Skip to content

[IDEA] Implement callbacks for specific signal handling in filters #206

@frikilax

Description

@frikilax

What is your feature about ?
It would be nice to be able to register callback functions to trigger specific functionalities when signals are received.

Describe what you'd like
the handling of signals is currently handled by the core, to reopen file descriptors in the Logger after a log rotate.
There are some (many) use-cases when it would be interesting to reopen other files/update models and internal memory maps when a signal is sent to a filter:

  • reload hostlookup maps
  • reload DGA tensorflow model
  • reload yara rules
  • ...

This would prevent users from restarting filters when a file is updated.

Additional context
The functionality could take the form of a Core interface defining and using a list of callbacks to call on each signal, with the ability to add callbacks depending on the needs.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions