github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 16:42:14 +00:00
Code Issues Projects Releases Wiki Activity
4,578 Commits 119 Branches 172 Tags 104 MiB
adeca79d1c
Commit Graph

4578 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mark Stemm
adeca79d1c Modify evttype_index_ruleset to derive from indexable_ruleset 
Modify evttype_index_ruleset to derive from indexable_ruleset instead
of having its own implementation of segregating filters by ruleset
id/event type.

An evttype_index_wrapper contains a falco rule and filter, and
implements the methods required by the template. run_wrappers()
evaluate the filter as before, without the segregation by ruleset
id/event type.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-06-20 11:23:12 +02:00
Mark Stemm
bbcfa61d82 Add an indexable ruleset that can split filters by ruleset/evttype 
Now that custom rules loading implementations (and related, custom
rulesets) can be swapped into falco in a customizable way, there is
some functionality in evttype_index_ruleset that could be used by
other rulesets, specifically the part that segregates filters by
ruleset and enables/disables filters based on name substring + tags.

To allow for this, create a new template indexable_ruleset<class
filter_wrapper> which derives from filter_ruleset and segregates the
filter_wrappers by ruleset. It also optionally segregates
filter_wrappers by event type.

The filter_wrapper class is an object that can return a name, tags,
and sc/event codes.

The main interfaces for classes that derive from indexable_ruleset are:

- add_wrapper(), which provides a filter_wrapper to the
  indexable_ruleset. This is generally called from
  add()/add_compile_output(), which must be implemented by the derived class.
- run_wrappers(), which must be implemented by the derived class and
  is called for event processing.

Most of the methods required by filter_ruleset are implemented by
indexable_ruleset and do not need to be implemented by the derived
class.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-06-20 11:23:12 +02:00
Gianmatteo Palmieri
3e91a27538 new(metrics): enable plugins metrics 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-06-13 16:32:48 +02:00
Federico Di Pierro
0e754aec14 chore(userspace): bump engine version and checksum. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-06-13 13:40:48 +02:00
Federico Di Pierro
0e4c580c1e update(cmake): bump libs to master. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-06-13 13:40:48 +02:00
Luca Guerra
b8e5e2e8dd update(engine): allow using -p to pass a format to plugin events 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-06-11 09:19:39 +02:00
dependabot[bot]
1c31390c56 chore(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `df963b6` to `ea57e78`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](df963b6bcd...ea57e78ea1)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-11 09:18:40 +02:00
Luca Guerra
8a59cee355 cleanup(falco): clarify that --print variants only affect syscalls 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-06-06 09:46:22 +02:00
Gianmatteo Palmieri
1c66b640f2 Revert "fix(engine): apply output substitutions for all sources" 
This reverts commit 4ef7c9553a.

Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-06-05 12:43:19 +02:00
Federico Di Pierro
35395728cc chore(ci): enable dummy tests on the testing framework. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-06-04 10:15:13 +02:00
Melissa Kilby
5777a44ca1 fix(metrics): fix sha256 metric names for prometheus 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-06-04 09:52:13 +02:00
Melissa Kilby
97207d309a fix(metrics): allow each metric output channel to be selected independently 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-06-04 09:52:13 +02:00
dependabot[bot]
f43347da45 chore(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `679a50a` to `df963b6`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](679a50aa5c...df963b6bcd)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-03 17:01:10 +02:00
Federico Di Pierro
6687d50fc2 chore(userspace/falco): more extra safety checks on stats collector too. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-06-03 15:56:14 +02:00
Federico Di Pierro
ae71cec507 fix(userspace/falco): fixed falco_metrics::to_text implementation when running with plugins. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-06-03 15:56:14 +02:00
Federico Di Pierro
ba85afa2ab update(cmake): bump libs and driver to master. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-31 11:26:59 +02:00
dependabot[bot]
048b9e3dd0 chore(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `9e56293` to `679a50a`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](9e56293b55...679a50aa5c)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-30 16:36:56 +02:00
Luca Guerra
1ddfde61f5 update(docs): update CHANGELOG for 0.38.0 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-05-30 16:35:56 +02:00
Federico Di Pierro
edd93054fd chore(proposals): fix typo. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-28 11:05:46 +02:00
Federico Di Pierro
b5316c98bc update(cmake): bump falcoctl to v0.8.0. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-28 11:05:46 +02:00
Luca Guerra
6c66294e72 chore(build): bump rules to 3.1.0 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-05-27 16:29:43 +02:00
dependabot[bot]
9fd26eaa2e --- 
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-23 09:51:23 +02:00
Jason Dellaluce
cd1c5f911c refactor(userspace): move falco logger under falco engine 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-23 09:29:23 +02:00
Luca Guerra
40765ca77b chore(gha): update cosign 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-05-21 11:41:13 +02:00
dependabot[bot]
1e942129b2 build(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `29c41c4` to `59bf03b`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](29c41c4eed...59bf03bf74)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-21 11:37:13 +02:00
Federico Di Pierro
0bf7458f3d chore(falco.yaml): rule -> rules. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-20 16:33:11 +02:00
Federico Di Pierro
d553662108 cleanup(falco.yaml): removed useless sentence. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-20 16:33:11 +02:00
Federico Di Pierro
a48965a00c chore(userspace,falco.yaml,unit_tests): configs_files -> config_files. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-20 16:33:11 +02:00
Federico Di Pierro
1b22c4566a chore(falco.yaml): added config maturity to index. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-20 16:33:11 +02:00
Federico Di Pierro
c03ce122e7 chore(docs): added falco.yaml section about config keys maturity. 
Also, rename `Experimental` -> `Incubating` and move `prometheus_metrics_enabled` to `Incubating`.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-20 16:33:11 +02:00
Melissa Kilby
0668c54485 cleanup(metrics): use sha26_rules (plural form) as naming 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-20 10:25:10 +02:00
Melissa Kilby
27bab30017 cleanup(metrics): add original rule name as label 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-20 10:25:10 +02:00
Federico Di Pierro
dfbd1810f9 update(cmake): bumped libs to 0.17.0-rc1 and falcoctl to v0.8.0-rc6. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-17 17:11:58 +02:00
Melissa Kilby
b0f352e7b9 cleanup(test): add test cases for sanitize_metric_name 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-17 14:54:58 +02:00
Melissa Kilby
c15a309781 clenaup: add sanitize_metric_name helper 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-17 14:54:58 +02:00
Melissa Kilby
e9afe24e17 cleanup(metrics): simplify some logic 
Co-authored-by: Samuel Gaist <samuel.gaist@idiap.ch>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-17 14:54:58 +02:00
Melissa Kilby
aa021537d9 cleanup(metrics): improve comments 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-17 14:54:58 +02:00
Melissa Kilby
0195dba889 cleanup: add getter functions to stats_manager 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-17 14:54:58 +02:00
Melissa Kilby
b7adcd251d new(metrics): add rules_counters_enabled option 
Intended to replace https://github.com/falcosecurity/falco-exporter
when used with Prometheus output

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-17 14:54:58 +02:00
Jason Dellaluce
64039196ad chore(unit_tests): fix linting issue 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-17 14:38:57 +02:00
Jason Dellaluce
ec9f148e0b test(engine): cover case of replaced or appended exceptions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-17 14:38:57 +02:00
Jason Dellaluce
e211e97e2a fix(userspace/engine): make sure exception fields are not optional in replace mode 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-17 14:38:57 +02:00
Federico Di Pierro
1bf6a83e31 new(docker): added zstd dep. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-17 13:38:57 +02:00
Luca Guerra
b5461e11a7 new(ci): sign .tar.gz packages 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-05-17 10:17:56 +02:00
Federico Di Pierro
c8072d2640 update(cmake): bumped falcoctl to v0.8.0-rc5. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-16 14:41:54 +02:00
Melissa Kilby
6057c1553e cleanup(engine): print total number of enabled rules 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-16 10:29:53 +02:00
Melissa Kilby
77341cbd2e new(engine): add print_enabled_rules_falco_logger when log_level debug 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-16 10:29:53 +02:00
dependabot[bot]
0869abc65e build(deps): Bump submodules/falcosecurity-rules 
Bumps [submodules/falcosecurity-rules](https://github.com/falcosecurity/rules) from `4f153f5` to `29c41c4`.
- [Release notes](https://github.com/falcosecurity/rules/releases)
- [Commits](4f153f53ae...29c41c4eed)

---
updated-dependencies:
- dependency-name: submodules/falcosecurity-rules
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-16 09:37:53 +02:00
Luca Guerra
eb3ee5d2b2 update(falco): add deprecation warning messages 
Signed-off-by: Luca Guerra <luca@guerra.sh>
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-15 10:33:50 +02:00
Luca Guerra
f9a56d9c9d update(falco): add deprecation notice for -T, -t and -D 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-05-15 10:33:50 +02:00