falco: fix dashboard visualisation and handling of event.original #11881
Conversation
chemamartinez
added
dashboard
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
chemamartinez
force-pushed
the
11511-falco-dashboard-fix
branch
from
f2343f7
to
87834af
Compare
chemamartinez
force-pushed
the
11511-falco-dashboard-fix
branch
from
e5a6af7
to
4bca948
Compare
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
History
|
|
| } |
There was a problem hiding this comment.
I don't think this should change.
| def original = ctx.falco.toString(); | ||
| if (original != null) { | ||
| if (ctx.event == null) { | ||
| ctx.event = new HashMap(); | ||
| } | ||
| ctx.event.original = original; | ||
| } |
There was a problem hiding this comment.
Make this depend on preserve_original_event?
| @@ -36,7 +38,14 @@ processors: | |||
| ctx.remove(v); | |||
| } | |||
| } | |||
| ctx['falco'] = m | |||
| ctx['falco'] = m; | |||
| def original = ctx.falco.toString(); | |||
There was a problem hiding this comment.
I don't think this is the right thing to do; toString gives a Java syntax representation of the value:
def a = [:];
a.a = 1;
a.b = 2;
a.c = "three";
a.toString();
{a=1, b=2, c=three}
We want something that renders the JSON. Json.dump works, though note that it does not canonicalise key order in my experience, so tests will be brittle.
def a = [:];
a.a = 1;
a.b = 2;
a.c = "three";
Json.dump(a);
{"a":1,"b":2,"c":"three"}
There was a problem hiding this comment.
Alternatively, just retaining the actual original data.
Proposed commit message
Falco assets are not only used for the integration itself. They are also used by users that want to ingest Falco alerts directly into Elasticsearch through Falco Sidekick (more information at https://www.elastic.co/blog/cncf-open-source-security-tools).
This PR adds
event.originalto events directly ingested from Falco Sidekick.It also updates the
Alerts by Hostvisualisation to rely on thehost.nameinstead ofhost.hostname.Checklist
changelog.ymlfile.Related issues
Screenshots