github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-05 08:40:52 +00:00
Code Issues Projects Releases Wiki Activity

Also include all exception fields in rule_result

Browse Source 
When returning a rule_result struct, also include a set of field names
used by all exceptions for this rule. This may make building exception
values a bit easier.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
Mark Stemm
2021-01-07 17:34:00 -08:00
committed by poiana
parent 49b8f87db4
commit 8c4040b610
3 changed files with 51 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
userspace/engine/falco_engine.h
View File

@@ -160,6 +160,7 @@ public:
std::string source;
falco_common::priority_type priority_num;
std::string format;
std::set<std::string> exception_fields;
};
//
@@ -262,6 +263,8 @@ private:
std::unique_ptr<falco_sinsp_ruleset> m_sinsp_rules;
std::unique_ptr<falco_ruleset> m_k8s_audit_rules;
void populate_rule_result(unique_ptr<struct rule_result> &res, gen_event *ev);
//
// Here's how the sampling ratio and multiplier influence
// whether or not an event is dropped in