Reference: Alert Template Schema

This section documents the Alert schema for use with Alert Templates.

The types defined in the Type column are either native Go types or are custom types that Capsule8 defined. This document uses lowercase names for native Go types and capitalized names for custom Capsule8 types. Every custom Capsule8 type defined below has its own section. The Usage Example column provides a template example that can be copy and pasted into your template for certain use cases. In the case of nested fields, the names of the parent fields required for access are included (e.g. {{.ProcessInfo.Program}}). In the case of slices, data is accessible through either the range action or the index function (e.g. {{range .Lineage}} {{.Program.Path}} {{end}}). Keep in mind that the provided usage examples are not the only way to use the Alert fields in an Alert Template. See the Alert Templates section for complete usage instructions. The Alert schema is not exactly the same between the JSON and Alert Template formats. For that reason it is important to consult this documentation.

Alert

Alert is the top-level Capsule8 Alert type.

AlertLocation

AlertLocation is accessible through the Alert Location field.

AlertNotification

AlertNotification is accessible through the Alert Notifications field which is a slice.

AlertMessageFields

AlertMessageFields are accessible through the Alert Notification's MessageFields.

ModifiedElement

ModifiedElement is accessible through the Alert Notification's MessageFields.ModifiedElements field which is a slice.

AlertFilterMatch

AlertFilterMatch is accessible through the Alert MatchedObjects field which is a slice.

ProcessInfo

ProcessInfo is accessible through the Alert ProcessInfo field and the Alert Lineage field which is a slice.

The usage examples below illustrate the simpler path through the Alert ProcessInfo field.

For access through the Alert Lineage field do the following:

{{range .Lineage}} {{.$FIELD}} {{end}}

Replace $FIELD with your field name of choice (e.g. Uuid).

ProgramInfo

ProgramInfo is accessible through the Alert ProcessInfo field and the Alert Lineage's ProcessInfo field.

The usage examples below illustrate the simpler path through the Alert ProcessInfo field.

For access through the Alert Lineage field do the following:

{{range .Lineage}} {{.Program.$FIELD}} {{end}}

Replace $FIELD with your field name of choice (e.g. Path).

Priority

Priority is an enum accessible through the Alert Priority field.

It can be one of the following strings:

• Unknown
• Low
• Medium
• High

Confidence

Confidence is an enum accessible through the Alert Confidence field.

It can be one of the following strings:

• Zero
• Low
• MediumLow
• MediumHigh
• High
• Max

Policy

Policy is an enum accessible through the Alert PolicyType field.

It can be one of the following strings:

• AppArmor
• BPFExec
• Chmod
• Connect
• CloudMetadata
• File
• FileMonitor
• Filter
• InteractiveShell
• KernelPayload
• LoadKernelModule
• MemoryProtection
• NewFileExec
• PrivilegeEscalation
• Program
• Ptrace
• RemoteInteractiveShell
• Segfault
• SELinux
• Sendto
• SensorTimeout
• SetPrivilege
• Setrlimit
• SmepSmap
• SpectreMeltdown
• StackPivotDetection
• NetworkService
• YaraScan

Scope

Scope is an enum accessible through the Alert Scope field.

It can be one of the following strings:

• Other
• Process
• RootProcess
• Container
• Node
• Subnet
• Socket