3 Commits

Author	SHA1	Message	Date
Nick Gregory	77d191ae26	ProcessTree: integrate process tree throughout the event processing lifecycle (3/4) (#1281) ... * process annotations: thread the tree through santa * Update enricher to read annotations from the ProcessTree * rebase changes * add configuration for annotations, disabling the tree entirely if none are enabled * lingering build dep * use tree factory constructor * fix configurator * build fixes * rebase fixes * fix tests * review comments * lint * english hard * record metrics even when event only used for process tree	2024-03-14 11:31:51 -04:00
Nick Gregory	5248e2a7eb	Fix import issues and lint (#1282) ... * lint * case insensitive filesystems ahhhh * tidy * one last header	2024-02-07 17:46:42 -05:00
Nick Gregory	e8db89c57c	ProcessTree: add core process tree logic (1/4) (#1236) ... * ProcessTree: add core process tree logic * make Step implicitly called by Handle* methods * lint * naming convention * widen pidversion to be generic * move os specific backfill to os specific impl * simplify ts checking * retain/release a whole vec of pids * document processtoken * lint * namespace * add process tree to project-wide unit test target * case change annotations * case change annotations * remove stray comment * default initialize seen_timestamps * fix missing initialization of refcnt and tombstoned * reshuffle pb namespace * pr review * move annotation registration to tree construction * use factory function for tree construction	2024-02-05 14:30:54 -05:00