Mutation event detection for integrity monitoring

1. A system comprising:

a memory device for storing program code; and

at least one hardware processor operatively coupled to the memory device and configured to execute program code stored on the memory device to:

generate one or more process trees based on one or more processes associated with one or more change events within a cluster computing system;

perform mutation event detection by comparing a root of each of the one or more process trees with one or more external commands; and

generate a mutation event report based on the comparison, with the mutation report including each of the one or more process trees resulting from a command other than the one or more external commands.

2. The system of claim 1 , further comprising:

a database in communication with the at least one processor device and configured to store the one or more change events; and

an application programming interface (API) server in communication with the at least one hardware processor.

3. The system of claim 2 , wherein the at least one hardware processor is further configured to execute program code stored on the memory device to:

collect the one or more change events from a database; and

obtain the one or more external commands using an application programming interface (API) server.

4. The system of claim 1 , wherein:

the cluster computing system includes one or more containers;

the at least one hardware processor is further configured to collect the one or more change events from the one or more containers; and

the one or more external commands are executed by a container platform.

5. The system of claim 1 , wherein the one or more external commands include one or more probe commands.

6. The system of claim 1 , wherein the at least one hardware processor is further configured to generate the mutation event report based on the comparison by:

determining that the root of a given one of the process trees is a process resulting from one of the external commands; and

omitting the given one of the process trees from the mutation event report.

7. The system of claim 1 , wherein the at least one hardware processor is further configured to transmit the mutation event report to one or more computing devices.

8. The system of claim 1 , wherein the cluster computing system includes a Kubernetes cluster computing system.

9. A computer-implemented method, comprising:

generating one or more process trees based on one or more processes associated with one or more change events within a cluster computing system;

performing mutation event detection by comparing a root of each of the one or more process trees with one or more external commands; and

generating a mutation event report based on the comparison, with the mutation report including each of the one or more process trees resulting from a command other than the one or more external commands.

10. The method of claim 9 , further comprising:

collecting the one or more change events; and

obtaining the one or more external commands.

11. The method of claim 10 , wherein:

the cluster computing system includes one or more containers;

collecting the one or more change events further includes collecting the one or more change events from the one or more containers; and

the one or more external commands are executed by a container platform.

12. The method of claim 9 , wherein the one or more external commands include one or more probe commands.

13. The method of claim 9 , wherein generating the mutation event report based on the comparison further includes:

determining that the root of a given one of the process trees is a process resulting from one of the external commands; and

omitting the given one of the process trees from the mutation event reports.

14. The method of claim 9 , further comprising transmitting the mutation event report to one or more computing devices.

15. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

generating one or more process trees based on one or more processes associated with one or more change events within a cluster computing system;

performing mutation event detection by comparing a root of each of the one or more process trees with one or more external commands; and

generating a mutation event report based on the comparison, with the mutation report including each of the one or more process trees resulting from a command other than the one or more external commands.

16. The computer program product of claim 15 , wherein the method further includes:

collecting the one or more change events; and

obtaining the one or more external commands.

17. The computer program product of claim 16 , wherein:

the cluster computing system includes one or more containers;

collecting the one or more change events further includes collecting the one or more change events from the one or more containers; and

the one or more external commands are executed by a container platform.

18. The computer program product of claim 15 , wherein the one or more external commands include one or more probe commands.

19. The computer program product of claim 15 , wherein generating the mutation event report based on the comparison further includes:

determining that the root of a given one of the process trees is a process resulting from one of the external commands; and

omitting the given one of the process trees from the mutation event reports.

20. The computer program product of claim 15 , wherein the method further includes transmitting the mutation event report to one or more computing devices.