{
  "repo": "tidbcloud/sysdig",
  "binary": "sysdig",
  "binary_path": "userspace/sysdig/sysdig.cpp",
  "dependencies": {
    "CLI sysdig capture": {
      "infrastructure": {
        "kernel_trace": {
          "conditions": [
            "When running live capture against the local host"
          ],
          "operations": [
            {
              "operation": "CAPTURE SYSTEM EVENTS",
              "trigger": "Initialize sysdig inspector and read kernel-level events",
              "conditions": [
                "The command is not reading from an existing trace file"
              ],
              "implementation": "main calls sysdig_init and capture logic in userspace/sysdig"
            }
          ]
        },
        "filesystem": {
          "conditions": [
            "When reading trace files or writing output captures"
          ],
          "operations": [
            {
              "operation": "READ / WRITE FILES",
              "trigger": "Open capture files, chisels, or output destinations",
              "conditions": [
                "The CLI is invoked with file-oriented options"
              ],
              "implementation": "sysdig userspace tooling loads local capture and configuration assets"
            }
          ]
        },
        "http": {
          "conditions": [
            "Optional integrations such as Kubernetes or Mesos API discovery are enabled"
          ],
          "operations": [
            {
              "operation": "HTTP CONNECT",
              "trigger": "Contact configured API endpoints for container metadata enrichment",
              "conditions": [
                "The user passes --k8s-api or Mesos-related options"
              ],
              "implementation": "sysdig CLI options allow API-server based metadata enrichment"
            }
          ]
        }
      },
      "services": []
    }
  }
}