[CWS] make exec event document clearer (#33783)

DataDog · Feb 7, 2025 · 66e8bfa · 66e8bfa
1 parent c13ca39
commit 66e8bfa
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/docs/cloud-workload-security/linux_expressions.md b/docs/cloud-workload-security/linux_expressions.md
@@ -38,7 +38,7 @@ Triggers are events that correspond to types of activity seen by the system. The
 | `chown` | File | A file’s owner was changed | 7.27 |
 | `connect` | Network | A connect was executed | 7.60 |
 | `dns` | Network | A DNS request was sent | 7.36 |
-| `exec` | Process | A process was executed or forked | 7.27 |
+| `exec` | Process | A process was executed (does not trigger on fork syscalls). | 7.27 |
 | `exit` | Process | A process was terminated | 7.38 |
 | `imds` | Network | An IMDS event was captured | 7.55 |
 | `link` | File | Create a new name/alias for a file | 7.27 |
@@ -572,7 +572,7 @@ A DNS request was sent
 
 ### Event `exec`
 
-A process was executed or forked
+A process was executed (does not trigger on fork syscalls).
 
 | Property | Definition |
 | -------- | ------------- |

diff --git a/docs/cloud-workload-security/secl_linux.json b/docs/cloud-workload-security/secl_linux.json
@@ -2007,7 +2007,7 @@
     },
     {
       "name": "exec",
-      "definition": "A process was executed or forked",
+      "definition": "A process was executed (does not trigger on fork syscalls).",
       "type": "Process",
       "from_agent_version": "7.27",
       "experimental": false,

diff --git a/pkg/security/secl/model/model_unix.go b/pkg/security/secl/model/model_unix.go
@@ -77,7 +77,7 @@ type Event struct {
 	Chdir       ChdirEvent    `field:"chdir" event:"chdir"`             // [7.52] [File] [Experimental] A process changed the current directory
 
 	// process events
-	Exec          ExecEvent          `field:"exec" event:"exec"`     // [7.27] [Process] A process was executed or forked
+	Exec          ExecEvent          `field:"exec" event:"exec"`     // [7.27] [Process] A process was executed (does not trigger on fork syscalls).
 	SetUID        SetuidEvent        `field:"setuid" event:"setuid"` // [7.27] [Process] A process changed its effective uid
 	SetGID        SetgidEvent        `field:"setgid" event:"setgid"` // [7.27] [Process] A process changed its effective gid
 	Capset        CapsetEvent        `field:"capset" event:"capset"` // [7.27] [Process] A process changed its capacity set