{"id":101654,"date":"2021-10-15T10:23:31","date_gmt":"2021-10-15T08:23:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-microsoft-portirovala-sysmon-dlya-linux-i-otkryla-ego-kod"},"modified":"2021-10-15T10:23:31","modified_gmt":"2021-10-15T08:23:31","slug":"kompaniya-microsoft-portirovala-sysmon-dlya-linux-i-otkryla-ego-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kompaniya-microsoft-portirovala-sysmon-dlya-linux-i-otkryla-ego-kod","title":{"rendered":"Ettev\u00f5te Microsoft portis Sysmoni Linuxile ja avas selle koodi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Microsoft on portinud Linuxi platvormile s\u00fcsteemi Sysmon aktiivsuse j\u00e4lgimise teenuse. Linuxi t\u00f6\u00f6 j\u00e4lgimiseks kasutatakse eBPF alams\u00fcsteemi, mis v\u00f5imaldab k\u00e4itada t\u00f6\u00f6tlejaid operatsioonis\u00fcsteemi tasemel. Eraldi arendatakse v\u00e4lja SysinternalsEBPF teeki, mis sisaldab funktsioone, mis on kasulikud BPF-t\u00f6\u00f6tlejate loomisel s\u00fcsteemi s\u00fcndmuste j\u00e4lgimiseks. T\u00f6\u00f6riistarikka kood on avatud MIT litsentsi alusel, samas kui BPF-programmid on litsentsitud GPLv2 alusel. Valmispakid RPM ja DEB, mis sobivad populaarsetele Linuxi distributsioonidele, on saadaval packages.microsoft.com hoidlas. <\/p>\n

Sysmon v\u00f5imaldab hoida logi, kus on detailne teave protsesside loomise ja l\u00f5petamise, v\u00f5rgu\u00fchenduste ja failihalduste kohta. Logis salvestatakse mitte ainult \u00fcldine teave, vaid ka teave, mis on kasulik turvaga seotud intsidentide anal\u00fc\u00fcsimiseks, nagu vanema protsessi nimi, t\u00e4itmisfailide sisu hash'id, teave d\u00fcnaamiliste raamatukogude kohta, loomise\/juhtimise\/muutmise\/kustutamise ajateave, infot protsesside otsep\u00e4\u00e4su kohta plokkseadmetele. Salvestatud andmete hulga piiramiseks on v\u00f5imalus seadistada filtreid. Logi saab salvestada l\u00e4bi standardse Syslog.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 Linux \u0441\u0435\u0440\u0432\u0438\u0441 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Sysmon. \u0414\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b Linux \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 SysinternalsEBPF, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u0438, \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f BPF-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041a\u043e\u0434 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u043e\u0442\u043a\u0440\u044b\u0442 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MIT, \u0430 BPF-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101654","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft on portitanud Sysmoni Linuxile ja avanud selle koodi | ProHoster","description":"Microsoft on portinud Linuxi platvormile s\u00fcsteemi aktiivsuse j\u00e4lgimise teenuse Sysmon. Linuxi t\u00f6\u00f6d j\u00e4lgimiseks kasutatakse eBPF alam s\u00fcsteemi, mis v\u00f5imaldab k\u00e4ivitada t\u00f6\u00f6tlejaid, mis toimivad operatsioonis\u00fcsteemi tuuma tasandil. Eraldi arendatakse SysinternalsEBPF raamatukogu, mis sisaldab funktsioone, mis on kasulikud BPF-t\u00f6\u00f6tlejate loomisel s\u00fcsteemi s\u00fcndmuste j\u00e4lgimiseks. T\u00f6\u00f6riista kood on avatud MIT litsentsi alusel, BPF-programmid aga GPLv2 litsentsi all.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kompaniya-microsoft-portirovala-sysmon-dlya-linux-i-otkryla-ego-kod","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 Sysmon \u0434\u043b\u044f Linux \u0438 \u043e\u0442\u043a\u0440\u044b\u043b\u0430 \u0435\u0433\u043e \u043a\u043e\u0434 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 Linux \u0441\u0435\u0440\u0432\u0438\u0441 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Sysmon. \u0414\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b Linux \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 eBPF, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 SysinternalsEBPF, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u0438, \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f BPF-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041a\u043e\u0434 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u043e\u0442\u043a\u0440\u044b\u0442 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MIT, \u0430 BPF-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. \u0412","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kompaniya-microsoft-portirovala-sysmon-dlya-linux-i-otkryla-ego-kod","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-15T08:23:31+00:00","article:modified_time":"2021-10-15T08:23:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101654","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-15 08:28:56","updated":"2022-10-10 04:15:07"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101654"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101654\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101654"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}