github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-05 00:31:38 +00:00
Code Issues Projects Releases Wiki Activity

Move container.info handling to falco engine.

Browse Source 
container.info handling used to be handled by the the falco_outputs
object. However, this caused problems for applications that only used
the falco engine, doing their own output formatting for matching events.

Fix this by moving output formatting into the falco engine itself. The
part that replaces %container.info/adds extra formatting to the end of a
rule's output now happens while loading the rule.
This commit is contained in:
Mark Stemm
2016-11-28 11:31:36 -08:00
parent c6c074ef60
commit 0d46fcf819
8 changed files with 57 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
userspace/engine/falco_engine.h
View File

@@ -96,6 +96,16 @@ public:
//
void set_sampling_multiplier(double sampling_multiplier);
//
// You can optionally add "extra" formatting fields to the end
// of all output expressions. You can also choose to replace
// %container.info with the extra information or add it to the
// end of the expression. This is used in open source falco to
// add k8s/mesos/container information to outputs when
// available.
//
void set_extra(string &extra, bool replace_container_info);
private:
//
@@ -132,5 +142,8 @@ private:
double m_sampling_multiplier;
std::string m_lua_main_filename = "rule_loader.lua";
std::string m_extra;
bool m_replace_container_info;
};