github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-08 10:09:40 +00:00
Code Issues Projects Releases Wiki Activity

update(userspace/engine): better modularize the code for getting json details

Browse Source 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
This commit is contained in:
Lorenzo Susini
2023-05-18 06:58:43 +00:00
committed by poiana
parent e11b4c4430
commit 1195b1e7f0
6 changed files with 176 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
userspace/engine/falco_engine.h
View File

@@ -299,8 +299,18 @@ private:
//
inline bool should_drop_evt() const;
// Retrieve details of a rule in json format
Json::Value get_json_rule_details(const falco_rule& r, filter_details& details) const;
// Retrieve json details from rules, macros, lists
void get_json_details(const falco_rule& r,
const rule_loader::rule_info& ri,
Json::Value& rule) const;
void get_json_details(const rule_loader::macro_info& m,
Json::Value& macro) const;
void get_json_details(const rule_loader::list_info& l,
Json::Value& list) const;
void get_json_details(libsinsp::filter::ast::expr* ast,
Json::Value& output) const;
void get_json_evt_types(libsinsp::filter::ast::expr* ast,
Json::Value& output) const;
rule_loader::collector m_rule_collector;
indexed_vector<falco_rule> m_rules;