From 4782a3cc36d3de2e1662147a1b2b123832c35066 Mon Sep 17 00:00:00 2001 From: prateek-stepsecurity Date: Wed, 5 Aug 2026 19:25:48 +0530 Subject: [PATCH] fix: set the auditd event status as blocked for global block ip currenlty we do not get global block ip event from nflog --- eventhandler.go | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/eventhandler.go b/eventhandler.go index 1051338..3a8cbfd 100644 --- a/eventhandler.go +++ b/eventhandler.go @@ -198,13 +198,23 @@ func (eventHandler *EventHandler) handleNetworkEvent(event *Event) { } reverseLookUp := eventHandler.DNSProxy.GetReverseIPLookup(event.IPAddress) - eventHandler.ApiClient.sendNetConnection(eventHandler.CorrelationId, eventHandler.Repo, event.IPAddress, event.Port, reverseLookUp, "", "", "", event.Timestamp, tool) + + status := "" + matchedPolicy := "" + reason := "" + if eventHandler.DNSProxy.GlobalBlocklist != nil && eventHandler.DNSProxy.GlobalBlocklist.IsIPAddressBlocked(event.IPAddress) { + status = "Dropped" + matchedPolicy = GlobalBlocklistMatchedPolicy + reason = eventHandler.DNSProxy.GlobalBlocklist.BlockedIPAddressReason(event.IPAddress) + } + + eventHandler.ApiClient.sendNetConnection(eventHandler.CorrelationId, eventHandler.Repo, event.IPAddress, event.Port, reverseLookUp, status, matchedPolicy, reason, event.Timestamp, tool) process := "" if image == "" { process = tool.Name } - WriteLog(fmt.Sprintf("endpoint called ip address:port %s:%s, domain: %s, pid: %s, process: %s", event.IPAddress, event.Port, reverseLookUp, event.Pid, process)) + WriteLog(fmt.Sprintf("endpoint called ip address:port %s:%s, domain: %s, pid: %s, process: %s, status: %s", event.IPAddress, event.Port, reverseLookUp, event.Pid, process, status)) } }