Class: Google::Apis::SecuritycenterV1beta2::KernelRootkit

Inherits:
Object
  • Object
show all
Includes:
Core::Hashable, Core::JsonObjectSupport
Defined in:
lib/google/apis/securitycenter_v1beta2/classes.rb,
lib/google/apis/securitycenter_v1beta2/representations.rb,
lib/google/apis/securitycenter_v1beta2/representations.rb

Overview

Kernel mode rootkit signatures.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(**args) ⇒ KernelRootkit

Returns a new instance of KernelRootkit.



2180
2181
2182
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2180

def initialize(**args)
   update!(**args)
end

Instance Attribute Details

#name ⇒ String

Rootkit name when available. Corresponds to the JSON property name

Returns:

  • (String) 


2124
2125
2126
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2124

def name
  @name
end

#unexpected_code_modification ⇒ Boolean Also known as: unexpected_code_modification?

Flag indicating unexpected modifications of kernel code memory. Corresponds to the JSON property unexpectedCodeModification

Returns:

  • (Boolean) 


2129
2130
2131
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2129

def unexpected_code_modification
  @unexpected_code_modification
end

#unexpected_ftrace_handler ⇒ Boolean Also known as: unexpected_ftrace_handler?

Flag indicating presence of ftrace points with callbacks pointing to regions that are not in the expected kernel or module code range. Corresponds to the JSON property unexpectedFtraceHandler

Returns:

  • (Boolean) 


2136
2137
2138
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2136

def unexpected_ftrace_handler
  @unexpected_ftrace_handler
end

#unexpected_interrupt_handler ⇒ Boolean Also known as: unexpected_interrupt_handler?

Flag indicating presence of interrupt handlers that are are not in the expected kernel, module code regions. Corresponds to the JSON property unexpectedInterruptHandler

Returns:

  • (Boolean) 


2143
2144
2145
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2143

def unexpected_interrupt_handler
  @unexpected_interrupt_handler
end

#unexpected_kernel_code_pages ⇒ Boolean Also known as: unexpected_kernel_code_pages?

Flag indicating presence of kernel code pages that are not in the expected kernel, module code regions. Corresponds to the JSON property unexpectedKernelCodePages

Returns:

  • (Boolean) 


2150
2151
2152
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2150

def unexpected_kernel_code_pages
  @unexpected_kernel_code_pages
end

#unexpected_kprobe_handler ⇒ Boolean Also known as: unexpected_kprobe_handler?

Flag indicating presence of kprobe points with callbacks pointing to regions that are not in the expected kernel or module code range. Corresponds to the JSON property unexpectedKprobeHandler

Returns:

  • (Boolean) 


2157
2158
2159
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2157

def unexpected_kprobe_handler
  @unexpected_kprobe_handler
end

#unexpected_processes_in_runqueue ⇒ Boolean Also known as: unexpected_processes_in_runqueue?

Flag indicating unexpected process(es) in the scheduler run-queue, those that are in the run-queue, but not in the process task-list. Corresponds to the JSON property unexpectedProcessesInRunqueue

Returns:

  • (Boolean) 


2164
2165
2166
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2164

def unexpected_processes_in_runqueue
  @unexpected_processes_in_runqueue
end

#unexpected_read_only_data_modification ⇒ Boolean Also known as: unexpected_read_only_data_modification?

Flag indicating unexpected modifications of kernel read-only data memory. Corresponds to the JSON property unexpectedReadOnlyDataModification

Returns:

  • (Boolean) 


2170
2171
2172
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2170

def unexpected_read_only_data_modification
  @unexpected_read_only_data_modification
end

#unexpected_system_call_handler ⇒ Boolean Also known as: unexpected_system_call_handler?

Flag indicating presence of system call handlers that are are not in the expected kernel, module code regions. Corresponds to the JSON property unexpectedSystemCallHandler

Returns:

  • (Boolean) 


2177
2178
2179
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2177

def unexpected_system_call_handler
  @unexpected_system_call_handler
end

Instance Method Details

#update!(**args) ⇒ Object

Update properties of this object



2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
 
# File 'lib/google/apis/securitycenter_v1beta2/classes.rb', line 2185

def update!(**args)
  @name = args[:name] if args.key?(:name)
  @unexpected_code_modification = args[:unexpected_code_modification] if args.key?(:unexpected_code_modification)
  @unexpected_ftrace_handler = args[:unexpected_ftrace_handler] if args.key?(:unexpected_ftrace_handler)
  @unexpected_interrupt_handler = args[:unexpected_interrupt_handler] if args.key?(:unexpected_interrupt_handler)
  @unexpected_kernel_code_pages = args[:unexpected_kernel_code_pages] if args.key?(:unexpected_kernel_code_pages)
  @unexpected_kprobe_handler = args[:unexpected_kprobe_handler] if args.key?(:unexpected_kprobe_handler)
  @unexpected_processes_in_runqueue = args[:unexpected_processes_in_runqueue] if args.key?(:unexpected_processes_in_runqueue)
  @unexpected_read_only_data_modification = args[:unexpected_read_only_data_modification] if args.key?(:unexpected_read_only_data_modification)
  @unexpected_system_call_handler = args[:unexpected_system_call_handler] if args.key?(:unexpected_system_call_handler)
end