how tracee-rules handle the event

[leiqi96]

After tracee-rules receive event from tracee-ebpf , what do tracee-rules do next

[itaysk]

Hi, in high level decode the event, examine it's metadata to determine which signatures would be interested in it, and then dispatching the event to the relevant signatures. The "dispatching" is basically calling the Signature's OnEvent function. In Rego signature that results in evaluating the tracee_match rego rule. Then id a "detection" is found, a "finding" struct is being emitted.