Investigate the possibility of using the workload benchmarks metrics pipeline in agents mode to send syscollector events

[GGP1]

Description

Investigate the possibility of using the workload benchmarks metrics pipeline in the agents mode to send syscollector events that trigger vulnerability detection alerts.

The pipeline should generate several mocked events that force the vulnerability detection module to populate its database.

[GGP1]

Update

Started analyzing the workload benchmarks metrics pipeline and agent simulator tool source code.

[GGP1]

Investigation

The workload benchmarks metrics pipeline can be executed using one of three modes:

• AGENTS: deploys n agents
• EPS: deploys a single agent that generates n events per second on the configured modules
• HYBRID: is a mix between the two modes above. It deploys n agents that each generate 2 EPS on the modules fim, syscollector, winevt, logcollector and sca.

The desired functionality could be achieved by using the HYBRID mode. However, we would need to modify the pipeline so the modules and the number of events generated can be selected by the user when launching the workflow.

Furthermore, additional changes may be required to the agent_simulator script to generate syscollector events that trigger specific rules. The templates of the generated events can be found here.

These changes will be carried out in #20779.

[Rebits]

LGTM

[davidjiglesias]

LGTM