pulsar-core: Include the whole ContainerInfo in Header, not just ID

exein-io · Nov 13, 2023 · 97fba8a · 97fba8a
1 parent e732a72
commit 97fba8a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 5 deletions.
diff --git a/crates/pulsar-core/src/event.rs b/crates/pulsar-core/src/event.rs
@@ -73,7 +73,7 @@ pub struct Header {
     pub pid: i32,
     pub parent_pid: i32,
     #[validatron(skip)]
-    pub container_id: Option<String>,
+    pub container: Option<ContainerInfo>,
     #[validatron(skip)]
     pub threat: Option<Threat>,
     pub source: ModuleName,

diff --git a/crates/pulsar-core/src/pdk/module.rs b/crates/pulsar-core/src/pdk/module.rs
@@ -245,7 +245,7 @@ impl ModuleSender {
                 image: String::new(),
                 parent_pid: 0,
                 fork_time: UNIX_EPOCH,
-                container_id: None,
+                container: None,
             };
             match process_tracker.get(process, timestamp).await {
                 Ok(ProcessInfo {
@@ -259,9 +259,7 @@ impl ModuleSender {
                     header.image = image;
                     header.parent_pid = ppid.as_raw();
                     header.fork_time = fork_time.into();
-                    if let Some(container) = container {
-                        header.container_id = Some(container.id);
-                    }
+                    header.container = container;
                 }
                 Err(e) => {
                     // warning: check if this actually happens or not