github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-05 08:40:52 +00:00
Code Issues Projects Releases Wiki Activity

update(userspace/engine): address jasondellaluce comments

Browse Source 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
This commit is contained in:
Lorenzo Susini
2023-05-29 12:17:58 +00:00
committed by poiana
parent 0bd609d5a4
commit 6e12b95dd2
3 changed files with 14 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
userspace/engine/falco_engine.cpp
View File

@@ -578,9 +578,9 @@ void falco_engine::get_json_details(const falco_rule &r,
rule["details"] = json_details;
// Get fields from output string
sinsp_evt_formatter fmt(insp, r.output);
auto fmt = create_formatter(r.source, r.output);
std::vector<std::string> out_fields;
fmt.get_field_names(out_fields);
fmt->get_field_names(out_fields);
Json::Value outputFields = Json::arrayValue;
for(const auto &of : out_fields)
{
@@ -736,15 +736,12 @@ void falco_engine::get_json_evt_types(libsinsp::filter::ast::expr* ast,
{
output = Json::arrayValue;
auto evtcodes = libsinsp::filter::ast::ppm_event_codes(ast);
if(evtcodes.size() != libsinsp::events::all_event_set().size())
auto syscodes = libsinsp::filter::ast::ppm_sc_codes(ast);
auto syscodes_to_evt_names = libsinsp::events::sc_set_to_event_names(syscodes);
auto evtcodes_to_evt_names = libsinsp::events::event_set_to_names(evtcodes, false);
for (const auto& n : unordered_set_union(syscodes_to_evt_names, evtcodes_to_evt_names))
{
auto syscodes = libsinsp::filter::ast::ppm_sc_codes(ast);
auto syscodes_to_evt_names = libsinsp::events::sc_set_to_event_names(syscodes);
auto evtcodes_to_evt_names = libsinsp::events::event_set_to_names(evtcodes, false);
for (const auto& n : unordered_set_union(syscodes_to_evt_names, evtcodes_to_evt_names))
{
output.append(n);
}
output.append(n);
}
}