-
Notifications
You must be signed in to change notification settings - Fork 77
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cloudtrail s3 interval #275
Cloudtrail s3 interval #275
Conversation
243adbc
to
e60fa02
Compare
Thanks! Will look into this, but I'm proposing to merge this after we wrap up the new plugins version for the next Falco release (which will happen in the next 2 weeks). |
Signed-off-by: Gerald Combs <[email protected]>
Add an "S3Interval" option, which limits log downloads to the specified time interval. Intervals can be a simple "relative time in the past to now", "an absolute timestamp until now", or a range of those two formats. The interval is applied at the far end using the StartAfter parameter and locally to filter log pathnames. In my informal testing here the time from capture start to first event is ~2s. Signed-off-by: Gerald Combs <[email protected]>
Time.Compare was added in go 1.20. Signed-off-by: Gerald Combs <[email protected]>
Remove our dependency on str2duration. Fix our interval regex. Signed-off-by: Gerald Combs <[email protected]>
c42c0b4
to
fcab42f
Compare
Rules files suggestionsaws_cloudtrail_rules.yamlComparing No changes detected |
I think the last commit misses a Sign-off! |
Make our default interval "" (which fetches all logs) instead of "24h". Signed-off-by: Gerald Combs <[email protected]>
fcab42f
to
0da7894
Compare
Fixed. Thanks! |
Rules files suggestionsaws_cloudtrail_rules.yamlComparing No changes detected |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/approve
LGTM label has been added. Git tree hash: d8ef17ae121ae857e5dec876c869255bdbe89ea6
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: geraldcombs, jasondellaluce The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area plugins
What this PR does / why we need it:
It should make configuration easier, since you can now just paste in an S3 URL from the AWS console and the plugin will determine which log pathnames need to be downloaded based on specified interval or duration.
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer: