Comments (6)
Sorry for being late. I'm gonna try to summarize all your proposals just to make sure we're in the same page:
- Including some/all HTTP headers of the api server webhooks alongside their body payload inside each event generated by the
k8s_audit
source - Extracting the HTTP headers info as Falco rule fields either through the
json
plugin or withk8saudit
-native fields - Adding custom fields to the
output_fields
entry of each Falco rule on top of the ones used in the rule'soutput
- Adding custom "label-like" fields in each Falco rule (generic marker strings that are not strictly Falco fields)
from plugins.
Ah yeah perhaps I should have included a summary of my ramblings.
I think the summary would come down to the following two proposals:
- optionally include the value of HTTP headers as user definable (custom) fields to each event generated by the
k8s_audit
plugin - add extra fields to the
output_fields
entry of each Falco rule on top of the ones used in the rule'soutput
The second proposal is already requested in falco #2127. Of course it depends on the actual solution chosen for 2127, but I am hoping the first proposal would work nicely together with proposal two.
The focus of this issue is the HTTP headers for the k8s_audit
plugin. But the implementation also allows other plugins, like the k8saudit-eks
plugin to enhance each event with additional fields. The k8s_audit
plugin uses HTTP headers as input, but I can imagine the k8saudit-eks
plugin using the aws api to retrieve additional custom fields a user might want to add to each event (the additional fields are not part of the k8s audit event itself as defined by kubernetes, but knowing the audit event source the aws api might be able to supply more context of the event, for example the cluster name, or the aws region/zone the cluster is deployed in).
Trying to express the flow of things:
k8s part:
k8s api server -> kubeconfig with auth -> k8s audit event -> (a compatible audit webhook endpoint)
proxy (up to the user to pick one and configure it, so not a k8s_audit
plugin problem to solve):
k8s audit event -> reverse proxy -> add custom headers, for example based on the auth supplied from kubeconfig -> forward headers and k8s audit event -> k8s_audit
plugin embedded webserver
k8s_audit
plugin:
receive headers + k8s audit event -> transform headers to extra fields -> parse k8s audit event, just as it works now -> merge extra fields and parsed fields -> output 'falco event' (SDK PushEvent object) for rule evaluation
falco engine:
PushEvent from plugin sdk/framework -> evaluate rules -> create falco alerts/events -> enhance output_fields
of alert/event with extra variables (second proposal) -> emit alert/event
from plugins.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale
.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close
.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
from plugins.
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten
.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close
.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
from plugins.
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen
.
Mark the issue as fresh with /remove-lifecycle rotten
.
Provide feedback via https://github.com/falcosecurity/community.
/close
from plugins.
@poiana: Closing this issue.
In response to this:
Rotten issues close after 30d of inactivity.
Reopen the issue with
/reopen
.Mark the issue as fresh with
/remove-lifecycle rotten
.Provide feedback via https://github.com/falcosecurity/community.
/close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
from plugins.
Related Issues (20)
- k8s_audit_rules missing rolebinding HOT 8
- Release process cleanup: unify release, OCI publishing and signing workflows HOT 5
- Request: Could a Falco plugin take over responsibility for the AKS Audit Log Forwarder from Sysdig? HOT 12
- Falco CPU 100% and Not Detecting Events HOT 1
- Falco cloudtrail can't parse SQS messages from s3 notifications HOT 1
- TRACKING: update `k8smeta` plugin registry when new capabilities will be available HOT 4
- Clean up GCP Audit Logs rules file HOT 2
- k8smeta: Document collectorHostname and nodeName configuration keys when running in Daemonset HOT 3
- Cloudtrail: Support for multiple accounts
- Application name is not captured by Falco
- [k8saudit-gke] Documentation clarification HOT 1
- Error verifying signatures for cloudtrail:latest, cloudtrail:0.11.0, github:latest, github:0.7.1 HOT 1
- eks audit plugin shows events for system users. HOT 10
- Standardisation capability of Falco rule output HOT 1
- rules of k8saudit-eks plugin use lists defined in falco_rules.yaml, not possible to overwrite HOT 7
- Feature: support additional annotations present on openshift clusters regarding authentication.openshift.io
- Falco Audit Plugin for EKS - HA and sidekick HOT 2
- Document k8smeta in falco's helm-chart with an MWE HOT 1
- K8smeta does not populate its events even though it is configured correctly and there are no errors HOT 9
- k8saudit-eks - memory leak HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from plugins.