Cloudtrail s3 interval #275
Conversation
geraldcombs
force-pushed
the
cloudtrail-s3-interval
branch
from
243adbc
to
e60fa02
Compare
|
Thanks! Will look into this, but I'm proposing to merge this after we wrap up the new plugins version for the next Falco release (which will happen in the next 2 weeks). |
Signed-off-by: Gerald Combs <[email protected]>
Add an "S3Interval" option, which limits log downloads to the specified time interval. Intervals can be a simple "relative time in the past to now", "an absolute timestamp until now", or a range of those two formats. The interval is applied at the far end using the StartAfter parameter and locally to filter log pathnames. In my informal testing here the time from capture start to first event is ~2s. Signed-off-by: Gerald Combs <[email protected]>
Time.Compare was added in go 1.20. Signed-off-by: Gerald Combs <[email protected]>
Remove our dependency on str2duration. Fix our interval regex. Signed-off-by: Gerald Combs <[email protected]>
geraldcombs
force-pushed
the
cloudtrail-s3-interval
branch
from
c42c0b4
to
fcab42f
Compare
Rules files suggestionsaws_cloudtrail_rules.yamlComparing No changes detected |
|
I think the last commit misses a Sign-off! |
Make our default interval "" (which fetches all logs) instead of "24h". Signed-off-by: Gerald Combs <[email protected]>
geraldcombs
force-pushed
the
cloudtrail-s3-interval
branch
from
fcab42f
to
0da7894
Compare
Fixed. Thanks! |
Rules files suggestionsaws_cloudtrail_rules.yamlComparing No changes detected |
|
LGTM label has been added. Git tree hash: d8ef17ae121ae857e5dec876c869255bdbe89ea6
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: geraldcombs, jasondellaluce The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area plugins
What this PR does / why we need it:
It should make configuration easier, since you can now just paste in an S3 URL from the AWS console and the plugin will determine which log pathnames need to be downloaded based on specified interval or duration.
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer: