ROX-33000: Support for process details in detection node by JoukoVirtanen · Pull Request #19586 · stackrox/stackrox

JoukoVirtanen · 2026-03-24T23:56:00Z

Description

change me!

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

How I validated my change

Manual testing.

The following script was used to test the changes here.

#!/usr/bin/env bash

set -euox pipefail

# Configuration
ROX_ENDPOINT=${ROX_ENDPOINT:-https://localhost:8000}

POLICY_FILE="$1"

# Check for required environment variable
if [ -z "${ROX_API_TOKEN:-}" ]; then
    echo "Error: ROX_API_TOKEN environment variable is not set"
    echo "Please set it with: export ROX_API_TOKEN=<your-token>"
    exit 1
fi

# Read policy from file
data=$(cat "$POLICY_FILE")

# Make the API call
response=$(curl --location --silent --request POST \
  "${ROX_ENDPOINT}/v1/policies" \
  -k \
  --header "Authorization: Bearer $ROX_API_TOKEN" \
  --header "Content-Type: application/json" \
  --data "$data")

echo "$response" | jq

The following policy was used as an input. This is a valid node policy with Process and FileAccess fields. The policy is successfully created in this branch.

{
  "id": "",
  "name": "Node with process",
  "description": "",
  "severity": "LOW_SEVERITY",
  "disabled": false,
  "lifecycleStages": [
    "RUNTIME"
  ],
  "notifiers": [],
  "lastUpdated": null,
  "eventSource": "NODE_EVENT",
  "isDefault": false,
  "rationale": "",
  "remediation": "",
  "categories": [
    "Anomalous Activity"
  ],
  "exclusions": [],
  "scope": [],
  "enforcementActions": [],
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "",
  "policySections": [
    {
      "sectionName": "Rule 1",
      "policyGroups": [
        {
          "fieldName": "Process Name",
          "booleanOperator": "OR",
          "values": [
            {
              "value": "bash"
            }
          ],
          "negate": false,
          "fieldKey": {
            "name": "Process Name",
            "shortName": "Process name",
            "longName": "Process name is",
            "negatedName": "Process name doesn’t match",
            "category": "Process activity",
            "type": "text",
            "placeholder": "apt-get",
            "canBooleanLogic": true,
            "lifecycleStages": [
              "RUNTIME"
            ]
          }
        },
        {
          "fieldName": "File Path",
          "booleanOperator": "OR",
          "values": [
            {
              "value": "/etc/sudoers"
            }
          ],
          "negate": false,
          "fieldKey": {
            "label": "File path",
            "name": "File Path",
            "shortName": "File path",
            "category": "File activity",
            "type": "text",
            "placeholder": "/home/**/.ssh/id_*",
            "helperText": "Enter an absolute file path. Supports glob patterns.",
            "canBooleanLogic": false,
            "lifecycleStages": [
              "RUNTIME"
            ]
          }
        }
      ]
    }
  ],
  "mitreAttackVectors": [],
  "criteriaLocked": false,
  "mitreVectorsLocked": false,
  "source": "IMPERATIVE"
}

In master it results in an error.

{
  "code": 3,
  "message": "policy invalid errors: [error validating lifecycle stage error: Node event policies must contain only node fields, Node event policies must contain only node fields]: invalid arguments",
  "details": [],
  "error": "policy invalid errors: [error validating lifecycle stage error: Node event policies must contain only node fields, Node event policies must contain only node fields]: invalid arguments"
}

An invalid policy with only a Process field was tested.

{
  "id": "",
  "name": "Node with process only",
  "description": "",
  "severity": "LOW_SEVERITY",
  "disabled": false,
  "lifecycleStages": [
    "RUNTIME"
  ],
  "notifiers": [],
  "lastUpdated": null,
  "eventSource": "NODE_EVENT",
  "isDefault": false,
  "rationale": "",
  "remediation": "",
  "categories": [
    "Anomalous Activity"
  ],
  "exclusions": [],
  "scope": [],
  "enforcementActions": [],
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "",
  "policySections": [
    {
      "sectionName": "Rule 1",
      "policyGroups": [
        {
          "fieldName": "Process Name",
          "booleanOperator": "OR",
          "values": [
            {
              "value": "bash"
            }
          ],
          "negate": false,
          "fieldKey": {
            "name": "Process Name",
            "shortName": "Process name",
            "longName": "Process name is",
            "negatedName": "Process name doesn’t match",
            "category": "Process activity",
            "type": "text",
            "placeholder": "apt-get",
            "canBooleanLogic": true,
            "lifecycleStages": [
              "RUNTIME"
            ]
          }
        }
      ]
    }
  ],
  "mitreAttackVectors": [],
  "criteriaLocked": false,
  "mitreVectorsLocked": false,
  "source": "IMPERATIVE"
}

This resulted in the following error

{
  "code": 3,
  "message": "policy invalid errors: [error validating lifecycle stage error: Node event policies with process criteria must include file access criteria in the same section, Node event policies with process criteria must include file access criteria in the same section]: invalid arguments",
  "details": [],
  "error": "policy invalid errors: [error validating lifecycle stage error: Node event policies with process criteria must include file access criteria in the same section, Node event policies with process criteria must include file access criteria in the same section]: invalid arguments"
}

It failed in master with the following error:

{ 
  "code": 3,
  "message": "policy invalid errors: [error validating lifecycle stage error: Node event policies must contain only node fields, Node event policies must contain only node fields]: invalid arguments",
  "details": [],
  "error": "policy invalid errors: [error validating lifecycle stage error: Node event policies must contain only node fields, Node event policies must contain only node fields]: invalid arguments"
}

A policy with only a FileAccess field was tested and worked in this branch and in master.

{
  "id": "",
  "name": "Node with file access only",
  "description": "",
  "severity": "LOW_SEVERITY",
  "disabled": false,
  "lifecycleStages": [
    "RUNTIME"
  ],
  "notifiers": [],
  "lastUpdated": null,
  "eventSource": "NODE_EVENT",
  "isDefault": false,
  "rationale": "",
  "remediation": "",
  "categories": [
    "Anomalous Activity"
  ],
  "exclusions": [],
  "scope": [],
  "enforcementActions": [],
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "",
  "policySections": [
    {
      "sectionName": "Rule 1",
      "policyGroups": [
        {
          "fieldName": "File Path",
          "booleanOperator": "OR",
          "values": [
            {
              "value": "/etc/sudoers"
            }
          ],
          "negate": false,
          "fieldKey": {
            "label": "File path",
            "name": "File Path",
            "shortName": "File path",
            "category": "File activity",
            "type": "text",
            "placeholder": "/home/**/.ssh/id_*",
            "helperText": "Enter an absolute file path. Supports glob patterns.",
            "canBooleanLogic": false,
            "lifecycleStages": [
              "RUNTIME"
            ]
          }
        }
      ]
    }
  ],
  "mitreAttackVectors": [],
  "criteriaLocked": false,
  "mitreVectorsLocked": false,
  "source": "IMPERATIVE"
}

openshift-ci · 2026-03-24T23:56:04Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

rhacs-bot · 2026-03-25T00:14:37Z

Images are ready for the commit at 9f121cd.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-436-g9f121cd1de.

codecov · 2026-03-25T00:29:32Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.28%. Comparing base (5d84b54) to head (9dfc9b8).
⚠️ Report is 13 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #19586      +/-   ##
==========================================
+ Coverage   49.26%   49.28%   +0.02%     
==========================================
  Files        2735     2735              
  Lines      206138   206220      +82     
==========================================
+ Hits       101550   101645      +95     
+ Misses      97041    97036       -5     
+ Partials     7547     7539       -8

Flag	Coverage Δ
go-unit-tests	`49.28% <100.00%> (+0.02%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Stringy

One minor non-blocking comment but overall LGTM

Stringy · 2026-03-25T11:20:16Z

central/policy/service/validator.go

 		return errors.New("Node event policies must contain only node fields")
 	}

+	if booleanpolicy.ContainsOneOf(policy, booleanpolicy.Process) {


I think this check is a little redundant - we can just go straight into the loop

JoukoVirtanen added 2 commits March 24, 2026 14:54

X-Smart-Branch-Parent: master

d69362d

Not allowing node events with processes only

d6ab08f

openshift-ci bot added the do-not-merge/work-in-progress label Mar 24, 2026

github-actions bot added the area/central label Mar 24, 2026

Added storage.EventSource_NODE_EVENT to process field metadata

9f121cd

Stringy approved these changes Mar 25, 2026

View reviewed changes

Removed redundant check

9dfc9b8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ROX-33000: Support for process details in detection node#19586

ROX-33000: Support for process details in detection node#19586
JoukoVirtanen wants to merge 4 commits intomasterfrom
jv-ROX-33000-support-for-process-details-in-detection-node

JoukoVirtanen commented Mar 24, 2026 •

edited

Loading

Uh oh!

openshift-ci bot commented Mar 24, 2026

Uh oh!

rhacs-bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

Stringy left a comment

Uh oh!

Stringy Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

JoukoVirtanen commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Uh oh!

openshift-ci bot commented Mar 24, 2026

Uh oh!

rhacs-bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Stringy left a comment

Choose a reason for hiding this comment

Uh oh!

Stringy Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

JoukoVirtanen commented Mar 24, 2026 •

edited

Loading

rhacs-bot commented Mar 25, 2026 •

edited

Loading

codecov bot commented Mar 25, 2026 •

edited

Loading