send custom event when detecting an event with missing args/envs

pkg/security/events/custom.go

@@ -58,6 +58,11 @@ const (
 	// BrokenProcessLineageErrorRuleDesc is the rule description for events with a broken process lineage
 	BrokenProcessLineageErrorRuleDesc = "Broken process lineage detected"
 
+	// NoProcessArgsEnvsErrorRuleID is the rule ID for events with no process args/envs
+	NoProcessArgsEnvsErrorRuleID = "no_process_args_envs"
+	// NoProcessArgsEnvsErrorRuleDesc is the rule description for events with no process args/envs
+	NoProcessArgsEnvsErrorRuleDesc = "Missing process arguments or environment variables detected"
+
 	// RefreshUserCacheRuleID is the rule ID used to refresh users and groups cache
 	RefreshUserCacheRuleID = "refresh_user_cache"
 
@@ -102,6 +107,7 @@ func AllCustomRuleIDs() []string {
 		NoProcessContextErrorRuleID,
 		BrokenProcessLineageErrorRuleID,
 		InternalCoreDumpRuleID,
+		NoProcessArgsEnvsErrorRuleID,
 	}
 }
 

pkg/security/events/rate_limiter.go

@@ -40,6 +40,7 @@ var (
 		BrokenProcessLineageErrorRuleID: NewStdLimiter(rate.Every(30*time.Second), 1),
 		EBPFLessHelloMessageRuleID:      NewStdLimiter(rate.Inf, 1), // No limit on hello message
 		InternalCoreDumpRuleID:          NewStdLimiter(rate.Every(30*time.Second), 1),
+		NoProcessArgsEnvsErrorRuleID:    NewStdLimiter(rate.Every(30*time.Second), 1),
 	}
 )
 

pkg/security/probe/probe_monitor.go

@@ -181,4 +181,11 @@ func (m *EBPFMonitors) ProcessEvent(event *model.Event) {
 			NewAbnormalEvent(events.BrokenProcessLineageErrorRuleID, events.BrokenProcessLineageErrorRuleDesc, event, event.Error),
 		)
 	}
+
+	var argsEnvsErr *model.ErrProcessArgsEnvsResolution
+	if errors.As(event.Error, &argsEnvsErr) {
+		m.ebpfProbe.probe.DispatchCustomEvent(
+			NewAbnormalEvent(events.NoProcessArgsEnvsErrorRuleID, events.NoProcessArgsEnvsErrorRuleDesc, event, event.Error),
+		)
+	}
 }