hub / github.com/chriskaliX/Hades
github.com/chriskaliX/Hades @agent-v1.1.1
Chat with this repo
5,712 symbols
18,907 edges
339 files
275 documented · 5%
What it actually does AI analysis from the code graph — generated when you open this
loading…
README
Hades
Hades 是一个基于 eBPF 的主机入侵检测系统，同时兼容低版本下通过 netlink(cn_proc) 进行事件审计。
申明：本项目借鉴了 Tracee 以及 Elkeid 中的代码以及思路等
概览
后台逐步开发中
架构
注: Agent 部分基本参照 Elkeid 1.7 部分重构
Agent
数据处理流程
插件列表
采集能力
EDriver
支持
21种 Hook，涵盖大部分安全审计检测需求，采集字段基本和 Elkeid 相同
Hook 详情查看
eBPF driver 插件 Hook 事件详情
| Hook | Status & Description | ID |
|---|---|---|
| tracepoint/syscalls/sys_enter_execve | ON | 700 |
| tracepoint/syscalls/sys_enter_execveat | ON | 698 |
| tracepoint/syscalls/sys_enter_memfd_create | ON | 614 |
| tracepoint/syscalls/sys_enter_prctl | ON(PR_SET_NAME & PR_SET_MM) | 1020 |
| tracepoint/syscalls/sys_enter_ptrace | ON(PTRACE_PEEKTEXT & PTRACE_POKEDATA) | 1021 |
| kprobe/security_socket_connect | ON | 1022 |
| kprobe/security_socket_bind | ON | 1024 |
| kprobe/commit_creds | ON | 1011 |
| k(ret)probe/udp_recvmsg | ON(53/5353 for dns data) | 1025 |
| kprobe/do_init_module | ON | 1026 |
| kprobe/security_kernel_read_file | ON | 1027 |
| kprobe/security_inode_create | ON | 1028 |
| kprobe/security_sb_mount | ON | 1029 |
| kprobe/call_usermodehelper | ON | 1030 |
| kprobe/security_inode_rename | ON | 1031 |
| kprobe/security_inode_link | ON | 1032 |
| uprobe/trigger_sct_scan | ON | 1200 |
| uprobe/trigger_idt_scan | ON | 1201 |
| kprobe/security_file_permission | ON | 1202 |
| uprobe/trigger_module_scan | ON | 1203 |
| kprobe/security_bpf | ON | 1204 |
Collector
S 代表异步采集，P 代表周期采集，C 代表触发采集
collector 插件 hook 详情
| Event | Type | ID |
|---|---|---|
| processes | P | 1001 |
| crontab | P | 2001 |
| sshdconfig | P | 3002 |
| ssh login | S | 3003 |
| user | P | 3004 |
| sshconfig | P | 3005 |
| yum | P | 3006 |
| host detect | C | 3007 |
| apps | P | 3008 |
| kmod | P | 3009 |
| disk | P | 3010 |
| systemd | P | 3011 |
| interface | P | 3012 |
| iptable | P | 3013 |
| bpf_program | P | 3014 |
| jar | P | 3015 |
| dpkg | P | 3016 |
| rpm | P | 3017 |
| container | P | 3018 |
| socket | P | 5001 |
NCP
Netlink CN_PROC 事件采集
联系 & 交流
输入 Hades 获取相关群二维码
404 星链计划
Hades 现已加入 404 星链计划
Extension points exported contracts — how you extend this code
ProtoType (Interface)Implement the unmarshal [11 implementers]
SDK/go/transport/protocol/protocol.go
IApp (Interface)
Mirrors Go's IApplication interface. [32 implementers]
plugins/collector/src/event/apps/mod.rs
Event (Interface)
(no doc) [45 implementers]
server/webconsole/grpc/handler/handler.go
IMetric (Interface)
Shared metric interface — mirrors `IMetric` in Go. [3 implementers]
agent/src/metrics/mod.rs
CfgTrait (Interface)
(no doc) [2 implementers]
plugins/eguard/src/config/parser/mod.rs
OsStrExt (Interface)
(no doc) [1 implementers]
SDK/rust/src/logger.rs
IClient (Interface)
Client-side interface [1 implementers]
SDK/go/transport/transport.go
IEvent (Interface)
(no doc) [16 implementers]
plugins/collector/src/manager/mod.rs
Core symbols most depended-on inside this repo
icalled by 3589
server/webconsole/api/static/frontend/node_modules_1b35660a.c447ddcd.async.js
r
called by 1957
server/webconsole/api/static/frontend/node_modules_1b35660a.c447ddcd.async.js
s
called by 920
server/webconsole/api/static/frontend/node_modules_1b35660a.c447ddcd.async.js
map
called by 696
server/webconsole/api/static/frontend/node_modules_1b35660a.c447ddcd.async.js
r
called by 442
server/webconsole/api/static/frontend/_project__Hades_server_webconsole_frontend_v2_6aad3897.9faf80d1.async.js
apply
called by 402
server/webconsole/api/static/frontend/_project__Hades_server_webconsole_frontend_v2_cfca2663.efbad6a3.async.js
slice
called by 389
server/webconsole/api/static/frontend/_project__Hades_server_webconsole_frontend_v2_cfca2663.efbad6a3.async.js
n
called by 371
server/webconsole/api/static/frontend/_project__Hades_server_webconsole_frontend_v2_f0c9d293.140ed417.async.js
Shape
Languages
TypeScript59%
Rust22%
Go14%
C++5%
C1%
Modules by API surface
server/webconsole/api/static/frontend/_project__Hades_server_webconsole_frontend_v2_cfca2663.efbad6a3.async.js1,379 symbols
server/webconsole/api/static/frontend/node_modules_58c39d94.271752c9.async.js455 symbols
server/webconsole/api/static/frontend/node_modules_c17fb583.5a55d688.async.js448 symbols
plugins/edriver/src/bpf/hades.skel.rs343 symbols
server/webconsole/api/static/frontend/_project__Hades_server_webconsole_frontend_v2_6aad3897.9faf80d1.async.js298 symbols
server/webconsole/api/static/frontend/node_modules_1b35660a.c447ddcd.async.js268 symbols
server/webconsole/grpc/transfer/proto/grpc.pb.go205 symbols
server/webconsole/api/static/frontend/_project__Hades_server_webconsole_frontend_v2_b24f6479.925a0b81.async.js80 symbols
plugins/eguard/src/bpf/eguard.skel.rs59 symbols
SDK/go/transport/protocol/transfer.pb.go58 symbols
plugins/libs/bpfheaders/utils.h57 symbols
server/webconsole/api/static/frontend/node_modules_bb76658e.6dd9a1fc.async.js56 symbols
Datastores touched
(mongodb)Database · 1 repos
For agents
$ claude mcp add Hades \
-- python -m otcore.mcp_server <graph>