Distillate

Distillate 会监控文件系统资源，并在所选资源发生变化时发出通知。典型用途是监控关键系统文件的篡改。

使用方法

distillate run --options-path=distillate.config

示例配置

{
    "fuzzy_paths": true,
    "watch_paths": [{
    "path": "/etc",
    "recursive": true,
    "alert_on": [
        {
            "event_type": "create",
            "path": "/etc/hosts"
        }
    ]
    }],
    "sink": {
        "log_path": "monitoring.log"
    }
} 

示例监控输出

[2024-03-01T11:17:00.053856+00:00]"create" event detected on path "/private/etc/1"
[2024-03-01T11:17:01.271469+00:00]"create" event detected on path "/private/etc/1"
[2024-03-01T11:17:01.271617+00:00]"remove" event detected on path "/private/etc/1"