From 78f07a54ebf720e1b70e7238d35135da6c0082e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eren=20Ar=C4=B1?= Date: Wed, 12 Aug 2026 10:51:55 +0000 Subject: [PATCH 1/2] pipeline: inputs: add AegisBPF input plugin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Documents the in_aegisbpf plugin (fluent/fluent-bit#12272): streams AegisBPF runtime-security (OCSF) events from the agent's control socket. Signed-off-by: Eren Arı --- SUMMARY.md | 1 + pipeline/inputs/aegisbpf.md | 62 +++++++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+) create mode 100644 pipeline/inputs/aegisbpf.md diff --git a/SUMMARY.md b/SUMMARY.md index c86f24ca7..0a7b1c51b 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -77,6 +77,7 @@ ## Data pipeline * [Inputs](pipeline/inputs.md) + * [AegisBPF](pipeline/inputs/aegisbpf.md) * [Blob](pipeline/inputs/blob.md) * [Collectd](pipeline/inputs/collectd.md) * [CPU metrics](pipeline/inputs/cpu-metrics.md) diff --git a/pipeline/inputs/aegisbpf.md b/pipeline/inputs/aegisbpf.md new file mode 100644 index 000000000..2a838c899 --- /dev/null +++ b/pipeline/inputs/aegisbpf.md @@ -0,0 +1,62 @@ +# AegisBPF + +{% hint style="info" %} +**Supported event types:** `logs` +{% endhint %} + +The _AegisBPF_ input plugin streams runtime-security events from a co-located +[AegisBPF](https://github.com/ErenAri/Aegis-BPF) agent into the Fluent Bit +pipeline. AegisBPF is a BPF-LSM enforcement agent that exposes an opt-in, +root-only Unix control socket; the plugin connects to it, requests the event +stream, and forwards each newline-delimited JSON (OCSF) security event as a +record. It reconnects automatically if the agent restarts. + +## Configuration parameters + +The plugin supports the following configuration parameters: + +| Key | Description | Default | +|-----------------|-----------------------------------------------------------------------------|------------------------------------| +| `socket_path` | Path to the AegisBPF control socket (a root-only Unix stream socket). | `/var/run/aegisbpf/aegisbpf.sock` | +| `reconnect_sec` | Interval in seconds between reconnection attempts while disconnected. | `2` | + +## Prerequisites + +- The AegisBPF agent must run with its control socket enabled, for example + `AEGIS_API_SOCKET=/var/run/aegisbpf/aegisbpf.sock`. +- The socket is created with `0600` permissions and owned by the agent (root), + so Fluent Bit must run as the same user (typically root) to connect. + +## Get started + +### Command line + +```shell +fluent-bit -i aegisbpf -p socket_path=/var/run/aegisbpf/aegisbpf.sock -o stdout +``` + +### Configuration file + +```yaml +pipeline: + inputs: + - name: aegisbpf + socket_path: /var/run/aegisbpf/aegisbpf.sock + outputs: + - name: stdout + match: '*' +``` + +```ini +[INPUT] + name aegisbpf + socket_path /var/run/aegisbpf/aegisbpf.sock + +[OUTPUT] + name stdout + match * +``` + +Each security event is emitted as a single record whose body is the JSON object +sent by the agent (AegisBPF emits OCSF-formatted events by default). The record +timestamp is the time the event was received. From bd8078cb418a340976c94d0a57f875f9da442b4b Mon Sep 17 00:00:00 2001 From: "Eric D. Schabell" Date: Fri, 14 Aug 2026 11:47:24 +0200 Subject: [PATCH 2/2] docs: pipeline: inputs: aegisbpf: fix lint and example conventions Unwrap hard line breaks, spell out BPF, LSM, and OCSF on first use, sort the parameter table, and note the plugin is Linux only. Wrap the config examples in GitBook tabs so they render as a tabbed pair and are picked up by the example validation, using the repo conventions of a text fence, 2-space indentation, and Title_Case keys for the classic config. Suppress example validation for the page since the plugin is not in the released container image used for validation yet, and add AegisBPF and Cybersecurity to the Vale exception lists. Signed-off-by: Eric D. Schabell --- pipeline/inputs/aegisbpf.md | 51 +++++++++++-------- scripts/test-config.sh | 2 + vale-styles/FluentBit/Headings.yml | 1 + vale-styles/FluentBit/Spelling-exceptions.txt | 1 + 4 files changed, 33 insertions(+), 22 deletions(-) diff --git a/pipeline/inputs/aegisbpf.md b/pipeline/inputs/aegisbpf.md index 2a838c899..90129d8c5 100644 --- a/pipeline/inputs/aegisbpf.md +++ b/pipeline/inputs/aegisbpf.md @@ -4,31 +4,28 @@ **Supported event types:** `logs` {% endhint %} -The _AegisBPF_ input plugin streams runtime-security events from a co-located -[AegisBPF](https://github.com/ErenAri/Aegis-BPF) agent into the Fluent Bit -pipeline. AegisBPF is a BPF-LSM enforcement agent that exposes an opt-in, -root-only Unix control socket; the plugin connects to it, requests the event -stream, and forwards each newline-delimited JSON (OCSF) security event as a -record. It reconnects automatically if the agent restarts. +The _AegisBPF_ input plugin streams runtime-security events from a co-located [AegisBPF](https://github.com/ErenAri/Aegis-BPF) agent into the Fluent Bit pipeline. This plugin is available only for Linux. + +AegisBPF is a Berkeley Packet Filter (BPF) Linux Security Module (LSM) enforcement agent that exposes an opt-in, root-only Unix control socket. The plugin connects to that socket, requests the event stream, and forwards each newline-delimited JSON Open Cybersecurity Schema Framework (OCSF) security event as a record. It reconnects automatically if the agent restarts. ## Configuration parameters The plugin supports the following configuration parameters: -| Key | Description | Default | -|-----------------|-----------------------------------------------------------------------------|------------------------------------| -| `socket_path` | Path to the AegisBPF control socket (a root-only Unix stream socket). | `/var/run/aegisbpf/aegisbpf.sock` | -| `reconnect_sec` | Interval in seconds between reconnection attempts while disconnected. | `2` | +| Key | Description | Default | +| :--- | :--- | :--- | +| `reconnect_sec` | Interval in seconds between reconnection attempts while disconnected. | `2` | +| `socket_path` | Path to the AegisBPF control socket (a root-only Unix stream socket). | `/var/run/aegisbpf/aegisbpf.sock` | ## Prerequisites -- The AegisBPF agent must run with its control socket enabled, for example - `AEGIS_API_SOCKET=/var/run/aegisbpf/aegisbpf.sock`. -- The socket is created with `0600` permissions and owned by the agent (root), - so Fluent Bit must run as the same user (typically root) to connect. +- The AegisBPF agent must run with its control socket enabled, for example `AEGIS_API_SOCKET=/var/run/aegisbpf/aegisbpf.sock`. +- The socket is created with `0600` permissions and owned by the agent (root), so Fluent Bit must run as the same user (typically root) to connect. ## Get started +You can run the plugin from the command line or through the configuration file: + ### Command line ```shell @@ -37,26 +34,36 @@ fluent-bit -i aegisbpf -p socket_path=/var/run/aegisbpf/aegisbpf.sock -o stdout ### Configuration file +In your configuration file append the following: + +{% tabs %} +{% tab title="fluent-bit.yaml" %} + ```yaml pipeline: inputs: - name: aegisbpf socket_path: /var/run/aegisbpf/aegisbpf.sock + outputs: - name: stdout match: '*' ``` -```ini +{% endtab %} +{% tab title="fluent-bit.conf" %} + +```text [INPUT] - name aegisbpf - socket_path /var/run/aegisbpf/aegisbpf.sock + Name aegisbpf + Socket_Path /var/run/aegisbpf/aegisbpf.sock [OUTPUT] - name stdout - match * + Name stdout + Match * ``` -Each security event is emitted as a single record whose body is the JSON object -sent by the agent (AegisBPF emits OCSF-formatted events by default). The record -timestamp is the time the event was received. +{% endtab %} +{% endtabs %} + +Each security event is emitted as a single record whose body is the JSON object sent by the agent (AegisBPF emits OCSF-formatted events by default). The record timestamp is the time the event was received. diff --git a/scripts/test-config.sh b/scripts/test-config.sh index 35b7913fd..05c126952 100755 --- a/scripts/test-config.sh +++ b/scripts/test-config.sh @@ -44,6 +44,8 @@ SUPPRESSED_FILES=( # Not currently supported in the container image. "pipeline/filters/tensorflow.md" "pipeline/inputs/ebpf.md" + # Not yet present in the released validation image. + "pipeline/inputs/aegisbpf.md" # Windows plugins are not available in the Linux image. "installation/downloads/windows.md" "pipeline/inputs/windows-event-log-winevtlog.md" diff --git a/vale-styles/FluentBit/Headings.yml b/vale-styles/FluentBit/Headings.yml index 9b549c4b2..26cd84799 100644 --- a/vale-styles/FluentBit/Headings.yml +++ b/vale-styles/FluentBit/Headings.yml @@ -7,6 +7,7 @@ match: $sentence indicators: - ':' exceptions: + - AegisBPF - AlmaLinux - Amazon - Amazon CloudWatch diff --git a/vale-styles/FluentBit/Spelling-exceptions.txt b/vale-styles/FluentBit/Spelling-exceptions.txt index 644520166..e53bc0546 100644 --- a/vale-styles/FluentBit/Spelling-exceptions.txt +++ b/vale-styles/FluentBit/Spelling-exceptions.txt @@ -42,6 +42,7 @@ coroutines cron Crowdstrike CRDs +Cybersecurity DaemonSet Dash0 Datadog