I’m running the Linux sensor on a VM with Docker containers, and processes inside the containers come through fine as NEW_PROCESS with the in-container FILE_PATH. Is there a supported way to get container attribution on those events, something like a container ID or an is_container flag? Especially interested for the k8s DaemonSet deployment, where a node’s pods would otherwise be hard to tell apart.
Hello, there isn’t a way to get that data built-in right now, but we do have a backlog item to add it as we agree it would be very high value.
1 Like