Signal.Target.Parent == nil { 16559 return uint64(0) 16560 } 16561 if !ev.Signal.Target.HasParent() { 16562 return uint64(0) 16563 } 16564 if !ev.Signal.Target.Parent.HasInterpreter() { 16565 return uint64(0) 16566 } 16567 return ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields.CTime 16568 } 16569 16570 // GetSignalTargetParentInterpreterFileFilesystem returns the value of the field, resolving if necessary 16571 func (ev *Event) GetSignalTargetParentInterpreterFileFilesystem() string { 16572 if ev.GetEventType().String() != "signal" { 16573 return "" 16574 } 16575 if ev.Signal.Target == nil { 16576 return "" 16577 } 16578 if ev.Signal.Target.Parent == nil { 16579 return "" 16580 } 16581 if !ev.Signal.Target.HasParent() { 16582 return "" 16583 } 16584 if !ev.Signal.Target.Parent.HasInterpreter() { 16585 return "" 16586 } 16587 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent) 16588 } 16589 16590 // GetSignalTargetParentInterpreterFileGid returns the value of the field, resolving if necessary 16591 func (ev *Event) GetSignalTargetParentInterpreterFileGid() uint32 { 16592 if ev.GetEventType().String() != "signal" { 16593 return uint32(0) 16594 } 16595 if ev.Signal.Target == nil { 16596 return uint32(0) 16597 } 16598 if ev.Signal.Target.Parent == nil { 16599 return uint32(0) 16600 } 16601 if !ev.Signal.Target.HasParent() { 16602 return uint32(0) 16603 } 16604 if !ev.Signal.Target.Parent.HasInterpreter() { 16605 return uint32(0) 16606 } 16607 return ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields.GID 16608 } 16609 16610 // GetSignalTargetParentInterpreterFileGroup returns the value of the field, resolving if necessary 16611 func (ev *Event) GetSignalTargetParentInterpreterFileGroup() string { 16612 if ev.GetEventType().String() != "signal" { 16613 return "" 16614 } 16615 if ev.Signal.Target == nil { 16616 return "" 16617 } 16618 if ev.Signal.Target.Parent == nil { 16619 return "" 16620 } 16621 if !ev.Signal.Target.HasParent() { 16622 return "" 16623 } 16624 if !ev.Signal.Target.Parent.HasInterpreter() { 16625 return "" 16626 } 16627 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields) 16628 } 16629 16630 // GetSignalTargetParentInterpreterFileHashes returns the value of the field, resolving if necessary 16631 func (ev *Event) GetSignalTargetParentInterpreterFileHashes() []string { 16632 if ev.GetEventType().String() != "signal" { 16633 return []string{} 16634 } 16635 if ev.Signal.Target == nil { 16636 return []string{} 16637 } 16638 if ev.Signal.Target.Parent == nil { 16639 return []string{} 16640 } 16641 if !ev.Signal.Target.HasParent() { 16642 return []string{} 16643 } 16644 if !ev.Signal.Target.Parent.HasInterpreter() { 16645 return []string{} 16646 } 16647 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent) 16648 } 16649 16650 // GetSignalTargetParentInterpreterFileInUpperLayer returns the value of the field, resolving if necessary 16651 func (ev *Event) GetSignalTargetParentInterpreterFileInUpperLayer() bool { 16652 if ev.GetEventType().String() != "signal" { 16653 return false 16654 } 16655 if ev.Signal.Target == nil { 16656 return false 16657 } 16658 if ev.Signal.Target.Parent == nil { 16659 return false 16660 } 16661 if !ev.Signal.Target.HasParent() { 16662 return false 16663 } 16664 if !ev.Signal.Target.Parent.HasInterpreter() { 16665 return false 16666 } 16667 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields) 16668 } 16669 16670 // GetSignalTargetParentInterpreterFileInode returns the value of the field, resolving if necessary 16671 func (ev *Event) GetSignalTargetParentInterpreterFileInode() uint64 { 16672 if ev.GetEventType().String() != "signal" { 16673 return uint64(0) 16674 } 16675 if ev.Signal.Target == nil { 16676 return uint64(0) 16677 } 16678 if ev.Signal.Target.Parent == nil { 16679 return uint64(0) 16680 } 16681 if !ev.Signal.Target.HasParent() { 16682 return uint64(0) 16683 } 16684 if !ev.Signal.Target.Parent.HasInterpreter() { 16685 return uint64(0) 16686 } 16687 return ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields.PathKey.Inode 16688 } 16689 16690 // GetSignalTargetParentInterpreterFileMode returns the value of the field, resolving if necessary 16691 func (ev *Event) GetSignalTargetParentInterpreterFileMode() uint16 { 16692 if ev.GetEventType().String() != "signal" { 16693 return uint16(0) 16694 } 16695 if ev.Signal.Target == nil { 16696 return uint16(0) 16697 } 16698 if ev.Signal.Target.Parent == nil { 16699 return uint16(0) 16700 } 16701 if !ev.Signal.Target.HasParent() { 16702 return uint16(0) 16703 } 16704 if !ev.Signal.Target.Parent.HasInterpreter() { 16705 return uint16(0) 16706 } 16707 return ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields.Mode 16708 } 16709 16710 // GetSignalTargetParentInterpreterFileModificationTime returns the value of the field, resolving if necessary 16711 func (ev *Event) GetSignalTargetParentInterpreterFileModificationTime() uint64 { 16712 if ev.GetEventType().String() != "signal" { 16713 return uint64(0) 16714 } 16715 if ev.Signal.Target == nil { 16716 return uint64(0) 16717 } 16718 if ev.Signal.Target.Parent == nil { 16719 return uint64(0) 16720 } 16721 if !ev.Signal.Target.HasParent() { 16722 return uint64(0) 16723 } 16724 if !ev.Signal.Target.Parent.HasInterpreter() { 16725 return uint64(0) 16726 } 16727 return ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields.MTime 16728 } 16729 16730 // GetSignalTargetParentInterpreterFileMountId returns the value of the field, resolving if necessary 16731 func (ev *Event) GetSignalTargetParentInterpreterFileMountId() uint32 { 16732 if ev.GetEventType().String() != "signal" { 16733 return uint32(0) 16734 } 16735 if ev.Signal.Target == nil { 16736 return uint32(0) 16737 } 16738 if ev.Signal.Target.Parent == nil { 16739 return uint32(0) 16740 } 16741 if !ev.Signal.Target.HasParent() { 16742 return uint32(0) 16743 } 16744 if !ev.Signal.Target.Parent.HasInterpreter() { 16745 return uint32(0) 16746 } 16747 return ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields.PathKey.MountID 16748 } 16749 16750 // GetSignalTargetParentInterpreterFileName returns the value of the field, resolving if necessary 16751 func (ev *Event) GetSignalTargetParentInterpreterFileName() string { 16752 if ev.GetEventType().String() != "signal" { 16753 return "" 16754 } 16755 if ev.Signal.Target == nil { 16756 return "" 16757 } 16758 if ev.Signal.Target.Parent == nil { 16759 return "" 16760 } 16761 if !ev.Signal.Target.HasParent() { 16762 return "" 16763 } 16764 if !ev.Signal.Target.Parent.HasInterpreter() { 16765 return "" 16766 } 16767 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent) 16768 } 16769 16770 // GetSignalTargetParentInterpreterFileNameLength returns the value of the field, resolving if necessary 16771 func (ev *Event) GetSignalTargetParentInterpreterFileNameLength() int { 16772 if ev.GetEventType().String() != "signal" { 16773 return 0 16774 } 16775 if ev.Signal.Target == nil { 16776 return 0 16777 } 16778 if ev.Signal.Target.Parent == nil { 16779 return 0 16780 } 16781 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent)) 16782 } 16783 16784 // GetSignalTargetParentInterpreterFilePackageName returns the value of the field, resolving if necessary 16785 func (ev *Event) GetSignalTargetParentInterpreterFilePackageName() string { 16786 if ev.GetEventType().String() != "signal" { 16787 return "" 16788 } 16789 if ev.Signal.Target == nil { 16790 return "" 16791 } 16792 if ev.Signal.Target.Parent == nil { 16793 return "" 16794 } 16795 if !ev.Signal.Target.HasParent() { 16796 return "" 16797 } 16798 if !ev.Signal.Target.Parent.HasInterpreter() { 16799 return "" 16800 } 16801 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent) 16802 } 16803 16804 // GetSignalTargetParentInterpreterFilePackageSourceVersion returns the value of the field, resolving if necessary 16805 func (ev *Event) GetSignalTargetParentInterpreterFilePackageSourceVersion() string { 16806 if ev.GetEventType().String() != "signal" { 16807 return "" 16808 } 16809 if ev.Signal.Target == nil { 16810 return "" 16811 } 16812 if ev.Signal.Target.Parent == nil { 16813 return "" 16814 } 16815 if !ev.Signal.Target.HasParent() { 16816 return "" 16817 } 16818 if !ev.Signal.Target.Parent.HasInterpreter() { 16819 return "" 16820 } 16821 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent) 16822 } 16823 16824 // GetSignalTargetParentInterpreterFilePackageVersion returns the value of the field, resolving if necessary 16825 func (ev *Event) GetSignalTargetParentInterpreterFilePackageVersion() string { 16826 if ev.GetEventType().String() != "signal" { 16827 return "" 16828 } 16829 if ev.Signal.Target == nil { 16830 return "" 16831 } 16832 if ev.Signal.Target.Parent == nil { 16833 return "" 16834 } 16835 if !ev.Signal.Target.HasParent() { 16836 return "" 16837 } 16838 if !ev.Signal.Target.Parent.HasInterpreter() { 16839 return "" 16840 } 16841 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent) 16842 } 16843 16844 // GetSignalTargetParentInterpreterFilePath returns the value of the field, resolving if necessary 16845 func (ev *Event) GetSignalTargetParentInterpreterFilePath() string { 16846 if ev.GetEventType().String() != "signal" { 16847 return "" 16848 } 16849 if ev.Signal.Target == nil { 16850 return "" 16851 } 16852 if ev.Signal.Target.Parent == nil { 16853 return "" 16854 } 16855 if !ev.Signal.Target.HasParent() { 16856 return "" 16857 } 16858 if !ev.Signal.Target.Parent.HasInterpreter() { 16859 return "" 16860 } 16861 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent) 16862 } 16863 16864 // GetSignalTargetParentInterpreterFilePathLength returns the value of the field, resolving if necessary 16865 func (ev *Event) GetSignalTargetParentInterpreterFilePathLength() int { 16866 if ev.GetEventType().String() != "signal" { 16867 return 0 16868 } 16869 if ev.Signal.Target == nil { 16870 return 0 16871 } 16872 if ev.Signal.Target.Parent == nil { 16873 return 0 16874 } 16875 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent)) 16876 } 16877 16878 // GetSignalTargetParentInterpreterFileRights returns the value of the field, resolving if necessary 16879 func (ev *Event) GetSignalTargetParentInterpreterFileRights() int { 16880 if ev.GetEventType().String() != "signal" { 16881 return 0 16882 } 16883 if ev.Signal.Target == nil { 16884 return 0 16885 } 16886 if ev.Signal.Target.Parent == nil { 16887 return 0 16888 } 16889 if !ev.Signal.Target.HasParent() { 16890 return 0 16891 } 16892 if !ev.Signal.Target.Parent.HasInterpreter() { 16893 return 0 16894 } 16895 return ev.FieldHandlers.ResolveRights(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields) 16896 } 16897 16898 // GetSignalTargetParentInterpreterFileUid returns the value of the field, resolving if necessary 16899 func (ev *Event) GetSignalTargetParentInterpreterFileUid() uint32 { 16900 if ev.GetEventType().String() != "signal" { 16901 return uint32(0) 16902 } 16903 if ev.Signal.Target == nil { 16904 return uint32(0) 16905 } 16906 if ev.Signal.Target.Parent == nil { 16907 return uint32(0) 16908 } 16909 if !ev.Signal.Target.HasParent() { 16910 return uint32(0) 16911 } 16912 if !ev.Signal.Target.Parent.HasInterpreter() { 16913 return uint32(0) 16914 } 16915 return ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields.UID 16916 } 16917 16918 // GetSignalTargetParentInterpreterFileUser returns the value of the field, resolving if necessary 16919 func (ev *Event) GetSignalTargetParentInterpreterFileUser() string { 16920 if ev.GetEventType().String() != "signal" { 16921 return "" 16922 } 16923 if ev.Signal.Target == nil { 16924 return "" 16925 } 16926 if ev.Signal.Target.Parent == nil { 16927 return "" 16928 } 16929 if !ev.Signal.Target.HasParent() { 16930 return "" 16931 } 16932 if !ev.Signal.Target.Parent.HasInterpreter() { 16933 return "" 16934 } 16935 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Signal.Target.Parent.LinuxBinprm.FileEvent.FileFields) 16936 } 16937 16938 // GetSignalTargetParentIsKworker returns the value of the field, resolving if necessary 16939 func (ev *Event) GetSignalTargetParentIsKworker() bool { 16940 if ev.GetEventType().String() != "signal" { 16941 return false 16942 } 16943 if ev.Signal.Target == nil { 16944 return false 16945 } 16946 if ev.Signal.Target.Parent == nil { 16947 return false 16948 } 16949 if !ev.Signal.Target.HasParent() { 16950 return false 16951 } 16952 return ev.Signal.Target.Parent.PIDContext.IsKworker 16953 } 16954 16955 // GetSignalTargetParentIsThread returns the value of the field, resolving if necessary 16956 func (ev *Event) GetSignalTargetParentIsThread() bool { 16957 if ev.GetEventType().String() != "signal" { 16958 return false 16959 } 16960 if ev.Signal.Target == nil { 16961 return false 16962 } 16963 if ev.Signal.Target.Parent == nil { 16964 return false 16965 } 16966 if !ev.Signal.Target.HasParent() { 16967 return false 16968 } 16969 return ev.Signal.Target.Parent.IsThread 16970 } 16971 16972 // GetSignalTargetParentPid returns the value of the field, resolving if necessary 16973 func (ev *Event) GetSignalTargetParentPid() uint32 { 16974 if ev.GetEventType().String() != "signal" { 16975 return uint32(0) 16976 } 16977 if ev.Signal.Target == nil { 16978 return uint32(0) 16979 } 16980 if ev.Signal.Target.Parent == nil { 16981 return uint32(0) 16982 } 16983 if !ev.Signal.Target.HasParent() { 16984 return uint32(0) 16985 } 16986 return ev.Signal.Target.Parent.PIDContext.Pid 16987 } 16988 16989 // GetSignalTargetParentPpid returns the value of the field, resolving if necessary 16990 func (ev *Event) GetSignalTargetParentPpid() uint32 { 16991 if ev.GetEventType().String() != "signal" { 16992 return uint32(0) 16993 } 16994 if ev.Signal.Target == nil { 16995 return uint32(0) 16996 } 16997 if ev.Signal.Target.Parent == nil { 16998 return uint32(0) 16999 } 17000 if !ev.Signal.Target.HasParent() { 17001 return uint32(0) 17002 } 17003 return ev.Signal.Target.Parent.PPid 17004 } 17005 17006 // GetSignalTargetParentTid returns the value of the field, resolving if necessary 17007 func (ev *Event) GetSignalTargetParentTid() uint32 { 17008 if ev.GetEventType().String() != "signal" { 17009 return uint32(0) 17010 } 17011 if ev.Signal.Target == nil { 17012 return uint32(0) 17013 } 17014 if ev.Signal.Target.Parent == nil { 17015 return uint32(0) 17016 } 17017 if !ev.Signal.Target.HasParent() { 17018 return uint32(0) 17019 } 17020 return ev.Signal.Target.Parent.PIDContext.Tid 17021 } 17022 17023 // GetSignalTargetParentTtyName returns the value of the field, resolving if necessary 17024 func (ev *Event) GetSignalTargetParentTtyName() string { 17025 if ev.GetEventType().String() != "signal" { 17026 return "" 17027 } 17028 if ev.Signal.Target == nil { 17029 return "" 17030 } 17031 if ev.Signal.Target.Parent == nil { 17032 return "" 17033 } 17034 if !ev.Signal.Target.HasParent() { 17035 return "" 17036 } 17037 return ev.Signal.Target.Parent.TTYName 17038 } 17039 17040 // GetSignalTargetParentUid returns the value of the field, resolving if necessary 17041 func (ev *Event) GetSignalTargetParentUid() uint32 { 17042 if ev.GetEventType().String() != "signal" { 17043 return uint32(0) 17044 } 17045 if ev.Signal.Target == nil { 17046 return uint32(0) 17047 } 17048 if ev.Signal.Target.Parent == nil { 17049 return uint32(0) 17050 } 17051 if !ev.Signal.Target.HasParent() { 17052 return uint32(0) 17053 } 17054 return ev.Signal.Target.Parent.Credentials.UID 17055 } 17056 17057 // GetSignalTargetParentUser returns the value of the field, resolving if necessary 17058 func (ev *Event) GetSignalTargetParentUser() string { 17059 if ev.GetEventType().String() != "signal" { 17060 return "" 17061 } 17062 if ev.Signal.Target == nil { 17063 return "" 17064 } 17065 if ev.Signal.Target.Parent == nil { 17066 return "" 17067 } 17068 if !ev.Signal.Target.HasParent() { 17069 return "" 17070 } 17071 return ev.Signal.Target.Parent.Credentials.User 17072 } 17073 17074 // GetSignalTargetParentUserSessionK8sGroups returns the value of the field, resolving if necessary 17075 func (ev *Event) GetSignalTargetParentUserSessionK8sGroups() []string { 17076 if ev.GetEventType().String() != "signal" { 17077 return []string{} 17078 } 17079 if ev.Signal.Target == nil { 17080 return []string{} 17081 } 17082 if ev.Signal.Target.Parent == nil { 17083 return []string{} 17084 } 17085 if !ev.Signal.Target.HasParent() { 17086 return []string{} 17087 } 17088 return ev.FieldHandlers.ResolveK8SGroups(ev, &ev.Signal.Target.Parent.UserSession) 17089 } 17090 17091 // GetSignalTargetParentUserSessionK8sUid returns the value of the field, resolving if necessary 17092 func (ev *Event) GetSignalTargetParentUserSessionK8sUid() string { 17093 if ev.GetEventType().String() != "signal" { 17094 return "" 17095 } 17096 if ev.Signal.Target == nil { 17097 return "" 17098 } 17099 if ev.Signal.Target.Parent == nil { 17100 return "" 17101 } 17102 if !ev.Signal.Target.HasParent() { 17103 return "" 17104 } 17105 return ev.FieldHandlers.ResolveK8SUID(ev, &ev.Signal.Target.Parent.UserSession) 17106 } 17107 17108 // GetSignalTargetParentUserSessionK8sUsername returns the value of the field, resolving if necessary 17109 func (ev *Event) GetSignalTargetParentUserSessionK8sUsername() string { 17110 if ev.GetEventType().String() != "signal" { 17111 return "" 17112 } 17113 if ev.Signal.Target == nil { 17114 return "" 17115 } 17116 if ev.Signal.Target.Parent == nil { 17117 return "" 17118 } 17119 if !ev.Signal.Target.HasParent() { 17120 return "" 17121 } 17122 return ev.FieldHandlers.ResolveK8SUsername(ev, &ev.Signal.Target.Parent.UserSession) 17123 } 17124 17125 // GetSignalTargetPid returns the value of the field, resolving if necessary 17126 func (ev *Event) GetSignalTargetPid() uint32 { 17127 if ev.GetEventType().String() != "signal" { 17128 return uint32(0) 17129 } 17130 if ev.Signal.Target == nil { 17131 return uint32(0) 17132 } 17133 return ev.Signal.Target.Process.PIDContext.Pid 17134 } 17135 17136 // GetSignalTargetPpid returns the value of the field, resolving if necessary 17137 func (ev *Event) GetSignalTargetPpid() uint32 { 17138 if ev.GetEventType().String() != "signal" { 17139 return uint32(0) 17140 } 17141 if ev.Signal.Target == nil { 17142 return uint32(0) 17143 } 17144 return ev.Signal.Target.Process.PPid 17145 } 17146 17147 // GetSignalTargetTid returns the value of the field, resolving if necessary 17148 func (ev *Event) GetSignalTargetTid() uint32 { 17149 if ev.GetEventType().String() != "signal" { 17150 return uint32(0) 17151 } 17152 if ev.Signal.Target == nil { 17153 return uint32(0) 17154 } 17155 return ev.Signal.Target.Process.PIDContext.Tid 17156 } 17157 17158 // GetSignalTargetTtyName returns the value of the field, resolving if necessary 17159 func (ev *Event) GetSignalTargetTtyName() string { 17160 if ev.GetEventType().String() != "signal" { 17161 return "" 17162 } 17163 if ev.Signal.Target == nil { 17164 return "" 17165 } 17166 return ev.Signal.Target.Process.TTYName 17167 } 17168 17169 // GetSignalTargetUid returns the value of the field, resolving if necessary 17170 func (ev *Event) GetSignalTargetUid() uint32 { 17171 if ev.GetEventType().String() != "signal" { 17172 return uint32(0) 17173 } 17174 if ev.Signal.Target == nil { 17175 return uint32(0) 17176 } 17177 return ev.Signal.Target.Process.Credentials.UID 17178 } 17179 17180 // GetSignalTargetUser returns the value of the field, resolving if necessary 17181 func (ev *Event) GetSignalTargetUser() string { 17182 if ev.GetEventType().String() != "signal" { 17183 return "" 17184 } 17185 if ev.Signal.Target == nil { 17186 return "" 17187 } 17188 return ev.Signal.Target.Process.Credentials.User 17189 } 17190 17191 // GetSignalTargetUserSessionK8sGroups returns the value of the field, resolving if necessary 17192 func (ev *Event) GetSignalTargetUserSessionK8sGroups() []string { 17193 if ev.GetEventType().String() != "signal" { 17194 return []string{} 17195 } 17196 if ev.Signal.Target == nil { 17197 return []string{} 17198 } 17199 return ev.FieldHandlers.ResolveK8SGroups(ev, &ev.Signal.Target.Process.UserSession) 17200 } 17201 17202 // GetSignalTargetUserSessionK8sUid returns the value of the field, resolving if necessary 17203 func (ev *Event) GetSignalTargetUserSessionK8sUid() string { 17204 if ev.GetEventType().String() != "signal" { 17205 return "" 17206 } 17207 if ev.Signal.Target == nil { 17208 return "" 17209 } 17210 return ev.FieldHandlers.ResolveK8SUID(ev, &ev.Signal.Target.Process.UserSession) 17211 } 17212 17213 // GetSignalTargetUserSessionK8sUsername returns the value of the field, resolving if necessary 17214 func (ev *Event) GetSignalTargetUserSessionK8sUsername() string { 17215 if ev.GetEventType().String() != "signal" { 17216 return "" 17217 } 17218 if ev.Signal.Target == nil { 17219 return "" 17220 } 17221 return ev.FieldHandlers.ResolveK8SUsername(ev, &ev.Signal.Target.Process.UserSession) 17222 } 17223 17224 // GetSignalType returns the value of the field, resolving if necessary 17225 func (ev *Event) GetSignalType() uint32 { 17226 if ev.GetEventType().String() != "signal" { 17227 return uint32(0) 17228 } 17229 return ev.Signal.Type 17230 } 17231 17232 // GetSpliceFileChangeTime returns the value of the field, resolving if necessary 17233 func (ev *Event) GetSpliceFileChangeTime() uint64 { 17234 if ev.GetEventType().String() != "splice" { 17235 return uint64(0) 17236 } 17237 return ev.Splice.File.FileFields.CTime 17238 } 17239 17240 // GetSpliceFileFilesystem returns the value of the field, resolving if necessary 17241 func (ev *Event) GetSpliceFileFilesystem() string { 17242 if ev.GetEventType().String() != "splice" { 17243 return "" 17244 } 17245 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Splice.File) 17246 } 17247 17248 // GetSpliceFileGid returns the value of the field, resolving if necessary 17249 func (ev *Event) GetSpliceFileGid() uint32 { 17250 if ev.GetEventType().String() != "splice" { 17251 return uint32(0) 17252 } 17253 return ev.Splice.File.FileFields.GID 17254 } 17255 17256 // GetSpliceFileGroup returns the value of the field, resolving if necessary 17257 func (ev *Event) GetSpliceFileGroup() string { 17258 if ev.GetEventType().String() != "splice" { 17259 return "" 17260 } 17261 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Splice.File.FileFields) 17262 } 17263 17264 // GetSpliceFileHashes returns the value of the field, resolving if necessary 17265 func (ev *Event) GetSpliceFileHashes() []string { 17266 if ev.GetEventType().String() != "splice" { 17267 return []string{} 17268 } 17269 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Splice.File) 17270 } 17271 17272 // GetSpliceFileInUpperLayer returns the value of the field, resolving if necessary 17273 func (ev *Event) GetSpliceFileInUpperLayer() bool { 17274 if ev.GetEventType().String() != "splice" { 17275 return false 17276 } 17277 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Splice.File.FileFields) 17278 } 17279 17280 // GetSpliceFileInode returns the value of the field, resolving if necessary 17281 func (ev *Event) GetSpliceFileInode() uint64 { 17282 if ev.GetEventType().String() != "splice" { 17283 return uint64(0) 17284 } 17285 return ev.Splice.File.FileFields.PathKey.Inode 17286 } 17287 17288 // GetSpliceFileMode returns the value of the field, resolving if necessary 17289 func (ev *Event) GetSpliceFileMode() uint16 { 17290 if ev.GetEventType().String() != "splice" { 17291 return uint16(0) 17292 } 17293 return ev.Splice.File.FileFields.Mode 17294 } 17295 17296 // GetSpliceFileModificationTime returns the value of the field, resolving if necessary 17297 func (ev *Event) GetSpliceFileModificationTime() uint64 { 17298 if ev.GetEventType().String() != "splice" { 17299 return uint64(0) 17300 } 17301 return ev.Splice.File.FileFields.MTime 17302 } 17303 17304 // GetSpliceFileMountId returns the value of the field, resolving if necessary 17305 func (ev *Event) GetSpliceFileMountId() uint32 { 17306 if ev.GetEventType().String() != "splice" { 17307 return uint32(0) 17308 } 17309 return ev.Splice.File.FileFields.PathKey.MountID 17310 } 17311 17312 // GetSpliceFileName returns the value of the field, resolving if necessary 17313 func (ev *Event) GetSpliceFileName() string { 17314 if ev.GetEventType().String() != "splice" { 17315 return "" 17316 } 17317 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Splice.File) 17318 } 17319 17320 // GetSpliceFileNameLength returns the value of the field, resolving if necessary 17321 func (ev *Event) GetSpliceFileNameLength() int { 17322 if ev.GetEventType().String() != "splice" { 17323 return 0 17324 } 17325 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Splice.File)) 17326 } 17327 17328 // GetSpliceFilePackageName returns the value of the field, resolving if necessary 17329 func (ev *Event) GetSpliceFilePackageName() string { 17330 if ev.GetEventType().String() != "splice" { 17331 return "" 17332 } 17333 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Splice.File) 17334 } 17335 17336 // GetSpliceFilePackageSourceVersion returns the value of the field, resolving if necessary 17337 func (ev *Event) GetSpliceFilePackageSourceVersion() string { 17338 if ev.GetEventType().String() != "splice" { 17339 return "" 17340 } 17341 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Splice.File) 17342 } 17343 17344 // GetSpliceFilePackageVersion returns the value of the field, resolving if necessary 17345 func (ev *Event) GetSpliceFilePackageVersion() string { 17346 if ev.GetEventType().String() != "splice" { 17347 return "" 17348 } 17349 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Splice.File) 17350 } 17351 17352 // GetSpliceFilePath returns the value of the field, resolving if necessary 17353 func (ev *Event) GetSpliceFilePath() string { 17354 if ev.GetEventType().String() != "splice" { 17355 return "" 17356 } 17357 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Splice.File) 17358 } 17359 17360 // GetSpliceFilePathLength returns the value of the field, resolving if necessary 17361 func (ev *Event) GetSpliceFilePathLength() int { 17362 if ev.GetEventType().String() != "splice" { 17363 return 0 17364 } 17365 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Splice.File)) 17366 } 17367 17368 // GetSpliceFileRights returns the value of the field, resolving if necessary 17369 func (ev *Event) GetSpliceFileRights() int { 17370 if ev.GetEventType().String() != "splice" { 17371 return 0 17372 } 17373 return ev.FieldHandlers.ResolveRights(ev, &ev.Splice.File.FileFields) 17374 } 17375 17376 // GetSpliceFileUid returns the value of the field, resolving if necessary 17377 func (ev *Event) GetSpliceFileUid() uint32 { 17378 if ev.GetEventType().String() != "splice" { 17379 return uint32(0) 17380 } 17381 return ev.Splice.File.FileFields.UID 17382 } 17383 17384 // GetSpliceFileUser returns the value of the field, resolving if necessary 17385 func (ev *Event) GetSpliceFileUser() string { 17386 if ev.GetEventType().String() != "splice" { 17387 return "" 17388 } 17389 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Splice.File.FileFields) 17390 } 17391 17392 // GetSplicePipeEntryFlag returns the value of the field, resolving if necessary 17393 func (ev *Event) GetSplicePipeEntryFlag() uint32 { 17394 if ev.GetEventType().String() != "splice" { 17395 return uint32(0) 17396 } 17397 return ev.Splice.PipeEntryFlag 17398 } 17399 17400 // GetSplicePipeExitFlag returns the value of the field, resolving if necessary 17401 func (ev *Event) GetSplicePipeExitFlag() uint32 { 17402 if ev.GetEventType().String() != "splice" { 17403 return uint32(0) 17404 } 17405 return ev.Splice.PipeExitFlag 17406 } 17407 17408 // GetSpliceRetval returns the value of the field, resolving if necessary 17409 func (ev *Event) GetSpliceRetval() int64 { 17410 if ev.GetEventType().String() != "splice" { 17411 return int64(0) 17412 } 17413 return ev.Splice.SyscallEvent.Retval 17414 } 17415 17416 // GetTimestamp returns the value of the field, resolving if necessary 17417 func (ev *Event) GetTimestamp() time.Time { 17418 return ev.FieldHandlers.ResolveEventTime(ev, &ev.BaseEvent) 17419 } 17420 17421 // GetUnlinkFileChangeTime returns the value of the field, resolving if necessary 17422 func (ev *Event) GetUnlinkFileChangeTime() uint64 { 17423 if ev.GetEventType().String() != "unlink" { 17424 return uint64(0) 17425 } 17426 return ev.Unlink.File.FileFields.CTime 17427 } 17428 17429 // GetUnlinkFileFilesystem returns the value of the field, resolving if necessary 17430 func (ev *Event) GetUnlinkFileFilesystem() string { 17431 if ev.GetEventType().String() != "unlink" { 17432 return "" 17433 } 17434 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Unlink.File) 17435 } 17436 17437 // GetUnlinkFileGid returns the value of the field, resolving if necessary 17438 func (ev *Event) GetUnlinkFileGid() uint32 { 17439 if ev.GetEventType().String() != "unlink" { 17440 return uint32(0) 17441 } 17442 return ev.Unlink.File.FileFields.GID 17443 } 17444 17445 // GetUnlinkFileGroup returns the value of the field, resolving if necessary 17446 func (ev *Event) GetUnlinkFileGroup() string { 17447 if ev.GetEventType().String() != "unlink" { 17448 return "" 17449 } 17450 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Unlink.File.FileFields) 17451 } 17452 17453 // GetUnlinkFileHashes returns the value of the field, resolving if necessary 17454 func (ev *Event) GetUnlinkFileHashes() []string { 17455 if ev.GetEventType().String() != "unlink" { 17456 return []string{} 17457 } 17458 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Unlink.File) 17459 } 17460 17461 // GetUnlinkFileInUpperLayer returns the value of the field, resolving if necessary 17462 func (ev *Event) GetUnlinkFileInUpperLayer() bool { 17463 if ev.GetEventType().String() != "unlink" { 17464 return false 17465 } 17466 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Unlink.File.FileFields) 17467 } 17468 17469 // GetUnlinkFileInode returns the value of the field, resolving if necessary 17470 func (ev *Event) GetUnlinkFileInode() uint64 { 17471 if ev.GetEventType().String() != "unlink" { 17472 return uint64(0) 17473 } 17474 return ev.Unlink.File.FileFields.PathKey.Inode 17475 } 17476 17477 // GetUnlinkFileMode returns the value of the field, resolving if necessary 17478 func (ev *Event) GetUnlinkFileMode() uint16 { 17479 if ev.GetEventType().String() != "unlink" { 17480 return uint16(0) 17481 } 17482 return ev.Unlink.File.FileFields.Mode 17483 } 17484 17485 // GetUnlinkFileModificationTime returns the value of the field, resolving if necessary 17486 func (ev *Event) GetUnlinkFileModificationTime() uint64 { 17487 if ev.GetEventType().String() != "unlink" { 17488 return uint64(0) 17489 } 17490 return ev.Unlink.File.FileFields.MTime 17491 } 17492 17493 // GetUnlinkFileMountId returns the value of the field, resolving if necessary 17494 func (ev *Event) GetUnlinkFileMountId() uint32 { 17495 if ev.GetEventType().String() != "unlink" { 17496 return uint32(0) 17497 } 17498 return ev.Unlink.File.FileFields.PathKey.MountID 17499 } 17500 17501 // GetUnlinkFileName returns the value of the field, resolving if necessary 17502 func (ev *Event) GetUnlinkFileName() string { 17503 if ev.GetEventType().String() != "unlink" { 17504 return "" 17505 } 17506 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Unlink.File) 17507 } 17508 17509 // GetUnlinkFileNameLength returns the value of the field, resolving if necessary 17510 func (ev *Event) GetUnlinkFileNameLength() int { 17511 if ev.GetEventType().String() != "unlink" { 17512 return 0 17513 } 17514 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Unlink.File)) 17515 } 17516 17517 // GetUnlinkFilePackageName returns the value of the field, resolving if necessary 17518 func (ev *Event) GetUnlinkFilePackageName() string { 17519 if ev.GetEventType().String() != "unlink" { 17520 return "" 17521 } 17522 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Unlink.File) 17523 } 17524 17525 // GetUnlinkFilePackageSourceVersion returns the value of the field, resolving if necessary 17526 func (ev *Event) GetUnlinkFilePackageSourceVersion() string { 17527 if ev.GetEventType().String() != "unlink" { 17528 return "" 17529 } 17530 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Unlink.File) 17531 } 17532 17533 // GetUnlinkFilePackageVersion returns the value of the field, resolving if necessary 17534 func (ev *Event) GetUnlinkFilePackageVersion() string { 17535 if ev.GetEventType().String() != "unlink" { 17536 return "" 17537 } 17538 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Unlink.File) 17539 } 17540 17541 // GetUnlinkFilePath returns the value of the field, resolving if necessary 17542 func (ev *Event) GetUnlinkFilePath() string { 17543 if ev.GetEventType().String() != "unlink" { 17544 return "" 17545 } 17546 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Unlink.File) 17547 } 17548 17549 // GetUnlinkFilePathLength returns the value of the field, resolving if necessary 17550 func (ev *Event) GetUnlinkFilePathLength() int { 17551 if ev.GetEventType().String() != "unlink" { 17552 return 0 17553 } 17554 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Unlink.File)) 17555 } 17556 17557 // GetUnlinkFileRights returns the value of the field, resolving if necessary 17558 func (ev *Event) GetUnlinkFileRights() int { 17559 if ev.GetEventType().String() != "unlink" { 17560 return 0 17561 } 17562 return ev.FieldHandlers.ResolveRights(ev, &ev.Unlink.File.FileFields) 17563 } 17564 17565 // GetUnlinkFileUid returns the value of the field, resolving if necessary 17566 func (ev *Event) GetUnlinkFileUid() uint32 { 17567 if ev.GetEventType().String() != "unlink" { 17568 return uint32(0) 17569 } 17570 return ev.Unlink.File.FileFields.UID 17571 } 17572 17573 // GetUnlinkFileUser returns the value of the field, resolving if necessary 17574 func (ev *Event) GetUnlinkFileUser() string { 17575 if ev.GetEventType().String() != "unlink" { 17576 return "" 17577 } 17578 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Unlink.File.FileFields) 17579 } 17580 17581 // GetUnlinkFlags returns the value of the field, resolving if necessary 17582 func (ev *Event) GetUnlinkFlags() uint32 { 17583 if ev.GetEventType().String() != "unlink" { 17584 return uint32(0) 17585 } 17586 return ev.Unlink.Flags 17587 } 17588 17589 // GetUnlinkRetval returns the value of the field, resolving if necessary 17590 func (ev *Event) GetUnlinkRetval() int64 { 17591 if ev.GetEventType().String() != "unlink" { 17592 return int64(0) 17593 } 17594 return ev.Unlink.SyscallEvent.Retval 17595 } 17596 17597 // GetUnloadModuleName returns the value of the field, resolving if necessary 17598 func (ev *Event) GetUnloadModuleName() string { 17599 if ev.GetEventType().String() != "unload_module" { 17600 return "" 17601 } 17602 return ev.UnloadModule.Name 17603 } 17604 17605 // GetUnloadModuleRetval returns the value of the field, resolving if necessary 17606 func (ev *Event) GetUnloadModuleRetval() int64 { 17607 if ev.GetEventType().String() != "unload_module" { 17608 return int64(0) 17609 } 17610 return ev.UnloadModule.SyscallEvent.Retval 17611 } 17612 17613 // GetUtimesFileChangeTime returns the value of the field, resolving if necessary 17614 func (ev *Event) GetUtimesFileChangeTime() uint64 { 17615 if ev.GetEventType().String() != "utimes" { 17616 return uint64(0) 17617 } 17618 return ev.Utimes.File.FileFields.CTime 17619 } 17620 17621 // GetUtimesFileFilesystem returns the value of the field, resolving if necessary 17622 func (ev *Event) GetUtimesFileFilesystem() string { 17623 if ev.GetEventType().String() != "utimes" { 17624 return "" 17625 } 17626 return ev.FieldHandlers.ResolveFileFilesystem(ev, &ev.Utimes.File) 17627 } 17628 17629 // GetUtimesFileGid returns the value of the field, resolving if necessary 17630 func (ev *Event) GetUtimesFileGid() uint32 { 17631 if ev.GetEventType().String() != "utimes" { 17632 return uint32(0) 17633 } 17634 return ev.Utimes.File.FileFields.GID 17635 } 17636 17637 // GetUtimesFileGroup returns the value of the field, resolving if necessary 17638 func (ev *Event) GetUtimesFileGroup() string { 17639 if ev.GetEventType().String() != "utimes" { 17640 return "" 17641 } 17642 return ev.FieldHandlers.ResolveFileFieldsGroup(ev, &ev.Utimes.File.FileFields) 17643 } 17644 17645 // GetUtimesFileHashes returns the value of the field, resolving if necessary 17646 func (ev *Event) GetUtimesFileHashes() []string { 17647 if ev.GetEventType().String() != "utimes" { 17648 return []string{} 17649 } 17650 return ev.FieldHandlers.ResolveHashesFromEvent(ev, &ev.Utimes.File) 17651 } 17652 17653 // GetUtimesFileInUpperLayer returns the value of the field, resolving if necessary 17654 func (ev *Event) GetUtimesFileInUpperLayer() bool { 17655 if ev.GetEventType().String() != "utimes" { 17656 return false 17657 } 17658 return ev.FieldHandlers.ResolveFileFieldsInUpperLayer(ev, &ev.Utimes.File.FileFields) 17659 } 17660 17661 // GetUtimesFileInode returns the value of the field, resolving if necessary 17662 func (ev *Event) GetUtimesFileInode() uint64 { 17663 if ev.GetEventType().String() != "utimes" { 17664 return uint64(0) 17665 } 17666 return ev.Utimes.File.FileFields.PathKey.Inode 17667 } 17668 17669 // GetUtimesFileMode returns the value of the field, resolving if necessary 17670 func (ev *Event) GetUtimesFileMode() uint16 { 17671 if ev.GetEventType().String() != "utimes" { 17672 return uint16(0) 17673 } 17674 return ev.Utimes.File.FileFields.Mode 17675 } 17676 17677 // GetUtimesFileModificationTime returns the value of the field, resolving if necessary 17678 func (ev *Event) GetUtimesFileModificationTime() uint64 { 17679 if ev.GetEventType().String() != "utimes" { 17680 return uint64(0) 17681 } 17682 return ev.Utimes.File.FileFields.MTime 17683 } 17684 17685 // GetUtimesFileMountId returns the value of the field, resolving if necessary 17686 func (ev *Event) GetUtimesFileMountId() uint32 { 17687 if ev.GetEventType().String() != "utimes" { 17688 return uint32(0) 17689 } 17690 return ev.Utimes.File.FileFields.PathKey.MountID 17691 } 17692 17693 // GetUtimesFileName returns the value of the field, resolving if necessary 17694 func (ev *Event) GetUtimesFileName() string { 17695 if ev.GetEventType().String() != "utimes" { 17696 return "" 17697 } 17698 return ev.FieldHandlers.ResolveFileBasename(ev, &ev.Utimes.File) 17699 } 17700 17701 // GetUtimesFileNameLength returns the value of the field, resolving if necessary 17702 func (ev *Event) GetUtimesFileNameLength() int { 17703 if ev.GetEventType().String() != "utimes" { 17704 return 0 17705 } 17706 return len(ev.FieldHandlers.ResolveFileBasename(ev, &ev.Utimes.File)) 17707 } 17708 17709 // GetUtimesFilePackageName returns the value of the field, resolving if necessary 17710 func (ev *Event) GetUtimesFilePackageName() string { 17711 if ev.GetEventType().String() != "utimes" { 17712 return "" 17713 } 17714 return ev.FieldHandlers.ResolvePackageName(ev, &ev.Utimes.File) 17715 } 17716 17717 // GetUtimesFilePackageSourceVersion returns the value of the field, resolving if necessary 17718 func (ev *Event) GetUtimesFilePackageSourceVersion() string { 17719 if ev.GetEventType().String() != "utimes" { 17720 return "" 17721 } 17722 return ev.FieldHandlers.ResolvePackageSourceVersion(ev, &ev.Utimes.File) 17723 } 17724 17725 // GetUtimesFilePackageVersion returns the value of the field, resolving if necessary 17726 func (ev *Event) GetUtimesFilePackageVersion() string { 17727 if ev.GetEventType().String() != "utimes" { 17728 return "" 17729 } 17730 return ev.FieldHandlers.ResolvePackageVersion(ev, &ev.Utimes.File) 17731 } 17732 17733 // GetUtimesFilePath returns the value of the field, resolving if necessary 17734 func (ev *Event) GetUtimesFilePath() string { 17735 if ev.GetEventType().String() != "utimes" { 17736 return "" 17737 } 17738 return ev.FieldHandlers.ResolveFilePath(ev, &ev.Utimes.File) 17739 } 17740 17741 // GetUtimesFilePathLength returns the value of the field, resolving if necessary 17742 func (ev *Event) GetUtimesFilePathLength() int { 17743 if ev.GetEventType().String() != "utimes" { 17744 return 0 17745 } 17746 return len(ev.FieldHandlers.ResolveFilePath(ev, &ev.Utimes.File)) 17747 } 17748 17749 // GetUtimesFileRights returns the value of the field, resolving if necessary 17750 func (ev *Event) GetUtimesFileRights() int { 17751 if ev.GetEventType().String() != "utimes" { 17752 return 0 17753 } 17754 return ev.FieldHandlers.ResolveRights(ev, &ev.Utimes.File.FileFields) 17755 } 17756 17757 // GetUtimesFileUid returns the value of the field, resolving if necessary 17758 func (ev *Event) GetUtimesFileUid() uint32 { 17759 if ev.GetEventType().String() != "utimes" { 17760 return uint32(0) 17761 } 17762 return ev.Utimes.File.FileFields.UID 17763 } 17764 17765 // GetUtimesFileUser returns the value of the field, resolving if necessary 17766 func (ev *Event) GetUtimesFileUser() string { 17767 if ev.GetEventType().String() != "utimes" { 17768 return "" 17769 } 17770 return ev.FieldHandlers.ResolveFileFieldsUser(ev, &ev.Utimes.File.FileFields) 17771 } 17772 17773 // GetUtimesRetval returns the value of the field, resolving if necessary 17774 func (ev *Event) GetUtimesRetval() int64 { 17775 if ev.GetEventType().String() != "utimes" { 17776 return int64(0) 17777 } 17778 return ev.Utimes.SyscallEvent.Retval 17779 }