mirror of
https://github.com/falcosecurity/falco.git
synced 2025-07-31 22:16:49 +00:00
Initial version of outputs.lua
This commit is contained in:
parent
7593aac4c9
commit
331042858f
30
userspace/digwatch/lua/output.lua
Normal file
30
userspace/digwatch/lua/output.lua
Normal file
@ -0,0 +1,30 @@
|
||||
local mod = {}
|
||||
|
||||
function mod.syslog(evt, level, format)
|
||||
nixio = require("nixio")
|
||||
formatter = digwatch.formatter(format)
|
||||
msg = digwatch.format_event(evt, formatter)
|
||||
nixio.syslog(level, msg)
|
||||
end
|
||||
|
||||
|
||||
local first_sequence_state = {}
|
||||
|
||||
function mod.first_sequence(evt, fieldname, key, format)
|
||||
local field_value = digwatch.field(evt, fieldname)
|
||||
local now = os.time()
|
||||
|
||||
if first_sequence_state[key] == nil then
|
||||
first_sequence_state[key] = {}
|
||||
end
|
||||
|
||||
if first_sequence_state[key][field_value] == nil or
|
||||
now - first_sequence_state[key][field_value] > 5 then
|
||||
formatter = digwatch.formatter(format)
|
||||
msg = digwatch.format_event(evt, formatter)
|
||||
print (msg)
|
||||
end
|
||||
first_sequence_state[key][field_value] = now
|
||||
end
|
||||
|
||||
return mod
|
Loading…
Reference in New Issue
Block a user