Monitoring configuration access and removal
A call touches selected Omnodex paths or resembles removing, stopping, or changing monitoring.
Why it is risky
Section titled “Why it is risky”Disabling capture or changing records can hide later activity and make an incident harder to reconstruct.
Example
Section titled “Example”An agent handling an unrelated task attempts to uninstall monitoring before running additional commands.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”One rule matches selected Omnodex configuration and log path references. Another recognizes uninstall, removal, process-stop, hook-edit, and capture-pause command patterns (omnodex record pause, omnodex sync pause) in execution or staged content. Pausing is meant for a person at a terminal; see Pausing Recording and Uploads.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_SELF_PROTECTION_BASH | self_protection | Community | HIGH |
RULE_SELF_PROTECTION_CONFIG_WRITE | self_protection | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Verify whether a change occurred and whether maintenance was authorized. Check capture health, configuration changes, and the events surrounding any interruption.
False positives
Section titled “False positives”An approved upgrade, uninstall, troubleshooting read, isolated monitoring test, or an agent repeating a pause command a person asked for can match. The path-based rule does not require a write.
False negatives
Section titled “False negatives”Custom state paths, unsupported stop commands, host actions outside tool capture, and monitoring removed before a session begins can be missed.
Technical details
Section titled “Technical details”A self_protection finding signals monitoring-related activity. It does not prove that capture stopped or that records were changed.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.