Add missing fields in PRESET alerts #2303
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Purpose of PR?:
Fixes #2302
{ "Timestamp": 1765272001, "UpdatedTime": "2025-12-09T09:20:01.450811Z", "ClusterName": "default", "HostName": "aryan", "NamespaceName": "presets", "Owner": { "Ref": "Deployment", "Name": "fileless", "Namespace": "presets" }, "PodName": "fileless-867bc8c769-g7mr5", "Labels": "app=fileless", "ContainerID": "af796c9c6d48dba28a5190336fcbea6c16b05904ec86af2175c463662b97a72a", "ContainerName": "fileless", "ContainerImage": "docker.io/kubearmor/ubuntu-w-utils:0.2@sha256:3e51e92a839b5e8f0dba01e08ec21fa2c1afe85111544a45aba29708c52de44f", "HostPPID": 3494068, "HostPID": 3625937, "PPID": 3494068, "PID": 110, "UID": 0, "ParentProcessName": "/usr/bin/dash", "ProcessName": "/proc/self/fd/3", "PolicyName": "ksp-preset-block-fileless", "Severity": "8", "Tags": "MITRE,VDSFKR", "ATags": [ "MITRE", "VDSFKR" ], "Message": "Fileless execution is blocked", "Type": "MatchedPolicy", "Source": "/proc/self/fd/3", "Operation": "Process", "Resource": "memfd:", "Enforcer": "PRESET-FilelessExecutionPreset", "Action": "Block", "Result": "Permission denied", "Cwd": "/", "TTY": "pts0", "ExecEvent": { "ExecID": "15573283688141239", "ExecutableName": "python3" }, "KubeArmorVersion": "v1.6.5-6-g01320956-dirty", "NodeID": "efc78266a44e507e428f499e4b92f75d2762926c45050a2ff15b16d834dd415f" }Does this PR introduce a breaking change?
If the changes in this PR are manually verified, list down the scenarios covered::
Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs
Checklist:
<type>(<scope>): <subject>