Enhanced agent-based file integrity monitoring

1 . A method for agent-based file integrity monitoring, the method comprising:

generating, using a file integrity monitoring (FIM) daemon in a user space of a device, a first system call to run an extended Berkeley Packet Filter (eBPF) FIM agent in a kernel space of the device;

generating, by a compiler in the kernel space, a translation of source code of the eBPF FIM agent to eBPF FIM machine code defining tracepoints of file system mutation actions in the kernel space, wherein the file system mutation actions include one or more of a file create, a file write, a file delete, a file change of ownership, or a modification of file permissions or any file attributes;

receiving, by the kernel space, a second system call, from the user space, to perform one of the file system mutation actions in the kernel space;

identifying, by the eBPF FIM machine code, in the kernel space, based on one of the tracepoints, the one of file system mutation actions in the kernel space;

sending, by the eBPF FIM machine code, to a buffer, an indication of the one of file system mutation actions in the kernel space;

identifying, by an application programming interface (API) of the FIM daemon in the user space, the indication of the one of file system mutation actions in the kernel space; and

sending, by the FIM daemon to a FIM control plane of multiple devices comprising the device, the indication of the one of file system mutation actions in the kernel space.

2 . The method of claim 1 , wherein the eBPF FIM machine code runs in a sandboxed engine within the kernel space based on the first system call.

3 . The method of claim 1 , wherein the eBPF FIM machine code defines event-based triggers for reporting the file system mutation actions to the buffer, and wherein the eBPF FIM machine code sends the indication of the one of file system mutation actions to the buffer based on the identifying of the one of file system mutation actions as one of the event-based triggers.

4 . The method of claim 1 , wherein the indication of the one of file system mutation actions is included in a batch report of multiple file system mutations identified by the eBPF machine code during a time period for the batch report.

5 . A method for agent-based file integrity monitoring, the method comprising:

receiving, by a kernel space of a device, a system call, from a user space of the device, to perform a file system mutation action in the kernel space, wherein the file system mutation action is one of a file create, a file write, a file delete, a file change of ownership, or a modification of file permissions or any file attributes;

identifying, by an extended Berkeley Packet Filter (eBPF) file integrity monitoring (FIM) machine code, in the kernel space, the file system mutation action in the kernel space;

sending, by the eBPF FIM machine code, to a buffer, an indication of the file system mutation action in the kernel space;

identifying, by a FIM daemon in the user space, the indication of the file system mutation action in the kernel space, wherein the eBPF FIM machine code runs in the kernel space based on the FIM daemon; and

sending, by the FIM daemon to a control plane of multiple devices comprising the device, the indication of the file system mutation action in the kernel space.

6 . The method of claim 5 , wherein the eBPF FIM machine code runs in a sandboxed engine within the kernel space based on the first system call.

7 . The method of claim 5 , wherein the eBPF FIM machine code defines event-based triggers for reporting file system mutation actions to the buffer, and wherein the eBPF FIM machine code sends the indication of the file system mutation action to the buffer based on the identifying of the file system mutation action as one of the event-based triggers.

8 . The method of claim 5 , wherein the indication of the file system mutation action is included in a batch report of multiple file system mutations identified by the eBPF machine code.

9 . The method of claim 5 , further comprising:

generating, using the FIM daemon in the user space, a second system call to run the eBPF FIM agent in a kernel space of the device.

10 . The method of claim 5 , wherein the FIM daemon delivers FIM eBPF source code in the user space to the kernel space, the method further comprising:

generating, by a compiler in the kernel space, a translation of the FIM eBPF source code to the eBPF FIM machine in the kernel space.

11 . The method of claim 5 , wherein the one or more system file mutation actions occurs in a remotely-mounted network file system.

12 . The method of claim 5 , wherein the eBPF FIM machine code defines file mutation actions for the device that are different than second file mutation actions defined by a second eBPF FIM machine code deployed in a kernel space of a second device that reports the second file mutation actions to the control plane.

13 . A system for agent-based file integrity monitoring, the system comprising memory coupled to at least one processor, wherein the at least one processor is configured to:

a control plane in communication with server devices; and

a first server of the server devices, the first server comprising a user space and a kernel space, wherein the first server is configured to:

receive, by the kernel space, a system call, from the user space, to perform a file system mutation action in the kernel space, wherein the file system mutation action is one of a file create, a file write, a file delete, a file change of ownership, or a modification of file permissions or any file attributes;

identify, by an extended Berkeley Packet Filter (eBPF) file integrity monitoring (FIM) machine code, in the kernel space, the file system mutation action in the kernel space;

send, by the eBPF FIM machine code, to a buffer, an indication of the file system mutation action in the kernel space;

identify, by a FIM daemon in the user space, the indication of the file system mutation action in the kernel space, wherein the eBPF FIM machine code runs in the kernel space based on the FIM daemon; and

send, by the FIM daemon to a control plane of multiple devices comprising the device, the indication of the file system mutation action in the kernel space.

14 . The system of claim 13 , further comprising a second server of the server devices, wherein the second server is configured to:

receive, by a kernel space of the second server, a second system call, from a user space of the second server, to perform a file system mutation action in the kernel space of the second server;

identify, by a second eBPF FIM machine code, in the kernel space of the second server, the file system mutation action in the kernel space of the second server;

send, by the eBPF FIM machine code in the second server, to a second buffer of the second server, an indication of the second file system mutation action in the kernel space of the second server;

identify, by a second FIM daemon in the user space of the second server, the indication of the second file system mutation action in the kernel space of the second server, wherein the second eBPF FIM machine code runs in the kernel space of the second server based on the second FIM daemon; and

send, by the second FIM daemon to the control plane, the indication of the second file system mutation action in the kernel space of the second server.

15 . The system of claim 13 , wherein the eBPF FIM machine code runs in a sandboxed engine within the kernel space based on the first system call.

16 . The system of claim 13 , wherein the eBPF FIM machine code defines event-based triggers for reporting file system mutation actions to the buffer, and wherein the eBPF FIM machine code sends the indication of the file system mutation action to the buffer based on the identifying of the file system mutation action as one of the event-based triggers.

17 . The system of claim 13 , wherein the one or more system file mutation actions occurs in a remotely-mounted network file system.

18 . The system of claim 13 , wherein the FIM daemon delivers FIM eBPF source code in the user space to the kernel space.