agent: add hostname to event

Adds the hostname of the machine the event was read from to the
"evebox" object of the event.

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Change Log
 
+## unreleased
+
+- [agent] Add hostname of machine the alert was read from. This
+  includes the server when instructed to input events. The hostname of
+  the machine generating the alert is added to "evebox" field.
+
 ## 0.17.2 - 2023-05-27
 
 - [elastic] Fixing negation queries using '-':

Cargo.toml

@@ -66,6 +66,7 @@ libc = { version = "0.2.140", default_features = false }
 
 rcgen = { git = "https://github.com/jasonish/rcgen", branch = "0.11.0-disable-botan" }
 directories = "5.0.1"
+gethostname = "0.4.3"
 
 [patch.crates-io]
 # Patch Rusqlite for now. 0.28.0 uses SQLite 3.39, but 3.40 is much

src/eve/filters.rs

@@ -67,6 +67,11 @@ impl EveBoxMetadataFilter {
             }
         }
 
+        // Add the hostname.
+        if let Ok(hostname) = gethostname::gethostname().into_string() {
+            event["evebox"]["hostname"] = hostname.into();
+        }
+
         // Add a tags object.
         if event.get("tags").is_none() {
             event["tags"] = serde_json::Value::Array(vec![]);