Spole\u010dnost Microsoft portovala na platformu Linux slu\u017ebu pro monitorov\u00e1n\u00ed \u010dinnosti v syst\u00e9mu Sysmon. Pro sledov\u00e1n\u00ed \u010dinnosti Linuxu se pou\u017e\u00edv\u00e1 podsystem eBPF, kter\u00fd umo\u017e\u0148uje spou\u0161t\u011bt zpracovatele pracuj\u00edc\u00ed na \u00farovni j\u00e1dra opera\u010dn\u00edho syst\u00e9mu. Samostatn\u011b se vyv\u00edj\u00ed knihovna SysinternalsEBPF, kter\u00e1 zahrnuje funkce u\u017eite\u010dn\u00e9 pro vytv\u00e1\u0159en\u00ed BPF zpracovatel\u016f pro monitorov\u00e1n\u00ed ud\u00e1lost\u00ed v syst\u00e9mu. K\u00f3d n\u00e1stroje je dostupn\u00fd pod licenc\u00ed MIT, zat\u00edmco programy BPF jsou pod licenc\u00ed GPLv2. V repozit\u00e1\u0159i packages.microsoft.com jsou um\u00edst\u011bny hotov\u00e9 bal\u00ed\u010dky RPM a DEB vhodn\u00e9 pro popul\u00e1rn\u00ed distribuce Linuxu. <\/p>\n
Sysmon umo\u017e\u0148uje v\u00e9st protokol se podrobn\u00fdmi informacemi o vytv\u00e1\u0159en\u00ed a ukon\u010dov\u00e1n\u00ed proces\u016f, s\u00ed\u0165ov\u00fdch p\u0159ipojen\u00edch a manipulac\u00edch se soubory. V protokolu se uchov\u00e1vaj\u00ed nejen obecn\u00e9 informace, ale i \u00fadaje u\u017eite\u010dn\u00e9 pro anal\u00fdzu souvisej\u00edc\u00edch bezpe\u010dnostn\u00edch incident\u016f, jako je jm\u00e9no nad\u0159azen\u00e9ho procesu, hash obsahu vykon\u00e1vateln\u00fdch soubor\u016f, informace o dynamick\u00fdch knihovn\u00e1ch, \u00fadaje o \u010dase vytvo\u0159en\u00ed\/p\u0159\u00edstupu\/zm\u011bny\/smaz\u00e1n\u00ed soubor\u016f a data o p\u0159\u00edm\u00e9m p\u0159\u00edstupu proces\u016f k blokov\u00fdm za\u0159\u00edzen\u00edm. Pro omezen\u00ed objemu zapisovan\u00fdch dat je k dispozici mo\u017enost nastaven\u00ed filtr\u016f. Protokol m\u016f\u017ee b\u00fdt uchov\u00e1v\u00e1n prost\u0159ednictv\u00edm standardn\u00edho Syslog. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 Linux \u0441\u0435\u0440\u0432\u0438\u0441 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Sysmon. \u0414\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b Linux \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 SysinternalsEBPF, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u0438, \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f BPF-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041a\u043e\u0434 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u043e\u0442\u043a\u0440\u044b\u0442 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MIT, \u0430 BPF-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101654","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Spole\u010dnost Microsoft portovala Sysmon pro Linux a otev\u0159ela jeho k\u00f3d | ProHoster","description":"Spole\u010dnost Microsoft portovala na platformu Linux slu\u017ebu pro monitorov\u00e1n\u00ed \u010dinnosti v syst\u00e9mu Sysmon.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/kompaniya-microsoft-portirovala-sysmon-dlya-linux-i-otkryla-ego-kod","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 Sysmon \u0434\u043b\u044f Linux \u0438 \u043e\u0442\u043a\u0440\u044b\u043b\u0430 \u0435\u0433\u043e \u043a\u043e\u0434 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 Linux \u0441\u0435\u0440\u0432\u0438\u0441 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Sysmon.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/kompaniya-microsoft-portirovala-sysmon-dlya-linux-i-otkryla-ego-kod","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-15T08:23:31+00:00","article:modified_time":"2021-10-15T08:23:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101654","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-15 08:28:56","updated":"2022-10-10 04:15:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=101654"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101654\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=101654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=101654"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=101654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"