github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-07 17:54:07 +00:00
Code Issues Projects Releases Wiki Activity

new(outputs): add source and tags to json output

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce
2021-08-31 15:51:16 +00:00
committed by poiana
parent b0562242e8
commit 8273e57598
4 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
userspace/engine/formats.cpp
View File

@@ -114,7 +114,7 @@ int falco_formats::lua_free_formatter(lua_State *ls)
} }
string falco_formats::format_event(const gen_event *evt, const std::string &rule, const std::string &source, string falco_formats::format_event(const gen_event *evt, const std::string &rule, const std::string &source,
const std::string &level, const std::string &format) const std::string &level, const std::string &format, std::set<std::string> &tags)
{ {
string line; string line;
@@ -181,8 +181,10 @@ string falco_formats::format_event(const gen_event *evt, const std::string &rule
if(s_json_output) if(s_json_output)
{ {
Json::Value event; Json::Value event;
Json::Value rule_tags;
Json::FastWriter writer; Json::FastWriter writer;
string full_line; string full_line;
unsigned int rule_tags_idx = 0;
// Convert the time-as-nanoseconds to a more json-friendly ISO8601. // Convert the time-as-nanoseconds to a more json-friendly ISO8601.
time_t evttime = evt->get_ts() / 1000000000; time_t evttime = evt->get_ts() / 1000000000;
@@ -197,12 +199,19 @@ string falco_formats::format_event(const gen_event *evt, const std::string &rule
event["time"] = iso8601evttime; event["time"] = iso8601evttime;
event["rule"] = rule; event["rule"] = rule;
event["priority"] = level; event["priority"] = level;
event["source"] = source;
if(s_json_include_output_property) if(s_json_include_output_property)
{ {
// This is the filled-in output line. // This is the filled-in output line.
event["output"] = line; event["output"] = line;
} }
for (auto &tag : tags)
{
rule_tags[rule_tags_idx++] = tag;
}
event["tags"] = rule_tags;
full_line = writer.write(event); full_line = writer.write(event);

2
userspace/engine/formats.h
View File

@@ -46,7 +46,7 @@ public:
static int lua_free_formatter(lua_State *ls); static int lua_free_formatter(lua_State *ls);
static string format_event(const gen_event *evt, const std::string &rule, const std::string &source, static string format_event(const gen_event *evt, const std::string &rule, const std::string &source,
const std::string &level, const std::string &format); const std::string &level, const std::string &format, std::set<std::string> &tags);
static map<string, string> resolve_tokens(const gen_event *evt, const std::string &source, static map<string, string> resolve_tokens(const gen_event *evt, const std::string &source,
const std::string &format); const std::string &format);

4
userspace/falco/falco_outputs.cpp
View File

@@ -142,7 +142,7 @@ void falco_outputs::add_output(falco::outputs::config oc)
} }
void falco_outputs::handle_event(gen_event *evt, string &rule, string &source, void falco_outputs::handle_event(gen_event *evt, string &rule, string &source,
falco_common::priority_type priority, string &format, std::set<std::string> tags) falco_common::priority_type priority, string &format, std::set<std::string> &tags)
{ {
if(!m_notifications_tb.claim()) if(!m_notifications_tb.claim())
{ {
@@ -190,7 +190,7 @@ void falco_outputs::handle_event(gen_event *evt, string &rule, string &source,
sformat += " " + format; sformat += " " + format;
} }
cmsg.msg = falco_formats::format_event(evt, rule, source, falco_common::priority_names[priority], sformat); cmsg.msg = falco_formats::format_event(evt, rule, source, falco_common::priority_names[priority], sformat, tags);
cmsg.fields = falco_formats::resolve_tokens(evt, source, sformat); cmsg.fields = falco_formats::resolve_tokens(evt, source, sformat);
cmsg.tags.insert(tags.begin(), tags.end()); cmsg.tags.insert(tags.begin(), tags.end());

2
userspace/falco/falco_outputs.h
View File

@@ -48,7 +48,7 @@ public:
// Format then send the event to all configured outputs (`evt` is an event that has matched some rule). // Format then send the event to all configured outputs (`evt` is an event that has matched some rule).
void handle_event(gen_event *evt, std::string &rule, std::string &source, void handle_event(gen_event *evt, std::string &rule, std::string &source,
falco_common::priority_type priority, std::string &format, std::set<std::string> tags); falco_common::priority_type priority, std::string &format, std::set<std::string> &tags);
// Format then send a generic message to all outputs. Not necessarily associated with any event. // Format then send a generic message to all outputs. Not necessarily associated with any event.
void handle_msg(uint64_t now, void handle_msg(uint64_t now,