ROX-33000: Support for process details in detection node by JoukoVirtanen · Pull Request #19586 · stackrox/stackrox

JoukoVirtanen · 2026-03-24T23:56:00Z

Description

A previous PR made it possible to create deployment policies with Process fields and FileAccess fields. This PR makes it possible to create node policies with a combination and Process and FileAccess fields. Node policies with Process only fields are still disallowed.

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

A test was modified.

How I validated my change

Summary

A script was used to create various policies and tested in master and this branch.

Process and FileAccess fields
This branch: Success
Master: Failure
Process only
This branch: Failure, but incorrect error message
Master: Failure
FileAccess only
This branch: Success
Master: Success

The first type of policy was also tested by triggering it in this branch.

Details

The following script was used to test the changes here.

#!/usr/bin/env bash

set -euox pipefail

# Configuration
ROX_ENDPOINT=${ROX_ENDPOINT:-https://localhost:8000}

POLICY_FILE="$1"

# Check for required environment variable
if [ -z "${ROX_API_TOKEN:-}" ]; then
    echo "Error: ROX_API_TOKEN environment variable is not set"
    echo "Please set it with: export ROX_API_TOKEN=<your-token>"
    exit 1
fi

# Read policy from file
data=$(cat "$POLICY_FILE")

# Make the API call
response=$(curl --location --silent --request POST \
  "${ROX_ENDPOINT}/v1/policies" \
  -k \
  --header "Authorization: Bearer $ROX_API_TOKEN" \
  --header "Content-Type: application/json" \
  --data "$data")

echo "$response" | jq

The following policy was used as an input. This is a valid node policy with Process and FileAccess fields. The policy is successfully created in this branch.

{
  "id": "",
  "name": "Node with process",
  "description": "",
  "severity": "LOW_SEVERITY",
  "disabled": false,
  "lifecycleStages": [
    "RUNTIME"
  ],
  "notifiers": [],
  "lastUpdated": null,
  "eventSource": "NODE_EVENT",
  "isDefault": false,
  "rationale": "",
  "remediation": "",
  "categories": [
    "Anomalous Activity"
  ],
  "exclusions": [],
  "scope": [],
  "enforcementActions": [],
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "",
  "policySections": [
    {
      "sectionName": "Rule 1",
      "policyGroups": [
        {
          "fieldName": "Process Name",
          "booleanOperator": "OR",
          "values": [
            {
              "value": "bash"
            }
          ],
          "negate": false,
          "fieldKey": {
            "name": "Process Name",
            "shortName": "Process name",
            "longName": "Process name is",
            "negatedName": "Process name doesn’t match",
            "category": "Process activity",
            "type": "text",
            "placeholder": "apt-get",
            "canBooleanLogic": true,
            "lifecycleStages": [
              "RUNTIME"
            ]
          }
        },
        {
          "fieldName": "File Path",
          "booleanOperator": "OR",
          "values": [
            {
              "value": "/etc/sudoers"
            }
          ],
          "negate": false,
          "fieldKey": {
            "label": "File path",
            "name": "File Path",
            "shortName": "File path",
            "category": "File activity",
            "type": "text",
            "placeholder": "/home/**/.ssh/id_*",
            "helperText": "Enter an absolute file path. Supports glob patterns.",
            "canBooleanLogic": false,
            "lifecycleStages": [
              "RUNTIME"
            ]
          }
        }
      ]
    }
  ],
  "mitreAttackVectors": [],
  "criteriaLocked": false,
  "mitreVectorsLocked": false,
  "source": "IMPERATIVE"
}

In master it results in an error.

{
  "code": 3,
  "message": "policy invalid errors: [error validating lifecycle stage error: Node event policies must contain only node fields, Node event policies must contain only node fields]: invalid arguments",
  "details": [],
  "error": "policy invalid errors: [error validating lifecycle stage error: Node event policies must contain only node fields, Node event policies must contain only node fields]: invalid arguments"
}

The policy was triggered by doing the following actions.

cat SSH_ACCESS
gcloud compute config-ssh --project=acs-team-temp-dev
ssh ******
sudo visudo

Alerts were checked with the following script

#!/usr/bin/env bash

set -euox pipefail

# Configuration
ROX_ENDPOINT=${ROX_ENDPOINT:-https://localhost:8000}

# Check for required environment variable
if [ -z "${ROX_API_TOKEN:-}" ]; then
    echo "Error: ROX_API_TOKEN environment variable is not set"
    echo "Please set it with: export ROX_API_TOKEN=<your-token>"
    exit 1
fi

# Make the API call
response=$(curl --location --silent --request GET \
  "${ROX_ENDPOINT}/v1/alerts" \
  -k \
  --header "Authorization: Bearer $ROX_API_TOKEN" \
  --header "Content-Type: application/json")

echo "$response" | jq

{
  "alerts": [
    {
      "id": "0b087242-b3a6-45e7-a1e6-e6313a9e0b62",
      "lifecycleStage": "RUNTIME",
      "time": "2026-03-25T21:09:59.119409214Z",
      "policy": {
        "id": "6af33bed-624f-45ad-b1aa-0209f662486a",
        "name": "Node with process",
        "severity": "LOW_SEVERITY",
        "description": "",
        "categories": [
          "Anomalous Activity"
        ],
        "developerInternalFields": null
      },
      "state": "ACTIVE",
      "enforcementCount": 0,
      "enforcementAction": "UNSET_ENFORCEMENT",
      "commonEntityInfo": {
        "clusterName": "remote",
        "namespace": "",
        "clusterId": "6ae794a4-aa60-44f5-958c-2802793afbd3",
        "namespaceId": "",
        "resourceType": "DEPLOYMENT"
      },
      "node": {
        "name": "gke-jv-0317-default-pool-76ef2ea2-3x9w"
      }
    },
 ]
}

The violation had been triggered.

An invalid policy with only a Process field was tested.

{
  "id": "",
  "name": "Node with process only",
  "description": "",
  "severity": "LOW_SEVERITY",
  "disabled": false,
  "lifecycleStages": [
    "RUNTIME"
  ],
  "notifiers": [],
  "lastUpdated": null,
  "eventSource": "NODE_EVENT",
  "isDefault": false,
  "rationale": "",
  "remediation": "",
  "categories": [
    "Anomalous Activity"
  ],
  "exclusions": [],
  "scope": [],
  "enforcementActions": [],
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "",
  "policySections": [
    {
      "sectionName": "Rule 1",
      "policyGroups": [
        {
          "fieldName": "Process Name",
          "booleanOperator": "OR",
          "values": [
            {
              "value": "bash"
            }
          ],
          "negate": false,
          "fieldKey": {
            "name": "Process Name",
            "shortName": "Process name",
            "longName": "Process name is",
            "negatedName": "Process name doesn’t match",
            "category": "Process activity",
            "type": "text",
            "placeholder": "apt-get",
            "canBooleanLogic": true,
            "lifecycleStages": [
              "RUNTIME"
            ]
          }
        }
      ]
    }
  ],
  "mitreAttackVectors": [],
  "criteriaLocked": false,
  "mitreVectorsLocked": false,
  "source": "IMPERATIVE"
}

This resulted in the following error

{
  "code": 3,
  "message": "policy invalid errors: [error validating lifecycle stage error: Node event policies with process criteria must include file access criteria in the same section, Node event policies with process criteria must include file access criteria in the same section]: invalid arguments",
  "details": [],
  "error": "policy invalid errors: [error validating lifecycle stage error: Node event policies with process criteria must include file access criteria in the same section, Node event policies with process criteria must include file access criteria in the same section]: invalid arguments"
}

It failed in master with the following error:

{ 
  "code": 3,
  "message": "policy invalid errors: [error validating lifecycle stage error: Node event policies must contain only node fields, Node event policies must contain only node fields]: invalid arguments",
  "details": [],
  "error": "policy invalid errors: [error validating lifecycle stage error: Node event policies must contain only node fields, Node event policies must contain only node fields]: invalid arguments"
}

A policy with only a FileAccess field was tested and worked in this branch and in master.

{
  "id": "",
  "name": "Node with file access only",
  "description": "",
  "severity": "LOW_SEVERITY",
  "disabled": false,
  "lifecycleStages": [
    "RUNTIME"
  ],
  "notifiers": [],
  "lastUpdated": null,
  "eventSource": "NODE_EVENT",
  "isDefault": false,
  "rationale": "",
  "remediation": "",
  "categories": [
    "Anomalous Activity"
  ],
  "exclusions": [],
  "scope": [],
  "enforcementActions": [],
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "",
  "policySections": [
    {
      "sectionName": "Rule 1",
      "policyGroups": [
        {
          "fieldName": "File Path",
          "booleanOperator": "OR",
          "values": [
            {
              "value": "/etc/sudoers"
            }
          ],
          "negate": false,
          "fieldKey": {
            "label": "File path",
            "name": "File Path",
            "shortName": "File path",
            "category": "File activity",
            "type": "text",
            "placeholder": "/home/**/.ssh/id_*",
            "helperText": "Enter an absolute file path. Supports glob patterns.",
            "canBooleanLogic": false,
            "lifecycleStages": [
              "RUNTIME"
            ]
          }
        }
      ]
    }
  ],
  "mitreAttackVectors": [],
  "criteriaLocked": false,
  "mitreVectorsLocked": false,
  "source": "IMPERATIVE"
}

openshift-ci · 2026-03-24T23:56:04Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

rhacs-bot · 2026-03-25T00:14:37Z

Images are ready for the commit at 148d3ba.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-438-g148d3ba939.

codecov · 2026-03-25T00:29:32Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.28%. Comparing base (5d84b54) to head (148d3ba).
⚠️ Report is 18 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #19586      +/-   ##
==========================================
+ Coverage   49.26%   49.28%   +0.01%     
==========================================
  Files        2735     2735              
  Lines      206138   206220      +82     
==========================================
+ Hits       101550   101631      +81     
- Misses      97041    97046       +5     
+ Partials     7547     7543       -4

Flag	Coverage Δ
go-unit-tests	`49.28% <100.00%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Stringy

One minor non-blocking comment but overall LGTM

central/policy/service/validator.go

JoukoVirtanen · 2026-03-25T22:23:28Z

/test gke-upgrade-tests

JoukoVirtanen added 2 commits March 24, 2026 14:54

X-Smart-Branch-Parent: master

d69362d

Not allowing node events with processes only

d6ab08f

openshift-ci bot added the do-not-merge/work-in-progress label Mar 24, 2026

github-actions bot added the area/central label Mar 24, 2026

Added storage.EventSource_NODE_EVENT to process field metadata

9f121cd

Stringy approved these changes Mar 25, 2026

View reviewed changes

central/policy/service/validator.go Outdated Show resolved Hide resolved

Removed redundant check

9dfc9b8

JoukoVirtanen marked this pull request as ready for review March 25, 2026 20:04

JoukoVirtanen requested a review from a team as a code owner March 25, 2026 20:04

openshift-ci bot removed the do-not-merge/work-in-progress label Mar 25, 2026

Minor unit test refactor

148d3ba

JoukoVirtanen requested a review from clickboo March 25, 2026 22:41

JoukoVirtanen merged commit 96335e9 into master Mar 26, 2026
98 checks passed

JoukoVirtanen deleted the jv-ROX-33000-support-for-process-details-in-detection-node branch March 26, 2026 14:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ROX-33000: Support for process details in detection node#19586

ROX-33000: Support for process details in detection node#19586
JoukoVirtanen merged 5 commits intomasterfrom
jv-ROX-33000-support-for-process-details-in-detection-node

JoukoVirtanen commented Mar 24, 2026 •

edited

Loading

Uh oh!

openshift-ci bot commented Mar 24, 2026

Uh oh!

rhacs-bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

Stringy left a comment

Uh oh!

Uh oh!

JoukoVirtanen commented Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

JoukoVirtanen commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Summary

Details

Uh oh!

openshift-ci bot commented Mar 24, 2026

Uh oh!

rhacs-bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Stringy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

JoukoVirtanen commented Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

JoukoVirtanen commented Mar 24, 2026 •

edited

Loading

rhacs-bot commented Mar 25, 2026 •

edited

Loading

codecov bot commented Mar 25, 2026 •

edited

Loading